Company
Trust Centre
How Revelion tests safely, what happens to the data testing produces, and who processes it on our behalf.
Testing safety
What the agent is permitted to do
Revelion runs offensive testing, so the controls around it matter as much as its capability.
- Scope is declared first
- Targets are explicit. Systems outside the declaration are out of bounds, including ones discovered mid-mission.
- Exploitation sits behind approval
- You nominate which actions require a human to approve before the agent proceeds.
- No persistence
- The agent demonstrates access and stops. It does not establish footholds or leave artefacts behind.
- Full action log
- Every action is recorded, so an engagement can be reconstructed after the fact.
Authorisation
Testing runs against documented authorisation
Recurring testing makes authorisation more important, not less, because there is no single engagement window to point at.
- Letter of Authorisation
- A published template covering estate, window, permitted actions and named parties.
- Per-estate record
- Authorisation is held against the estate, so who approved what is answerable.
- For testing on behalf of clients
- Establishes that the client authorised the work rather than the provider assuming it.
Data handling
What we hold, and for how long
Testing produces sensitive output by definition. These are the commitments about how it is handled.
- Findings and evidence
- Retained against the estate so history and retests remain meaningful, and removable on request.
- Credentials you supply
- Held encrypted, used only for the estate they were issued against, revocable at any time.
- Account data
- The minimum required to operate the service: identity, organisation and billing.
- Deletion
- Estate data can be deleted on request, which removes findings, evidence and mission history.
- Access
- Internal access to customer data is restricted to what operating and supporting the service requires.
- Sub-processors
- Named, with purpose and region, on the sub-processors page.
Documents
What is available today
| Item | Status |
|---|---|
| Responsible disclosure policy | Published at /.well-known/security.txt |
| Data processing agreement | Available on request |
| Letter of Authorisation template | Published |
| Sub-processor list | Published and maintained |
How we answer questions
We would rather be verifiable than impressive
This page describes how the platform is operated and what happens to the data testing produces. It does not claim accreditations, because a security vendor that overstates its own posture has undermined the thing it is selling.
If a procurement process needs something specific that is not here, ask us directly rather than inferring it from silence. We would rather answer a hard question than publish a comfortable page.