Legal

Testing & Disclosure Policy

Effective date: 4 October 2026

1. Authorised testing only

Orvantis Security conducts offensive testing exclusively against systems that a client owns or is lawfully authorised to have tested. Every engagement begins only after a signed scope, Rules of Engagement, and written authorisation are in place. We do not test systems without explicit, documented permission — full stop.

2. How we work within scope

  • We stay strictly within the agreed scope and boundaries.
  • We exploit only to the minimum extent needed to demonstrate impact — no unnecessary lateral movement.
  • We do not exfiltrate or destroy real data.
  • Every action is documented, and anything time-sensitive or high-impact is agreed with the client in advance.

3. Reporting a security issue in our systems

If you believe you've found a vulnerability in Orvantis Security's own website or infrastructure, we want to hear from you. Please report it responsibly:

  • Email: security@orvantis.co.ke
  • Include: the affected asset, steps to reproduce, and the impact you observed.
  • Please give us reasonable time to remediate before any public disclosure.
  • See our machine-readable contact at /.well-known/security.txt.

4. Good-faith safe harbour

If you research the security of Orvantis Security's own public assets in good faith and within the limits of this policy — testing only our systems, avoiding privacy violations, service disruption and data destruction, and giving us reasonable time to remediate before any disclosure — we will treat that research as authorised and will not pursue or support legal action against you for it.

This safe harbour applies only to assets Orvantis Security owns or operates; it does not grant permission to test, and does not protect you in relation to, any third party. If you are unsure whether something is in scope, contact us first and we'll clarify.

5. What is out of scope

  • Any testing that degrades service availability (denial of service) without prior written agreement.
  • Social engineering of our staff or suppliers.
  • Accessing, modifying or destroying data that is not yours.
  • Third-party services we rely on but do not control.

6. Found a vulnerability in your own product?

If you suspect a vulnerability in something you own or run and want help validating and fixing it, that's exactly the kind of work we do. Reach out via the contact page — it stays confidential.

7. Contact

Security matters: security@orvantis.co.ke · General: martin@orvantis.co.ke