Authorized testing only.
Signed rules of engagement. Scope enforced mechanically.
Authorized testing only
OctaSec tests only assets you own or are explicitly authorized to test, under signed rules of engagement agreed before any request is sent. Scope, timing and intensity limits are enforced in the harness — out-of-scope assets are technically unreachable.
Responsible disclosure
Found a security issue in OctaSec or octasec.ai itself? Report it in good faith and we'll work with you. Please give us reasonable time to remediate before any public disclosure. Contact [email protected] (subject: “Security”).
security.txt
Our machine-readable security contact lives at /.well-known/security.txt.
Privacy
We collect only what we need to run your engagements: the details you send through our contact and quote forms; your account, organisation and contact details in the portal; and the scope, findings and reports of the tests you request. We use them to respond to you, deliver and support the service, and keep an audit trail of security-relevant actions. We do not sell your data. Test findings are visible only to your organisation and to OctaSec operators working on your engagement. To access, correct or delete your data, email [email protected].
Terms
OctaSec services are provided by Octagram Limited, Dhaka. Testing is performed only on assets you own or are authorized to test, under signed rules of engagement. Quotes are fixed for the agreed scope; changes to scope are quoted separately before work starts. Reports are confidential to your organisation. The full service agreement is shared with every quote and signed before any engagement begins.
Contact
Email [email protected] · Phone +880 1326-875385
Rules of engagement
A sample rules-of-engagement document is available on request and will be published here. Sample PDF coming soon.
One finding pays for the engagement.
Book a 30-minute scoping call — if a scanner is enough for you, we'll say so.