Engagement security
How we handle your data during an engagement.
Security assessments, penetration tests, and managed services give a provider access to sensitive systems and findings. Here is how Sidechain handles that access, from the first scoping call to the last retest.
In brief
- Team
- Sidechain employees only; no subcontractors
- Authorization
- Written scope and rules of engagement
- Access
- Least privilege, named accounts, removed at close
- Findings
- Encrypted in transit and at rest
- Agreements
- NDA and BAA available
Practices
Our commitments during an engagement.
- People
- All work is performed by Sidechain employees based in the United States. Penetration testing and assessments are never subcontracted. Engineers are background-checked and bound by confidentiality agreements.
- Authorization
- No testing begins without written authorization defining targets, access levels, windows, exclusions, and escalation contacts. Changes to scope are agreed in writing.
- Access
- We request the least privilege required for the agreed work, use named accounts rather than shared credentials, and ask that access be removed when the engagement closes. For managed clients, access is documented and reviewed.
- Evidence and findings
- Report drafts, evidence, and credentials are stored encrypted and shared through secure channels, not email attachments. Sample reports on this site are sanitized reconstructions, never client material.
- Data minimization
- We capture the evidence needed to demonstrate a finding and no more. Where testing could expose sensitive records, we agree an approach that proves access without extracting data.
- Retention
- Engagement materials are retained for the period set in your agreement, then securely deleted. You can request earlier deletion of working materials once deliverables are accepted.
- Agreements
- Mutual NDAs are standard. Business Associate Agreements are available for engagements that may involve ePHI.
- Incident handling
- If we discover evidence of an active compromise during testing, we stop, notify your escalation contact immediately, and follow the agreed process.
We hold ourselves to the program we sell.
Sidechain runs on the same controls we deploy for clients: endpoint detection and response, MFA everywhere, email authentication and filtering, encrypted devices, managed patching, and tested backups. Our own infrastructure, including the private cloud that hosts client security systems and the Timberline platform, is segmented, monitored, and reviewed.
We are happy to walk your security team through our internal practices as part of your due diligence.
- Internal controls mirror the managed program
- Segmented, monitored infrastructure for hosted services
- Due diligence conversations welcomed
Bring your security questionnaire.
We answer vendor risk questionnaires as a normal part of starting an engagement.
(503) 389-3174 · info@sidechainsecurity.com · Portland, Oregon