How we protect your systems and your data.
Clients trust us with admin access, customer data and source code. This page explains exactly how we handle them, and how to report a security problem to us.
Last updated: [date]
Contact: mailto:security@aegisfuse.comExpires: 2027-09-30T23:59:59ZPreferred-Languages: en, esPolicy: https://aegisfuse.com/security/#disclosureCanonical: https://aegisfuse.com/.well-known/security.txt
How we secure our own work
We hold ourselves to the same checklist we use for clients.
Accounts
A separate, named account for every system, with two-factor authentication on all of them. No shared logins.
Passwords and keys
Kept in a password manager and shared through it or another encrypted channel, never by email or chat.
Least privilege
We ask for the lowest level of access the work needs, and we remove it when the work ends.
Devices
Encrypted disks, current operating systems, automatic screen lock and endpoint protection.
Changes
Backups before changes, testing on staging first, and a rollback plan for every release.
Code
Kept in your repository, reviewed before release, with no secrets in the code.
Service providers
[List of providers that process data: hosting, email, scheduling, spam protection, analytics.]
How we handle your data
The short version: as little as possible, for as short a time as possible.
What we collect
Only what the project needs. We prefer test data and anonymized samples when they will do.
How we use it
Only to deliver the work you hired us for. Never sold, never shared for marketing.
Where it lives
In your systems and accounts whenever possible. Working copies stay on encrypted devices.
How long we keep it
Working copies are deleted [X] days after a project ends, unless your contract says otherwise.
Confidentiality
Covered by our contract, and by your NDA when you have one.
AI and your data
We use AI tools in our own work and build AI features for clients. These are the limits.
We never paste client data into consumer AI tools.
AI features we build use business APIs, with training on your data turned off where the provider allows it.
We document which provider processes which data, so you can review it.
People review AI output before it changes records, sends messages or affects decisions about someone.
If something goes wrong
If we discover an incident that affects your systems or data, we tell you within [72 hours] with what we know, what we’ve done and what we recommend, and we keep you updated until it’s closed. We never wait for a full picture before telling you.
Report a vulnerability
If you’ve found a security problem in our website or systems, we want to hear about it, and we’ll work with you in good faith.
In scope
aegisfuse.com and its subdomains
Systems operated by AegisFuse LLC
Not client systems: report those to the owner, or to us and we will coordinate
How to report
Email security@aegisfuse.com, encrypted with our PGP key if you can
Describe the issue, where it is and how to reproduce it
English or Spanish is fine
Please don’t
Run denial-of-service tests or anything that degrades service
Use social engineering or physical attacks
Access, change or keep data beyond what proves the issue
What we commit to
Acknowledge your report within [3] business days
Keep you updated until the issue is fixed
Credit you publicly, if you want
Safe harbor
We won’t pursue legal action for good-faith research that follows this policy
If in doubt about scope, ask first
Publication
Please give us reasonable time to fix the issue before publishing
We’ll agree a disclosure date with you
There is no paid bug bounty.