Trust Centre
Simply secure.
Security is what we do for our clients every day, so we hold ourselves to the same standard. This page explains, in plain language, how CyberImmune protects the information you trust us with.
1. Our security commitment
When you give us access to your systems, your findings and your credentials, you are trusting us with some of the most sensitive information your company has. We treat that trust as our first responsibility: we build security into how we work from day one, we tell you plainly what we do and what we are still working on, and we keep improving as we grow.
2. How we protect your information
These are practices we have in place today.
- Two-step verification on company accounts. We require two-step verification for every CyberImmune company account, which covers our email and file storage. Text-message and phone-call codes are not accepted.
- Two-step verification across our tools. We require two-factor authentication in our team chat workspace and in our code-hosting organisations, including the one that holds DeepScan's code. Our CRM, e-signature, billing and project-tracking accounts also use two-factor authentication.
- Files stay inside the company. Our file storage is set so that company files cannot be shared outside CyberImmune.
- A dedicated password manager for credentials. Our team uses a company password manager, protected by two-step verification, for the credentials we handle during engagements.
- Pentesters lead every engagement. Our pentesters lead every engagement and do the manual testing of business logic, access control and attack chains. DeepScan, our own product, automates the reconnaissance, endpoint mapping and repetitive checks, so our people can spend their time where human judgment matters most.
- Approved security policies. We run on a written set of security policies approved by our CEO, covering information security, access control, acceptable use, incident response, data classification and retention, and more. We review them every year.
- A clear incident response path. We have an approved incident response policy and a dedicated security inbox, security@cyberimmune.com, monitored by our CEO with a named backup.
- Dependency alerts on DeepScan code. Automated dependency vulnerability alerts and security updates are turned on for DeepScan's code repositories.
3. Privacy and data handling
Website visitors. When you contact us through our website, we collect your name, work email, company, topic and message so we can reply. Our website privacy notice explains this, along with the analytics and cookies we use: cyberimmune.com/privacy
Engagement data. During an engagement we handle what you share with us so we can test and report. That can include scope details, test accounts and credentials, findings, evidence and reports. We use it only to deliver the work you asked for, and we set retention periods for it in our data retention policy.
Please don't email secrets. Never send passwords, access tokens or sensitive customer data in a first message. We'll agree a secure way to share them with you.
DeepScan. DeepScan has its own privacy policy: deepscansecurity.ai/privacy-policy
4. Compliance status
SOC 2: in progress. We're preparing CyberImmune, including DeepScan, for a SOC 2 Type 1 audit covering Security, Availability and Confidentiality. We have not yet been audited. We'll update this page when an independent auditor issues our report.
CREST Pathway. CyberImmune is a CREST Pathway organisation. A CREST Pathway organisation has signed Codes of Conduct and Ethics and committed to CREST's standards. A CREST Pathway organisation is aiming for, but is not, a CREST Accredited member company.
5. Frequently asked questions
Who can access our data? The CyberImmune team members working on your engagement. Our company accounts require two-step verification, and our file storage does not allow company files to be shared outside CyberImmune.
How do I report a security concern? Email security@cyberimmune.com. Tell us what you saw, where, and how to reproduce it safely. Please don't include credentials or other people's personal data. If you need to share sensitive evidence, ask us first and we'll set up a safe way to receive it.
Is CyberImmune SOC 2 compliant? Not yet. We're preparing for our SOC 2 Type 1 audit and have not been audited. We'll say so here as soon as an independent auditor issues our report.
You help other companies get ready for SOC 2 and ISO 27001. Does that make you certified? No. Preparing clients for their audits is a service we provide. It is separate from our own SOC 2 work, which is in progress.
Does DeepScan replace your pentesters? No. Our pentesters lead every engagement and do the manual testing of business logic, access control and attack chains. DeepScan handles the reconnaissance, endpoint mapping and repetitive checks.
How should we share test credentials with you? Don't send them by email or chat. We'll agree a secure method with you at the start of the engagement. Our team keeps them in a company password manager protected by two-step verification.
Can you answer our security questionnaire? Yes. Email security@cyberimmune.com and we'll be glad to help.
6. Contact
Security contact: security@cyberimmune.com
Page owner: Surya Mettupalli, Founder and CEO
Last reviewed: 12 November 2026