Data Handling & Security Policy

This Data Handling & Security Policy describes RECON ONE’s general approach to customer technical information and other data handled in connection with cybersecurity services.

Specific customer agreements may establish additional or different requirements.

1. Data Handling Principles

RECON ONE’s data-handling practices are based on the following principles:

• collect information for legitimate and authorized purposes;
• limit unnecessary collection;
• restrict access according to business and security needs;
• apply reasonable safeguards appropriate to the sensitivity of information;
• maintain appropriate separation between customer-specific information and broader research or analytical uses;
• retain information only where a legitimate business, contractual, research, security, or legal purpose exists; and
• securely delete or otherwise dispose of information when retention is no longer appropriate.

2. Information We May Handle

Depending on an engagement, RECON ONE may receive or generate technical information including:

• network traffic or packet-capture information;
• network architecture information;
• device, system, service, or protocol observations;
• logs and configuration information;
• vulnerability and exposure information;
• assessment evidence;
• customer-provided documentation;
• security findings;
• analytical results;
• reports; and
• other information reasonably necessary for an authorized cybersecurity engagement.

The specific information required depends on the scope of the engagement.

3. Public Website Boundary

The RECON ONE public website is not intended to receive packet captures, credentials, private keys, sensitive technical evidence, regulated information, or other customer security datasets.

Customers should provide sensitive engagement material only through a transfer method approved by RECON ONE for that engagement.

4. Purposes of Processing

RECON ONE may process authorized information to:

• perform contracted cybersecurity services;
• analyze architecture, configuration, exposure, vulnerabilities, or security conditions;
• create customer findings and deliverables;
• validate and support findings;
• maintain security and integrity;
• investigate incidents or technical issues;
• satisfy contractual, legal, audit, or insurance obligations; and
• where permitted by applicable customer agreements, operate, maintain, secure, improve, test, research, and develop RECON ONE cybersecurity services, technologies, and analytical capabilities.

Where appropriate, information used for broader analytical, research, or development purposes may be aggregated, de-identified, pseudonymized, transformed, or otherwise separated from unnecessary customer-identifying information.

5. Ownership and Rights

Customers retain ownership of their underlying data except as otherwise expressly agreed.

RECON ONE retains ownership of its:

• methodologies;
• software;
• analytical systems;
• tools;
• models;
• algorithms;
• frameworks;
• templates;
• know-how;
• research;
• generalized techniques; and
• other preexisting or independently developed intellectual property.

Rights concerning information, findings, derivative information, research uses, and deliverables may be further defined in the applicable customer agreement.

6. Access Controls

Access to customer information is limited to personnel, systems, and authorized service providers with a legitimate need for access.

Access may be further restricted based on:

• sensitivity;
• engagement requirements;
• legal or regulatory restrictions;
• customer requirements; and
• security risk.

7. Security Measures

RECON ONE uses administrative, technical, and organizational safeguards appropriate to the nature of the information and service.

Security controls may include, where appropriate:

• access controls;
• authentication;
• encryption;
• logging and monitoring;
• environment separation;
• integrity controls;
• secure transfer mechanisms;
• vulnerability management;
• backup and recovery controls;
• retention controls; and
• secure deletion processes.

Security measures may evolve as technology, risk, and RECON ONE services change.

8. Service Providers

RECON ONE may use carefully selected service providers to support infrastructure, storage, communications, security, or other legitimate operational requirements.

Where appropriate, providers are subject to contractual, technical, or organizational controls concerning the information they process.

9. Retention

RECON ONE retains customer information according to the nature of the information, purpose of processing, customer agreement, security requirements, legitimate business or research needs, and applicable legal obligations.

Different categories of information may have different retention periods.

RECON ONE may retain customer-specific information where reasonably necessary to:

• perform and validate an engagement;
• support findings and deliverables;
• address customer questions;
• satisfy contractual obligations;
• support authorized research or service development;
• investigate security matters;
• maintain business records; or
• satisfy legal, regulatory, audit, or insurance obligations.

Where permitted by applicable agreements and law, aggregated, de-identified, pseudonymized, statistical, transformed, or derived information may be retained for longer periods for cybersecurity research, analytical development, service improvement, and related legitimate purposes.

10. Credentials and Secrets

RECON ONE does not seek to retain credentials, private keys, authentication secrets, or similar sensitive authentication information for research or general business purposes.

Where such information is incidentally encountered or temporarily required during an authorized engagement, access and retention should be minimized consistent with the engagement and applicable requirements.

11. Customer Restrictions

Customers must inform RECON ONE before transferring information subject to unusual contractual, regulatory, handling, localization, export-control, privacy, or other restrictions.

RECON ONE may require additional agreements or controls before accepting such information.

12. Security Incidents

RECON ONE maintains processes for assessing and responding to suspected security incidents involving information under its control.

Where notification or cooperation is required by applicable law or contract, RECON ONE will address those obligations according to the circumstances and applicable requirements.

13. Deletion and Return

Customer agreements may establish requirements for return, deletion, preservation, or extended retention of information.

RECON ONE may preserve information where reasonably necessary or required for legal holds, disputes, security investigations, contractual requirements, or other lawful obligations.

14. Questions

Questions concerning RECON ONE data handling may be directed to:

info@recon-one.com

Security vulnerability reports should be directed to:

disclosure@recon-one.com