Skip to content
Request a quote

Every test includes

  • Proof of exploit for every finding
  • An executive briefing for leadership
  • One retest within 30 days of the report
Request a quote

Questions first? Email info@greysurface.com

On this page

Who we are

This website, greysurface.com, is run by GreySurface, a penetration testing company.

GreySurface decides why and how the personal data described in this policy is used, which makes us its controller.

If you have a question about this policy or your data, email info@greysurface.com.

What this policy covers

This policy covers personal data we collect through greysurface.com, its quote form and the emails you send us.

It does not cover:

  • data we handle for a client during an engagement, which that engagement's signed agreement governs
  • other websites, which have their own privacy policies

What we collect

We collect what you choose to send us, plus technical data from your visit that the site and its providers need.

When you request a quote

The quote form asks for:

  • your name, work email address and company name
  • the service you are interested in and roughly how much is in scope
  • when you would like to start, if you choose to say
  • anything you add in the optional details box

Please leave out passwords, keys, customer data and other secrets.

If a test later needs access details, we agree a secure way to share them with you.

When you email us

Your name, your email address, what you write and anything you attach, whatever the message is about.

When you browse the site

Our hosting provider keeps standard server logs, such as your IP address, browser type and the pages you request.

When you send the quote form, the site also counts requests from your IP address in its memory, to limit repeated sending.

That count is never written to disk and is lost when the server restarts.

What we do not ask for

We do not ask for sensitive data, such as health, beliefs or biometric data. Please do not send it to us.

How we use it

We use personal data only for the purposes below, each with the legal basis we rely on.

  • To reply to your quote request.

    We use your answers to reply, discuss the work with you and prepare a quote.

    This is a step you ask us to take before a possible contract.

  • To answer your email.

    We use what you send to reply to you and to deal with what you raise.

    This is our legitimate interest in answering the people who write to us.

  • To keep the site secure and stop spam.

    Server logs and the checks on each quote request help us spot abuse and keep the site working.

    This is our legitimate interest in protecting the site and the people who use it.

  • To carry out work you engage us for.

    If a request leads to an engagement, we use your contact details to run it under its signed agreement.

    This is needed to perform that contract.

  • To meet legal obligations.

    We keep the records the law requires and respond to lawful requests from authorities.

We do not make decisions that have a legal or similarly significant effect on you by automated means alone, and we do not build profiles of visitors.

The automatic checks on the quote form only stop spam and repeated sending. If one stops you, email info@greysurface.com instead.

We do not sell your data, use it for advertising or add you to a marketing list.

Analytics and cookies

We do not use advertising or tracking cookies, so there is no cookie banner.

The site's own code sets no cookies and keeps nothing in your browser's storage.

We do not run analytics today. If we turn them on, we will use Plausible Analytics, which sets no cookies, and this section will say so.

Our fonts are served from this site, so no font service learns that you visited.

Who we share it with

We share personal data only with the providers that help us run this site and reply to you, and only as much as each one needs:

  • Our hosting provider, which serves the site and keeps its server logs.
  • Our email provider, which delivers quote requests and emails to us.

We may also share data when the law requires it, such as in response to a valid order from a court or regulator.

Data outside your country

Some of the providers above may store or process personal data in countries other than yours.

Where they do, we rely on the safeguards that data protection law requires for such transfers.

To ask about any transfer, email info@greysurface.com.

How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for.

  • The website itself keeps no copy of your form answers: they are sent on as one email.
  • Quote requests and other emails are kept as long as we need them to reply and plan any work that follows.
  • If we work together, engagement records are kept for as long as our agreement and the law require.
  • Server logs are kept for a limited period set by our hosting provider.
  • The request counts used to limit repeated sending live only in memory and are lost on restart.

How we keep it safe

We protect personal data with measures that fit what the site handles. They include:

  • HTTPS on every page, with HSTS telling browsers to use it every time
  • a Content-Security-Policy that blocks framing and limits where code can load from, with no third-party scripts
  • checks on every quote request: same site only, a size limit, a rate limit and a spam trap
  • form answers sent to our mail server encrypted, unless that server runs on the same machine
  • no record of what you send in the site's own logs
  • camera, microphone, location and other browser features switched off for the site

Quote requests and emails reach only the people at GreySurface who need them to reply.

No website or email system is free of risk, so we cannot promise absolute security.

If a breach affects your data, we will act as the law requires.

Your rights

Depending on where you live, data protection law may give you rights over your personal data. They can include the right to:

  • ask whether we hold data about you, and for a copy of it
  • have it corrected if it is wrong or incomplete
  • have it deleted
  • ask us to restrict how we use it
  • object to how we use it, including where we rely on our legitimate interests
  • receive it in a format you can move to another provider

Some US state laws also give residents the right to know, delete and correct their data, and to opt out of its sale or sharing.

We do not sell personal data or share it for advertising.

You will not be treated differently for using any of these rights.

How to use them

To make a request, email info@greysurface.com. We may need to confirm who you are before we act on it.

We reply within the time the law sets.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right.

You can also complain to the data protection authority where you live or work.

Children

This site is for businesses and is not aimed at children. We do not knowingly collect their personal data.

If you think a child has sent us their details, email info@greysurface.com and we will delete them.

Other websites

If the site links to another website, that site's own privacy policy applies once you follow the link.

If you follow such a link, your browser tells the other site at most that you came from greysurface.com, not which page you were reading.

Changes to this policy

We may update this policy when the site or the law changes. The date at the top of this page shows when it last changed.

If a change is significant, we may also point it out on the site.

Contact

For any question or request about this policy or your personal data, email info@greysurface.com.