What we look at, and what we never do

Before any agreement, we only look at what any visitor’s browser can see: your public pages, the response headers, the TLS certificate, the scripts and libraries a page loads, and how fast the server answers. Our Surveyor identifies itself in every request and obeys robots.txt. How it works and how to block it.

• —Try to sign in, guess a password or submit your forms.
• —Get round a firewall, a bot check or a robots.txt rule.
• —Load-test or penetration-test anything without your written permission and an agreed window.
• —Contact your customers or staff, or use what we find for anything other than your survey.

For a deeper survey you can send slow-query logs or request timings. The file is compressed in your browser before it is sent. We keep the totals and timings, and the shape of each query with every value taken out, so names, emails and account numbers in your data never reach our database. The raw file itself is not kept. Any upload can be deleted on request.

Access beyond the public site is given only under a signed agreement, and we will sign your NDA first if you have one. We ask for the least access the work needs, read-only wherever that will do, named to the engineer using it, and we hand it back at the end of the engagement.

This site sends the same security headers our survey checks for, and no analytics or advertising cookies. You can watch it pass those checks, live, in the survey section. What the contact form collects is set out in the privacy notice.

If you find a security problem in anything we have built, email samuel@houseofdangelo.co.uk with the details. We will reply within one working day and keep you told until it is fixed.