Home / Trust

Trust and data handling

You are handing a security company the keys to watch your systems. This page says what we hold, where, who sees it, for how long, and how we protect it. Last reviewed 2026-08-13.

What we hold

Security telemetry (process, network and authentication events), alert and case records, vulnerability data, assessment evidence, policy documents and the contact details of the people we work with. We do not need or keep your business data except where it is the subject of an incident, and then only as evidence under the engagement's terms.

Where it lives

All client data is stored and processed in the United States in AWS regions us-west-2 and us-east-1, encrypted at rest with keys we control and in transit with TLS 1.2 or later. Each client's telemetry is logically segregated in the SIEM and EDR tenants.

Who can see it

Analysts and consultants assigned to your account, under role-based access with hardware-key MFA, from managed devices. Every access to client data is logged and reviewed monthly. Background checks are run on every employee before they touch client systems.

How long we keep it

Telemetry for the retention on your plan (90 days on Essential, 12 months on Enterprise, 24 months with the add-on). Case records, reports and evidence for seven years to support audits and legal holds. Deleted within 30 days of a written request after the engagement ends, except where law or a litigation hold requires otherwise.

Our own security

The same controls we sell: EDR on every device, conditional access, hardware keys, a SIEM watched by our own SOC, quarterly vulnerability scanning and an annual penetration test of the client portal by an outside firm. Findings and the attestation letter are available to clients under NDA.

Sub-processors

Amazon Web Services (hosting), CrowdStrike, SentinelOne and Microsoft (endpoint telemetry), Splunk (SIEM), Tenable (vulnerability data), KnowBe4 (training records), Vanta (compliance evidence), Google Workspace (email and documents), HubSpot (contacts and invoicing). Each is under a data processing agreement; we give 30 days' notice before adding one.

Responsible disclosure

Found a problem in our portal or this website? Email security@worldscybersec.com. We acknowledge within two business days, do not pursue good-faith researchers, and credit fixes in the advisories page when you want us to.

Documents available under NDA

• Most recent third-party penetration test attestation for the client portal
• Information security policy set and incident response plan
• Sub-processor data processing agreements
• Cyber and professional liability certificates of insurance
• Completed SIG Lite or CAIQ questionnaire

Request them from your client success contact or at sales@worldscybersec.com. Our security.txt carries the disclosure contact in machine-readable form.