Trust Center
How TrekShield tests safely, protects the findings it produces and handles security reports. What is in place today, stated plainly.
At a glance
- Role-based access In place
- Audit log In place
- Evidence integrity checks In place
- Responsible disclosure with safe harbor In place
- Authenticator-app MFA API only
- API keys and signed webhooks Available
Platform security controls.
Pentest findings describe how to break into systems, so access to them is controlled. These are capabilities the platform has today.
Role-based access
In placeAccess follows defined roles. On our side: Platform Administrator, Engagement Manager, Pentester and QA Reviewer, with the last three working on engagements they are assigned to. On yours: Client Administrator, Client Developer and Client User.
Separate client organizations
In placeEach client is managed as its own organization, and its users see only their own company’s engagements, findings and users. People who work across several clients use a client switcher.
Sign-in protections
In placePasswords are stored hashed and must meet complexity rules. Accounts lock after repeated failed sign-ins, sign-in and password-reset requests are rate-limited, and sessions sign out after a period of inactivity.
Multi-factor authentication
API onlyThe platform supports authenticator-app (TOTP) codes as a second factor, with single-use recovery codes, through its API. The web app does not have an enrolment screen yet, and there is no single sign-on (SSO) today.
Audit log
In placeCreate, update and delete actions made through the platform are recorded with the user, the time and the record affected, with sensitive fields such as passwords and tokens redacted. Every engagement, finding, remediation and retest also keeps a timeline of its state changes.
API keys
AvailableKeys are shown once, stored hashed, can carry an expiry date and can be revoked immediately. A key has exactly the role and visibility of the person who created it, and no more.
Signed webhooks
AvailableWebhook deliveries are signed with HMAC-SHA256 so your endpoint can verify they came from TrekShield. Endpoints must use HTTPS, and outbound calls refuse private network addresses.
Evidence integrity
In placeEvidence files are checked against their declared type on upload, and a SHA-256 hash is recorded and verified. Download links are short-lived.
How engagement data is handled.
Findings, evidence and reports are among the most sensitive documents you have. Here is what we can state about how they are handled today.
- Encryption in transit
- The platform is served over HTTPS only (TLS 1.2 and 1.3), with HTTP Strict Transport Security. Plain HTTP requests are redirected.
- Evidence integrity
- Evidence files are checked against their declared type and a SHA-256 hash is recorded and verified. We do not run antivirus scanning on uploads.
How we keep testing safe.
You are letting us attack your systems. These are the practices that keep that safe and accountable.
Agreed scope and rules of engagement
Every engagement starts by agreeing the targets and the rules of engagement, as set out in our methodology. We test what is in scope.
Safe techniques, coordinated
We use safe techniques and coordinate with you before any potentially disruptive test.
QA before release
Every finding passes an internal QA review before you see it. Reports are checked against a checklist covering scope, CVSS accuracy, evidence quality, remediation quality, formatting and classification.
Evidence kept with the finding
Proof, evidence and reproduction steps are stored with each finding in the platform.
Findings released when ready
Findings stay with the TrekShield team until the engagement is delivered, and comments the team marks internal are never shown to client users.
Found a vulnerability in TrekShield?
Email security@trekshield.com with the steps to reproduce it. Good-faith research is covered by our safe harbor.
Need more for your security review?
Send us your security questionnaire or tell us what your review needs. We will answer what we can directly, and tell you plainly where something is not in place.
Legal & privacy.
- Privacy notice
- How we handle personal data on this site. Read the privacy notice.
- Company details
- TrekShield IT Solutions Pvt. Ltd., Hyderabad, India.
See how we work.
Read the methodology
The six phases every engagement follows, from scope to retest.
Meet the bench
The testers behind every finding, and the individual credentials they hold.
Compliance pentesting
Penetration test evidence for your own audits, with retests that show which fixes were verified.
See the platform
Findings, evidence, remediation and retests in one workspace.
Common security-review questions.
Who can see our findings?
People with access to your organization in the platform: TrekShield staff in the roles that work on your engagement, and the users you invite with client roles. Findings stay with the TrekShield team until the engagement is delivered.
How do we report a vulnerability in TrekShield?
Email security@trekshield.com with steps to reproduce. Our responsible disclosure policy, including safe harbor for good-faith research, is on the disclosure policy page, and a security.txt file is published at /.well-known/security.txt.
Can a TrekShield penetration test support our own compliance audits?
Yes. Our compliance pentesting produces evidence for your own audits, including retests that show which fixes were verified. Compliance reports map findings to framework controls as an informational aid. The mapping is not an audit or an assessment of your compliance.
How can we verify that a webhook came from TrekShield?
Each delivery carries an X-TrekShield-Signature header: the HMAC-SHA256 of the raw request body, keyed with your webhook secret. Verify it before parsing the body.
Can we request your security documentation?
Yes. Send us your security questionnaire or tell us what your review needs. We will answer what we can directly, and tell you plainly where something is not in place.
Does the platform support single sign-on (SSO)?
Not today. People sign in with an email address and password, and the platform supports authenticator-app (TOTP) codes as a second factor through its API. If SSO is a requirement for your review, tell us when you contact us.
Do you scan uploaded evidence for malware?
No. Evidence files are checked against their declared type and hashed with SHA-256, but we do not claim antivirus scanning.
Need something for your security review?
Send us your questionnaire and we will answer what we can, plainly.