Privacy notice
This notice covers the Alvo website and client portal. The data we handle while testing your systems is governed by the contract and data-processing terms for that engagement, not by this page.
What we collect
- Emails you send us: quote requests, support questions and anything else, with whatever you choose to include. The site has no forms that collect them; they arrive in our mailboxes like any other email.
- Client portal: the contact name and email we hold for your organisation, plus a log of sign-ins, sign-outs and report downloads: time, IP address and browser user-agent.
We don't use analytics, advertising or tracking technologies of any kind, and we don't buy, sell or rent personal data.
Why we use it
- To reply to your request and prepare a proposal, which you've asked us to do.
- To deliver reports and support to existing clients under our contract with them.
- To keep the site and portal secure, for example by rate-limiting abuse and investigating suspicious sign-ins. This is our legitimate interest, and yours.
Who else sees it
The site, the portal and their data are hosted on Cloudflare, and our email is hosted by our email provider. Both process this data on our behalf; delivered reports are stored encrypted. Nobody else receives it unless the law requires it.
How long we keep it
- Quote requests that don't become engagements: up to 24 months, then deleted.
- Portal access logs: 12 months.
- Web server logs (IP address, browser user-agent, the page requested and when): kept by our hosting provider for a few days, at most 30, for security and troubleshooting.
- Client contact details and delivered reports: for the duration of the relationship and the retention period in your contract.
Your rights
You can ask to see, correct or delete the personal data we hold about you, or object to how we use it, by emailing support@alvo.team. Depending on where you live, you may also have the right to complain to a data-protection authority.
Cookies
The public website sets no cookies. The client portal sets one strictly necessary cookie after you sign in, which holds a random session identifier and expires when you sign out, after 30 minutes of inactivity, or after 8 hours at most. There's nothing to consent to because there's nothing optional.
No guarantee of findings
Security testing is a time-boxed assessment of an agreed scope. Alvo doesn't guarantee that an engagement will identify any vulnerabilities, a particular number of them, or issues of a particular severity. Our fees are for the testing and reporting we carry out, not for findings.
Equally, a report with few or no findings doesn't mean a system is free of vulnerabilities, only that none were identified within the scope and time available. Retest reports and attestation letters record what was tested and verified; they don't certify that a system is secure. The terms of each engagement are set out in its contract.
Website terms
The content of this site is provided for general information. Descriptions of our services are not an offer; the scope, deliverables and terms of any engagement are set out in a written proposal and contract.
You may not use this site or the client portal to attempt unauthorised access, to interfere with their operation, or to submit content you don't have the right to share. Good-faith security research is welcome under our disclosure guidelines.
Client-IDs are confidential credentials issued to a specific organisation. Keep yours secret and tell us at once if you think someone else has it.