Our security
We hold the map to your weak spots.
A penetration test report describes how to break into your systems. That makes us a target, so here's precisely how we handle what you trust us with, including what we haven't done yet.
The client portal
Reports are only ever delivered here, never as email attachments.
- Client-ID sign-in
- Each client gets a Client-ID made of 120 random bits. It's shown once when issued, stored only as an HMAC-SHA256 hash keyed with a secret held outside the database, and can be rotated at any time, which immediately ends every session.
- Sessions
- Server-side sessions in HttpOnly, Secure, SameSite=Strict cookies. They end after 30 minutes idle or 8 hours total, whichever comes first.
- Abuse protection
- Sign-in is rate-limited per address and per network, with tighter limits on failed attempts. Every write is protected against cross-site request forgery.
- Isolation
- Every request is scoped to the signed-in client. Another client's report doesn't return "forbidden"; as far as you're concerned, it doesn't exist.
- Visibility
- Your portal lists every sign-in and download on your account, with time and address. If you see one you don't recognise, tell us and we'll rotate your Client-ID.
Reports & evidence
Encrypted at rest, checkable on download, deleted on schedule.
- Encryption
- Each report file is encrypted with its own AES-256-GCM key. That key is encrypted with a master key held separately from the stored files, and every file is cryptographically bound to the client it belongs to.
- Integrity
- The portal shows a SHA-256 checksum for each report, so you can verify your copy byte for byte.
- No caching
- Portal pages and downloads are sent with Cache-Control: no-store, so no proxy or shared machine keeps a copy.
- Retention
- Working evidence and any source code are deleted when the engagement closes. Delivered reports stay in your vault for the period in your contract, then are deleted unless you ask us to keep them.
This website
The same standard we'd hold you to.
- No third parties
- No analytics, tracking pixels, tag managers, chat widgets, fonts or scripts from other origins. Your visit isn't reported to anyone.
- Content Security Policy
- Same-origin scripts and styles only, with no inline code, and Trusted Types enforced, so injected markup can't execute.
- Transport
- HTTPS only, HTTP Strict Transport Security, TLS 1.2 and 1.3 only, and a full set of security headers on every response.
- Cookies
- None on the public site. The portal sets a single session cookie after you sign in, and nothing else.
- This site collects nothing through forms and sends no email. You write to us from your own mail, and we reply from ours.
What we don't have yet
We'd rather tell you than have you find out in a questionnaire.
- An independent SOC 2 Type II or ISO 27001 certification of Alvo itself.
- Single sign-on (SAML / OIDC) or per-person accounts for the client portal.
- A contractual uptime SLA for the portal.
If one of these is a requirement for you, say so when you email us. It helps us prioritise.
Found a vulnerability in Alvo?
We want to hear about it.
Email security@alvo.team with the details. Contact details are also published in our security.txt. We'll acknowledge your report within two business days and keep you updated until it's fixed. Please act in good faith: don't access other clients' data, don't degrade the service, and give us reasonable time to fix the issue before disclosing it.
Questions for your vendor review?
Email them to us with your quote request and we'll answer them in writing, including the uncomfortable ones.