Who we are

This website is run by Hexdrift Security, the trading name of Hexdrift LLP, registered in [Country] under company number [Company number]. Our registered address is [Registered address].

For anything about your personal data, email info@hexdrift.com with "Privacy" in the subject.

What we collect

We only collect what you give us through a form or an email.

  • Contact form: your name, work email and company, and, if you choose, your company size, timeline, the services you're interested in and a message.
  • Job applications by email: what you choose to send, such as your CV and links to your work. Applications made on LinkedIn are covered by LinkedIn's privacy policy.
  • Emails you send us, including vulnerability reports sent to ops@hexdrift.com.

What we don't collect

This site has no analytics, advertising or tracking scripts, and it doesn't set cookies. Everything it loads, including fonts, comes from our own server, so visiting a page doesn't share your details with any third party.

It stores two settings in your browser's local storage: whether you chose the light or dark theme, and whether you closed the announcement bar. They stay on your device and are never sent to us. Clearing your browser's site data removes them.

How we use it

  • To reply to your enquiry, scope work and send a proposal, because you asked us to.
  • To assess your job application and reply to you, because you applied.
  • To investigate and fix vulnerabilities reported to us, and to reply to the reporter.

We don't sell your data, use it for advertising, or add you to marketing lists you didn't sign up for.

Client engagement data

This notice covers the website and enquiries only. Data we handle during an engagement, such as test results, source code, credentials and findings, is covered by the agreement and NDA we sign with each client.

Services we rely on

These providers process data on our behalf:

  • Website hosting: [Hosting provider and region].
  • Email: [Email provider].
  • Contact form delivery: Resend, which sends contact form submissions to our inbox. See Resend's privacy policy.

We may also disclose data where the law requires it.

How long we keep it

  • Enquiries that don't lead to an engagement: [Retention period].
  • Job applications: [Retention period] after the role is filled, unless you ask us to keep your details for future roles.

How we protect it

Access to enquiries and applications is limited to the people who need it to reply. Accounts that hold this data use multi-factor authentication. [Confirm these controls, or edit to match what is in place]

Your rights

You can ask us to show you the data we hold about you, correct it, delete it, or stop using it. Where we rely on your consent, you can withdraw it at any time.

Email info@hexdrift.com and we'll respond within [Response period]. If you're unhappy with how we handled your data, you can complain to [Data protection authority].

Changes to this notice

If we change how we handle personal data, we'll update this page and the date at the top.