Trust

Scope

This policy covers triongle.com and any other system TriOngle operates. Out of scope: systems of our clients (report those to the client), third-party services we use, denial-of-service testing, social engineering of our people, and physical attacks.

How to report

Email security@triongle.com. Please include what you found, where (the URL or system), the steps to reproduce it, the impact you expect, and how to reach you. We do not yet publish an encryption key; please leave sensitive details out of the first message and we will agree a secure way to receive them. The same contact is published in our security.txt file, following RFC 9116.^⁠[2]

What we do

• Acknowledge your report and tell you who is handling it.
• Confirm whether we can reproduce the issue, and keep you informed until it is resolved.
• Agree a disclosure date with you once a fix is available.
• Credit you publicly if you wish, or keep your name private if you prefer.

What we ask of you

• Act in good faith, and test only what you need to show the issue.
• Do not access, change or delete data that is not yours, beyond the minimum needed to prove the issue.
• Do not degrade the service for others.
• Give us reasonable time to fix the issue before you disclose it.

Safe harbour

If you act in good faith and within this policy, we will consider your research authorised, we will not pursue legal action against you for it, and we will say so if anyone asks.

Findings in client systems

Vulnerabilities we find while working for a client belong to that client and are handled under the engagement letter. Where a finding affects a third-party product, we agree with the client how and when the vendor is told.

Test evidence is kept on EU servers only.

Test evidence is everything we collect from your systems during an engagement: prompts and responses, logs and traces, screenshots, proofs of concept, and copies of configuration and design documents.

• It is stored on servers in the European Union, and nowhere else.
• Access is limited to the people working on your engagement.
• It is used only for your engagement.
• How long it is kept, and whether it is returned or deleted at the end, is set in your engagement letter.

Where evidence contains personal data, we handle it under the GDPR and agree the terms with you before the work starts.

A security firm’s claims should be as checkable as its findings. Ours follow these rules.

• No clients, logos, testimonials, case studies or figures without the client’s written permission and a real engagement behind them. Today this site shows none.
• Aligned with, never certified by. Our services are aligned with published frameworks. We do not say TriOngle is certified by OWASP, NIST, ISO or any other body. If we hold a certification in future, we will name it with its scope and expiry.
• No guarantee of compliance. Readiness work for the EU AI Act, ISO/IEC 42001 or the GDPR is not legal advice and does not guarantee compliance.
• Every number has a method and a date. An error rate or test result we publish states how it was measured and when.
• Providers in plain text only. We name the models, frameworks and runtimes we work with so you know what we cover. Naming implies no partnership, endorsement or certification, and this version of the site shows no third-party logos.

These rules follow the law as well as good practice. EU law treats displaying a trust or quality mark without authorisation, and falsely claiming approval or endorsement, as unfair in all circumstances,^⁠[3] and the US Federal Trade Commission has barred a company from misrepresenting the accuracy and test results of its AI-powered security product.^⁠[4]

• No cookies, no analytics, no tracking and no third-party requests. Fonts and images are served from triongle.com.
• No forms and no chatbot. If we ever add a chatbot, it will tell you it is an AI system, as Article 50 of the EU AI Act requires.^⁠[5]
• When you email us, we use your message and address to answer you and for any engagement that follows. Ask us to delete them at any time.