Security

This is a public security overview, not a certification, audit report, warranty, or detailed description of internal architecture. It does not claim ISO 27001, SOC 2, PCI DSS, a penetration-testing schedule, a bug bounty, or a response SLA. Product-specific services, including AntiBot, may publish separate security and privacy information appropriate to their systems.

1 · Security principles

Our security approach is guided by the following principles:

• Collect less: request and retain only information reasonably needed for a defined purpose;
• Limit access: provide access according to role and business need;
• Protect accounts: use strong authentication and additional verification for sensitive systems where available;
• Use reputable platforms: assess providers according to the information and function entrusted to them;
• Keep systems maintainable: patch, update, and replace components according to risk;
• Design for recovery: maintain appropriate backups, recovery methods, and incident procedures; and
• Improve over time: review incidents, changes, and material risks to improve controls.

2 · Governance and responsibility

Security responsibilities are assigned within Techies Lab according to system ownership and business function. Material security risks are considered when selecting vendors, designing workflows, granting access, and delivering client work.

Policies, procedures, and technical controls are reviewed as the business, systems, and risk profile change. Team members and contractors are expected to follow confidentiality, acceptable-use, access, and incident-reporting requirements relevant to their role.

3 · Access control

Our intended access-control practices include:

• Unique user accounts where supported;
• Multi-factor authentication for sensitive business and administrative systems where available;
• Least-privilege access based on job responsibility and project need;
• Prompt review or removal of access when responsibilities change or a relationship ends;
• Restricted administrative permissions; and
• Periodic review of access to material systems and client workspaces.

Credentials, private keys, and access tokens must not be submitted through public Website forms or ordinary project documents.

4 · Data handling and confidentiality

We classify and handle information according to its sensitivity and purpose. General practices include:

• Separating public material from confidential client information;
• Limiting client information to authorised team members and approved providers;
• Using contractual confidentiality commitments where appropriate;
• Avoiding the use of real confidential data in demonstrations or tests unless authorised and protected;
• Applying retention and deletion practices appropriate to the engagement and applicable requirements; and
• Using controlled sharing methods instead of public links for confidential proposals, credentials, datasets, and deliverables.

Client-specific security, data-location, access, retention, or deletion requirements should be documented in the applicable proposal, statement of work, data-processing agreement, or security schedule.

5 · Encryption and transmission

The Techies Lab Website is intended to use HTTPS to protect information in transit between the browser of a visitor and the Website. We also select service providers that support encryption in transit and, where appropriate to the service and data involved, encryption at rest.

Encryption reduces risk but does not make a system immune to compromise. Users should avoid sending credentials or highly sensitive information through general Website forms or unapproved communication channels.

6 · Website and application security

Depending on the system and change involved, our development and operating practices may include:

• Reviewing code and configuration changes before production deployment;
• Separating development or test activity from production where appropriate;
• Managing dependencies and applying security updates according to risk;
• Protecting secrets through environment or platform controls rather than embedding them in public code;
• Validating input and applying platform protections against common web attacks;
• Restricting administrative interfaces;
• Maintaining logs needed for reliability, misuse detection, and incident investigation; and
• Removing obsolete routes, exposed documents, and unnecessary access paths.

We prioritise remediation according to likely impact, exploitability, exposure, and available mitigations.

7 · Infrastructure and service providers

Techies Lab uses third-party infrastructure and business-service providers. Provider selection may consider:

• Security and privacy documentation;
• Access-control and authentication capabilities;
• Encryption and data-handling features;
• Availability and recovery capabilities;
• Contractual and confidentiality protections;
• Data location and international-transfer considerations; and
• The sensitivity and volume of information the provider will process.

No provider is risk-free. We aim to avoid giving a provider more information or access than reasonably necessary for its role.

8 · Monitoring and incident response

We maintain processes appropriate to our size and systems for receiving security reports, investigating suspected incidents, containing harm, restoring affected services, and preserving information needed for investigation.

When a confirmed incident affects personal information or client information, Techies Lab will assess notification and cooperation obligations under applicable law and relevant contracts. Notification timing and content depend on the facts, affected systems, risk, and legal requirements.

9 · Business continuity and recovery

For material systems, we seek to maintain recovery options appropriate to business impact. These may include provider-level resilience, backups, version history, configuration recovery, and documented ownership for restoring service.

Recovery methods are selected and tested in proportion to the importance of the system and the consequences of unavailability or data loss.

10 · People and working practices

Security also depends on daily behaviour. Team members and contractors are expected to:

• Protect accounts and devices;
• Use approved tools and sharing methods;
• Verify unusual requests involving access, payments, credentials, or sensitive data;
• Report suspected phishing, loss, exposure, or unauthorised access promptly;
• Avoid placing confidential information in public AI tools or unapproved systems; and
• Follow client-specific security requirements communicated for an engagement.

11 · Artificial intelligence and client information

AI-assisted workflows may be used in research, content, tooling, or execution. Before client information is processed through an AI service, the workflow should consider authorisation, confidentiality, data sensitivity, provider terms, retention settings, access, and whether redaction or synthetic data is more appropriate.

Techies Lab does not treat a public AI interface as an appropriate destination for passwords, production credentials, private keys, regulated personal data, or confidential client materials unless the specific use has been approved and protected under the relevant engagement and provider configuration.

12 · Reporting a vulnerability

If you believe you have found a vulnerability affecting the Techies Lab Website or a system controlled by Techies Lab, email yolo@techieslab.app with the subject Security Report.

Please include, where safe and lawful:

• The affected URL, feature, or system;
• A clear description of the issue and potential impact;
• Reproduction steps or a limited proof of concept;
• The date and time observed; and
• A contact method for follow-up.

Do not include personal information, confidential client information, credentials, or copied production data unless we specifically request it through an approved secure channel.

13 · Responsible testing expectations

Unless Techies Lab has provided prior written authorisation, do not:

• Access, alter, download, or delete the data of another person;
• Exfiltrate data beyond the minimum needed to demonstrate an issue;
• Use denial-of-service, resource-exhaustion, spam, or destructive testing;
• Use social engineering, phishing, physical intrusion, or attacks against team members or providers;
• Install persistence or malware;
• Publicly disclose an unremediated issue in a way that increases risk; or
• Test third-party systems that Techies Lab does not control.

Stop testing and contact us immediately if you encounter credentials, personal information, confidential information, or evidence of active compromise.

This page does not create a bug bounty, promise payment, authorise unlawful activity, or provide a legal safe harbour. Any testing must comply with applicable law and with the acceptable-use section of our Terms of Use.

14 · Our response to reports

We aim to review credible security reports as soon as reasonably practicable, confirm the affected scope, prioritise according to risk, and communicate with the reporter when useful. Response and remediation time depends on severity, complexity, ownership, provider involvement, and available mitigation.

Please allow us a reasonable opportunity to investigate and reduce risk before public disclosure.

15 · Security limitations

No organisation, control, network, or service can guarantee absolute security. This page describes a risk-based approach and does not warrant that Techies Lab systems will be uninterrupted, error-free, or immune from every vulnerability or incident.

We update this page when our practices, systems, or risk profile materially change.

16 · Contact

• Email: yolo@techieslab.app, subject Security Report

For privacy requests, use the instructions in the Privacy Policy.