We assess the security of other organizations’ databases, so we hold ourselves to the standard we recommend. This page answers the questions security, privacy and procurement teams usually ask before an engagement. Need more detail? We can complete your vendor security questionnaire.

Your data, your choice

Every assessment can run the way your policies require:

• No changes to your systems. Our collection tools only read: they make no changes to configuration or data and install no agents. Depending on the tool, your DBA runs it and reviews the output, or we run it together with you.
• Business data only where the work requires it. Most assessments don’t need to read the contents of your tables. Where a task does, we agree it with you in advance, and it is covered by the NDA.
• Permissions agreed up front. We tell you before we start which permissions each tool needs. Some checks need only read permissions such as VIEW SERVER STATE; a full assessment can require sysadmin. Nothing runs without your agreement.
• AI-assisted code review, only with your approval. If you want AI help in a code review, you choose how: with an AI service you have already approved, inside your environment, or with our business-plan AI services from Anthropic (Claude) and OpenAI, including OpenAI’s Codex Security (Daybreak) for in-depth security analysis. Their business terms exclude using your code to train their models. Only code is reviewed, never table data, and a senior consultant verifies every finding. Prefer no AI? We review with static analysis and manual review only.

People and confidentiality

• NDA first. We sign your NDA or provide ours before any technical detail is exchanged.
• Background-checked consultants. Everyone who works on your project has passed a background check.
• No subcontractors without your consent. The consultants named in your proposal do the work; anyone else only with your written consent.

How we protect what we hold

• Transfer and storage your way: your SFTP, an encrypted container, or another method you specify. Access is limited to the consultants on your project.
• Deletion when you want it: immediately after the final report or after an agreed retention period, confirmed in writing.
• Multi-factor authentication on every account we use for client work.

Regulated environments

Our team has worked in healthcare, finance and the public sector, and our findings map to the frameworks you report against, such as HIPAA, PCI DSS and DISA STIG. We sign HIPAA Business Associate Agreements (BAAs). Our reports support your compliance work; we are not a certifying body.

Contracting

• US company: Sarpedon Quality Lab LLC, 3409 North 7th Ave Unit 724, Phoenix, AZ 85013.
• Fixed scope and price, agreed in writing before any work starts. Where your procurement requires it, we work under a Master Services Agreement with a Statement of Work per project.
• Buy directly or through AWS Marketplace as a private offer billed to your AWS account.
• Vendor onboarding: W-9 on request.

Our own security

Our website enforces HTTPS and modern security headers and publishes a security.txt file. Found a vulnerability? See our vulnerability disclosure policy.