Security & Trust
Trust is never the only control.
Clients bring us questions they cannot ask anyone else, about threats, transactions and people. This page describes how we protect what they tell us, what we collect on their behalf and the investigation itself, in enough detail for a security team to test.
- Access to client systems
- None required, for any service
- Access model
- Per case, need to know, every action logged
- Authentication
- Hardware security key on every staff account
- Encryption
- In transit and at rest, keys separated by client
- Retention
- Case data deleted 90 days after closure
- Assurance
- Independent security testing and certification audit every year
Design principles
Six decisions that shape everything else.
Security controls are easier to trust when they follow from a small number of decisions that are hard to reverse. These are ours.
No footprint in your environment
We work from open sources and from what you choose to give us. Nothing is installed on your network, no credentials to your systems are held and no connection to them is needed.
Compartmented by case
Each engagement has its own workspace. Analysts see only the cases they are assigned to, and access ends when the assignment does.
Minimized by default
We ask for the least information the question needs, and we do not retain material about people who turn out to be irrelevant to it.
Keys separated by client
Data is encrypted in transit and at rest. Encryption keys are held per client, so one client's data cannot be read with another's key.
Research the subject never sees
Collection runs through non-attributable infrastructure, isolated per case, so research cannot be traced to us or to you.
Deleted on schedule
Case data is deleted 90 days after closure unless a legal hold applies. Deletion is automatic, logged and confirmed to the client on request.
Data handling
What we hold, who can see it and when it goes.
Different kinds of data carry different risks. Each is handled under its own rule, and none of it is reused for another client or another purpose.
| Category | Examples | Who can access it | Deletion |
|---|---|---|---|
| Client-provided material | Identifiers, documents, supplier lists, claim files | Assigned case team only | 90 days after closure |
| Collected evidence | Captured pages, media, records, with hashes and audit log | Assigned case team and the red-team reviewer | 90 days after closure, or as a legal hold requires |
| Reports and evidence bundles | Finished reports, annexes, exports | Case team, and client contacts named in the engagement letter | 90 days after closure. The client keeps its own copy |
| Screening subject data | Identifiers supplied with the subject's knowledge, and findings | Screening team and the client's named adjudicators | 30 days after the report, unless the program requires longer |
| Monitoring alerts | Verified alerts and the evidence behind each | Watch floor, named lead analyst and client contacts | 12 months, rolling, for trend review |
| Exposed personal data | Leak samples reviewed to verify a claim | Two named analysts per matter | On completion of verification. Hashes and findings are retained |
People
The controls that are not software.
Most failures of confidentiality are human. Our people are vetted before they join, trained before they touch a case and limited to what each assignment requires.
All collection and analysis is carried out by Aldervane employees on Aldervane infrastructure. We do not subcontract casework, and no third party has standing access to case workspaces.
- Vetting before accessBackground screening and references proportionate to the role, completed before any case access is granted and repeated periodically for sensitive roles.
- Training that is testedEvidence handling, data protection and operational security are assessed on joining and every year after.
- Two people for every exportEvidence bundles and reports leave the platform only after a second person has approved the recipient and the contents.
- Clean departuresAccess is revoked on the day a person leaves or changes role, and their hardware keys are returned and retired.
Assurance
How you can check, instead of taking our word.
Statements on a web page are not evidence. These are the ways clients and independent parties test what we say.
Independent testers, every year
An outside firm tests the platform and our research infrastructure annually. Summary results are shared with retained clients under confidentiality.
An audited management system
Our information security management system is independently certified against a recognized international standard and re-audited each year.
Your own review
Retained clients may review our controls, interview our security lead and inspect the audit trail for their own cases.
Hashes you can verify
Every evidence item carries a SHA-256 hash recorded at capture. Your examiner can confirm that nothing has changed without relying on our systems.
A committee that can stop work
The standards committee, chaired by our General Counsel, samples access logs and evidence handling every month and can halt any case.
Told within 24 hours
If we confirm an incident that affects your data, your named contact is told within 24 hours, with what we know and what we are doing.
Machine assistance
Your data does not train anything.
Machine assistance on our platform helps analysts sort and read large volumes of material. It runs inside the case boundary, under the same access rules as the analysts it supports.
- Case data is never used to train or tune any model
- No case data leaves the case workspace for processing elsewhere
- Every machine-assisted step is recorded in the audit trail
- Machine output is never cited as evidence
Questions
What security teams ask us
Do you need access to our network or accounts?
No. None of our services requires a connection to your systems, an agent on your devices or credentials to your accounts. Where your own records are relevant, such as access logs in a leak investigation, your team runs the query and shares the result.
Where is our data stored?
In the region agreed in your engagement letter. Retained clients can require that all case data stays within a chosen region, and that requirement is enforced technically and not only by policy.
Is our data ever used for another client?
No. We do not resell, pool or repurpose client data or findings across engagements. Analysts on one case cannot see another, and that separation applies to our own business development as well.
How do you exchange files with us?
Through an encrypted channel assigned to your case and named in your engagement letter. We will never ask you to send sensitive material by any other route, and you should treat any such request as suspect.
What happens when the engagement ends?
You receive the report and the evidence bundle. Ninety days after closure, the case workspace and everything in it are deleted, unless you or a legal obligation require a hold. We confirm deletion in writing if you ask.
Can we audit you?
Retained clients can. We share independent test summaries and certification reports under confidentiality, answer security questionnaires and make the audit trail for your own cases available for inspection.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.