Our own security

• We acknowledge every report within three business days. An assessment of what you sent follows within ten.
• Good-faith research is welcome. We will not pursue or support legal action against anyone who reports an issue to us in good faith, avoids privacy violations and service disruption, and gives us reasonable time to respond before disclosing.
• In scope: l4is.ai and its subdomains, including l4lean.l4is.ai, and any service operated under them.
• Out of scope: systems belonging to our clients or to third-party providers. If you have found something in a client system, tell us and we will route it — we will not act on it ourselves without their instruction.
• No bounty. We do not currently pay for reports. We will credit you publicly if you would like us to.

• Access is limited to people engaged on the work. Personnel and contractors working on your engagement, plus our own auditors, assessors, insurers and professional advisers — each under equivalent written confidentiality obligations, with Level Four responsible for their acts as for its own.
• Ordinary commercial services only. Client material is held using ordinary-course storage, backup and productivity services, named below. Anything beyond that requires your consent.
• Some material is never transferred. Penetration test reports and incident records are reviewed by screen share and are not copied to our systems.
• Retention runs from the most recent engagement, not from a single statement of work. Your register survives between pieces of work. We securely dispose of client material no later than two years after we last use it to serve you, unless we must keep it for legal defense or by law. Material is returned or destroyed on request, subject to retention required for legal defense and to backups that cannot practically be reached.
• If we have an incident, you hear from us within 72 hours. If we determine that client information we hold has been accessed or disclosed without authorization, we notify the affected client in writing within 72 hours of that determination — what we know at the time, what we are doing about it, and what we recommend you do. We follow up as the picture changes.
• Compelled disclosure is notified. If we are required by subpoena or a regulator to disclose your information, we tell you where we are legally permitted to.

• Microsoft 365. Email and document storage, United States. Anything you send us that we keep is held here. If another service is ever to hold it, that service is named on this list before your material goes there.

We do not give your documents to AI services. We use Claude, from Anthropic, for our own work, and your material is not part of it. That changes only when we have commercial terms with a provider that cover client material, and the provider is named on this list first, or when you choose a provider and connect your own account.

This website is hosted by Cloudflare, which also provides our DNS and domain registration. No client material passes through it: the site has no forms, no logins and no uploads, and our contact addresses deliver directly to Microsoft 365. Our registered agent and our accounting software see our own business records, not yours.

We will tell you before adding a sub-processor that would affect an active engagement.

What we run

Email authentication

SPF, DKIM and DMARC published for l4is.ai, with DMARC at p=reject

Authentication

Multi-factor authentication on every account that supports it; phishing-resistant factors where available

Encryption in transit

TLS on this site and on every service used to hold or exchange client material; we do not send client material over an unencrypted channel

Encryption at rest

Full-disk encryption on every device used for client work, and encryption at rest on the storage and backup services that hold client material

Endpoints

Automatic patching and screen lock on every device used for client work

Credentials

A password manager for all credentials; no shared accounts

Sub-processors

Microsoft 365. Named above, with what it holds

We publish what we actually do, rather than a control list borrowed from a larger organization, and we would rather this page be short and true than long and aspirational. If something you need is missing from it, Contact us and ask.