Authorization, data and our own security

Authorization and the legal basis

In Germany, accessing a computer system you are not authorized to access is a criminal offense. Section 202a of the Criminal Code (StGB) covers data espionage, and sections 202b, 202c and 303a and following cover interception, preparation and data alteration. Penetration testing is only lawful when the person who may dispose of the system has permitted it in advance.

So the signature comes before the first packet. Every engagement runs under a written testing agreement from the system owner that names the exact targets and exclusions, our fixed source IP addresses, the testing windows and an emergency stop contact on both sides. Where your hoster or cloud provider requires consent for tests in their infrastructure, we obtain it with you before testing starts. We verify that the targets belong to the party authorizing the test.

How we handle your data

What we hold, and for how long

During an engagement we hold the attack surface inventory, scan output, evidence for findings and any test accounts you provide. This working data is deleted 90 days after the closing call, or after the retest if you order one, and earlier on request. The final report and the signed testing agreement are kept for three years and then deleted, so we can answer questions about the work within the regular limitation period. Accounting records are kept for the statutory periods under German tax and commercial law.

How the report reaches you

Reports are delivered as an encrypted archive, with the password sent through a separate channel agreed at scoping, by phone by default. PGP-encrypted email is available on request. We never send a report or a password through a single unencrypted message.

AI-assisted analysis

Tyvar is AI-assisted. AI-assisted analysis is processed by a third-party model provider under contractual data protection terms. All subprocessors are listed in the data processing agreement, which is available on request. We do not claim that your data never leaves Germany or the EU, because that would depend on the processing involved and we will not promise what we have not verified in writing for your engagement.

Contracts

A mutual non-disclosure agreement can be signed before scoping details are exchanged. A data processing agreement under Article 28 GDPR is part of the contract set whenever personal data may be processed, which is the case for authenticated testing and for most web applications.

Our own security

The brief for this site was to be an example of the practice it sells. This site is fully static, serves no third-party requests, sets a strict Content Security Policy without inline script, runs TLS 1.2 and 1.3 only, and carries the HTTP security headers you can check yourself in your browser's network panel. The contact form is handled by a small service that stores nothing, logs status codes only and sends mail over an authenticated API, never SMTP. Our domains send no mail at all and say so in their DNS: a null MX record, a restrictive SPF record and a DMARC policy of reject.

Responsible disclosure

If you believe you have found a security issue in Tyvar's own systems, tell us before you tell anyone else and we will work with you. Write to [email protected], by default in English or German. Describe the issue and how to reproduce it, and give us reasonable time to fix it before any public disclosure. We do not run a paid bug bounty, and we will not take legal action over good-faith research that stays within this policy and touches only our own systems. Our machine-readable policy is at /.well-known/security.txt.