Security

Security is part of how this public site is designed and operated. The consultancy release is delivered as static content over HTTPS, behind content-delivery and web-application firewall controls. Changes pass through controlled source review, automated security checks and a protected deployment path.

We use access control, environment separation, monitoring, dependency checks and bounded retention of operational records. These measures reduce risk, but no website or supplier can guarantee that a vulnerability will never exist.

If you believe you have found a security weakness affecting a system operated by Invicta Group Cyber, email hello@invictagroupcyber.com with the subject “Security report”. Please include:

• the affected hostname, URL or feature;
• a concise description of the issue and its likely impact;
• the minimum steps needed to reproduce what you observed;
• the date and time of the observation; and
• a safe way for us to contact you.

This page is a reporting route, not permission to perform active testing. Unless we have given you specific written authorisation, do not:

• access, alter, download or retain another person's information;
• exploit a finding beyond the minimum observation needed to describe it;
• use denial-of-service, high-volume automation, malware or destructive actions;
• test employees, suppliers or third-party infrastructure through social engineering;
• attempt persistence, lateral movement or access to non-public systems; or
• publish details before we have had a reasonable opportunity to investigate.

Stop immediately if you encounter sensitive information or any sign that your activity is affecting availability. Contact us before taking another step.

We will acknowledge a useful report as soon as practical, confirm that it reached the right owner, and investigate proportionately to the apparent risk. We may ask for more detail or a safe retest after a correction is ready.

We will try to keep you informed about material progress and coordinate any public disclosure. We do not currently operate a public bug-bounty programme and cannot promise a payment, reward or particular remediation date.

Only systems that clearly identify Invicta Group Cyber as the operator are covered by this reporting route. Services linked from our pages may be owned by another organisation and should be reported through that organisation's process.

We may ask you to verify a message or use an agreed channel before discussing sensitive details. We will never ask you to disclose passwords, private keys or unrelated customer information to prove a report.