Privacy
A security practice that was careless with your data would be making an argument against itself. This site collects nothing on its own: no cookies, no analytics, no third-party scripts. The rest of this page is the detail behind that sentence.
SRDA Labs — Security Research and Defence Advisory — is a security consultancy operating from India. For the purposes of data protection law we are the controller of the personal information described in this policy.
Questions, requests and complaints go to privacy@srdalabs.com.
Nothing, until you type something.
This site sets no cookies. It runs no analytics, no tag manager, no advertising pixels and no session recording. It reads and writes nothing in your browser’s storage. It loads no fonts, scripts or images from a third-party host, so no third party learns that you were here by virtue of the page rendering.
There is no consent banner because there is nothing to consent to. If that ever changes, this page changes first.
The site is served by Cloudflare. As with any web server, Cloudflare processes the technical details of each request — IP address, user agent, the path requested, timestamps — to deliver the page and to absorb abuse. We use Cloudflare as a processor and do not build visitor profiles from these logs.
We do not maintain our own analytics copy of this data.
Scheduling runs on Cal.com. The booking interface on this site is ours, but the calendar data and the booking itself belong to Cal.com, and your browser talks to api.cal.com directly rather than through us. Two consequences are worth stating plainly:
The form asks for your name, email address and organisation name, and optionally a website URL and whatever you choose to write in the free-text field. Your browser also reports the timezone you selected so the slot times line up. We use this to hold the appointment, to send the calendar invitation and joining link, and to prepare for the conversation.
Cal.com processes this as our processor under their own privacy policy. If you would rather not involve them, email us instead and we will arrange a time by hand.
Do not put credentials, access tokens, customer data or details of an unfixed vulnerability in the booking form. It is a scheduling field, not a secure channel. We will set one up before you need it.
If you write to us, we keep the correspondence so that we have a record of what was discussed and agreed. Mail is handled by Google Workspace as our processor.
Security work produces unusually sensitive material: findings, configurations, screenshots, logs and sometimes credentials issued to us for testing. How we treat it is a professional obligation before it is a privacy one.
We process personal information to answer your enquiry, to schedule and hold meetings, to perform an engagement and deliver its report, to issue invoices, and to meet our legal and professional obligations.
For people in the UK, the EEA and other regions with equivalent law, the basis is: performance of a contract, or steps taken at your request before one exists; our legitimate interest in running and securing the practice; your consent, where we have asked for it; and compliance with legal obligations. Where we rely on consent you can withdraw it at any time.
We do not sell personal information, we do not share it for advertising, and we send no marketing email to an address that reached us through this site.
If you want something deleted earlier than this and we are not required to keep it, say so and we will.
We operate from India and use service providers — including Cloudflare, Cal.com and Google — that process data outside your country. Where the law requires a transfer mechanism, we rely on the standard contractual clauses or equivalent safeguards in those providers’ terms.
Depending on where you are, you may ask us to give you a copy of the personal information we hold about you, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. You may also withdraw consent, and you may complain to your data protection authority.
Write to privacy@srdalabs.com. We will answer within thirty days. We may need to confirm who you are first, and we will not ask you for anything beyond what that takes.
Encryption in transit and at rest, hardware-backed multi-factor authentication on every account that touches client material, least-privilege access, and separate devices and accounts for engagement work. Our own practices are subject to the same reviews we sell.
No system is perfectly secure. If we ever suffer a breach affecting your information, we will tell you and the relevant authority within the timeframes the law sets, and we will tell you what we actually know rather than what sounds reassuring.
This site and our services are intended for organisations and the people who work in them. We do not knowingly collect information from anyone under sixteen.
If we change this policy we will update the date at the top. If a change is material — a new processor, a new category of data, a new purpose — we will say what changed rather than quietly reissuing the page.
If something here is unclear, or you want a data processing agreement before an engagement starts, that is a normal request and we have one ready.