01This site
The public site carries no analytics, no tracking pixels, and no advertising cookies. The engagement form on the homepage composes a draft email in your own browser; nothing is transmitted to us until you choose to send it yourself.
02The client portal
Creating a portal account collects a work email and a password. Passwords are salted and hashed before storage — we never hold or can recover the plaintext. We store the minimum needed to run the account: your email, engagement metadata, and the findings you've been granted access to.
03Sessions
The portal sets no cookies. Authentication uses an access token held in your browser's local storage, scoped to this site, and cleared when you log out or clear site data.
04Engagement data
Once a mandate is signed, scope, findings, and communications are confidential and handled under the coordinated disclosure policy and terms of engagement. Records are retained only as long as needed to support the work and any agreed re-test, then destroyed.
05Third parties
We don't sell or share data for marketing, and we don't run ads. Account and engagement email is sent through a third-party transactional mail provider (Resend) solely to deliver those messages — it does not receive your findings or scope.
06Your data, your call
Write to legal@mephistopheles.zip to access, export, or delete the data tied to your account. We respond within two business days.
07Changes
If this policy changes materially, the version and effective date above will move, and active clients will be notified.