Security by design
The public website is static, has no user accounts, no application backend, and no third-party analytics. Engagement work is scoped, least-privilege, and documented.
Trust is operational, not decorative.
This page states how AegisCore Labs handles information, how to report a security issue, and the limits of what we currently claim.
Data minimization
We ask only for the evidence and context required to perform the agreed work. This site does not collect personal data through forms or trackers.
Isolated processing
Collection and investigation run in a hermetic retention environment operated by the firm. When evidence can remain in the client environment, that option is preferred over unnecessary data movement. Engagement data is not handed to external generative-AI providers for the verdict.
No secrets upload policy
Do not send passwords, API keys, tokens, private keys, dumps of secrets, or production credentials through email or this website. If access is required, it is arranged through a scoped, time-bound channel agreed in the engagement.
Responsible disclosure
If you believe you have found a security issue in AegisCore Labs public properties, email [email protected]. We do not currently operate a public bug bounty.
Current limitations
- AegisCore Labs is a cybersecurity services brand operated from Colombia. This site does not state a corporate incorporation form or tax identification number.
- We do not publish client names, partnership badges, awards, or certification marks we do not hold.
- AETHER OS is Private Alpha. CPEP is internal infrastructure. Neither is a generally available cloud service, a self-service workspace, or a guarantee of compliance or security.
- References to SOC 2, PCI-DSS, NIST CSF, ISO 27001 or CIS Controls describe how a signed manifesto can support the client’s own evaluations—not official accreditation by AegisCore Labs.
The client contracts expert judgment. Cryptographic custody and deterministic evaluation make that judgment auditable.