Effective Date: March 18, 2026
We are a cybersecurity company. We know that no system is perfect, including ours. If you discover a security vulnerability in any CELVEX Group system, we want to hear about it and we want to make it easy and safe for you to tell us.
We also want you to know how we approach disclosure in our own work. When we discover vulnerabilities in the course of our security research and services, we practice responsible disclosure. We report issues to help organizations fix them -- never to harm, threaten, or leverage them. Our reputation depends on doing the right thing, and we take that seriously.
CELVEX Group will never threaten, extort, coerce, or leverage discovered vulnerabilities against any party. When we find security issues -- whether in the course of a paid engagement, through our free scan tool, or through independent research -- we report them to the affected party through appropriate channels with the sole goal of helping them remediate the issue.
We do not publicly disclose vulnerabilities in other organizations' systems without coordination. We do not use vulnerability information as leverage in business negotiations. We do not sell vulnerability data to third parties.
This is foundational to who we are.
This policy covers:
The following activities and vulnerability types are out of scope and should not be attempted:
Email: security@celvexgroup.com
Please include:
If you want to encrypt your report, our PGP key is available at https://celvexgroup.com/.well-known/pgp-key.txt
| Step | Timeline |
|---|---|
| Acknowledgment | Within 48 hours of your report |
| Triage and initial assessment | Within 5 business days |
| Status update | You will receive updates at least every 10 business days until resolution |
| Resolution | As fast as the nature of the vulnerability allows; we will keep you informed |
We will not take legal action against security researchers who:
If you make a good-faith effort to follow this policy and accidentally cause disruption, we will not hold it against you. We are security professionals -- we understand that things can go sideways during research.
We will also work with you to understand the issue and will not file complaints with law enforcement against researchers acting in good faith under this policy. We believe the security research community makes the internet safer for everyone, and we want to be part of that.
We maintain a Hall of Fame on our website to recognize researchers who help us improve our security. If you report a valid vulnerability:
This policy is meant to describe our commitment to working with the security research community. It is not a legal contract and does not override applicable law. However, it reflects our genuine intent: if you act in good faith, we will act in good faith. That is who we are.
Effective Date: March 18, 2026
This is a short cookie policy because we have very little to say. That is by design.
CELVEX Group does not use tracking cookies. We do not use:
We use Plausible Analytics for website analytics. Plausible is a privacy-focused analytics tool that:
All analytics data is aggregate and anonymous. We can see that "47 people visited our pricing page today." We cannot see that "John Smith from Acme Corp visited our pricing page at 2:14 PM."
We may set a small number of essential cookies that are strictly necessary for the website to function:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Maintains your session if you log in to our platform | Expires when you close your browser, or after 24 hours |
| CSRF token | Prevents cross-site request forgery attacks on forms | Expires when you close your browser |
These cookies do not track you. They do not contain personal information. They exist because the website cannot function securely without them.
The free scan tool may set a session-related cookie to maintain state during the scanning process (e.g., to associate you with your scan results and to enforce rate limits). This cookie:
No third party sets cookies through our website. When you visit celvexgroup.com, the only cookies that may appear in your browser are the essential ones listed above, set by us.
Because we do not use tracking cookies, we do not display a cookie consent banner. There is nothing to consent to. We believe this is better for everyone: you get a cleaner browsing experience, and we do not have to pretend that an "accept all cookies" button is meaningful consent.
If you have questions about our cookie practices: privacy@celvexgroup.com
RFC 9116 Standard Implementation
The following content is placed at /.well-known/security.txt on celvexgroup.com:
Contact: mailto:security@celvexgroup.com Expires: 2027-03-18T00:00:00.000Z Preferred-Languages: en Canonical: https://celvexgroup.com/.well-known/security.txt Policy: https://celvexgroup.com/responsible-disclosure Hiring: https://celvexgroup.com/careers
This file follows the RFC 9116 standard for reporting security vulnerabilities. The Expires field is updated annually.
Effective Date: March 18, 2026
This disclaimer applies to all scanning and testing services provided by CELVEX Group, whether free or paid. Please read it carefully.
We are your trusted security partner. Our goal is straightforward: to help you identify and fix security issues before bad actors find them. We would never do anything to compromise that trust. Everything described below exists to protect both of us so we can focus on that shared mission.
The CELVEX Group free scan tool performs passive scanning only. This means:
The free scan tool and all results it produces are provided "AS IS," without warranties of any kind. CELVEX Group makes no representations or warranties regarding the accuracy, completeness, reliability, timeliness, or usefulness of free scan results. The free scan tool is provided as a courtesy to the security community, and its use is entirely at your own risk.
All paid penetration testing and security assessment work performed by CELVEX Group is:
The client acknowledges that authorized security testing may involve interacting with production systems in ways that could potentially cause unexpected behavior, service disruption, or other impacts. By signing a Statement of Work authorizing testing, the client accepts the inherent risks of security testing and agrees that CELVEX Group is not liable for impacts that occur during testing activities conducted within the agreed scope and parameters.
CELVEX Group does NOT perform denial-of-service attacks, distributed denial-of-service attacks, heavy load testing, stress testing, capacity testing, or any form of destructive testing against production systems.
This is a core principle, not a footnote.
The sole exception is when the client has specifically engaged CELVEX Group for resilience, load, or stress testing under a signed Statement of Work that:
Under no other circumstances will CELVEX Group intentionally generate traffic, request volumes, or system loads designed to test or exceed the capacity of a client's systems.
Security assessments are conducted with professional care and diligence. However, CELVEX Group does not warrant or guarantee that:
No security assessment can provide absolute assurance. The threat landscape is dynamic, systems change continuously, and new vulnerabilities are discovered daily. Our assessments represent a professional evaluation at a specific point in time using specific methodologies.
CELVEX Group reports findings and provides remediation guidance based on our professional judgment. The decision of whether, when, and how to remediate is entirely the client's. We are not liable for:
We strongly encourage clients to remediate critical and high-severity findings promptly, and we are always available to advise -- but the responsibility for remediation decisions rests with the client.
CELVEX Group is not liable for security breaches, data loss, unauthorized access, or other security incidents affecting the client's systems, whether such incidents occur before, during, or after an engagement. This includes, without limitation:
Our role is to help you understand and reduce your risk. We do that with dedication and integrity. But we cannot guarantee outcomes in an adversarial environment, and we are not an insurance policy against future incidents.
By using any CELVEX Group service, you acknowledge that:
Questions about this disclaimer: legal@celvexgroup.com
Effective Date: March 18, 2026
We exist to help you find and fix security issues before attackers do.
This is not a marketing tagline. It is the reason CELVEX Group exists. Every service we offer, every tool we build, and every engagement we take on is guided by a simple commitment: to make our clients more secure.
We operate with integrity, transparency, and respect for your systems. When you invite us to examine your security posture -- whether through our free scan tool or a full-scope penetration test -- you are placing your trust in us. We do not take that lightly. We treat every engagement as a partnership built on mutual respect and shared goals.
We never test without authorization. Our free scan tool gathers only publicly available information. Our paid testing services operate strictly within the scope you define and authorize. We do not exceed boundaries, and we do not take liberties with access.
We never access data beyond what is needed for the engagement. If we encounter sensitive data during testing, we stop, document the access path, report it to you, and move on. We do not copy, retain, or use sensitive data beyond what is strictly necessary to demonstrate the finding.
We never leverage findings for anything other than your benefit. When we discover a vulnerability, we report it to you so you can fix it. We do not use findings to embarrass, threaten, extort, or gain advantage over anyone. We do not sell vulnerability information. We do not disclose your vulnerabilities to third parties.
We are on your side. The security landscape is challenging enough without wondering whether your security partner has your best interests at heart. We do. Our business succeeds when our clients are more secure. That alignment of incentives is by design.
We hold ourselves to the highest standards of professional conduct. We invest in our people, our tools, and our methodologies so that when you engage CELVEX Group, you are getting the best we have to offer.
This is our promise to every client, every user, and every organization we work with: we will always act in your best interest, with honesty, professionalism, and care.
If you ever feel we have fallen short of this commitment, we want to know. Reach out to us directly at trust@celvexgroup.com and our leadership team will respond personally.
All legal pages are owned and maintained by CELVEX Group. For questions, contact legal@celvexgroup.com.
↑ Back to top