How I handle your data.
A security practice is judged on how it handles its own clients' data. This page states what is true today, and nothing more.
Who handles it
Metalink is a solo practice. Client work is done by me, Rajesh Kumar: the person on the first call is the person with access.
Access to your systems
Access is least-privilege and read-only. It is recorded when it is granted, and removed at handover unless a retainer follows.
Before anything is shared
A mutual non-disclosure agreement comes before intake and before any access to your systems. The statement of work then sets out how your data is handled.
Where the work ends up
At handover everything moves into your own storage: the deliverable pack, the answer bank and the roadmap.
AI tools
I use AI tools in my work, for example to produce first drafts. Which tools may be used on your data, and on what terms, is written into the statement of work before work starts.
I review every answer line by line before it goes to you or your customer. An answer in a security questionnaire is a contractual representation, so nothing goes out unreviewed.
Mail sent to [email protected] is hosted on Google Workspace.
This website
- Static files served over HTTPS only, from Amazon CloudFront and a private Amazon S3 bucket.
- No cookies, no analytics and no third-party scripts, fonts or images.
- A content security policy that allows scripts and styles from this site alone, and one outside frame: the Cal.com scheduler on the booking page.
- More detail on the privacy page.
Reporting a security problem
Write to [email protected]. The contact details are also published in security.txt.
Not covered here
If your own security review of me needs an answer that is not on this page, ask and I will give it to you in writing.
Deal waiting on a security review?
Book thirty minutes, or send me the questionnaire and I'll tell you what it will take.
- [email protected]
- Based
- Pacific Northwest