Authorized security work
We conduct testing, assessment, investigation, and response activities only with appropriate authorization and within an agreed scope. Engagement documentation should identify relevant systems, timing, methods, contacts, and escalation paths before work begins.
Information protection
- Limit access to client information to people who need it for the engagement.
- Use reasonable technical and organizational safeguards for data in transit and at rest.
- Handle findings and evidence according to the sensitivity of the information and the agreed reporting process.
- Return, delete, or retain engagement information according to the applicable contract and legal requirements.
Responsible disclosure
When we identify a vulnerability, we prioritize clear evidence, responsible notification, and practical remediation guidance. We do not publish or disclose findings in a way that needlessly increases risk. Any public disclosure is subject to authorization and applicable agreements.
Applicable requirements
Depending on the engagement, we may help clients evaluate controls against applicable laws, regulations, contractual obligations, and recognized security frameworks. The relevant requirements and the client’s responsibilities are defined by the scope and written agreement for each engagement.
References to a framework or regulatory requirement do not mean that denuko or a client is certified or compliant unless a qualified assessor or authorized authority has formally established that status.
Raise a concern
Questions about our security practices, an engagement, or a potential vulnerability can be sent to info@denukokenya.com. Please do not include sensitive personal data or confidential system details in an initial email unless requested through an approved channel.