Security

Your access

Test logins go only into an encrypted field in your project, never into the chat or e-mail. Team members see them only when the work needs them, every view is logged, and we delete them within 14 days after the work ends. Use test accounts and a staging environment where you can.

Our team

Everyone who works on your project signs a confidentiality agreement, uses an individual account with multi-factor authentication and an encrypted computer, and gets only the access the work needs.

The platform

piperlink.com runs over TLS behind Cloudflare; the team console is reachable only through an identity-checked gateway; secrets are kept out of the code. Notifications to our team’s messenger carry no data from your app. Our security contact is listed in /.well-known/security.txt.

AI tools

We use AI to work faster: drafting test cases and reports, automating regression. AI tools are used only under business terms that exclude training on your data, never receive passwords or keys, and a person reproduces every AI finding before it reaches you.

Vulnerability testing

Only with your written authorisation, without damage, within the agreed scope and following OWASP guidance: https://piperlink.com/security-testing-authorization

Incidents

If something happens to data you entrusted to us, we tell you within 48 hours what we know and what we are doing. To report a vulnerability in piperlink itself, write to support@piperlink.com.

Documents for your company

Master Services Terms: https://piperlink.com/master-services-terms

Data Processing Agreement with standard contractual clauses and our subprocessors (Annex III): https://piperlink.com/data-processing-agreement

Security Testing Authorization: https://piperlink.com/security-testing-authorization

For your security questionnaire, write in your project chat.