Method and trust

How an engagement runs

It starts with a conversation about scope, and nothing else. No signature, no access. No access, no work. When access is granted, it is scoped to the engagement: the named systems, the named window, the named purpose. Temporary access is revoked or rotated at close-out, and the close-out says which.

Evidence is classified before it is collected. We take the minimum the work needs: the shape of a configuration, the presence of a rule, the state of a control. Client-side collectors are read-only and inspectable before they run, and they seal what they gather into an evidence bundle with a SHA-256 manifest, so the record you receive is the record that was taken.

Changes are never a surprise. In any applied-fix work, the exact change is shown before it is applied, approved by you, backed up, applied in the agreed window, and verified by read-back. The rollback path is written on the ticket before the change, not invented after.

What happens to your data

Working material is destroyed 30 days after your report is delivered. Secret-class material, passwords, keys, tokens, never leaves your environment at all: the collectors record that a control exists and how it is set, never the secret value itself.

Reports are fingerprinted per client and marked confidential, licensed for your internal use. Our methods, templates, and test material remain KOLLAZ property; your systems and the changes applied to them are yours. That split is what lets us show you real sample artefacts without handing over the machine that made them.

What we never collect

Secret values. Customer records beyond the minimum an agreed check needs. Anything from a third party who is not part of the signed scope. Offensive testing runs only against systems you own and named in writing, after the lab has proven the technique on ours.

Honest limits

KOLLAZ is a new, small specialist firm. The published case on this site is our own stack, because it is the only case that is ours to publish; client cases will appear only with written permission, and the close-out of every engagement asks for it.

We make no SOC 2 or ISO claims, and we offer no certification, compliance attestation, or legal advice. Where a finding touches law, the report says so and names the gap; your own counsel rules. A security review lowers risk and proves state; no honest firm can promise that a system will never be attacked, and we will not write that sentence for money.

The free tools carry the same posture. The AI Visibility Checker states on its face what it tested and what it did not, keeps one free check per business in a single shared record, and shows its full free result whether or not you leave an address.