Security

The DarkStream model is itself a security control:

• Verified-asset access. A customer can only access exposure data relating to digital assets it has registered and whose ownership or control has been verified.
• Server-side enforcement. Access scoping is enforced on the server, not in the browser, so it cannot be bypassed by manipulating the client.
• No open look-ups. We do not allow searching for, or browsing of, data relating to assets a customer does not control.
• Least exposure. Customers see only what is necessary to protect their own organisation, and nothing about other organisations.

Encryption. Data is encrypted in transit using current TLS standards and at rest using strong, industry-standard algorithms. Backups are encrypted. Encryption keys are managed through a dedicated key-management process with restricted access.

Access control. We apply the principle of least privilege. Administrative and privileged access requires multi-factor authentication and is limited to authorised personnel on a need-to-know basis. Access is logged and reviewed periodically, and revoked promptly when no longer required.

Data separation. Customer data is logically separated and isolated between organisations. Exposure data is scoped to a customer's Verified Assets at the data layer, not only in the interface.

Our platform runs on reputable cloud infrastructure with regional data residency options available for enterprise customers. Production environments are separated from development and staging. We apply network-level controls, monitoring, and logging across our infrastructure to detect and respond to anomalous activity.

Access to production systems is restricted to personnel who require it for their role. We maintain internal security policies covering access management, secure development, and data handling, and we review them periodically as the company and its infrastructure grow.

We maintain an internal process for identifying, containing, and remediating security incidents. Where a security incident affects a customer's data, we will notify the affected customer without undue delay, consistent with our contractual and regulatory obligations under the DIFC Data Protection Law and, where applicable, GDPR.

Our documents and platform are built to align with the DIFC Data Protection Law 2020 and, where applicable, the GDPR and NIS2. We help enterprise customers meet their own reporting obligations under these frameworks through the compliance features available on qualifying plans.

If you believe you have found a security vulnerability in our Services, please report it to legal@ictlcorp.com. We ask that you do not access, modify, or exfiltrate data belonging to other customers while investigating, and that you give us a reasonable opportunity to remediate before any public disclosure.

For any security enquiry, including vulnerability reports and questions about our data-processing obligations, contact legal@ictlcorp.com. See also our Data Processing Agreement.