How Elitor earns trust

Elitor is an independent security-testing practice. We are not a CREST or CHECK-accredited firm, and we are not SOC 2 or ISO 27001 certified. We do not claim certifications we do not hold. If your situation needs an accredited provider — for cyber-insurance, a regulated-sector tender, or an enterprise procurement gate — we will tell you plainly, rather than sell you something that will not clear that bar.

An assessment puts us inside your app, so we keep the handling tight: your report is delivered by an expiring, encrypted link and never stored on our platform; testing runs only on your written authorisation; access is temporary and revocable and source code is never required; secrets come through a secure, one-time channel; testing is non-destructive by default; and your data is never used to train any model. The full detail is on our security page.

We keep our own attack surface small. The site runs on managed infrastructure (Vercel and Supabase) that encrypts data in transit and at rest, and we collect only what we need to operate — see the privacy policy. Your assessment reports are deliberately kept off the platform entirely.

Elitor Ltd is the data controller (registered in England & Wales, company no. 17318982; ICO registration C1976881). We can put a data-processing agreement (DPA) in place before you share anything, and there is a public complaints route for any data-protection concern.

Found something in our site? We welcome good-faith reports. Email team@elitor.ai or use the report-an-issue form. We acknowledge reports promptly and keep you updated.