Security practices at Illicus

We run security programs for clients, so we work under the same rules: NDA by default, least-privilege access through your SSO/IAM, audit logs.

Our security posture

Access controls

  • All team members authenticate with hardware security keys (FIDO2)
  • We use your SSO/IAM systems when accessing client environments
  • Access follows least privilege: we only request what is needed
  • All access is time-limited and revoked when the engagement ends
  • We keep detailed audit logs of our activities

Data handling

  • Client data is never stored on personal devices
  • All communications use encrypted channels (TLS 1.3)
  • Sensitive documents are shared through client-controlled systems when possible
  • We don't access, copy or store customer application data
  • Engagement artifacts are securely deleted after agreed retention periods

Operational security

  • Endpoint detection and response (EDR) on all devices
  • Full-disk encryption required
  • Regular security awareness training
  • Background checks for all team members
  • Incident response procedures documented and tested

During client engagements

  • NDA by default

    Every engagement is covered by an NDA from the start.

  • Named individuals

    You know by name who has access, and each of them is a senior practitioner with 10+ years of hands-on experience.

  • Your controls

    We work within your existing security policies and access management systems.

  • Audit trail

    We document what we access and why, available for your security reviews.

Responsible disclosure

Found a vulnerability in our systems? Email security@illicus.com with:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Your contact information

We commit to acknowledging reports within 48 hours and will keep you updated until it is fixed.

Vendor security reviews

Send your security questionnaire or vendor review to security@illicus.com. To talk through an engagement first, book a 20-minute discovery call. No prep required. If you need this rigor in your own company, see Fractional CISO and SOC 2 compliance readiness.

On request we provide:

  • Security questionnaire responses
  • Details about our security practices
  • References from similar engagements