Privacy Policy

Fast Pen Tests is a trade name of CERES BASE LLC, a New Jersey limited liability company ("Fast Pen Tests," "we," "us"). We take your privacy seriously. This Privacy Policy outlines our practices concerning the collection, use, and protection of your personal information when you use our penetration testing services.

We collect minimal personal information necessary to provide our services. This includes:

• Your email address (for communication and report delivery)
• The domain you submit for penetration testing
• If you subscribe to our newsletter, a record of that consent (see Email Communications below)

We do not collect or store any personal information beyond what is listed here.

We use your information solely for the purpose of:

• Conducting the requested penetration test on the specified domain
• Generating and delivering the penetration test report
• Communicating with you about your service
• Running the free security scan you request and, if you give us your email, emailing you the result
• Sending Fix This Week, our weekly security newsletter, if you subscribed and confirmed (see Email Communications below)

We send Fix This Week, our weekly security newsletter, only to people who ask for it. To subscribe you enter your email, tick a box that says you want it, and then click the link in a confirmation email. Running a free scan, buying a pen test, or emailing us does not sign you up. Every newsletter includes a one-click unsubscribe link, and you can also opt out by emailing info@fastpentests.com. We honor opt-outs right away and always within 10 business days, and an opt-out applies to all of our marketing email.

When you subscribe we keep a record of your consent: your email address, the exact wording you agreed to and its version, the page you signed up on, the date and time, the country your connection came from (not your IP address), your browser's user agent, when you confirmed, and when you unsubscribed. We keep that record for as long as we might need to show you agreed, including after you unsubscribe, and delete it on request. Newsletters are sent through our email provider, Resend. We do not sell, rent, or share your email address with anyone else for their marketing.

Contact details (your email address, the domain you scanned or ordered a test for, and order records) are kept while you remain a customer or subscriber and are deleted on request. For our unauthenticated services (the $495 external penetration test and the free security scan), we do not store any data collected during the test after the scan is completed and the report is delivered. All scan-related data is automatically and permanently deleted from our systems once the report is generated and sent to you. For authenticated (logged-in) engagements, we keep evidence and test data for 90 days after the final report, so we can run the retest and answer questions about findings, and then delete it. See the authenticated engagement terms.

We use Stripe, a secure third-party payment processor, to handle all payment transactions. We do not store your payment information on our servers. Stripe may collect and store your payment details in accordance with their own privacy policy and security practices.

We implement industry-standard security measures to protect your information during transmission and while in our possession. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

We use Stripe for payment processing and potentially other third-party services for email delivery. These services may collect, use, and disclose your information according to their own privacy policies. We encourage you to review the privacy policies of these third-party services.

You have the right to access, correct, or delete your personal information. If you have any questions or requests regarding your data, please contact us at info@fastpentests.com.

We occasionally send a single email to businesses whose public website we have checked with our free, read-only security header scan. For this we use the business contact details of one person at the company (name, work email address, company name and website), taken from the company's own website, public company registers or business directories, together with the scan result for that website.

For recipients in the United Kingdom, we rely on legitimate interests (UK GDPR Article 6(1)(f)): telling a business about a security weakness on its public website and offering a service to fix it. We only email incorporated businesses at work addresses, send one message unless you reply, and keep the data for no longer than 12 months if you do not respond.

Every email includes a one-click unsubscribe link. You can also object, or ask what we hold about you and where we got it, by emailing info@fastpentests.com. Once you object we add your address to a suppression list so you are never contacted again. You may also complain to the UK Information Commissioner's Office (ico.org.uk).

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.