Confidentiality Agreement

Overview

Overview

This agreement sets out how Cyberlord protects confidential information disclosed by a client during an engagement, with Cyberlord acting as recipient and the client as discloser. It covers what counts as confidential, the protection measures applied, the narrow cases where disclosure is permitted, what happens to data at the end of an engagement, and how a suspected breach is handled. It sits alongside the Service Agreement and the GDPR page, and it applies for the duration of the engagement and well beyond it.

What Counts as Confidential

The definition is deliberately wide: technical material such as system architectures, network diagrams, source code, databases, and APIs; security material such as vulnerabilities, findings, incident reports, and remediation plans; business material such as trade secrets, strategies, customer data, and financial information; access credentials including passwords, API keys, certificates, and authentication tokens; internal documentation, policies, procedures, and specifications; and any communications marked confidential. Treating everything in those categories as confidential by default removes the argument about whether a particular document was labelled correctly.

Obligations and Protection Measures

Cyberlord does not disclose confidential information to any third party without prior written consent, limits access to authorised personnel, uses it only to provide the agreed services, and applies the same care it applies to its own confidential material. In practice that means AES-256 at rest and TLS 1.3 in transit, role-based access with multi-factor authentication and least privilege, EU-based encrypted servers with redundant backups, firewalls and intrusion detection with VPN access requirements, and restricted-access data centres with surveillance and audit trails. Staff sign individual confidentiality agreements, are security trained, and are background checked.

Exceptions and Permitted Disclosures

Confidentiality does not apply to information already public at disclosure, information that becomes public without a breach by Cyberlord, material independently developed without use of the confidential information, or material lawfully obtained from a third party free of restriction. Disclosure compelled by law, regulation, or court order is permitted, with notice to the client where that is possible, disclosure limited to the minimum required, protective orders sought where appropriate, and cooperation with the client's legal counsel. Subcontractors and service providers are bound by equivalent obligations under GDPR-compliant data processing agreements.

Handling During an Engagement

Confidential data moves over encrypted channels only and is stored in encrypted containers with logged, audited access and logical separation per client. Credentials live in encrypted password vaults, test data is not kept on personal devices, screenshots and other evidence are sanitised before they appear in a report, and no unnecessary data is collected or exfiltrated. Critical findings travel by encrypted email or a secure portal, reports are delivered through secure file transfer, sensitive discussions happen on video rather than phone, and nothing confidential is posted publicly.

Return, Destruction, and Breach Reporting

Within 30 days of service completion, client data is securely deleted from production systems, credentials and access tokens are destroyed, and reports are archived in encrypted long-term storage for seven years for liability purposes. On request you can have data deleted earlier subject to legal retention, have copies returned, or receive certification of destruction. Deletion uses DoD 5220.22-M three-pass overwrite or cryptographic erasure. If a breach occurs, Cyberlord notifies within 24 hours of discovery, investigates immediately, and delivers a full incident report within seven days.

Term, Remedies, and Credentials

The agreement takes effect when the Service Agreement is executed, runs through the engagement, continues for five years after completion, and survives termination; trade secrets stay protected indefinitely while they qualify as trade secrets. A client may seek injunctive relief without posting bond and recover actual damages, profits gained from a breach, and legal costs. Cyberlord carries cyber liability and errors and omissions insurance covering this exposure, holds ISO 27001 and SOC 2 Type II, and commissions an annual third-party penetration test. Certificates are available on request.