Compliance Statement

1. Ethical hacking and authorised testing

BVORTENIC TECHNOLOGIES operates strictly within the bounds of ethical and authorised cyber security practice. We do not perform offensive security operations without:

• Explicit written authorisation from the system owner
• A clearly defined and agreed scope of engagement
• Signed legal documentation protecting both parties

All engagements follow internationally recognised frameworks including OWASP, the Penetration Testing Execution Standard (PTES) and NIST SP 800 115.

2. Applicable laws and regulations

Our operations are conducted in compliance with:

• The Electronic and Postal Communications Act (EPOCA), Tanzania, governing lawful use of electronic systems
• The Cybercrime Act, 2015 (Tanzania), ensuring all activity stays within legal boundaries
• General data protection principles, aligned with GDPR best practice where applicable to international clients
• Computer misuse and cybercrime laws, with no unauthorised access, interception or modification of systems

3. Data handling compliance

We are committed to responsible data handling:

• Client data is used only for the agreed scope of engagement
• Sensitive data accessed during assessments is handled under strict non disclosure obligations
• When a project ends, client data and credentials are securely deleted unless retention is expressly agreed
• We keep internal data handling logs for accountability

4. Professional standards

Our team upholds the following standards:

• Continuous professional development in cyber security disciplines
• Adherence to codes of ethics from international bodies such as (ISC)² and EC Council
• Zero tolerance for using skills, tools or access for malicious, unauthorised or personal gain

5. Vulnerability disclosure policy

If BVORTENIC TECHNOLOGIES discovers a vulnerability outside an authorised engagement, we follow responsible disclosure:

• Document findings without exploiting them further
• Notify the affected organisation privately and in good faith
• Allow a reasonable remediation window, typically 90 days, before any public disclosure
• Coordinate with national cyber security authorities if the risk is critical

6. Fair practice

BVORTENIC TECHNOLOGIES does not discriminate against clients or partners on the basis of race, gender, nationality, religion or political affiliation. Services are offered on technical merit and ethical alignment only.

7. Reporting violations

If you believe BVORTENIC TECHNOLOGIES or a team member has acted against these standards, report it immediately:

• Email: info@bvortenic.co.tz
• Subject line: Compliance concern and a brief description

All reports are investigated promptly and treated with full confidentiality.