DEFCON2TECH LLC
PUBLIC INFORMATION SECURITY POLICY

Version: 1.0
Effective date: September 4, 2026
Owner: DEFCON2TECH LLC
Review cycle: At least annually and following material changes to services or security practices

1. PURPOSE AND SCOPE

DEFCON2TECH LLC is committed to protecting information entrusted to it by prospective
and current clients. This policy summarizes the high-level safeguards used for the
public website, client communications, and consulting services. It is intended for
clients, partners, and other external stakeholders. Internal procedures and technical
configuration details are not published.

2. SECURITY APPROACH

DEFCON2TECH applies a risk-based approach to information security. Safeguards are
selected and maintained in light of the nature of the information, the requested
service, and reasonably foreseeable threats. The program is informed by widely used
security practices, including the Identify, Protect, Detect, Respond, and Recover
functions of the NIST Cybersecurity Framework. This statement does not claim
certification or formal conformity with a particular framework.

3. CURRENT WEBSITE SAFEGUARDS

The public website is served over HTTPS. Its contact form:

* accepts only a name, email address, selected service, and message;
* validates submitted data on the server;
* uses self-hosted ALTCHA challenge verification and rate limiting to deter automated
  abuse; and
* relays accepted inquiries through authenticated TLS SMTP to the designated mailbox.

The public static website and the private contact-form service are separated. The
contact-form service is not directly exposed to the Internet.

4. CLIENT INFORMATION

DEFCON2TECH limits access to client information to the extent needed to provide
requested services and manage the business relationship. Sensitive communications can
be arranged using the secure-communications information published at
https://dc2tech.com/#verify. Clients should not send passwords, private keys, or other
highly sensitive information through the public contact form.

5. INCIDENTS AND CONTINUOUS IMPROVEMENT

Suspected security events affecting DEFCON2TECH systems are assessed and addressed
according to their impact. Where an event is determined to affect a client, relevant
communications will be handled in accordance with contractual obligations and
applicable law. Security practices are reviewed as the business and its services
evolve.

6. REPORTING A SECURITY ISSUE

To report a potential vulnerability in a DEFCON2TECH public system, use
security@dc2tech.com and follow the Responsible Disclosure Policy available at
https://dc2tech.com/documents/responsible-disclosure-policy.txt.

7. CONTACT

For general questions about this policy or DEFCON2TECH services, contact
sites@dc2tech.com.