| ASSESSMENT | VERSION | PREPARED FOR | CLASSIFICATION |
|---|
| Initial vendor assessment | 1.0 | Security team, on request from the testing team | Internal, published as a sample |
|---|
This is a sample. It is based on a real assessment; the vendor, its documents and every detail that would identify it have been changed. The wording of the vendor's documents is paraphrased.
| VERDICT
Approved with conditions, for internal testing only.
The tool can be used on a dedicated, isolated machine with cloud sync switched off. Used any other way, the risk is higher than the benefit. |
|---|
Scope
| Item | Detail |
|---|
| Tool | A desktop application a client's testing team wanted to use |
|---|
| Intended use | Internal security testing by a small, named team |
|---|
| What was reviewed | The vendor's privacy notice, licence agreement and FAQ; the company register entry; independent reviews of the tool; public records of breaches, malware reports and regulatory action |
|---|
| What was not reviewed | The vendor's infrastructure and source code. The vendor publishes no audit report, so its technical claims could not be verified |
|---|
Summary by category
| Category | Level | Why | Ref. |
|---|
| Data the tool reads on the device | Medium | It works with passwords, cookies and browsing history on whatever machine it is installed on | F-01 |
|---|
| Independent verification | Medium | No certification or audit; the security claims rest on the vendor's word | F-02 |
|---|
| Liability under the licence | Medium | All legal responsibility for use sits with the customer | F-03 |
|---|
| Cloud sync | Medium | If switched on, local data goes to the vendor and stays after the subscription ends | F-04 |
|---|
| Company transparency | Low | Recently registered company, little public information about who builds the product | F-05 |
|---|
| Procurement record | Low | Non-standard payment method, no ordinary invoice trail | F-06 |
|---|
| Breach and incident record | Low | Nothing found in public sources | — |
|---|
No overall score is given. Each category is read on its own, and the verdict follows from the conditions below.
Where the data goes
| Data | Stays on the device | Sent to the vendor |
|---|
| Account email | — | At registration |
|---|
| Device and usage data | — | Yes, described by the vendor as anonymised |
|---|
| Saved passwords, cookies, browsing history | Yes, used by the tool locally | No |
|---|
| Payment details | — | No: a payment processor handles them, the vendor receives a confirmation only |
|---|
| Support messages and attachments | — | Only if you contact support |
|---|
| All local data above, if cloud sync is switched on | — | Yes, and kept after the subscription ends |
|---|
Findings
F-01 The tool reads sensitive data on the machine it runs on Medium
The issue. To do its job, the tool works with saved passwords, cookies, local storage and browsing history. The privacy notice lists all of them. The risk is not that the tool reads them, but that it reads them on whatever machine it is installed on, including one used for everyday work.
Required control. Install it only on a dedicated machine that holds no passwords, sessions or cookies from production systems and is not used for anything else.
Source: Privacy notice, section on the data the tool processes.
F-02 No certification and no independent audit Medium
The issue. The vendor publishes no ISO 27001 certificate, SOC 2 report, penetration test summary or any other independent check. Its FAQ calls the product "the most secure tool of its kind", which is a claim nobody has verified.
What weighs the other way. No breach, malware report or regulatory action involving the vendor was found in public sources, and independent reviews confirm that locally stored data is encrypted. That is the only security claim confirmed by someone other than the vendor.
Net view. The vendor's claims cannot be confirmed, and there is no evidence against them. On an isolated machine with cloud sync off, the remaining risk is low.
Source: The vendor's website and FAQ; public records of breaches, malware reports and regulatory action; two independent reviews.
F-03 All liability sits with the customer Medium
The issue. The licence agreement makes the customer solely responsible for how the tool is used and requires the customer to cover the vendor's legal costs in any related dispute. This is common for tools of this kind.
What it means. If anyone uses the tool outside the approved testing scope, the organisation carries the legal and financial consequences, not the vendor.
Required control. Access limited to named people, on an approved list, with the permitted use written down.
Source: Licence agreement, sections on liability and indemnification.
F-04 Cloud sync sends local data to the vendor Medium
The issue. With cloud sync on, everything in the table above, including passwords and session history, is uploaded to the vendor's servers.
What the vendor's documents disagree on. The licence agreement says synced data is kept for at least a year after the subscription ends. The privacy notice says six months. The longer period is treated as the one that applies.
Required control. Switch cloud sync off before the first launch, and check that it stays off. This is a condition of use.
Source: Licence agreement, section on data after termination; privacy notice, section on retention.
F-05 Little public information about the company Low
The issue. The company that sells the tool was registered recently, and public sources say little about who develops the product or where.
What it means. On its own this does not block use. Combined with F-04, it is the main reason cloud sync must stay off.
Source: Company register entry; the vendor's website.
F-06 Non-standard payment method Low
The issue. The vendor accepts payment only through a processor that does not produce an ordinary invoice trail.
Required control. Note the payment method in the procurement record and keep the processor's confirmation.
Source: The vendor's website, pricing and payment page.
What counts in the vendor's favour
| Observation | Source |
|---|
| Session data is stored locally by default | Privacy notice |
|---|
| Local data is encrypted at rest | Independent reviews |
|---|
| Cloud sync is optional and can be switched off | Privacy notice |
|---|
| The vendor is subject to a data protection authority and names it | Privacy notice |
|---|
| Transfers outside the country are covered by standard contractual clauses | Privacy notice |
|---|
| No breach, malware report or regulatory action found | Public sources |
|---|
| A refund period is offered | Licence agreement |
|---|
Conditions for use
| # | Condition | Priority | Owner |
|---|
| 1 | Runs only on a dedicated machine with no access to production systems | Mandatory | IT |
|---|
| 2 | That machine is on a network segment separated from production and the corporate network | Mandatory | IT |
|---|
| 3 | Cloud sync switched off before first launch, and checked to stay off | Mandatory | Testing team lead |
|---|
| 4 | No production passwords, sessions or cookies on that machine | Mandatory | Testing team lead |
|---|
| 5 | Access limited to named people, on an approved list | Mandatory | Testing team lead |
|---|
| 6 | Payment method noted in the procurement record, with the processor's confirmation kept | Required | Finance |
|---|
| 7 | Reviewed once a year: is the tool still needed, and has anything new been published about the vendor | Required | Security team |
|---|
Sources reviewed
The vendor's website, privacy notice, licence agreement and FAQ; the company register entry; two independent reviews of the tool; public records of breaches, malware reports and regulatory action; the list of EU adequacy decisions. In a client report, each source is listed with its full address.
