Binautopsy Labs operates as a confidential, evidence-led specialist lab. This page summarises the operational practices behind that promise.
1. Authorised engagements only
We perform only defensive, investigative, product-security, compliance-support, or resilience-oriented work. Authorisation is confirmed in writing before any analysis begins. Engagements without written authorisation do not proceed.
2. Confidentiality & NDA handling
Every engagement is governed by a mutual NDA. We do not disclose the existence of an engagement, the identity of the client, or the contents of any artefact except to the client or to parties named in the engagement scope.
3. Secure artefact submission
Sensitive artefacts travel only through approved channels:
- Single-use secure portal link — issued on confirmed scoping, expires in 72 hours
- PGP envelope — public key at /pgp/
- Hand delivery — by prior arrangement only
We do not accept artefacts attached to first-contact emails.
4. PGP & secure portal workflow
The PGP key (/pgp/) is used for sensitive correspondence and small advisory-only payloads. The secure portal link, issued post-scoping, is the canonical channel for binary, firmware, sample, memory, and log uploads. Portal links are single-use and expire automatically.
5. Evidence handling & chain of custody
Every artefact submission is recorded with an engagement reference, submitter identity, authorisation status, ingestion timestamp, cryptographic hash, storage location, analyst owner, and retention decision. Working copies are destroyed (NIST SP 800-88: cryptographic erase + degauss + physical shred) at engagement close unless retention is explicitly contracted.
6. Report confidence levels & limitations
Every finding separates observed evidence, technical inference, and speculation, with an explicit confidence level (high / medium / low) and a recommended action (patch, mitigate, isolate, escalate, or no action). Limitations are stated on the cover page. Findings are not asserted beyond the artefacts, access, and scope available during the engagement.
7. Responsible disclosure
Vulnerabilities affecting binautopsy.com or any Binautopsy-operated infrastructure can be reported under our responsible disclosure policy. Reports about third-party code we have analysed should go to the affected vendor first.
8. Privacy & minimal tracking
This website uses no analytics, no marketing trackers, and no third-party tags. The only data we collect through the public site is what you submit through the contact form. See privacy for the full data flow.
9. Legal entity & jurisdiction
Binautopsy Labs operates from a privacy-conscious European jurisdiction (Andorra). Registration details are on the imprint page. Engagement-level liability is set in the per-engagement statement of work.
10. Emergency intake expectations
Emergency intake is monitored continuously. Priority response is reserved for retained clients and active incident requests. Acknowledgement target: same business day. Analysis begins after authorisation, conflict check, and scope confirmation.
Binautopsy Labs is an independent security research agency and is not affiliated with The Sleuth Kit, Autopsy, or Sleuth Kit Labs.