Security & Data Handling

• Product: Arctic Fox Labs Active Directory Security Assessment Pilot v1.0.0 RC3
• Collector: v0.8.1
• JSON Schema: v0.8.0
• Reporting Engine: v0.9.4
• Assessment rules: 12
• Laboratory QA: passed
• General production release: not approved
• Unrestricted public distribution: not approved

• Collection takes place only with customer authorization.
• The collector is designed to perform read-only Active Directory operations.
• Collection and report generation run locally in the customer's environment.
• Reports are produced in HTML and JSON, with optional PDF.
• There is no automatic upload and no cloud-based assessment processing.
• There is no automatic remediation; no changes are made to the directory.
• Arctic Fox Labs does not require direct administrative access to the customer's Active Directory for this model.

Explicit authorization is required for the agreed collection scope and for any supported collection operations outside the agreed SearchBase.

Written scope and authorization will be mandatory before any future customer engagement begins. This describes a requirement, not a completed process or signed agreement.

Findings are assessment indicators. They require technical validation and review in the context of the customer's business before any remediation. For example, a potential DCSync permission grant is not the same as proven, effective replication privileges.

The assessment does not perform complete effective-permission analysis.

• The pilot has not undergone independent penetration testing.
• The pilot has not received independent security certification.
• We do not guarantee the absence of vulnerabilities.
• We do not guarantee regulatory compliance.
• The pilot is not production-ready beyond its verified laboratory QA.

Assessment data and reports may contain sensitive identity and infrastructure information and should be protected accordingly.

Any transfer of assessment data to Arctic Fox Labs must be separately authorized by the customer and use an agreed secure process. The transfer method, retention schedule, deletion procedure, and contractual data-handling terms have not yet been approved. Owner review

• Do not submit passwords, hashes, Kerberos tickets, keys, or other credentials through the contact form.
• Do not send Active Directory exports, assessment reports, or other assessment files through the contact form or by unagreed email.

This website does not accept assessment file uploads.

The Request a Guided Assessment form uses server-side validation, rate limiting, and spam protection, and is transmitted over HTTPS. Submissions are delivered by email to an Arctic Fox Labs business mailbox. See our Privacy Policy.

To report a security concern about this website, email admin@arcticfoxlabs.io.