Trust & Security
Last updated: 13 September 2026Contacting us securely
BlackSword Technologies is a cybersecurity company working with government and defence organizations. We expect to be reached the way we would ask any organization to be reached: over authenticated email, and encrypted where the content is sensitive.
| Channel | Purpose | Encryption |
|---|---|---|
| security@blacksword.ae | Security reports, coordination, incident contact | PGP required |
| research@blacksword.ae | Vulnerability research submissions | PGP for technical detail |
| info@blacksword.ae | General and commercial enquiries | Not required |
| abuse@blacksword.ae | Reports of abuse originating from our infrastructure | Not required |
Do not send live exploit code, credentials, personal data, or information obtained through unauthorized access through any initial channel.
PGP key
Encrypt sensitive material to our organisation key. Verify the fingerprint out-of-band before you use it — a fingerprint published on the same website as the key is a convenience, not proof.
To verify the key you downloaded:
gpg --show-keys --with-fingerprint blacksword-public.asc
Compare the fingerprint against the one published here and in our security.txt. If they differ, stop and contact us through a second channel before sending anything.
Authenticated email
Mail claiming to come from our domain is authenticated. We publish SPF, DKIM, and a strict DMARC policy for our sending domains, so a message that fails authentication can be identified and rejected rather than trusted. This matters most where a message asks you to send research, follow a link, or act on instructions.
- SPF restricts which hosts may send for our domain.
- DKIM signs every outbound message so tampering in transit is detectable.
- DMARC ties the two together and tells receivers what to do when they fail.
If a message appears to come from us and fails authentication, treat it as hostile. Our published security.txt records the canonical contact channels.
Verifying signed communication
Where we sign a message or document, the signature is made with the same organisation key. Verification is local and does not require trusting anything we serve:
gpg --verify message.asc
Vulnerability disclosure policy
We welcome good-faith reports about the security of our own website, services, and infrastructure.
- In scope: this website and its associated infrastructure; any service we operate under our own domain.
- Out of scope: denial-of-service testing, physical intrusion, social engineering of our staff or suppliers, and any third-party product or service we happen to use.
- How to report: email security@blacksword.ae, encrypted to our PGP key. Include the affected address, a description of the issue, reproduction steps, and the potential impact.
- Safe harbour: we will not pursue or support legal action against researchers who act in good faith under this policy — staying in scope, not accessing or altering data beyond what is needed to demonstrate the issue, not degrading services, and giving us reasonable time to remediate before public disclosure.
- Our commitments: we acknowledge reports promptly, keep you informed while we investigate, and credit you where you wish to be credited.
You are responsible for complying with the laws that apply to you. Nothing in this policy authorizes testing against third parties or against systems you do not have permission to test.
How submitted research is handled
- Submissions are treated as confidential from the moment of receipt.
- Access is limited to those involved in review, under confidentiality obligations.
- Initial submissions are limited to a high-level description; we ask for technical material only after review, and only through a channel we designate.
- Engagements proceed only on documented authorization, with provenance verified and end use recorded.
- We do not accept material obtained through unauthorized access, and we decline research with unlawful provenance.
Compliance and jurisdiction
BlackSword Technologies operates from the United Arab Emirates. Engagements are subject to applicable laws, contractual requirements, export controls, and responsible security practices, and are governed by the laws of the United Arab Emirates unless otherwise agreed in writing. See Legal & Compliance and our Privacy Notice.
Machine-readable contacts
Our security contact, encryption key, and disclosure policy are published in machine-readable form at /.well-known/security.txt in the format described by RFC 9116.