For procurement teams
Everything a vendor review usually asks for, in one place. If your team uses its own security questionnaire, send it to ryan@ghosts.lk and we will complete it.
Company details
- Registered name
- Ghost Protocol (Private) Limited
- Company number
- PV00305227
- Incorporated
- 18 July 2024
- Based in
- Colombo, Sri Lanka
- Working hours
- Monday to Friday, 09:00 to 18:00 Colombo time (UTC+5:30)
- Contact
- Ryan Sebastian, founderryan@ghosts.lk+94 71 055 5055
- Reply time
- We reply within 24 hours.
Documents for your vendor file
The example report downloads here. Anything marked on request opens an email to us with the document already named in the subject line.
Example penetration test report
A complete report from a test of a fictional company, in the format a client receives: each finding with its evidence, severity, reproduction steps and fix.
Download PDF182 KBSample attestation letter
The short signed letter that says who tested what, when, by which method, and the outcome. It is the document you can pass to an auditor or a customer. A signed one is issued for each completed test.
Engagement letter
The agreement we sign before a test starts: scope, price, dates and responsibilities.
Mutual NDA
A two-way confidentiality agreement, signed before either side shares anything sensitive.
Rules of engagement
What both sides agree for the testing window: the systems in scope, when we test, and who to call if something needs to stop.
Data handling and retention
How we store test data and findings during an engagement, and how we destroy them after it.
Company profile
Who we are, what we do and how we work, in a few pages.
How an engagement works
One page on the steps from the first call to the re-test.
Certificate of incorporation
Issued on 18 July 2024. Sent as a copy on request; it is not published here.
What you can check, and what you can send us
Vulnerability disclosure policy
How to report a security problem in our own systems and what we commit to in return. The machine-readable contact is at /.well-known/security.txt.
Privacy notice
What this website collects, where it is processed, how long it is kept, and the rights you have.
Accessibility statement
The standard this website aims for, how we check it, and what is not right yet.
Your security questionnaire
Send it in whatever format your team uses and we will complete it.
How we invoice and get paid
- Invoices are issued by Ghost Protocol (Private) Limited, Company No. PV00305227.
- Purchase orders accepted.
- Invoices in US dollars, or in Sri Lankan rupees for companies registered in Sri Lanka, at the local rate card.
- Bank transfer. Rupee invoices are due within 14 days and exclude applicable taxes.
- Card payment through Stripe for the fixed-price services on the pricing page.