Security and privacy

How your account is protected

• Every account must use two-step verification with an authenticator app.
• You are signed out after 30 minutes of inactivity.
• You can see your active sessions, recent sign-ins and security activity in Settings, Security, and sign out other sessions from there.

See Security settings.

Your data

• You can export your data as JSON, and your exercise history as CSV, from Settings, Security.
• You can permanently delete your account from the same tab.

How we handle personal data is set out in our legal documents:

• Privacy Policy 
• Terms of Service 
• Data Processing Agreement 

What to put in an exercise

Exercises use a fictional organisation and invented people. When you write a custom scenario, describe your systems and suppliers in general terms. Do not enter passwords, secrets or personal data about real people.

Report a security issue

If you think you have found a security issue in Adversary X, email security@adversary-x.com. Our security contact details are also published at adversary-x.com/.well-known/security.txt .

If you think someone else has used your account, email support@adversary-x.com straight away.