Independence policy

A team that assesses the security of a system it built has a conflict of interest: it can struggle to find its own mistakes and has an incentive not to report them. We therefore separate the two activities and put that separation in writing.

Banana Defense, our cybersecurity team, does not audit or certify systems that Banana Script has built, operates or maintains. When a client wants an assessment of a system we built, we recommend an independent third party and provide the documentation it needs.

This does not prevent us from testing security during development of our own projects. Those tests are part of building the system properly. They are not an independent audit, and we never present them as one.

Before any security test, we sign an agreement defining the scope, systems, dates, hours and contact people. We do not test anything outside the agreed scope.

In Colombia, accessing a system without authorization or beyond the agreed scope is a crime under Ley 1273 de 2009, artículo 269A. Our agreements are written to leave no doubt about what is authorized.

We request read-only access for our security and AI diagnostics. If a test needs additional permissions, we agree on them in writing, with a start and end date, and remove the access when the work is complete.

When we work with a client's personal data, we act as a data processor under Colombia's Ley 1581 de 2012 and the regulations applicable in each country.

When we recommend a tool or manufacturer with which we have a commercial partnership, we disclose that partnership before you decide.

Email info@bananascript.io. We review each case and respond in writing.