Frequently asked questions

Our team sits in Jakarta and we work with clients across Indonesia. Most of the work is done remotely, and we arrange on-site presence when an engagement actually needs it.

Bahasa Indonesia and English. Reports, workshops, and the day-to-day back and forth can run in either one. That tends to matter when your board reads in Indonesian but your technical teams or head office work in English, and you need both to follow the same report.

Mostly the regulated and higher-risk sectors in Indonesia: financial services, government, healthcare, telecommunications, manufacturing, energy, and critical infrastructure. Our service and industry pages cover each one in more detail.

It comes out of the discovery call and a questionnaire we tailor to the service. For a penetration test that means the number of applications and your IP ranges. For a compliance engagement it means your data flows and the systems in scope. Either way you get a fixed scope, a timeline, and a price before anything starts.

Yes. We sign a mutual non-disclosure agreement before any engagement begins, and we treat every finding and report as confidential.

Both. Most testing and advisory work is remote, run from our Jakarta team. On-site work, like an OT assessment at a facility, gets built into the scope when it is needed.

Both are on the table. A lot of engagements, like a penetration test or an assessment, are fixed-scope projects. Ongoing work such as managed security or advisory support usually runs on a retainer. We will tell you which model fits the work rather than push you toward one.

It mostly comes down to scope and depth. How many systems or applications are in scope, how far the testing or assessment goes, whether anyone needs to be on-site, and what the reporting and retest requirements are. We spell all of that out in the proposal so you can see what is driving the number.

Yes. We help financial institutions and other regulated entities check their security posture against the rules that apply to them, close the gaps, and put together the evidence an auditor is going to ask for. Our compliance and GRC service covers this.

Yes. Our reports lead with an executive summary in plain language and map each finding back to the relevant regulation, so your compliance owners and the regulator can read them without translating between documents to work out what applies.

You do. The report and everything in it belong to your organisation, and we keep the contents confidential.

We plan the testing windows with you, and where it is safer we test against staging instead of production. Anything that could be intrusive is agreed in writing before it runs, so your production systems are not caught off guard.