How we contract, what we sign, what we never do.

Partner posture

Huntress Secure Partner

Obsidian Ridge is a Huntress MDR Partner. That means we operate the Huntress Managed EDR, Managed ITDR, Managed Security Awareness Training, and Managed SIEM platforms end-to-end for covered organizations — deployment, alert triage, escalation handling, incident response coordination, and compliance evidence packaging. Huntress operates the 24/7 SOC behind the detection platforms; we add the practitioner program that turns the platform into an outcome.

Read the Huntress partner explainer →

Data residency

Where your data lives.

Application data (briefing requests, assessment responses, newsletter subscribers) is stored in the United States at Supabase (US East). Email delivery uses US-region Resend. The self-hosted RMM stack runs in Germany on Hetzner. Where a US-hosted sub-processor handles personal data of an EU or UK data subject, the EU / UK Standard Contractual Clauses are incorporated by reference through the relevant DPA. No client data is transferred to a jurisdiction without an approved transfer mechanism in place.

Vulnerability disclosure

Found a security issue? Tell us privately.

We publish an RFC 9116 security.txt at /.well-known/security.txt, and its Policy field points here. Send coordinated vulnerability reports to security@obsidianridge.io — encrypted over PGP on request. Please give us a reasonable chance to fix an issue before disclosing it publicly.

In scope: this website — obsidianridge.ioand its subdomains — and its forms and API endpoints.

Out of scope:any client environment or system we manage on a client's behalf; the third-party platforms we use as sub-processors (report those to the vendor — we'll help coordinate); denial-of-service or volumetric testing; physical attacks; and social engineering of the operator, clients, or vendors.

What to expect:we acknowledge a report within 2 business days, give an initial assessment within 5, keep you updated through resolution, and — with your permission — credit you once the issue is fixed.

Safe harbor: if you make a good-faith effort to follow this policy, we will treat your research as authorized, we will not pursue or support legal action against you for it, and we will work with you to resolve the issue quickly.

Obsidian Ridge is led by a CISSP-certified security practitioner with 10+ years of cybersecurity experience spanning the IDF, the Israeli Government Tax Authority as Production Technical Lead, Deloitte in Digital Forensics & Risk Analytics, Varonis as a Cyber Security Architect, Cypress Creek Renewables as a Cloud Security Analyst, and TEKRiSQ as Director of Security Solutions — currently leading Zero Trust Island Browser deployment for a Fortune 500 airline. Work spans individual protection, small business security, and enterprise environments.

CISSP • CCFH (CrowdStrike) • ZDTA (Zscaler) • CySA+ (CompTIA) • Security+ (CompTIA) • Network+ (CompTIA) • CC (ISC²)

Each credential is verifiable through its issuing body on request. The full bio, employment history, and engagement scope live on the About page.