Services
We test your applications, APIs and AI systems the way an attacker would, then hand you findings your team can fix.
Book a timeHead of Security
Head of Security
Jacob Roy founded SignalOrange in 2022 in Montreal. He has 10 years of experience in enterprise solution architecture and software development. He leads the SignalOrange Red Team and approves the scope of every engagement before the first test.
The function
The SignalOrange Red Team is SignalOrange's offensive testing function. It is part of the Product Security team.
Services
We look for what makes a model or an agent go wrong: direct prompt injection or injection hidden in a document, data leaking through answers or logs, and abuse of the tools and MCP servers the agent can reach.
Authentication, access control, tenant isolation, injection and business logic, tested against your applications and APIs.
A picture of your practices and configuration, with a list of fixes ranked by priority.
We read your source code to find flaws: input validation, secrets handling, vulnerable dependencies, access control.
We trace where the personal information your systems handle goes, including what is sent to AI APIs, and check the security measures Law 25 asks of you.
Frameworks
Our tests and reports follow these public frameworks.
Rules of engagement
It lists the systems in scope, the window of dates and hours, and the techniques allowed. The client signs it and the Head of Security approves it before the first test.
It is signed before work begins.
Findings go to the system owner within 10 business days.
Once you have fixed them, we test again to confirm each flaw is closed.
Responsible disclosure
If you find a vulnerability in a SignalOrange site or product, write to us with the steps to reproduce it and the impact you saw: [email protected]
Do not exploit the flaw beyond what it takes to show it, and do not make it public before we have fixed it.
Tell us about your systems and what worries you. We will come back with a proposed scope.
Contact us