SA-APEX · governance
Policies, in plain language.
A certification is a trust instrument. If the rules that govern it are vague, the credential is worth less — to the holder and to the employer reading it. This page summarises every policy that applies to a candidate, and it is versioned so you can see what you agreed to.
- Program version 1.0.0-pilot
- Versioned policy acceptance
- Independent appeals
- Published retention
Code of ethics
What holding this credential commits you to.
- Included:You test only what you are authorized to test, in writing, within the agreed scope and window.
- Included:You do not use client data, code, credentials or findings outside the engagement that produced them.
- Included:You do not present unverified output — from a model, a scanner or a colleague — as a proven finding.
- Included:You disclose limitations, coverage gaps and residual uncertainty rather than letting a clean report imply completeness.
- Included:You handle vulnerabilities discovered in third-party software through coordinated disclosure.
- Included:You remain personally accountable for every claim in a report carrying your name, whatever produced the first draft.
- Included:You do not misrepresent the credential — course completion, exam eligibility and certification are three different things and you say which one you hold.
Enforcement
A credential can be suspended or revoked for a breach of this code. Verification reflects the change immediately and publicly, because a registry that lags behind reality is worse than no registry. Every status change carries a stated reason and an audit record.
Exam
Rules, identity and integrity.
| Area | Policy |
|---|---|
| Authorized resources | Documentation, your own prior tooling, and the examination AI gateway as each phase permits. External network and model calls are blocked unless the phase provides them. |
| Identity | Verified at session start. Multi-factor authentication is required, and the oral defense is conducted live. |
| Proctoring | A controlled remote environment plus the oral defense. Recording scope, consent and retention are covered by the candidate agreement and are under privacy review before enrollment opens. |
| Integrity events | Recorded by the platform and reviewed by a proctor. A proctor cannot unilaterally change a score. |
| Answer sharing | Ends the attempt and, where the conduct warrants it, results in an exclusion from future attempts. Exam forms are rotated and per-candidate instances are seeded so shared answers do not transfer. |
| Accommodations | Requested during application and assessed against documented need. Accommodation status is never visible to graders. Contact apex@securityarsenal.com. |
Scoring, retest and appeal
You can challenge a decision, and it is heard by someone else.
| Stage | How it works |
|---|---|
| Grading | Submissions are anonymised. Graders see a candidate handle rather than a name or an employer — this matters because the program is open to people who work for firms that compete with us. |
| Replay | Selected critical and high findings are independently reproduced from signed artifacts before a decision is finalised. |
| Standard setting | Pass standards are set by a panel and versioned per exam form, not adjusted to hit a pass rate. |
| Result | Pass, fail, or a limited retest addressing specific phases, with the reasoning given. |
| Retest | Scoped to what was not met. A candidate who cleared the manual gate and the build does not repeat them for a reporting failure. |
| Appeal | Heard by a panel independent of the original decision wherever practical, with access to the evidence record. Score changes require a reason, an authorization and an immutable audit row. |
| Invalidation | If an exam form is compromised, affected sessions are identified and the program contacts every candidate concerned. Nobody is quietly re-graded. |
Pass rate is not a target
A low pass rate may mean appropriate rigour, inadequate prerequisites, poor instruction, unreliable challenges or unfair assessment. We interpret it alongside validity, reliability and fairness evidence — and we do not tune the exam to produce a number that looks good in marketing.
Credential lifecycle
Issue, renew, suspend, revoke.
| Event | What it means |
|---|---|
| Issued | A verifiable credential with a public identifier, an issue date and an expiry. Recommended initial term: 3 years, pending governance sign-off. |
| Active | Current and in good standing. This is what verification shows. |
| Expired | The term ended without renewal. Expiry is derived at verification time, so a lapsed credential never displays as active because a job did not run. |
| Suspended | Temporarily withdrawn pending an investigation or an unmet condition. Reversible. |
| Revoked | Permanently withdrawn. Reserved for integrity breaches and ethics violations. |
| Renewal | Current practice, continuing development in both AI and offensive security, an ethics attestation, and a practical delta assessment. Model and vendor trivia is not the basis of renewal — safe architecture, evidence discipline and novel security reasoning are. |
Anyone can check a credential at /verify. The public record shows the credential, its status and its dates — and the holder’s name only where the holder consented to publish it.
Your data
What we collect, why, and when it goes.
| Data | Purpose | Retention |
|---|---|---|
| Eligibility self-check answers | None — scoring runs in your browser. | Never transmitted, never stored. Only the derived summary is stored, and only if you choose to attach it to an application. |
| Application evidence | Eligibility review. | 24 months from submission, then deleted. The deadline is set when the application is created, not decided afterwards. |
| Identity verification | Exam integrity. | Held only as long as the exam integrity and appeal window requires. |
| Exam artifacts and AI traces | Scoring, replay and appeals. | Retained to the published exam retention schedule, then destroyed with a recorded deletion event. |
| Credential record | The public trust registry. | Retained for the life of the credential and its verification history. |
| Audit events | Accountability for decisions affecting you. | Append-only. Never edited, never deleted. |
Redacted work samples are fine
Many candidates are contractually barred from sharing client artifacts. Structured attestations and redacted samples are accepted, and an application is never penalised for honouring a confidentiality obligation. Sending us something you are not allowed to send us is, by itself, a reason to decline.
Independence
What we do not claim.
- Note:No accreditation claim. The program is designed with ISO/IEC 17024 alignment in mind, and we will not assert conformity until it is formally established.
- Note:No endorsement by, or affiliation with, any other certification body, standards organisation or vendor. Where we recognise another credential, that is our own admissions decision and confers nothing on their behalf.
- Note:No guaranteed outcome. We do not promise a pass, a job, a salary band, or that every holder will find real-world zero-days.
- Note:No published pass thresholds, exam durations, prices or launch dates until pilot evidence supports them.
Policy questions, accommodation requests, complaints and appeals: apex@securityarsenal.com. Program version 1.0.0-pilot. Candidates record the version they accepted, and a later edit does not change what applied to them.