Question 1

What cybersecurity services does Antbytelabs offer?

Accepted Answer

We offer penetration testing (web, mobile, API, network), security code reviews, vulnerability assessments, GDPR compliance consulting, ISO 27001 preparation, security architecture reviews, and emergency incident response.

Question 2

How often should we conduct security audits?

Accepted Answer

We recommend a comprehensive pentest annually and after any major release. High-risk apps (fintech, health, e-gov) should be tested every 6 months or continuously with automated scanning.

Question 3

What is the cost of a penetration test in Nepal?

Accepted Answer

A web application pentest starts from NPR 150,000. Network pentests and full red-team engagements are scoped individually. We provide a fixed-price quote after a free scoping call.

Question 4

Do you help achieve GDPR or ISO 27001 compliance?

Accepted Answer

Yes. We help implement the controls required for GDPR (data mapping, consent management, right-to-erasure) and guide the ISO 27001 ISMS framework — gap analysis, policy documentation, risk register, and audit preparation.

Question 5

What data protection law applies to a business in Nepal?

Accepted Answer

Mainly the Privacy Act, 2075 (2018), which recognises the right to keep personal data confidential, requires consent before collecting personal or family data, and limits use of that data to the purpose it was collected for. Around it sit the Electronic Transactions Act, 2063 (2008), which is the foundational cyber law and creates offences for unauthorised access and data interference, the Data Act, 2079 (2022), and privacy provisions in the National Penal Code, 2074 (2017). If you hold customer records in Nepal, consent and purpose limitation are the two obligations to design for first.

Question 6

Does Nepal require us to report a data breach?

Accepted Answer

No. Nepal currently has no mandatory breach notification rule, no dedicated data protection regulator, and no clear cross-border transfer regime, with penalties spread across several overlapping laws. That is a gap rather than a permission. It means the decision to tell affected customers is yours to make on the ethics and on the commercial risk, not one the law makes for you, and it means nobody is checking your security except you. Businesses handling payment or health data should write a disclosure policy before they need one, because deciding mid-incident goes badly.

Question 7

Do we need GDPR compliance if we are based in Nepal?

Accepted Answer

Only if you process personal data of people in the EU or UK, which applies to plenty of Nepali companies selling software, services or tourism abroad. Location of your servers does not decide it; location of your users does. If that is you, the work is data mapping, a lawful basis for each processing activity, consent handling, and a route to honour erasure and access requests. If all your users are in Nepal, the Privacy Act 2075 is the one that binds you and GDPR is not.

Question 8

What should we do if we suspect a security breach?

Accepted Answer

Call us, then preserve evidence: do not wipe or rebuild the affected machine, because the logs on it are how anyone works out what happened. Isolate it from the network instead. We help identify the attack vector, assess what data was exposed, remediate, and prepare a written report. We will give you a realistic start time when you call rather than advertise a response window we do not staff a night rota to meet.

Find Vulnerabilities Before Attackers Do

How We Work

Scoping & Rules of Engagement

Reconnaissance & Assessment

Exploitation & Validation

Report & Remediation Support

Built With Best-in-Class Tools

Testing Tools

SAST / DAST

Frameworks

Compliance

Is Your Business Actually Secure?