Terms of Service
Master terms for VAPT and security assessment services.
Scope and Authorization
Client warrants ownership/control of in-scope assets and grants written authorization to perform agreed testing. Certain activities (e.g., DoS, phishing, destructive testing) are prohibited unless explicitly approved in the Statement of Work.
Rules of Engagement
- Defined assets, windows, rate limits, and emergency stop contacts
- Secure credential provision and deprovisioning post-engagement
- Third-party or multi-tenant components require separate approval
Deliverables and IP
Client owns findings and final reports. We retain rights to our tools, templates, methodologies, and know-how. Re-test windows may be provided as defined in the SOW.
Confidentiality and Trust Commitments
We treat your systems, data, and findings with the highest level of confidentiality. Our program is designed to give you confidence that sensitive information remains protected throughout the engagement.
- Mutual NDA executed prior to any exchange of sensitive information.
- Principle of least privilege and role-based access; test assets and evidence are accessible only to assigned personnel.
- Encryption in transit and at rest for reports and evidence; segregated repositories with access logging and periodic review.
- Dedicated secure channels for credentials and approvals; credentials are rotated or deprovisioned immediately after use.
- Transparency and auditability: upon request, we can provide an overview of our internal controls and change logs for engagement artifacts.
- Report sharing is limited to your authorized recipients; we do not publish, market, or disclose your results without written consent.
If you require additional assurances (e.g., dedicated storage location, custom retention rules, or on-prem artifact handling), we can accommodate these in the Statement of Work.
Data Protection
Each party shall comply with applicable privacy laws. Our privacy practices are described in the Privacy Policy. A DPA can be executed when required.