Signed declaration
The domain owner signs the scope: domains, roles, window and prohibitions.
home / security
security
The security rules of our tests: before, during and after.
The controls do not depend on the goodwill of the model. They depend on technical rules and signatures.
before testing
Authorisation and verification, without exceptions.
DNS check
A domain that is not verified receives no request.
during testing
The scope is a technical limit, not a promise.
Locked scope
Requests reach only the hosts of the verified scope.
Closed list of actions
The executor does not generate free commands.
Log of every action
Every request and response is recorded. The log is a chain.
Emergency stop
One command halts active tests and closes connections.
Text is not instruction
Content from the tested system is treated as data.
Data kept to a minimum
Encrypted credentials, used only for the scope, deleted at the end.
after testing
Reports and data follow clear rules.
What we keep
- The report delivered to the client
- The log, for the agreed period
- The evidence needed to reproduce a vulnerability
What we do not do
- We do not share results with third parties
- We do not use one client's data for other clients
- We do not keep data beyond the agreed period
Stated limits. We do not test third-party systems without authorisation. We do not carry out social engineering, physical attacks or denial of service. We do not access real end-user data beyond what is needed to demonstrate a vulnerability, and we report it at once.