How an engagement works
Security testing only makes sense when it is controlled. Here is exactly what happens, from the first call to the final report, and what protects both of us.
STEP 1
Free introduction call
About 45 minutes. You explain what you run and what worries you. We ask questions and tell you honestly whether we can help, and which service fits.
STEP 2
Written scope and quote
You receive a short document: what will be tested, what will not, the test type, the time window, the contacts on both sides, the deliverables, the price and the timeline. Nothing starts before you approve it.
STEP 3
Signed authorisation and rules of engagement
Someone with authority over the systems signs the permission to test, electronically: you receive a private link, confirm your email with a one-time code, and sign. Every step is recorded in a tamper-evident log, and anyone with the document reference can check it on our verification page. We agree the rules: the testing window, the source addresses we will use, an emergency contact, and the conditions that make us stop. If you use a hosting or cloud provider, we check whether it needs to be told or its rules allow the test.
STEP 4
Testing
We test manually and with tools, only inside the scope. We avoid destructive actions. If we find something critical, we tell you right away instead of waiting for the report.
STEP 5
Report
A written report with a plain-language summary, then each finding with severity, evidence, impact and how to fix it. You can see what one looks like in the sample report.
STEP 6
Debrief call
We walk through the findings with you and your technical team and answer questions, so the report leads to action.
STEP 7
Fix and retest
Your team fixes the issues. We check the fixes and update the report. Our standard quote includes one retest of the reported findings.
STEP 8
Close-out
Final report delivered. Test data, credentials and evidence are handled and deleted as agreed in the scope. A confidentiality agreement is available on request.
Documents are signed electronically. Already signed one? Check a signed document.
What we will always do
- Test only with written authorisation, and only the systems named in the scope.
- Keep your information confidential and use it only for your engagement.
- Tell you straight away about critical issues.
- Explain every finding in plain language, with a fix.
- Say clearly when something is outside what we offer.
What we will not do
- Test anything without signed permission from someone who controls the system.
- Test systems that are not in the scope, even if we notice them.
- Run denial-of-service, social engineering or physical tests unless you agree in writing.
- Keep your data after the agreed retention period.
- Certify compliance or issue audit opinions.
Why written authorisation matters
Accessing a system without permission can be a crime, even with good intentions. The signed authorisation protects you, because it proves the test was requested, and it protects us, because it defines exactly what we are allowed to do. It also helps if your hosting provider or security team asks who is generating the traffic.
What the rules of engagement cover
- Systems, addresses and accounts in scope, and what is excluded
- Dates, times and the testing window
- Source addresses of our traffic
- Emergency contacts and the conditions to pause or stop
- How findings and evidence are shared and stored
What we need from you
A decision-maker
Someone who can approve the scope and sign the authorisation.
A technical contact
A person we can reach during the test window if something looks wrong.
Access and time
Test accounts, a staging environment if possible, and time for the debrief.
Found a security problem on our own website or systems? See responsible disclosure.