Testingauthorisation

Effective 2 November 2026. Last updated 2 November 2026.

When testing may start

ScnFix Pentest tests only after all of the following have happened for that project:

1. A person at ScnFix has reviewed the request and issued a quotation.
2. You have accepted that quotation.
3. Staff have prepared rules of engagement that name the targets, environment, methods, window, exclusions, emergency contacts, and stop procedure.
4. You have signed that version in your customer account.
5. ScnFix staff have approved the signed version. The system never auto-approves.

Paying an invoice, if one is issued off this site, does not start a test. Automated scanner jobs, when used, can be queued only after those permissions are in place.

Your authority

You must own the targets or have written authority to permit the test. You must be able to show that permission if we ask. Do not name a customer’s production system, a third-party SaaS console, or shared infrastructure unless that owner has agreed in writing and it is listed in the rules.

The statement stored when you sign is:

I confirm that I am authorised to approve testing of the targets named in this version. The organisation owns those targets or has written authority to permit this test. Testing starts only after ScnFix staff approve this signed document. Only the named domains, applications, APIs, environments, methods, and window are in scope. Destructive testing, denial of service, social engineering, and testing of third-party infrastructure stay out unless this document expressly allows them.

What must be listed

Each version of the rules names:

• domains, subdomains, IP addresses, applications, and API endpoints in scope;
• the environment (staging, production, or both);
• permitted methods and activities, and what is excluded or prohibited;
• the testing start and end dates, time windows, and rate limits;
• emergency contacts and the stop-testing procedure;
• whether disruptive testing is allowed (default: no).

Hosts, applications, and APIs that are not listed are out of scope. Redirects off the allowlist are not followed into a test.

What stays out unless the rules say otherwise

• destructive testing;
• denial-of-service testing;
• social engineering;
• testing of third-party infrastructure that is not named;
• work outside the agreed window or above the agreed rate limits.

Stop-testing and emergencies

Each signed version includes emergency contacts and a stop procedure. If you need testing paused, use that procedure and the contacts on the document. Staff can also withdraw or expire a version. You can withdraw a signed or approved version in the product where that action is offered; testing on that version then stops.

Evidence and confidentiality

Evidence and scanner output are stored privately. Customers receive reviewed findings and released reports, not raw scanner logs. Reports are confidential to the named organisation. See the Privacy policy and Terms of service.

How you sign

When a version is waiting, it appears under Authorisation in your customer account. You review the named scope, confirm the statement above, and sign. A person at ScnFix then approves or asks for a revision. You can download the signed rules after signature.