Draft for legal review
Parties
“You” means the organisation requesting an assessment and the person submitting that request. “ScnFix Pentest” means the operator of this service. [Owner to confirm: the legal entity name and address.]
The service
ScnFix Pentest is a human-led test of the web application and API named in an accepted quotation and in signed rules of engagement. The public website is a way to request that work. Submitting the form does not start a test. Paying an invoice does not start a test. Testing starts only after written authorisation of the scope.
Your authority
You confirm that you have authority to request testing of every target you name. You are responsible for the accuracy of the scope and for any test accounts you later provide. Do not send production secrets on the public form or by ordinary email.
Scope
The rules of engagement name included targets, excluded targets, the environment, the roles, the window, and the activities that are not allowed. Systems that are not named are not part of the test. Denial-of-service and destructive testing stay out unless a later written change says otherwise.
Findings and the report
You receive findings a reviewer has released, and a report that states methods, limitations, and dates. A raw automated alert is not, by itself, a confirmed finding. The report is not a certification, an attestation of compliance, or a statement that the application has no vulnerabilities. The downloadable sample report is fictional and is not a customer engagement.
Fees
Fees, currency, tax, and payment timing are the amounts on the quotation you accept. This website does not collect card payments. [Owner to confirm: deposit, late payment, and cancellation terms.]
Accounts
Customer and researcher accounts use a password. After an authenticator is enrolled, later sign-in requires that authenticator or a one-time recovery code. A code is not required before enrolment. Recovery codes are shown once and are not emailed.
Limitation
Security testing reduces uncertainty. It does not remove it. This draft does not set a monetary cap, a governing law, or a venue. [Owner and counsel to confirm those terms.] Do not read this page as limiting or creating liability.
Changes
A final version will replace this draft before customers are asked to accept terms. Until then, an engagement proceeds on the quotation and the rules of engagement for that project, not on this page.