Terms of Service & Rules of Engagement

1. Authorization and safe harbor

Before testing begins, the client and Secatix agree in writing on the systems, domains, IP addresses, APIs and cloud resources in scope. The client confirms it owns those assets or has written authority from their owner to authorize testing. Testing within the agreed scope and Rules of Engagement is authorized by the client. No testing begins until the scope and authorization are documented.

2. Rules of Engagement

Each engagement follows the scope, schedule, contacts and constraints approved in writing by both parties. Unless specifically authorized in writing, Secatix will not perform denial-of-service testing, intentional data destruction, or mass credential brute forcing.

• Operational safety: If testing appears to degrade a system or disrupt a business process, active testing stops and the client contact is notified.
• Sensitive data: If testing reveals access to production customer records or credentials, further access is minimized, evidence is limited to what is needed to validate the finding, and the client is notified promptly.
• Scope changes: New targets or testing methods require written approval before work begins on them.

3. Confidentiality and deliverables

Client information, findings, evidence, reproduction steps and reports are treated as confidential and shared only with people who need them to deliver or receive the engagement. Secatix uses access controls and encrypted storage for engagement materials and handles their retention and disposal in line with its data-handling practices and any written agreement with the client.

4. Retesting

Where included in the approved proposal, one retest of reported findings is available within 30 calendar days after the initial report is delivered. Retesting verifies remediation of the previously reported issues and does not constitute a new assessment of changed or additional scope.

5. Scope, proposals and pricing

Quotes are based on the scope information provided and approved. If the target inventory, access model or requested testing changes, Secatix will explain any impact to price or timeline and obtain written approval before performing additional work. No additional fee is charged without client approval.

6. Assessment limitations

A penetration test is a point-in-time assessment of the agreed scope using the access, time and methods described in the proposal. It cannot identify every vulnerability or guarantee that a system is free from security issues. Findings and recommendations are based on evidence collected during the engagement.

7. Contact and governing agreement

These terms supplement the signed Statement of Work and any other written agreement between the client and Secatix. If terms conflict, the signed agreement controls. Questions about these Terms or a proposed engagement can be sent to hello@secatix.com.