Authorized use

Assessments are performed only:

1. 01

   With customer authorization

   Preliminary scans require the submitter’s confirmation that they are authorized to request an assessment of the named organization or that only lawful public sources will be used. Extended reports and white-box engagements require written authorization (and a statement of work where applicable) from the customer or another lawful authorizing party.

2. 02

   Against customer-owned systems or lawful public sources

   Outside-in work uses lawful public information—not unauthorized private access. White-box and internal testing target systems, corpora, and endpoints the customer owns or is otherwise authorized to have tested. We do not accept unsolicited confidential uploads through open public forms.

3. 03

   Within an agreed scope

   Domains, organizations, source categories, systems in scope, success criteria, and out-of-scope activity are agreed before deep work. Preliminary requests collect “what we should examine” to guide a limited public review—not an unbounded hunt.

4. 04

   With documented retention and deletion rules

   Marketing contact fields, public-source working sets, customer confidential materials, and generated findings are retained and deleted under rules described in our privacy policy and, for paid work, in the engagement SOW. Customer confidential data is not kept indefinitely “just in case.”