Authorized Testing Policy

1. The Core Authorization Principle

Assessments are only ever performed on assets the customer owns or is explicitly authorised in writing to test

No assessment may begin without evidence of authority. Testing on systems you do not own or lack written authorisation to test is not permitted.

2. Proof of Ownership or Authorization

Before any assessment run, the customer must provide written proof of ownership or authorisation. Acceptable proof includes:

• For systems you own: Proof of ownership (domain registration, infrastructure account access, legal ownership documents)
• For third-party systems: Written authorization from the system owner, signed by someone with authority to grant permission (C-level executive, system administrator, or legal representative)
• For contractor/consultant work: A signed contract or SOW (Statement of Work) that explicitly authorizes security testing

No assessment may proceed on vague authorization. Authorization must be specific to the systems being tested and must name the party authorized to conduct the testing (Pentforge or the company/person hiring you).

3. Scope Document Requirements

The scope of testing must be fixed and signed before an assessment begins — expanding it requires a new signed scope. This scope must specify:

• The exact systems, IP ranges, or domains being tested
• The assessment type(s) authorized (e.g., external web, API, network)
• Testing window (date and time range)
• Authorization for any special techniques (e.g., social engineering, physical testing)
• Contacts for escalation if issues arise during testing
• Signature from an authorized representative of the system owner

Scope expansion requires a new signed document. If an assessment identifies systems outside the original scope, those systems may not be tested without new written authorization.

4. Prohibited Testing Activities

The following activities are strictly prohibited on the Pentforge platform, regardless of the claims made:

• No assessment may include prospect scanning or reconnaissance against anyone who has not authorised it in writing
• No assessment may include autonomous exploitation or anything beyond the proof-of-concept verification agreed in the signed scope
• Testing third-party infrastructure – assessing systems you do not own or are not authorized to test (e.g., cloud provider infrastructure, third-party SaaS)
• Denial of Service (DoS) testing – any form of resource exhaustion or service disruption without explicit authorization
• Data exfiltration – accessing or downloading data beyond what is needed to verify a vulnerability

5. Rules of Engagement

Any authorized assessment must follow these rules:

• Stay within scope. An assessment may cover only the systems, IP ranges, and domains explicitly authorized. It may not expand to related systems without new authorization.
• Minimize impact. An assessment must use the lowest-risk testing techniques necessary to validate each finding and may not use destructive testing unless explicitly authorized.
• Report responsibly. Findings must be provided only to authorized recipients. Reports may not be published or shared without permission.
• Communicate escalations. Any critical issue identified during an assessment must be escalated through the contact in the scope document.
• Preserve evidence. Records of assessment activity must be maintained for compliance and legal protection.

6. Assessment Reports: Automated vs. Human Validation

Automated First-Pass Reports:

• Any automated first-pass report is governed by this policy
• Any automated first-pass report must be labelled unvalidated and must never be presented as human-validated
• It may be used only for preliminary triage and prioritization, not for final remediation decisions or compliance claims.

Human Validation (Optional Paid Service):

• Human validation is a separate paid step; no finding may be described as verified until that step has been purchased and completed
• No finding may be cited in compliance reports or used for business decisions without human validation
• Critical rule: You may never claim that unvalidated findings have been reviewed by a human professional.

7. No False Compliance Claims

No assessment may be represented as a third-party audit or as producing a compliance certification. You may not:

• Claim that Pentforge assessments satisfy compliance frameworks (ISO 27001, SOC 2, etc.)
• Use Pentforge in automated report generation or certification-like documents
• Present unvalidated findings as verified by certified professionals
• Use Pentforge reports in customer-facing compliance claims without human validation

This policy does not permit an assessment to be used as a compliance certification; certification requires third-party auditors and formal assessment processes.

8. Suspected Abuse Reporting

If you suspect that Pentforge is being used for unauthorized testing or other abuse, please report it:

Abuse Reporting Contact: TODO-owner: confirm the legal/support contact address

Reporting Procedure: TODO-owner: confirm the abuse reporting address and escalation procedure

Law Enforcement Cooperation: TODO-owner: confirm the contact point for law-enforcement requests and the policy for responding to them

Unauthorised testing and abuse breach this policy. What data is preserved afterwards, and how law-enforcement requests are handled, are open items recorded above.

9. Account Suspension for Violations

TODO-owner: define the suspension policy for unauthorised testing, prospect scanning or other abuse

The consequences beyond suspension are open. This draft makes no promise in either direction until the owner settles them:

• Remaining credits: TODO-owner: decide what happens to a suspended account's remaining credits — no outcome is promised until this is settled
• Assessment data: TODO-owner: decide what assessment data is preserved after a violation, for how long, and on what legal basis
• Appeals: TODO-owner: define the suspension appeal and reinstatement process
• TODO-owner: confirm the contact point for law-enforcement requests and the policy for responding to them

10. Related Policies

• Terms of Service
• Privacy Policy

11. Questions About Authorization?

If you are unsure whether proposed testing is authorized or need help preparing scope documentation, contact TODO-owner: confirm the legal/support contact address before seeking an assessment.