Penetration Testing Terms

These terms govern the penetration-testing engagement you book through Warden by VeritAi. Testing is limited to the specific site, systems and scope you identify when booking. You warrant that you own the target, or are duly authorised by its owner to authorise testing, and that you have obtained any consent required from your hosting, CDN, or other third-party providers. You are responsible for confirming that testing does not breach any agreement you hold with such providers.

A penetration test is a time-boxed, best-effort security assessment carried out by a qualified tester, assisted by our tooling. It is not a guarantee that every vulnerability will be found, and a report that identifies no issues does not certify that the site is secure or free of vulnerabilities. The assessment reflects the state of the target during the testing window only.

We exclude destructive techniques and denial-of-service attacks. Nevertheless, security testing interacts with live systems and carries a small inherent risk of unexpected behaviour, degraded performance, or data changes made through the application under test. By booking, you confirm that you hold a recent, working backup of the site and its data, and you accept this residual risk.

You agree to provide accurate scope information, to keep any test accounts you supply isolated from production data where practical, to allow-list our testing sources where a firewall or WAF would otherwise block them, and to inform your own stakeholders that testing is taking place. You must not ask us to test systems, data, or third parties that fall outside the authorised scope.

Where authenticated testing is required, you are responsible for providing valid test-account credentials through the secure channel we specify. Never send credentials in the booking form or by other insecure means. We use such credentials solely for the engagement and do not retain them beyond it.

During testing the tester may view data that is accessible to the accounts and scope you provide. Both parties agree to keep the engagement, its findings, and any information disclosed confidential. We store findings and evidence securely, redact secrets where we can, and share the report only with your account.

Findings are provided for your internal remediation. We may withhold release of the report until it has passed our internal review. Advice and remediation guidance are provided in good faith; how you act on them is your decision and responsibility.

The engagement is charged as the one-off fee shown at checkout. Once testing has commenced, fees are non-refundable except where required by law.

The service is provided on a best-effort, as-is basis, without warranty that it will identify all vulnerabilities or that the target is secure. To the fullest extent permitted by law, we are not liable for any indirect, incidental, or consequential loss, nor for loss of profit, revenue, or data, arising from the engagement; and our total liability for any claim is limited to the fee paid for that engagement. Nothing in these terms limits liability that cannot be limited by law.

You agree to indemnify us and hold us harmless against any claim, loss, or expense arising from testing you authorised without the necessary rights, or from your direction to test systems, data, or third parties outside the authorised scope.

We may pause or stop testing if we reasonably believe it is causing harm, if authorisation is in doubt, or if a critical issue requires your immediate attention. We will contact your nominated emergency contact where appropriate.

These terms are governed by the laws of England & Wales. Questions about these terms can be raised through the contact page.