Penetration Testing Terms & Authorisation

This Agreement is entered into on the date of purchase between Daniel Abbott, trading as BSRsec (the Tester), and the organisation submitting the order (the Customer). All testing under this Agreement is performed personally by Daniel Abbott.

1 · Definitions

Agreement — these terms, including the scope, schedule and contact details recorded in the Customer's order. Confidential Information — any proprietary, technical, business or personal information disclosed by either party. Penetration Testing / Machine Testing — authorised simulated cyber attacks performed to evaluate system security. Systems — computer systems, networks, applications and related infrastructure.

2 · Scope of Services

Testing Authorisation. The Tester will perform security testing to identify vulnerabilities and configuration weaknesses on systems owned and/or operated by the Customer.

Testing Scope. The host IP addresses, ranges, URLs and other resources in scope (the pentest scope) are those specified in the Customer's order.

Methodology. Web application testing is conducted in accordance with the industry-standard OWASP Testing Guide. External infrastructure testing follows recognised standards including the Penetration Testing Execution Standard (PTES) and NIST SP 800-115. Findings in both cases are classified by severity with remediation guidance.

Explicit Exclusions. Unless specifically authorised in writing, testing will NOT include: Denial of Service (DoS) attacks; physical security testing; social engineering attacks; testing of third-party systems not owned by the Customer.

Testing Schedule. The Tester is authorised to perform tests during the testing window recorded in the Customer's order.

3 · Communication

The designated contacts are those provided in the Customer's order (plus any secondary contact supplied). Both parties will communicate via the recorded email addresses and guarantee these channels remain available during testing. Response times: standard communications within 4 hours during business days; urgent matters within 2 hours; critical security findings within 1 hour of confirmation. The Customer may request the Tester to stop testing immediately at any time via email.

4 · Professional Standards

The Tester guarantees tests will be performed in a responsible and professional manner following industry best practice, using best efforts not to modify applications, data, programs or system components. Testing personnel maintain OSCP certification or equivalent credentials. All testing activities comply with applicable data protection regulations including GDPR and other relevant privacy laws.

5 · Limitations of Testing

The Tester provides no express or implied guarantee that test results ensure complete system security, as cybersecurity is a continually evolving field with emerging threats and attack vectors.

6 · Customer Authorisation & Responsibility

The Customer guarantees it has legal authority to subject the designated systems to testing, and has obtained any permissions required from system owners. The Customer certifies that relevant third parties have been informed of the authorised testing. By accepting these terms, the Customer confirms it is in a position to perform, authorise and receive the results of testing, and takes full responsibility for all effects of testing, including any and all legal consequences arising from it.

7 · Reporting

The Tester will provide an executive summary for management, a technical report with detailed findings, remediation recommendations with priority rankings, and raw scan data on request. Reports are delivered by the date recorded in the Customer's order.

8 · Liability & Indemnification

Neither party will be liable for indirect, punitive, special, incidental or consequential damages, including loss of business, revenue, profits or data, however arising. Each party's total liability is limited to the fees paid for the services, except for breaches of confidentiality or gross negligence. The Customer has sole responsibility for data backup and system protection and will not claim against the Tester for data loss, system downtime or business interruption.

9 · Confidentiality

Both parties will maintain strict confidentiality of all information disclosed in relation to testing. Confidential information may only be used for authorised testing purposes. Confidentiality obligations survive termination.

10 · Incident Response

If testing causes system instability or outages, the Tester will cease activities and notify Customer contacts as an urgent matter. The Customer may respond to detected testing activity through normal security procedures but agrees not to involve legal authorities or law enforcement.

11 · Compliance, Quality & Retesting

All testing complies with applicable industry regulations and standards. Methodology and results undergo internal quality review before delivery. Upon Customer request, limited retesting of remediated vulnerabilities may be performed at no additional cost within 30 days of report delivery.

12 · Intellectual Property

The Tester retains ownership of proprietary testing tools and methodologies, which may not be disclosed to the Customer in part or full. The Customer retains ownership of all system and business data. Test reports become Customer property upon delivery and payment.

13 · Force Majeure

Neither party will be liable for performance delays or failures due to circumstances beyond reasonable control, including natural disasters, government actions or network outages.

14 · Termination

Either party may terminate immediately for material breach after 48-hour written notice, or for convenience with 7 days written notice. Confidentiality obligations survive termination.

15 · Governing Law

This Agreement is governed by the laws of the Republic of Lithuania, and disputes will be resolved by the competent courts of Lithuania.

16 · Entire Agreement & Severability

These terms and the Customer's order constitute the complete agreement between the parties; modifications must be in writing and agreed by both parties. If any provision is deemed invalid, the remainder of the Agreement remains enforceable.