Authorized Testing Policy
We test only what we are authorized in writing to test, within an agreed scope, under agreed rules. This policy explains what that means in practice.
1. Purpose of this policy
Security testing involves deliberately attempting actions that would be unlawful without permission. In most jurisdictions, unauthorized access to a computer system is a criminal offence regardless of intent, and permission from someone who lacks the authority to grant it is not a defence. This policy sets out how CyberCache establishes lawful authorization before any testing takes place, and what boundaries apply once it does.
It applies to every engagement we undertake, including success-based engagements. Commercial terms never alter the authorization requirements described here.
2. Written authorisation is mandatory
Security testing requires prior express written authorisation from a person entitled to grant it for each asset, an agreed scope and a permitted testing window. Required third-party permissions must be obtained before testing.
3. Scope
Only expressly authorised assets and activities may be tested. Scope changes require written agreement and any additional authorisation needed.
4. Rules of engagement
The signed engagement documents define permitted techniques, timing, contacts, communications, stop conditions and other engagement-specific requirements.
5. Exclusions
Activities outside the agreed scope or without the required permission are not authorised. A commercial arrangement, including success-based pricing, does not expand testing permission.
6. Suspension or termination
Testing must not continue where authorisation is absent, invalid or withdrawn, or where continuing would be unlawful, outside scope or unsafe. Further action is governed by the signed engagement agreement and applicable law.
7. Data and evidence
Any personal-data processing, evidence handling, permitted access, confidentiality and retention requirements must be addressed in the signed engagement documents and applicable data-protection terms before processing begins.
8. Limits of any assessment
A security assessment examines a defined scope during a defined period using the access and information available at the time. It cannot prove the absence of vulnerabilities, and we do not represent that it does. We provide no warranty, express or implied, that any system is secure, fully compliant, or free of defects.
We do not issue certificates, seals, badges, or accreditation, and we do not claim certifications or memberships that we do not hold. Our methodology is published so it can be assessed on its content instead.
9. Reporting a security issue
Suspected vulnerabilities affecting CyberCache may be reported privately to info@cybercache.cc. Provide a description and any information already available without undertaking further testing.
This reporting route does not authorise scanning, probing, exploitation or any other security testing. Testing requires the Company’s prior express written authorisation and an agreed scope.
Submitting a report creates no entitlement to payment, rewards, public credit, acknowledgement, progress updates or a response within a particular period. This policy grants no legal safe harbour or undertaking not to pursue legal action.
10. Suspected misuse of the Company’s name
Suspected impersonation or unauthorised use of CyberCache’s name may be reported to info@cybercache.cc. The Company may assess the report without confirming or disclosing any confidential client relationship or engagement.
11. Changes
The Company may update this website policy. Changes to this website policy do not retrospectively amend existing signed engagement agreements.
12. Contact
Questions about this policy can be sent to info@cybercache.cc.