Pentest scope policy

Rules for contracted penetration testing — what the platform does NOT do and how the authorized service works.

Difference between assessment and pentest

The platform assessment is passive and automated. The pentest is conducted by professionals, with a controlled attempt at exploitation, and only occurs with a contract and written authorization.

Written authorization

Every pentest requires a document signed by the asset owner, including the scope, execution window, emergency contacts, and limits (for example, the prohibition of tests that bring down production).

Targets and windows

The scope lists domains, IPs, and included applications. Schedules are agreed upon to reduce impact. Activities outside the window are halted.

Data and evidence

Evidence is stored with access control and delivered in a technical and executive report. Data found during the test is not copied unnecessarily and is deleted after delivery.

Legal limits

No test is performed without authorization. Testing third-party assets without a contract constitutes a crime (Law 12.737/2012) — the platform refuses this type of use.