These terms govern how Certus Security engages. They exist to keep the work lawful, and to protect both sides of the engagement.
We conduct security assessments exclusively on systems, networks and applications that you own, or for which you have obtained explicit written authorisation from the system owner. A signed scope-of-work agreement is required before any testing begins. We do not access, probe or test any system without documented consent.
By engaging Certus Security you warrant that you own, or have obtained explicit written authorisation to test, every system in the agreed scope. That includes any approval required from cloud providers, hosting partners and third-party vendors. You will identify production systems and any out-of-scope assets before work starts.
We state the certifications held by the practitioner assigned to your engagement, and we provide the certification identifiers on request so you can verify them in the issuing body's registry. We do not claim firm-level accreditations that we do not hold.
We do not access accounts or systems without the owner's consent, monitor or surveil individuals, recover access to accounts that are not yours, or undertake any activity that would breach the Computer Fraud and Abuse Act, the Computer Misuse Act, or equivalent legislation. Requests of that kind are declined.
We sign your non-disclosure agreement as standard, report findings only to you, and retain nothing after delivery.