Authorisation to Test & Rules of Engagement
The written permission that makes security testing lawful, and the rules both sides follow while it runs. Signed by the client's authorised signatory before any testing starts.
1. Parties and engagement
1.1 Client: Client legal name, registration number, address ("the Client").
1.2 Provider: Provider legal name, trading as Verfend (Independent Security Operations), CNPJ or CPF, Recife, Pernambuco, Brazil, email ("Verfend").
1.3 Engagement ID: VF-2026-001. Service: ☐ Validate ☐ Assess ☐ Resolve ☐ Monitoring.
1.4 This Authorisation forms part of the Service Agreement (Document 03) dated date and its Annex A (Proposal & Statement of Work, Document 02); where they differ on what may be tested, the narrower reading applies. Testing starts only after both are signed.
2. Authorisation statement
2.1 The Client confirms that it owns, or is expressly authorised by the owner to permit security testing of, each asset listed in section 3.
2.2 The Client grants Verfend permission to perform the testing described in sections 5 and 6 against the listed assets only, during the window in section 4, from the source addresses in 4.3.
2.3 The person signing this document is entitled to grant this permission on the Client's behalf.
3. In-scope assets
| # | Asset | IP / URL / hostname | Environment | Access level | Owner confirmation |
|---|---|---|---|---|---|
| 1 | asset | IP or URL | ☐ Prod ☐ Staging | ☐ External ☐ Grey-box ☐ White-box | ☐ Owned ☐ Authorised by owner: owner |
| 2 | asset | IP or URL | ☐ Prod ☐ Staging | ☐ External ☐ Grey-box ☐ White-box | ☐ Owned ☐ Authorised by owner: owner |
3.1 Explicitly out of scope: systems, hostnames, IP ranges, paths. Anything not listed in the table is out of scope, including other subdomains, neighbouring IP ranges, employee devices and corporate email.
4. Testing window and source addresses
4.1 Window: from start date and time to end date and time, time zone. ☐ Any hour within the window ☐ Only hours ☐ Not on blackout dates.
4.2 Testing outside the window requires written agreement from the Client's technical contact; email is sufficient.
4.3 Tester source IPs: tester IPs. All testing traffic comes from these addresses, so the Client can recognise and whitelist it and tell it apart from genuine attacks. Verfend gives written notice before using any other address.
4.4 ☐ Standing authorisation for Monitoring — non-intrusive scheduled checks only, on the assets in section 3, until cancelled under the Ongoing Monitoring Terms (Document 10).
5. Permitted activities by access level
5.1 External (black-box): reconnaissance of the listed assets; TLS, header and configuration review; throttled unauthenticated vulnerability scanning; manual verification of findings with minimal proof.
5.2 Grey-box: everything in 5.1, plus authenticated testing with the dedicated vf-test-* accounts provided under Document 05, including access-control checks across the roles provided.
5.3 White-box: everything in 5.2, plus review of the source code and configuration provided, and intrusive checks against the staging environment named in section 3.
5.4 Verfend works in three steps — SCAN (throttled discovery), VERIFY (manual confirmation with minimal proof), RETEST (after remediation) — following OWASP WSTG/ASVS and PTES, with findings rated under CVSS v3.1. Techniques are non-disruptive: no exploitation beyond proof of impact, and no change to data that is not immediately reversed.
6. Prohibited activities
6.1 Denial-of-service, stress or load testing of any kind.
6.2 Social engineering or phishing of the Client's staff, customers or suppliers, unless separately authorised in writing.
6.3 Physical access attempts.
6.4 Destructive actions: deleting or corrupting data, changing production configuration, installing persistent code or back doors.
6.5 Accessing, altering, copying or exfiltrating data beyond the minimum needed to prove a finding. Where personal data is encountered, only redacted evidence is recorded.
6.6 Lateral movement into systems not listed in section 3, even where a finding makes it possible; such possibilities are reported, not pursued.
6.7 Testing third-party services (payment gateways, SaaS, identity providers, shared infrastructure) without that third party's consent.
7. Third parties
7.1 ☐ The Client confirms that the terms of its hosting and cloud provider(s) permit security testing of the listed assets, and that any separate consent or notification the provider requires has been obtained or made (Service Agreement, Document 03, §13). Provider(s): provider names.
7.2 SaaS and third-party components are excluded unless listed in section 3 with the third party's written consent attached.
8. Stop-word protocol
8.1 Either named contact in section 10 may say or write "STOP" at any time, with or without a reason.
8.2 On receiving STOP, Verfend halts all testing traffic within 15 minutes, confirms the halt in writing, and does not resume until the Client confirms in writing.
9. Incident protocol
9.1 If testing affects, or appears to affect, the availability or integrity of any system, Verfend will stop immediately, notify the Client's emergency contact by phone and in writing, assist with diagnosis and recovery, and document what happened and when.
9.2 If the Client observes unexpected behaviour it believes is related to testing, it uses the stop-word first and asks afterwards.
9.3 If Verfend finds evidence of a prior or ongoing compromise by someone else, it reports this to the Client the same day and does not disturb the evidence.
10. Emergency contacts
| Role | Name | Phone | Hours | |
|---|---|---|---|---|
| Client technical contact | name | phone | hours | |
| Client emergency contact | name | phone | hours | |
| Verfend lead tester | name | phone | hours | |
| Verfend emergency contact | name | phone | hours |
11. Data handling during testing
11.1 Evidence is limited to the minimum proof of each finding. Personal data, credentials and payment data are redacted in notes, screenshots and the report.
11.2 Verfend does not persist personal data obtained during testing beyond that minimal proof. Evidence is stored encrypted, retained for 90 days after report delivery and then deleted; the Client may request earlier deletion or longer retention in writing. The vf-test-* accounts are revoked by the Client within 24 hours after the window closes (Access Provisioning, Document 05).
11.3 Each party handles personal data in accordance with LGPD (Lei nº 13.709/2018) and, where EU data subjects are involved, GDPR, as set out in the Service Agreement (Document 03, §12).
12. Legal basis
12.1 Accessing computer systems without permission is a criminal offence: in Brazil under Lei nº 12.737/2012 (art. 154-A, Código Penal), in the EU under Directive 2013/40/EU and national implementing law, and under applicable computer-misuse laws elsewhere. This signed Authorisation is the express permission that makes the described testing lawful. Verfend does not test without it.
12.2 The Client is responsible for the accuracy of the ownership confirmations in section 3 and the third-party confirmation in 7.1.
13. Duration and revocation
13.1 This Authorisation is valid for the window in 4.1 and ends automatically when the window closes or the Service Agreement ends, whichever is earlier. Where the standing authorisation for Monitoring is ticked in 4.4, it continues — for non-intrusive scheduled checks only, on the assets in section 3 — until cancelled under the Ongoing Monitoring Terms (Document 10) or the Service Agreement ends.
13.2 The Client may narrow the scope or revoke this Authorisation in writing at any time; Verfend stops within 15 minutes of receipt. Work properly performed up to that point is payable as set out in the Payment Terms (Document 13), including the scheduling fee in its §9.1 where the engagement is cancelled before work begins, and the Service Agreement (Document 03, §20); the narrowing or revocation itself gives rise to no other charge.
13.3 Changes to the assets, window or access level require a signed addendum or written confirmation from both parties' named contacts.
14. Signatures
Client authorised signatory: ______________ Role: ________ Date: ________
For Verfend (Provider legal name): ______________ Role: ________ Date: ________
Verfend · Independent Security Operations · email · website · Document 04 v1.0 · date