No written authorisation, no audit
This is the rule that protects your company and us. Here is how it works.
Why it is essential
A security test looks very much like a real attack: the only difference is permission. That is why we only work on systems whose owner has authorised us in writing, with a defined scope and dates.
If you are not the owner or cannot authorise testing of that system, we cannot begin. We also do not audit third-party websites “out of curiosity” or at the request of anyone who is not responsible for them.
What the authorisation includes
- Owner and representative: who authorises and on whose behalf.
- Scope: domains, subdomains, applications and IP addresses included, and what is excluded.
- Dates and hours: the time window in which testing takes place.
- Rules of engagement: permitted and prohibited types of test (by default, no denial of service and no destructive actions).
- Infrastructure pentest: if the service includes exploitation, privilege escalation or lateral movement, the authorisation states it expressly, with the list of permitted systems, networks and techniques, and the limits that are not crossed.
- Test accounts: if private areas are audited, which accounts and roles will be used.
- Emergency contact: a reachable person during testing in case we need to stop.
- Third-party providers: confirmation that your hosting or cloud provider's conditions have been met, if they require any.
Confidentiality and data
All information we access during the audit is confidential. We use it only to carry out the work, access the minimum necessary, extract no personal data beyond what is essential to demonstrate a finding, and delete evidence when we agree on closure.
How we report findings
- Results are delivered only to the people you designate.
- Critical findings are reported immediately, without waiting for the final report.
- We do not publish or share information about your company without your express permission.
Authorisation template
This is the standard content we use. The final document is adapted to each case.
View authorisation template (summary)
AUTHORISATION TO CARRY OUT A SECURITY AUDIT
Owner: ________________________ Tax ID: ____________
Representative: ________________ Position: __________
I authorise BreachLess to run security tests on:
- Domains / systems: _____________________________
- Out of scope: _________________________________
Period: from __/__/____ to __/__/____ Hours: ________
Permitted tests: _________________________________
- Exploitation / privilege escalation / lateral movement: YES [ ] NO [ ]
Systems and networks included: ________________
Prohibited tests (by default: denial of service and destructive actions).
Test accounts provided: __________________________
Emergency contact (name and phone): ______________
I declare that I own the listed systems or have the authority to
authorise their audit, and that I have met the conditions required
by my hosting providers.
Both parties undertake to keep the exchanged information confidential.
Date and signature of the owner: Date and signature of BreachLess:This template is indicative and is not legal advice.