The clauses below apply to penetration testing, red team operations, 0-day research and secure code analysis alike. Read them alongside the terms of service and the privacy policy: the terms govern the commercial relationship, the privacy policy governs personal data, and these rules govern the testing itself.
2. Scope is a closed list
We test what the scope names and nothing else. Hosts, domains, ranges, applications and accounts are listed explicitly; anything not listed is out of scope even if it is discovered during the work and even if it is obviously related. Where an in-scope asset sits on infrastructure you do not own, we need the provider's consent in writing before it is touched.
3. Windows and intensity
Testing runs inside an agreed window. Denial-of-service and volumetric techniques are excluded by default. Anything genuinely destructive - deleting data, changing production configuration, disabling a control - happens only with a separate written instruction naming that specific action. If we see a technique that would prove a finding but risks availability, we describe it and ask rather than run it.
4. Named lead and shared channel
Each engagement has a named lead on our side and a named counterpart on yours, and both work in one shared channel opened at kick-off. Questions, changes of scope and findings all move through that channel so there is a single record of the engagement rather than a scatter of private mail threads.
5. Escalation of critical findings
A critical finding, an exposure that is already being exploited, or evidence of a prior compromise does not wait for the report. It goes to your named counterpart on the shared channel on the same day we confirm it, with enough detail to act on before the written finding is complete.
6. Data handling and evidence
An NDA is signed before scope detail changes hands. Evidence is encrypted in transit and at rest, held on systems reserved for engagement work, and reachable only by the people on the engagement. Evidence is destroyed after the retest is closed, or on written request before that. PGP is available for anything sent by mail.
7. Data minimisation
We take the least data that proves a finding. Personal data, credentials and customer records are sampled only far enough to demonstrate exposure, redacted in the report, and never taken outside the engagement systems. Where a finding can be proved without touching real records at all, that is how it is proved.
8. Deconfliction
Before work starts we agree the source addresses we will test from, a marker your team can look for, and a number your defenders can call to ask whether an alert is us. That way a real intrusion during the window is not written off as the test, and the test is not escalated as a real intrusion.
9. Stop conditions
Either side can pause the engagement at any time through the named contacts, and we stop on our own initiative if a target turns out to be outside the authorisation, if a system becomes unstable, if we find evidence of an active third-party compromise, or if a third party objects to being tested. Work resumes only after the reason is resolved in writing.
10. Reporting and retest
You receive a written report with the finding, the evidence, the reproduction steps and the remediation advice, plus an executive summary that can be circulated on its own. Once your team has fixed the findings we verify the fixes and record what is closed and what is still open. Reports become yours; our tooling, methodology and internal know-how remain ours.
11. Third parties and the law
Nothing in these rules authorises testing anyone else's systems, and nothing in them displaces Indonesian law or any obligation either party has to a regulator. Where an engagement touches a shared or hosted service, the provider's own testing policy applies on top of these rules, not instead of them.
This page describes our standing practice and is published for transparency. It is not the contract. The rules that bind a specific engagement are the ones in the document both parties signed for that engagement, and those override anything written here.