How we are allowed to hack you.

Version 1.0 · applies to every Hack1ng engagement

Everything we do is offensive by technique and defensive by purpose. That only works if the boundaries are written down before the work starts. These rules form the baseline of every engagement; the signed engagement letter for your specific project may tighten them further, never loosen them.

01 Written authorisation first

No testing begins until a scope document and authorisation to test are signed by a representative of the target organisation who is empowered to give it. Where you do not own the infrastructure - cloud, hosting, SaaS, a shared premises - you are responsible for obtaining and evidencing the provider's permission before we start.

• Named in-scope assets: domains, IP ranges, applications, physical locations, accounts.
• Explicit out-of-scope list - treated as hostile ground and never touched.
• Agreed testing windows and any change-freeze periods.
• Named technical and business escalation contacts, reachable during the window.

02 Scope is a hard boundary

We stay inside the scope. If a route out of scope appears - a trust relationship into a third party, an unexpected shared host, customer data belonging to someone else - we stop at the boundary, document the path, and report it rather than follow it. Scope changes happen in writing, not in the middle of a test.

03 Availability and data are protected

Unless you explicitly commission it in writing, we do not run denial-of-service or volumetric attacks, we do not destroy or modify production data, and we do not disable your security controls. Where a finding can only be fully proven by a destructive action, we prove the precondition and describe the rest - we do not detonate it on your production estate.

04 Evidence handling

We extract the minimum evidence needed to prove a finding. Credentials, tokens, personal data and customer records are captured only to the extent required, stored encrypted, kept on least-privilege access, and destroyed on the agreed retention date with written confirmation.

05 Critical findings are escalated immediately

If we find something being actively exploited, a live exposure of sensitive data, or a critical flaw that puts you at immediate risk, we contact your escalation contact straight away. You hear about it during the engagement, not in the report three weeks later.

06 Social engineering and physical testing

Phishing, pretexting, physical entry and similar techniques are only in scope when explicitly commissioned. They are run with a get-out-of-jail letter carried by every tester, defined no-go areas and no-go individuals, and a strict prohibition on coercion, threats, or anything that could endanger a person. No employee is ever named or disciplined on the basis of our results.

07 Clean exit

Every artefact we create - accounts, shells, implants, uploaded files, scheduled tasks, firewall changes - is inventoried and removed at the end of the engagement, and the inventory is handed to you so you can verify the estate is clean.

08 Confidentiality

Your findings are yours. We work under NDA, we do not disclose that you are a client without your written consent, and we never use your vulnerabilities as marketing material.

09 What we will not do

• Test any asset you cannot demonstrate authority over.
• Access an account, device or communication belonging to a person who has not consented, on behalf of anyone.
• Provide surveillance, stalking, account recovery, or "get into this profile for me" work of any kind.
• Develop or supply capability intended to harm a third party.

10 Vulnerability disclosure to us

Found a flaw in our own systems? Use the channel published in security.txt. Report it in good faith, without exfiltrating data, disrupting the service, or disclosing to third parties before we have had a reasonable opportunity to remediate, and we will not pursue you. We publish no email address; the disclosure channel in security.txt is the route.

11 Authority, law and your warranties

By instructing us you warrant that you own the in-scope assets or hold documented authority over them, that any third-party provider consent required has been obtained, and that our testing will not breach any agreement binding on you. We work within applicable computer-misuse, data-protection, sanctions and export-control law, and we will refuse or halt any instruction that would put us outside it. If authority turns out to be absent, we stop immediately and the engagement is suspended.

12 Our people and subcontractors

Testing is performed by vetted personnel bound by confidentiality obligations. We do not subcontract any part of an engagement without your prior written consent, and any approved subcontractor is bound to these rules and to equivalent confidentiality and data-protection terms.

13 Precedence

These rules are incorporated into every engagement. Where your signed engagement letter or scope document is stricter, the stricter term prevails; nothing in an order form, portal or email loosens these rules. Use of this website is separately governed by our terms of use and privacy policy.