Testing Safety Policy

01Written authorisation comes first

We test nothing until we hold a signed contract and written authorisation, for every system in scope, from someone entitled to grant it.

• Systems hosted or operated by third parties, such as cloud platforms, SaaS providers and managed service providers, are tested only where those third parties' policies allow it or with their permission.
• The authorisation names the systems, the testing window and the people who can stop the test.
• Before testing, we check that the person authorising the test controls each target, for example through domain registration, IP allocation or cloud account records.
• If a test may involve intercepting network traffic, viewing financial or personal data, or affecting availability, the written authorisation says so expressly.

02Agreed scope, nothing more

Targets, such as domain names, IP ranges, applications and accounts, are listed in writing before testing starts. Anything not listed is out of scope.

• If we find an asset that appears to be yours but is not in scope, we do not test it. We tell you and ask how you want to proceed.
• Scope changes are agreed in writing before we act on them.
• Before testing starts, we give you the IP addresses we will test from.

03Testing windows and escalation contacts

• Testing runs inside agreed windows, and we tell you when each window opens and closes.
• Both sides name escalation contacts who are reachable for the whole window.
• You can pause or stop testing at any time through your escalation contact.

04Safe techniques as standard

We do not use the following unless you authorise them explicitly and in writing:

• Denial-of-service or load testing.
• Actions that delete, alter or corrupt data.
• Persistence mechanisms, backdoors or anything left running after the test.
• Social engineering or physical access attempts.
• Automated scanning of production at rates beyond what we agree with you.

Social engineering pretexts never impersonate a government body, law enforcement or another real organisation's brand.

05Stop conditions

We stop immediately and contact you if we see:

• Instability, errors or degraded performance in a system under test.
• Signs that someone else has already compromised the environment.
• Access to sensitive data beyond what is needed to prove a finding.

If our testing causes an outage or instability, we stop, tell your escalation contact straight away and help you work out what happened.

06Critical findings within 24 hours

We report any finding rated critical to your escalation contact within 24 hours of confirming it, with enough detail to start fixing it. You do not have to wait for the final report.

07Handling your data

• We access the minimum data needed to prove a finding, and redact personal and sensitive data from evidence.
• Engagement data, meaning the data we collect or create while testing your systems, is stored encrypted in Saudi Arabia, and only the people working on your engagement can access it. We deliver reports and evidence through an encrypted channel agreed with you, and never by email or WhatsApp.
• We may use AI tools run by AI providers on your engagement. Before anything is sent to them, we remove personal data, passwords, keys and tokens, and we only use providers that do not train their models on your data and that protect it under written terms. A tester confirms anything an AI tool produces. You can ask us in your statement of work not to use outside AI providers.
• We keep engagement data only for the retention period in your contract, then destroy it, including backup copies, and confirm this in writing. You can ask us to destroy it earlier once the engagement has ended, unless a law requires us to keep it. After that we keep only the records the law requires.
• If we become aware of a breach affecting personal data we hold for your engagement, we tell your escalation contact without delay, with the details you need to meet your own reporting duties.

08Credentials and test accounts

• We use test accounts that you provide, and store credentials in an encrypted vault.
• At the end of the engagement we ask you to disable or rotate every credential you shared with us.

09Our people

• Everyone who works on your engagement is bound by confidentiality before they see any detail of your environment.
• We do not subcontract testing without your written consent.

10Clean-up

When testing ends, we remove what we introduced, such as uploaded files, created accounts and test payloads. The report lists anything we could not remove, so you can remove it yourselves.

11Raising a concern

During an engagement, contact the escalation contact we named for your engagement. At any other time, write to info@thagharat.com or message us on WhatsApp.