Assessment Authorization Policy

Testing may be authorized only by a person acting on behalf of an organization registered with the Service who is:

• the owner of the domain or server to be tested (the "asset"), or
• a party holding written authorization from the owner to approve testing (for example a web agency or maintenance contractor).

If you are not sure whether you have this authority, check with the owner of the asset before you request a diagnosis.

Before active testing, or before showing results that require it, we verify that you control the asset. Verification is done by one of the following:

• adding a DNS TXT record
• placing a file we provide on the website
• adding a meta tag we provide to the website
• submitting a signed letter of authorization, which our team reviews

Each assessment has a written scope, timing and exclusions that the authorizing person accepts before testing begins. Consent is recorded with name, role and timestamp. For the quick diagnosis, we ask for confirmation of authorization with every request and record its date and time, source IP address and browser type.

One complimentary diagnosis per eligible organization. It does not renew, cannot be transferred, and is not reissued for additional accounts. If you disagree with an eligibility decision, you can ask us to reconsider it through our contact page.

You may withdraw authorization at any time before testing starts, and you can pause an engagement at any time by contacting us at [email protected].

Testing beyond scope, denial-of-service, social engineering and data exfiltration are never performed without a separate written agreement. If we suspect a diagnosis is unauthorized, we stop it and respond to enquiries from the owner of the asset.