These terms describe how we run assessments and managed services. They supplement our Terms of Service.
Scope confirmation
Every engagement begins with a written scope listing the domains, IP addresses, accounts and systems involved, the testing window and your technical contact. We only work within the confirmed scope.
Testing authorisation
You confirm that you own, or have permission to authorise testing of, every in-scope asset. For cloud or hosted systems, you are responsible for complying with the provider’s testing policy.
Nature of assessments
- Security Checks are external and non-intrusive: we identify exposures and misconfigurations but do not attempt to exploit them.
- Penetration testing, where required, is performed by a CSA-licensed provider under a separate agreement.
- We stop testing immediately if we observe signs of an active compromise or service impact, and contact you.
Handling of findings
Findings and evidence are stored encrypted on systems we control in Singapore, shared only with your nominated contacts, and deleted 12 months after delivery unless you ask us to keep them longer.
Managed services
For managed plans you grant us the administrative access needed to perform the service. Access is limited to named consultants, protected by MFA, and removed when the plan ends. We will not make changes outside the agreed baseline without your approval, except to contain an active threat.
Contact
Questions: info@vsitsecurity.com.