These terms govern how Sentinel Black engages. They exist to keep the work lawful, and to protect both sides of the mandate.
We conduct security assessments exclusively on systems, networks and applications that you own, or for which you have obtained explicit written authorisation from the system owner. A signed engagement letter and scope of work is required before any technical work begins. We do not access, probe or test any system without documented consent.
By retaining Sentinel Black you warrant that you own, or have obtained explicit written authorisation to test, every system in the agreed scope. That includes approvals required from cloud providers, hosting partners and third-party vendors. You will identify production systems and any out-of-scope assets before work starts.
Mutual non-disclosure is signed before any technical discussion. We report findings only to you, we do not name a client without written consent, and evidence and findings are destroyed when the mandate closes. No engagement is subcontracted.
We do not access accounts or systems without the owner's consent, surveil individuals, recover access to accounts that are not yours, alter records held by another party, identify or retaliate against an attacker, or undertake any activity that would breach the Computer Fraud and Abuse Act, the Computer Misuse Act, or equivalent legislation. Requests of that kind are declined and receive no reply.
Mandates are quoted as a fixed fee after a scoping conversation, and that fee does not change during the engagement. We do not bill hourly. Where a budget cannot carry the proposed depth we adjust the scope rather than discount the work.