It sits alongside the proposal you have accepted, and together they describe what I will test, when I will test, and what you will receive at the end.
My job is to find realistic ways an attacker could get in, without creating avoidable disruption for your production systems. The terms below are how I keep the engagement controlled, auditable, and predictable once work starts.
What I will test
Penetration testing under this agreement covers only the targets, environments, dates and test hours you authorise in writing. Before Day 1, you confirm what is in scope and what is off limits, and I test only within those boundaries.
What you get is the deliverables listed in the proposal, including reporting, evidence capture, and one retest of agreed fixes during the Days 9 to 12 retest period. If you add targets, swap environments, or shift the timeline after I have started, I will confirm the change and any extra fee in writing before I continue, so you are not surprised later.
Payment
To book the project, I invoice 40% of the price when you sign the proposal. I schedule the engagement once that invoice is issued, and I start work once it is paid and access is ready.
I invoice the remaining 60% when the engagement is complete. Each invoice is payable within 14 days of its date. If a payment goes past due, I will pause non-urgent work, including report final sign-off and any retest booking, until your account is back up to date. If timing matters for an audit or go-live, tell me early so I can plan around payment dates.
Keeping things private
During penetration testing I may see system details, configurations, data, and security weaknesses. I treat anything I learn from your environment, and the fact of the findings themselves, as confidential. I do not share it outside your organisation.
You may need to share the final report with an auditor or a customer to prove you have been tested. That is fine once the final invoice is paid, and you can share it for the purpose it was written for. When the project ends, I keep my working notes private and I only retain what I need to support the report and answer reasonable follow-up questions. If you need an NDA or customer-specific wording, send it before Day 1.
How I am engaged
I do this work as an independent penetration tester, not as your employee. That means I control how I run my day-to-day work, the tools I use, and the technical approach, as long as I stay within the agreed rules of engagement.
You are responsible for your own internal approvals, change management, and communications to your users and stakeholders. I am responsible for my own taxes, insurance, equipment, and safe handling of the access you provide. I will ask for the access I need, such as test accounts, VPN details, and IP allowlisting, and you provide it before Day 1 so I can start on time.
What I am responsible for
I take care to keep production stable. I avoid actions that are likely to knock over systems, and if a step carries a meaningful stability risk I will stop and ask you for written approval and a safer time window. You also agree that penetration testing involves probing real systems, so some side effects can happen, especially in fragile environments or where monitoring and rate limits are tight.
I am responsible for the quality of my work and for handling your access and materials with care. I am not responsible for pre-existing weaknesses, outages caused by third-party providers, or issues caused by changes made in your environment while testing is in progress.
Stopping early
Either of us can end the project by giving notice. Because timing often ties to audits and go-live dates, I will agree the notice period with you in writing so it fits your schedule and mine.
If the project ends early, you pay for the work I have completed up to the end date, plus any non-cancellable costs you approved. I will hand over what is ready at that point, such as notes needed to explain confirmed findings and any draft or final report sections that are complete. If I am waiting on access, approvals, or a change window you have not provided, the schedule moves, and you can either keep the project on hold or end it under this clause.
Signature
