1. Definitions
“Services” means all penetration testing, vulnerability assessments, and cybersecurity advisory activities performed by PentestPilot.
“In-Scope Assets” means systems explicitly authorized for testing in writing.
“Out-of-Scope Assets” means any system not explicitly authorized.
“Express Written Permission” means documented authorization provided by the Client allowing PentestPilot to conduct testing under applicable law, including the Cyber Security Act, 2023.
“Engagement” means a specific service engagement defined through an SOW.
“Fees” means the charges payable for Services.
2. Scope of Services
PentestPilot provides cybersecurity services as defined in an agreed SOW, which may include:
- Web application testing
- API security testing
- Network and cloud assessments
- Internal security reviews
- Advisory and remediation guidance
Deliverables typically include:
- Executive Summary
- Technical Vulnerability Report
- Risk prioritization matrix
- Remediation roadmap
Note: Certain services (e.g., retesting, social engineering, physical testing) require explicit authorization.
3. Client Warranties and Authorization
3.1 Authorization Requirement
By using PentestPilot services, you represent and warrant that:
- You own or have legal authorization over all assets submitted for testing
- You have obtained all necessary third-party permissions (e.g., cloud providers, ISPs)
- You have authority to grant testing access
3.2 Express Written Permission
All testing is conducted only upon receipt of proper authorization. This constitutes lawful authorization under the Cyber Security Act, 2023 and applicable laws.
3.3 Responsibility for Authorization
You are solely responsible for ensuring that all permissions are valid. PentestPilot shall not be liable for unauthorized testing claims arising from incorrect or incomplete authorization.
4. Service Execution and Operational Framework
PentestPilot conducts testing using recognized standards (OWASP, PTES, NIST).
Prohibited Activities
We do not perform:
- Denial-of-Service attacks
- Destructive actions (data deletion/modification)
- Unauthorized lateral movement
- Testing outside approved scope
Emergency Stop Protocol
Testing may be immediately halted if:
- System instability is detected
- Out-of-scope systems are accessed
- A legal or security risk arises
5. Safe Harbor and Authorized Security Testing
All actions performed:
- In good faith
- Within authorized scope
- During approved timeframes
shall be considered authorized cybersecurity activities, not unauthorized access, under the Cyber Security Act, 2023.
You agree not to pursue legal action against PentestPilot for such authorized activities.
6. Confidentiality
Both parties agree to:
- Protect confidential information
- Use it only for service purposes
- Not disclose it without authorization
PentestPilot will:
- Not disclose vulnerabilities publicly
- Not retain sensitive data beyond necessity
- Delete engagement data within a defined period
Confidentiality obligations survive termination.
7. Data Handling and Processing
PentestPilot:
- Applies strict data minimization
- Accesses data only when necessary for testing
- Does not store sensitive personal or financial data unnecessarily
All processing aligns with:
- The Cyber Security Act, 2023
- Industry standards such as ISO/IEC 27001
8. Liability and Indemnification
8.1 Limitation of Liability
To the fullest extent permitted by law, PentestPilot’s total liability shall not exceed the Fees paid for the relevant service.
8.2 Exclusion of Damages
PentestPilot shall not be liable for:
- Indirect or consequential damages
- Loss of profit, data, or reputation
- Security incidents occurring after service completion
- Failure to implement recommendations
8.3 Client Responsibility
You agree to indemnify PentestPilot against claims arising from:
- Lack of proper authorization
- Misrepresentation of scope
- Failure to remediate identified vulnerabilities
9. Professional References
PentestPilot may reference clients in a limited, non-sensitive manner, including:
- Name and/or logo
- General description of services
No confidential or technical information will be disclosed.
You may request removal at any time.
10. Sector-Specific Provisions
Where applicable, additional safeguards apply for:
- Fintech platforms
- E-commerce systems
- SaaS environments
11. Intellectual Property
All PentestPilot tools, methodologies, and frameworks remain our intellectual property.
Reports are provided under a limited, non-transferable license for internal use only.
12. Fees and Payment
Fees are defined in the SOW.
- Payment due within 30 days unless otherwise agreed
- Late payments may incur charges
- Services may be suspended for non-payment
13. Termination
We may suspend or terminate services if:
- Terms are violated
- Authorization is invalid
- Payment obligations are not met
You may terminate services subject to payment for work performed.
14. Changes and Modifications
We may update these Terms from time to time.
Continued use of services constitutes acceptance of updated Terms.
15. Governing Law and Disputes
This Agreement is governed by the laws of Bangladesh, including the Cyber Security Act, 2023.
Disputes shall be resolved through:
- Good faith negotiation
- Arbitration seated in Dhaka, Bangladesh
16. General Provisions
- Entire Agreement applies across all engagements
- Invalid provisions do not affect the rest
- No waiver unless explicitly stated
- Rights cannot be assigned without consent
17. Acceptance
By accessing or using PentestPilot services, you acknowledge that you have read, understood, and agreed to these Terms and Conditions.