Legal & ethics
Acceptable use & authorization
This policy is the foundation of everything we do. It states plainly what we will help with, what we will always refuse, and how we confirm you are authorized to request testing on a system.
Last updated: January 15, 2026
What we will do
- Test systems, networks and apps you own or control
- Investigate incidents on your own infrastructure
- Help you recover devices and accounts you own
- Support fraud and identity-theft victims lawfully
- Teach defensive and ethical hacking in isolated labs
- Report vulnerabilities responsibly and confidentially
What we will never do
- Access someone else's account, email or social media
- Track, spy on or locate another person's device
- Launch DDoS or any attack against third parties
- Dump, steal or alter databases you don't own
- Crack WiFi or networks you are not authorized on
- "Hack back," forge credit records or falsify evidence
Authorization & proof of ownership
Before any testing begins, we require written authorization naming the assets in scope and confirming you own them or have permission from the owner. Depending on the engagement we may ask for domain or infrastructure ownership records, a signed scope document, or confirmation from the asset owner. If authorization cannot be established, we will not proceed.
Good faith. Authorization is not a formality — it is what separates a professional security assessment from a crime. We verify it every time.
Rules of engagement
Every engagement runs under agreed rules: defined scope, testing windows, rate and intensity limits, escalation contacts, and data-handling procedures. Findings are handled confidentially, evidence is stored securely, and anything discovered outside scope is reported — never exploited.
Our refusal policy
We refuse any request that involves unauthorized access to a third party, harm to people or systems, or other illegal activity — regardless of payment. Requests that appear to involve imminent harm or illegal conduct may be reported to the appropriate authorities. This policy protects our clients, our team and the public.
Related: Terms of Service · Privacy Policy · How to spot a scam
Have a lawful security need?
If you own or control the systems in question, we're ready to help. Tell us the scope and we'll confirm authorization and next steps.