Terms & Rules of Engagement
The basis on which we test. Plain English, because a document nobody reads protects nobody.
Last updated 9 September 2026
1. Who we are
PenTest Online provides independent website security testing to businesses in the United Kingdom. Contact: hello@penetrationtest.online.
2. What the service is
We test the website and hosts you list, using two independent commercial-grade scanning engines, and cross-verify the results so duplicated and contradictory findings are resolved before you see them.
- Dual-engine scan (£250 per website) — both engines run against the agreed scope, findings cross-verified and reported with severity and remediation guidance.
- Manual-verified report (£750 per website) — as above, plus hands-on verification of each finding to remove false positives, with a written report suitable for sharing with clients, insurers or auditors.
Prices are per website, fixed in advance, and not subject to VAT. Retests after remediation are a separate chargeable engagement, because each retest is a genuine additional scan.
3. Authorisation is a precondition
Testing a computer system without authority is an offence under the Computer Misuse Act 1990. We will not test anything until you have confirmed, in writing, that you own the systems in scope or hold written authority from the owner to permit testing.
You agree to tell us immediately if that authority is withdrawn or the scope changes. We may decline or halt any engagement where authorisation is unclear, and we reserve the right to ask for further evidence of control over a domain.
4. What you are responsible for
- Holding a current, tested backup of the site and its data before testing begins.
- Obtaining your hosting provider or agency’s permission where their terms require it.
- Telling us about fragile functionality, rate limiting, WAFs, or anything that should be excluded.
- Making sure the contact details you give us are monitored, since the report is delivered by email.
5. What testing involves, and its risks
Testing generates a high volume of automated requests. This will appear in your logs, may trigger security alerts, and may create test entries through forms. Although we work to avoid disruption, automated testing of a fragile application carries a small but real risk of errors, degraded performance or unexpected behaviour. You accept that risk, which is why clause 4 requires a backup.
We do not carry out denial-of-service testing, social engineering, physical intrusion, or any testing outside the hosts you have listed and authorised.
6. Findings are a point in time, not a guarantee
A report describes what was found on the systems in scope at the time of testing. It is not a certificate, a warranty, or proof that a system is secure. An absence of findings does not mean an absence of vulnerabilities. New weaknesses appear as code, configuration and third-party components change.
We do not claim, and you should not represent to anyone else, that a report from us constitutes certification or regulatory compliance.
7. Your report and your data
Reports are delivered as an encrypted attachment, with the passphrase sent by a separate channel. Findings about your systems are confidential and are not shared with anyone else, used in marketing, or published as a case study without your written consent.
How we handle personal data is set out in our privacy policy.
8. Payment
We confirm scope and price in writing before any testing. Payment terms are agreed at that point. Because each scan carries a direct cost to us, cancellations after a scan has started are chargeable.
9. Liability
We provide the service with reasonable skill and care. We are not liable for indirect or consequential loss, loss of profit, or loss of data. Nothing in these terms limits liability where it cannot lawfully be limited. Any total liability is limited to the fee paid for the engagement in question.
10. Governing law
These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.