TouchMetrics Digital Solution
Services Directory Audit Methodology About Us Contact & Scoping
Request Pentest
Master Service Agreement

Terms of Service & Rules of Engagement

Last Updated: October 1, 2026 • Master Agreement Governing Penetration Testing & Vulnerability Audits

1. Authorization to Perform Security Assessments

By commissioning a Penetration Test, Vulnerability Assessment, or Red Team engagement with VAPT Portal, you represent and warrant that your organization has the full legal authority, ownership, or explicit written consent from the asset owner to authorize offensive security testing on the target domains, IP blocks, and cloud infrastructure specified in the Scope of Work (SOW).

2. Rules of Engagement

All security assessments are executed in strict accordance with the mutually agreed Rules of Engagement (RoE). The RoE explicitly defines:

  • In-scope hostnames, CIDR network ranges, APIs, and credentials.
  • Excluded endpoints, sensitive third-party integrations, and out-of-scope production databases.
  • Authorized testing time windows and emergency escalation contacts.

3. Non-Destructive Testing Warranty

Our security engineers conduct manual and automated verification using controlled, non-destructive methodologies. We will not intentionally perform:

• Distributed Denial of Service (DDoS) or brute volumetric flooding attacks without written consent.
• Permanent alteration, destruction, or irreversible corruption of client production data.
• Physical attacks against facilities or non-consenting employees.

4. Client Warranties & Backup Obligations

The client agrees to maintain current, verified operational backups of all in-scope systems prior to the commencement of testing. While all efforts are made to prevent system instability, security testing by nature probes unanticipated software execution paths.

5. Confidentiality & Ownership of Deliverables

Upon full payment of assessment fees, the client retains 100% exclusive intellectual property ownership of all custom vulnerability audit reports, remediation advisories, and executive summaries. VAPT Portal maintains zero ownership or right to publicize vulnerability findings without explicit mutual written consent.

6. Limitation of Liability

To the maximum extent permitted by applicable law, neither party shall be liable for indirect, incidental, or consequential damages. Our total liability for any claim arising under an engagement shall not exceed the total fees paid by the client under the specific SOW giving rise to the claim.

7. Governing Law & Dispute Resolution

These Terms shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of law principles. Any dispute arising under this agreement shall be settled through binding commercial arbitration.