A clear agreement.
Before the first test.

Identify the assets and environments included in the audit, exclusions and the person authorized to approve testing. Agree on access to authenticated APIs and any relevant third-party permissions.

Set the testing window, permitted techniques, operational contacts and how testing will be paused if a service is affected. Record any restrictions on production testing or access to sensitive data.

The engagement defines confirmation evidence, severity assessment using CVSS and the price cap for your scope. Prices per severity are fixed in USD. Vulnerabilities you disclose before testing are not billed, several manifestations of one root cause count as one finding, and a disputed finding is not billed until the dispute is resolved.

Payment depends on confirmed vulnerabilities and severity. No findings means no audit fee. Your agreed cap is the maximum audit fee before applicable taxes. If the findings add up to more, every additional confirmed vulnerability is still included in your report at no extra charge.

A service agreement and NDA are available. Access to audit materials is restricted to people who need it for the engagement. Materials are deleted at the client’s request or after one month; a longer retention period can be agreed at the client’s request. Secure transfer, storage and any applicable data processing terms are documented for the engagement.

From signing the agreement to your report: up to one week. We deliver 90% of reports within one day. The engagement defines the report format and communication of findings. Retesting the vulnerabilities you paid for is free for 60 days after the report.

The agreement should identify the contracting parties and cover invoicing, tax treatment, cancellation, liability, governing law and dispute resolution. Contact legal@synt.world to discuss the agreement.