Limits and commitments

A capability is only "delivered" once it is proven in the target environment. What follows is absent, partial or unproven, and remains so as long as this page says so.

Scope#

• The external pentest tests exact HTTP(S) URLs over IPv4. The full external domain, typed exclusions and custom network limits are not offered externally.
• Bare IP addresses, Git repositories, uploaded code and CI pipelines are not tested.
• The internal scan tests the application named in the mandate, not "the whole network". It must be enabled by SpectrAI on the client space.
• A target's explicit exclusions, the Guidance's out-of-scope elements, the excluded paths, the requested rate and the careful mode are test instructions, not a network policy. Only the authorised URLs (external) and the mandate (internal) are enforced at the network level.

Authorisation#

• The attestation accepted at launch does not replace a separate signed legal authorisation between you and the owner of the application. This workflow is not delivered.

Retests#

• A retest publishes an inconclusive result when the finding is not found again; it does not verify the fix. No "fix verified" verdict is issued.
• After the two batches are used up or the sixty-day window closes, no additional fix is tested free of charge.

Test accounts and data#

• Test accounts transit in clear text in the test engine and the model during execution; no erasure at the provider or on storage media can be promised.
• A confirmed purge does not prove erasure from backups nor from subcontractors' systems.

Models and coverage#

• Model profiles do not require that the provider retains nothing; no European inference region is attested; the word "sovereign" is not used.
• Consumption and duration caps are internal guardrails: neither a strict guaranteed cost, nor exhaustive coverage, nor an absence of false positives.

Compliance#

• The NIS2 index, CVSS and CWE structure the deliverable. They replace neither a regulatory audit, nor a qualification, nor a certification.

Operations#

• The platform runs pentests one after the other; a queue is possible.
• A partner's custom domain is delivered in the code and activated manually; no real partner domain has yet been exercised end to end.

Invoicing#

• No refund is performed from the application. A dispute places the contract in verification, resolved by an operator with a justification.

See also Data and privacy and the terms of use.