# Limits and commitments

> What SpectrAI does not do, does not promise or does not cover today: scope, confinement, retests, test accounts, models, compliance, invoicing. The list the product does not hide.

A capability is only "delivered" once it is proven in the target environment. What follows is absent, partial or unproven, and remains so as long as this page says so.

## Scope

- The external pentest tests exact HTTP(S) URLs over IPv4. The full external domain, typed exclusions and custom network limits are not offered externally.
- Bare IP addresses, Git repositories, uploaded code and CI pipelines are not tested.
- The internal scan tests the application named in the mandate, not "the whole network". It must be enabled by SpectrAI on the client space.
- A target's explicit exclusions, the Guidance's out-of-scope elements, the excluded paths, the requested rate and the careful mode are test instructions, not a network policy. Only the authorised URLs (external) and the mandate (internal) are enforced at the network level.

## Authorisation

- The attestation accepted at launch does not replace a separate signed legal authorisation between you and the owner of the application. This workflow is not delivered.

## Retests

- A retest publishes an inconclusive result when the finding is not found again; it does not verify the fix. No "fix verified" verdict is issued.
- After the two batches are used up or the sixty-day window closes, no additional fix is tested free of charge.

## Test accounts and data

- Test accounts transit in clear text in the test engine and the model during execution; no erasure at the provider or on storage media can be promised.
- A confirmed purge does not prove erasure from backups nor from subcontractors' systems.

## Models and coverage

- Model profiles do not require that the provider retains nothing; no European inference region is attested; the word "sovereign" is not used.
- Consumption and duration caps are internal guardrails: neither a strict guaranteed cost, nor exhaustive coverage, nor an absence of false positives.

## Compliance

- The NIS2 index, CVSS and CWE structure the deliverable. They replace neither a regulatory audit, nor a qualification, nor a certification.

## Operations

- The platform runs pentests one after the other; a queue is possible.
- A partner's custom domain is delivered in the code and activated manually; no real partner domain has yet been exercised end to end.

## Invoicing

- No refund is performed from the application. A dispute places the contract in verification, resolved by an operator with a justification.

See also [Data and privacy](https://docs.spectr-ai.eu/en/compte-et-securite/donnees-et-confidentialite) and the [terms of use](https://spectr-ai.eu/en/conditions).

---

https://docs.spectr-ai.eu/en/reference/limites