Rules of engagement
This page is a v0.1 placeholder and is not yet a binding document. It will be replaced with reviewed terms before launch.
A summary of the rules every Gadfly Cyber engagement runs under. The signed document for your engagement is the one that applies.
Written authorisation first
Testing starts only after a party with authority over the targets has signed the scope. Unauthorised use is out of scope, always.
Hard scope
In-scope hosts and domains are allowlisted at the network layer. Everything else is unreachable from the harness.
Non-destructive defaults
Agents do not delete, corrupt or exfiltrate data. Checks that could affect availability or data require your written opt-in.
Rate limits and windows
Request rates and testing hours are agreed in advance. Either side can pause the engagement through the named contacts.
Audit log
Every request made during the engagement is logged and available to you.
Human gate
Every critical finding is reproduced and confirmed by a person before it is reported.
Data handling
The model runs inside your own environment, isolated for the engagement and destroyed when it ends. Evidence is redacted of secrets and personal data before it is reported, and we retain no copy of engagement data afterward.