Penetration tests are illegal without prior written authorisation (FR art. 323-1 to 323-3 CP, EU NIS2 art. 21, US 18 USC §1030).
1 — Test authorisation
The signatory, acting in name and on behalf of the company named above (the "Client"), expressly authorises ASC-IT (the "Provider") to carry out a security audit and penetration testing on the assets defined in Step 3 (the "Scope"), in accordance with the methodology and intrusiveness levels selected in Step 4.
2 — Mandate & capacity
The signatory declares (i) being duly authorised by the legal entity to sign this authorisation, (ii) being the lawful owner of the assets in scope or having obtained explicit written consent from every owner of said assets, and (iii) bearing full responsibility towards any third party affected by the testing.
3 — Scope limitation
The Provider undertakes to remain strictly within the boundaries of the agreed Scope. Any asset outside this list is expressly excluded. The Provider will immediately stop and notify the Client if it discovers personal data of third parties, weapons-grade vulnerabilities, or signs of an unrelated ongoing intrusion.
4 — Operational safety
Testing will be performed during the intervention window declared in Step 5. The Provider will not knowingly cause denial of service unless DoS testing has been explicitly authorised. Destructive payloads (data deletion, ransomware-like behaviour) are prohibited at all intrusiveness levels.
5 — Confidentiality & data protection
All information exchanged is treated as Confidential Information. The Provider commits to GDPR (Reg. EU 2016/679), only processes personal data strictly required for the engagement, and deletes such data within 60 days of report delivery. A DPA is available on request.
6 — Deliverables & ownership
The deliverable is a written penetration testing report, ranked by CVSS v3.1 severity, with technical evidence and prioritised remediation guidance, plus an oral debriefing meeting (kmeet, Infomaniak). All deliverables become the property of the Client upon payment in full.
7 — Liability
The Provider's liability is limited to the amount paid for this engagement. The Client acknowledges that penetration testing carries inherent operational risks (transient unavailability, log noise, false positives in monitoring) and accepts these.
8 — Applicable law & forum
This authorisation is governed by French law. Any dispute will be submitted to the competent courts of Toulouse, France, unless the Client is a consumer in which case the consumer's domicile court applies.
9 — Electronic signature
Pursuant to eIDAS Regulation (EU) 910/2014, the Client agrees that the typed signature, capture of timestamp, IP and user-agent below constitute a valid electronic signature with full legal effect.