01
Before anything is touched
A written scope, rules of engagement, testing windows and named contacts. If the scope changes, it changes in writing before work continues.
Working together
The parts that matter after the call.
Scope, confidentiality, access and payment. These are the questions serious buyers ask in the first conversation, so they are answered here instead of in a five-email thread.
02
Confidentiality
NDA on request, and strict confidentiality by default. Client names, findings and data stay private. Case studies on this site are only published with permission.
03
Handling your data
Test data is kept to what a finding needs. Evidence is stored encrypted, shared through a link rather than email attachments, and deleted when the engagement closes unless you ask otherwise.
04
Access
Least privilege, named accounts, and removal of my access at the end of the engagement. Any credentials shared are rotated or destroyed with your confirmation.
05
Commercial terms
Fixed fee agreed before work starts. Typically 50 percent on signature and 50 percent on delivery. Change requests are quoted and approved in writing, never added silently to the invoice.
06
Availability
Based in Skopje, CET. I keep mornings free for US East clients and afternoons for Europe. Critical findings are reported as soon as they are confirmed, not held for the final report.
What I need from you
Four things, before day one.
- 01
The scope: URLs, applications, IP ranges or accounts to be tested.
- 02
One technical contact and one escalation contact, with phone numbers for the testing window.
- 03
Written approval for the testing window, or confirmation that 24/7 testing is acceptable.
- 04
Credentials for the roles that should be tested, issued to a named account rather than a shared one.
Next step
If these terms work for you, the rest is scope.
Send the system and the trigger. You will get a written scope, fixed fee and start date, and the confidentiality terms you need before anything is shared.
Typically replies within one business day. NDA on request.
hello@enesismaili.com