Terms of Engagement
Last updated: 22 September 2026
These Terms of Engagement describe the general terms under which AttackSurfaceCheck (AttackSurfaceCheck) provides External Attack Surface Check services, and the terms under which this website may be used. They apply alongside the specific written scope, authorization, and Rules of Engagement agreed for each individual assessment, not instead of it.
1. Website use
This website provides information about AttackSurfaceCheck’s services. You may browse it and submit enquiries through the forms provided. You agree not to misuse this website. For example, by attempting to disrupt its operation, submit false or malicious form data, or extract content for unauthorized redistribution.
2. Requesting an assessment does not authorize testing
Submitting the Request Assessment form, or any other enquiry, is an expression of interest only. It does not authorize any security testing of any kind. No scanning, probing, or investigative activity against your systems begins until a written scope of work and a signed Rules of Engagement (RoE) document have been agreed between you and AttackSurfaceCheck. The RoE defines, at minimum: the authorized organization and target scope, explicit exclusions, the testing window, permitted and prohibited techniques, an emergency contact, and data-handling terms.
3. Nature of the service
An External Attack Surface Check is an independent, outside-in assessment. It combines automated discovery techniques with manual, human-led analysis and validation. See our Methodology page for a full description. Because it is based on externally observable information and agreed testing boundaries, no assessment can guarantee the discovery of every possible exposure, and the absence of a reported finding does not constitute a guarantee of security.
4. Client responsibilities
Before an engagement begins, you confirm that you have the legal authority to authorize testing of the systems and domains within the agreed scope, whether as the owner of that infrastructure or with the explicit permission of the owner (for example, a hosting provider or ultimate parent company). You are responsible for providing accurate scoping information and for promptly flagging any system that should be excluded.
5. Confidentiality
Information exchanged during scoping, testing, and reporting, including any findings, is treated as confidential. We do not disclose the existence or content of an engagement, or any findings from it, to any third party without your written consent, except where required by law.
6. Reports and intellectual property
The assessment report and any accompanying materials are provided for your internal use in understanding and remediating the findings described. Ownership and permitted use of deliverables are set out in the individual engagement agreement.
7. Limitation of liability
Security assessments identify weaknesses observable within an agreed scope and timeframe; they cannot eliminate all risk or guarantee that no further vulnerabilities exist. To the maximum extent permitted by law, AttackSurfaceCheck’s liability in connection with any engagement is limited as set out in the individual engagement agreement. Nothing in these terms excludes liability that cannot lawfully be excluded.
8. Fictional demonstration content
The “Northstar Industries” example on our Sample Assessment page is fictional demonstration content created to illustrate the format and depth of a typical report. It does not describe a real client, a real organization, or a real security incident.
9. Governing law
These terms are governed by the laws of the Netherlands, without regard to its conflict-of-law principles, unless a specific engagement agreement states otherwise.
10. Changes
We may update these terms from time to time; the “Last updated” date above reflects the most recent revision. Individual, already-signed engagement agreements are not affected by later changes to this page.
Contact
Questions about these terms: info@attacksurfacecheck.com.