Terms of Service

1. What this service is

Syrah operates a portal through which an organization can request a penetration test of an internet-facing domain it controls, and receive a written report describing what was tested and what was found.

The free program is limited by capacity. Eligibility requires an organization account, a verified domain, and a free seat granted by Syrah. A seat may be revoked; revocation does not affect an engagement already in progress.

One free engagement may be accepted per organization per calendar month, counted in Coordinated Universal Time. Declined or cancelled requests do not consume the month.

Paid (Pro) engagements are scheduled separately and may run weekly, or daily where agreed.

2. Scope of a free engagement

A free engagement covers the verified domain and hostnames beneath it that resolve to infrastructure attributable to the organization. Hostnames hosted by third parties are listed in the report as out of scope and are not tested.

Authenticated testing is supported on the free program. Where the organization supplies a test account, token, or instructions, the engagement may exercise the authenticated surface. Credentials are encrypted before storage, are readable only by Syrah operators, and may be withdrawn by the organization at any time before the engagement closes.

Mobile applications, hardware devices, and assets outside the verified domain are not included in the free program and are available only by separate agreement.

Syrah does not perform denial-of-service testing, does not attempt to persist access, and does not exfiltrate customer data beyond the minimum necessary to demonstrate a finding.

3. Disclosure of findings (free program)

A confirmed vulnerability identified during a free engagement is reported to the organization first, with enough detail to reproduce and fix it.

Syrah may publish a technical description of the issue so that other operators of similar systems can defend against it.

We never name your organization in a disclosure, and never identify the affected asset, without your written approval. That applies on the free program and on Pro alike.

4. Reports

Every engagement produces a report, including engagements in which no findings are identified. A report states the scope tested, the hostnames excluded and why, the testing window, the technique catalogue version applied, and the limits of the engagement.

Free reports are produced by an autonomous agent and are not reviewed by a person before delivery. We say so on the pricing page and in the engagement view, and the report states it as well.

Pro reports are reviewed by an engineer before delivery.

Reports are delivered to the organization through the portal. Each report file is versioned and its digest is recorded at upload.

5. Customer responsibilities

The organization must be entitled to authorize testing of every asset it submits, and the person submitting a request must be authorized to do so on the organization's behalf.

The organization must keep the verification record in place while it holds an active domain. If the record is removed, Syrah may suspend new engagements for that domain.

6. Availability and liability

The free program is provided without warranty. Engagements are scheduled according to capacity and no completion date is guaranteed.

To the maximum extent permitted by law, Syrah's liability arising from the free program is limited to the amount paid for it, which is zero. Nothing in these terms limits liability that cannot lawfully be limited.

7. Changes

These terms are versioned. Each request records the version accepted at the time it was made, and a report always refers to the version that governed its engagement.