Before any test begins, the client must own the target assets or hold the owner's written authorization. We sign a penetration testing authorization agreement with every client, defining scope, time windows and emergency contacts.

Unauthorized testing of third-party systems may violate applicable laws. The Gabala platform enforces an authorization statement when creating missions and retains the full audit trail.

All attacks run in isolated sandbox containers with rate control to protect availability. Exploit verification follows No PoC, No Finding — minimal action, proof, stop.

Security experts stay in the loop throughout and can inspect progress, intervene or abort missions at any time through the chat interface.

Credentials, screenshots and evidence gathered during testing are encrypted at rest and used solely for report delivery. After delivery, data is sanitized or destroyed per agreement; NDAs available on request.

Targets the client does not own and has no written authorization for; unlawful purposes; any unauthorized probing of third-party systems. Unsure about your scope? Contact us and we'll help you clarify.