Using this website and the client portal.

About these terms

These terms apply to this website and to the 1ST Cyber client portal. By creating an account or using the client portal, you agree to them.

Registered name

1ST CYBER LTD

Company number

17492640

Registered in

England and Wales

Registered office

Icon Office, 182-184 High Street North, London, England, E6 2JA

Each engagement is also covered by its own agreement with your organisation. If that agreement and these terms differ, the engagement agreement applies.

Your account

• Each account is for one person. Use your own work email address and don’t share your sign-in details.
• Use a strong password that you don’t use anywhere else, and keep it private.
• You’re responsible for what is done with your account. If you think someone else has used it, tell us straight away.
• You’re signed out automatically after eight hours.
• We can deactivate an account that is used in breach of these terms. Deactivating an account signs it out straight away.

Authorising a penetration test

We test only the assets listed in the version of the scope you approve and authorise in the client portal. When you authorise a scope, you confirm that you have authority over the listed assets and that 1ST Cyber may test them.

Changing what we may test, how, or within which dates creates a new version of the scope, which you review and authorise. If a change removes or limits anything we may test, testing stops at once and doesn’t start again until you have authorised the new version. If we propose a change, or you only add to what we may test, we keep testing only within the version you last authorised until you authorise the new one. You can stop testing at any time. Contact details, and booked dates inside your authorised window, can be updated without a new version. Every change is recorded.

If an asset in your scope is hosted or run by someone else, such as a cloud provider, a hosting company or a managed service provider, you confirm that you have any permission their terms require for it to be tested, and that you’ll give us a copy if we ask. We may pause testing of an asset until you have.

What you share with us

• Upload only documents and information you have the right to share with us.
• Every uploaded file is checked for malware. A file stays in quarantine, and can’t be downloaded, until it passes the scan. A file in which malware is found is blocked.
• Don’t use the client portal to send anything unlawful or unrelated to your engagements.

Findings and reports

Findings, evidence and reports are released to your organisation once the report has been reviewed and published in the client portal. Everyone in your organisation with a client portal account can then see them.

We keep your findings and reports confidential, and share them only as this page and our privacy notice describe. Your organisation may use them for its own purposes, including sharing them with its auditors, insurers, regulators and suppliers who need them. We keep the rights in our methods, tools and templates; the engagement agreement may say more.

Using the site responsibly

• Don’t try to access accounts, engagements or files that aren’t yours.
• Don’t test the security of this website or the client portal except as our vulnerability disclosure policy allows.
• Don’t overload the site, for example with high-volume automated requests, or try to get round its limits on repeated attempts.
• Don’t use the site in any way that breaks the law.

Changes to the site and these terms

We may change the website and the client portal. We’ll update these terms when they change.

We aim to keep the client portal available, but can’t promise it will always be, for example during maintenance. Nothing in these terms limits liability that can’t be limited by law. Otherwise, our liability for an engagement is as set out in its engagement agreement.

Governing law

These terms, and any dispute about them or about your use of this website or the client portal, are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Questions about these terms

Contact us or email privacy@1stcyber.co.uk. Our privacy notice explains how we handle your personal information.