Testing authorization
Extra terms for every security test: the Arabic AI Red Team, the AI Red Team (English) and the Agent Red Team.
No authorization, no test
Before any test, the client signs an authorization that names the system, the owner of the system, the test window in UAE time, the request limits, the contacts on both sides, and the person who can stop the test. Our tools refuse to run without a complete authorization, against a host that is not listed, or outside the window.
The person who signs confirms that the client owns the system or has written permission from its owner to test it, including any model provider whose terms apply.
How we test
We never ask the client's system for harmful content. We plant a test secret and a fake customer record with the client and measure whether they come out, or we run the client's agent inside a sandbox with fake tools.
We stop at once if the client asks, if we see a risk to the client's live service, or if we find real personal data. Any real personal data we see is not copied into the report and is deleted.
Results and retention
The report and the raw results belong to the client and are shared only with the people named in the authorization. We keep the raw results for 90 days after the report so that we can run the retest, then delete them unless the client asks us in writing to keep them longer.