Trust + Safety Center

By purchasing and using MSP Pentesting services you agree to these terms in full. If you do not agree, do not use the platform.

MSP Pentesting provides automated and AI-assisted penetration testing services. All testing is performed exclusively on targets for which you have provided explicit written authorisation.

Credits are non-refundable once a pentest job has been dispatched to our backend systems.

We reserve the right to suspend or terminate accounts that violate these terms without notice or refund.

These terms are governed by the laws of the United States.

We collect only the data necessary to provide our services: your email address, payment information (processed by Stripe — we never see card details), and scan targets you submit.

Scan results and reports are stored in Google Cloud Storage, accessible only to you and our backend systems. We do not sell or share your data with third parties.

We use Firebase Authentication for identity management. Firestore is used to store account and pentest metadata.

You may request deletion of your account and associated data at any time by contacting support@msppentesting.com.

You must have explicit, written authorisation from the system owner before submitting any target for testing. Verbal permission is not sufficient and will not be accepted as a legal defence.

By submitting a target you are legally attesting that you own the system or hold current, documented permission from the owner to conduct penetration testing on it. This attestation is binding.

Submitting targets you do not own or have not obtained authorisation for is a criminal offence. In the United States, the Computer Fraud and Abuse Act (CFAA, 18 U.S.C. § 1030) imposes severe penalties — including fines and imprisonment — for unauthorised access to protected computers. Similar laws apply worldwide (e.g., UK Computer Misuse Act 1990, Canada's Criminal Code s. 342.1, EU Directive 2013/40 on attacks against information systems).

MSP Pentesting relies on your attestation in good faith and performs no independent verification of ownership. You bear sole legal and financial responsibility for any targets you submit. We will cooperate fully with law enforcement if we receive a credible complaint regarding unauthorised testing.

Customer explicitly represents, warrants, and covenants that it owns, or has obtained all necessary valid written consents and authorizations from third parties to conduct automated security assessments on, every IP address, host, network, domain, and application submitted to the Software.

Customer agrees to defend, indemnify, and hold harmless Provider against any third-party claims, costs, or damages arising out of Customer's failure to secure proper authorization for submitted targets.

Before any scan is dispatched, the platform requires the user to explicitly confirm — via a mandatory checkpoint in the launch workflow — that they own or have written legal authorization to test every target submitted, and this confirmation is recorded with a timestamp, user identity, and target parameters.

To the maximum extent permitted by applicable law, Provider's total aggregate liability arising out of or related to the AI Pentesting Module shall not exceed the total fees actually paid by Customer for said module in the three (3) months preceding the event giving rise to liability.

In no event shall Provider be liable for any indirect, incidental, consequential, downtime, service interruption, or loss of profits arising from or in connection with automated vulnerability scanning or testing.

Customer acknowledges that automated AI pentesting is designed as a supplementary scanning utility and does not constitute a comprehensive manual penetration test or guarantee the complete elimination of security vulnerabilities.

Pentest report PDFs and their associated metadata records are retained for 90 days from the date of generation. After this period, both the stored PDF files (Google Cloud Storage) and the corresponding Firestore report records are automatically and permanently deleted.

Report deletion is handled by an automated daily cleanup job running at 03:00 UTC. This job permanently removes report files and records older than 90 days. Deleted reports cannot be recovered — please download and archive any reports you need before the retention period expires.

Pentest metadata (target, status, findings summary, timestamps) stored on the pentest document itself is retained indefinitely for audit and historical tracking purposes. Only the full report PDF and its dedicated Firestore record are subject to the 90-day retention.

Users may request early deletion of specific reports by contacting support. Account deletion requests will trigger deletion of all associated reports and pentest data within 30 days of the request.

If you discover a security vulnerability in the MSP Pentesting platform itself, please disclose it responsibly to security@msppentesting.com. We encourage the use of our PGP key (available on request) for sensitive findings.

We commit to acknowledging your report within 48 hours, working to remediate confirmed issues within 30 days, and not pursuing legal action against good-faith security researchers who follow responsible disclosure practices.

We do not currently operate a bug bounty programme, but we will credit researchers who assist us in improving our security — including public acknowledgment where permitted.