Legal
Authorization Terms
These terms apply when you purchase a self-serve web VAPT from Astra Cybertech Pvt. Ltd.. By checking the authorization box at checkout you agree to them.
Last updated: 8 September 2026
1. Your authorization to test
You confirm that you own the target domain you enter, or that you are formally authorized by its owner to commission security testing of it, and that you have the authority to bind that organisation to these terms. You will not enter a domain you do not control.
2. Domain-ownership verification
Before any testing runs you must prove control of the target by adding a DNS TXT record we generate for you (or another method we offer). Testing is authorized and begins only after that record resolves. If you cannot complete verification the engagement will not start and you may request a refund.
3. Scope
The engagement covers the single web application at the verified domain, sized by the scope tier you selected. It does not include mobile or thick-client applications, network or wireless testing, social engineering, physical testing, denial-of-service testing, or any host or service outside the verified domain. Testing avoids reserved and internal address ranges.
4. Conduct of testing
Testing is performed by automated reconnaissance and vulnerability analysis followed by manual review. We take reasonable care to avoid service disruption, but authorized security testing carries inherent risk. You are responsible for having current backups and for notifying your own hosting providers and third parties as required by your contracts with them.
5. Results and reporting
Findings are withheld until reviewed and approved by one of our testers. Until then your portal shows scan status and a count of findings pending review, not their content. The approved findings and report are made available in your client portal.
6. Delivery date
The date you choose is a target delivery date and sets the service level for triage. It is not a guarantee; verification delays on your side, or findings that require deeper manual analysis, may move it.
7. Payment and refunds
Payment is taken by our payment provider (Razorpay or Stripe) and confirmed by that provider. If the engagement cannot start because domain verification fails, or we are unable to deliver, contact info@astracybertech.com for a refund. Once testing has begun, fees are non-refundable except where required by law.
8. Data
We process the contact details you provide and the technical data produced by the engagement to deliver the service, in line with our Privacy Policy. The engagement report and findings are retained in your client portal.
9. Liability
Nothing in these terms limits liability that cannot be limited by law. Subject to that, our total liability arising from a self-serve engagement is limited to the fee paid for it. We are not liable for indirect or consequential loss.
10. General
These terms are governed by the laws of India and sit alongside our Terms of Use. For anything outside the self-serve scope, contact us for a scoped engagement under a signed agreement.