Authorization and scope
Syber tests only the surfaces you authorize. For the free baseline assessment, booking requires that the work email used shares the registrable domain with the site being tested, which is a simple first check of authorization. For continuous and targeted work, a signed scope document supersedes that check. Syber does not probe anything outside the scope you give it, and does not pivot through your infrastructure to reach third parties.
What the agents will and will not do
When an agent needs to confirm a flaw, it takes the smallest proof that settles it, then stops. Denial-of-service testing runs only with your written, change-controlled approval, and social engineering only under a separate red-team agreement. Physical and wireless testing sit outside Syber's work, and agents leave no persistence or implants behind.
The fix flow
Syber proposes every fix. Your engineers review it, adjust it if they choose, and ship it through your own release process. Syber does not ship code or configuration changes to your production systems; your team does. Once the change is live, Sentry retests the path and records whether it is closed.
Data Syber touches, and how it is handled
While testing, agents observe your application's responses and capture the minimum evidence needed to reproduce a finding, typically a request and response pair and a screenshot. Syber treats all of it as confidential, stores only what reproduces a finding, and purges it on the schedule set in your engagement contract, as the privacy policy describes. If an agent encounters sensitive values, it masks them in place and flags the finding rather than copying the data out. Every finding is yours to keep, and Syber does not sell findings or publish or name you without written consent.
Model training policy
Syber's agents run on an offensive security model Syber trains in-house. Each engagement teaches the model at the level of attack technique, meaning what worked, which paths chained and which fixes held. Customer data and personal data are not used for training.
Disclosure
Syber reports findings to you, and to a licensed partner only where your engagement includes one. Syber does not disclose a client's findings publicly, and does not name a client without written consent.