EXTERNAL10 Back to the site

Terms

Terms of service

These terms apply when you request an external penetration test from EXTERNAL10, a service of SCORE10 SL, CIF B23860547, 29670 Marbella, Spain. They are deliberately short. If something is unclear, ask before you sign up.

Last updated 11 September 2026

  1. 01

    The service

    Our standard service is an external test of explicitly agreed internet-facing hosts, followed by a written report with findings and prioritised remediation guidance. A separate, limited highlights campaign offers a no-charge external assessment and only a brief overview; the detailed report is an optional, separately ordered purchase. In either case, the exact signed engagement terms govern the named hosts, methods and testing window. We work from the internet only, without customer-supplied credentials.

  2. 02

    Authorization

    Submitting or verifying a signup expresses interest only. It is not authorization to test. Before any customer testing, a signatory authorized for the specifically named hosts signs the exact engagement scope and permitted window. For the standard offer, these general authorization limits also apply:

    • The customer authorizes SCORE10 SL (EXTERNAL10) to assess the primary domain and related customer-controlled subdomains, including discoveries during testing, for 30 days from signature. Listed hosts define minimum report coverage; additional coverage is not guaranteed. Testing may begin immediately after signature.
    • Testing may include low-impact vulnerability scanning and controlled validation within that scope. It will not intentionally damage data, lock out users or disrupt operations.
    • Testing of third-party systems requires separate permission.
    • Results are confidential and the customer may request that testing stops at any time.
  3. 03

    Scope

    In scope:

    • Listed starting hosts define minimum report coverage; related customer-controlled subdomains are also authorized
    • Up to two business days of active external testing within the authorized customer-controlled domain and testing window
    • A reviewed report covering the agreed test, evidence, limitations and prioritized recommendations

    Out of scope:

    • Denial-of-service or anything that degrades availability
    • Phishing or social engineering of your staff
    • Physical access and on-site testing
    • Internal testing, and testing with credentials you give us. We never receive passwords from you
    • Third-party SaaS you do not operate yourself
    • Other domain roots or third-party systems without authorization
    • Authenticated testing, supplied credentials and account/role testing unless separately agreed
  4. 04

    Timing

    Testing may begin immediately after signature; active testing takes up to 2 business days and the complete reviewed report is prepared regardless of purchase. A free overview summarizes the work; payment unlocks full report delivery. The standard authorization lasts 30 days from confirmation. Campaigns use their signed testing window, with the same full assessment and report quality; no testing occurs outside that window.

  5. 05

    Price and payment

    Optional full report delivery: 1 000 EUR per engagement, excl. VAT. Prices exclude VAT. Spanish IVA (21%) is added for customers in Spain. EU businesses with a valid VAT number are invoiced under reverse charge. Customers outside the EU pay no VAT.

    The full pentest and complete report are prepared at no charge. Receive a free overview, then choose whether to buy delivery of the full report for 1 000 EUR.

    The assessment and brief overview cost 0 EUR. The same full penetration test and complete report preparation are performed whether or not the report is purchased. Its optional 1 000 EUR detailed report requires a separate order and verified full payment before release. Signing a no-charge assessment agreement does not order or pay for that report. The exact signed campaign addendum takes precedence over conflicting standard commercial or method terms.

  6. 06

    What a test is, and is not

    A penetration test is a snapshot of what an outside attacker could find in a limited time window. We cannot guarantee that every weakness is found, and a clean report is not a certification or a promise that your systems are secure. Fixing what we report is your responsibility.

  7. 07

    Confidentiality

    Everything we learn about your systems, and everything you learn about our methods, stays between us. The report is delivered to you alone. We may say that you are a customer only with your permission.

  8. 08

    Liability

    We test carefully and never intentionally damage data or disrupt operations. Our total liability for an engagement is limited to the fee you paid for it. We are not liable for indirect losses such as lost revenue or lost data, except where Spanish law does not allow such a limitation.

  9. 09

    Law and disputes

    Spanish law applies. Disputes go to the courts of Málaga, Spain, unless the law gives you the right to another venue.

  10. 10

    Contact

    [email protected]