Trust
Responsible testing & authorisation
Security testing is only legitimate when it is authorised, scoped and conducted safely. This is how GoldAgent works, on every engagement, without exception.
The principle
Authorised systems only
GoldAgent performs active security testing only against systems the customer owns, or is explicitly authorised to have tested. We do not test third-party systems without authorisation, and we do not help anyone target infrastructure they do not control. Our monitoring services read public data only.
The hosted-PBX question
Many business phone systems are hosted by a provider. In those cases the customer may not be the party with authority to authorise active testing. Before any active work, we confirm that the right party has authorised the engagement, including the hosting provider's consent where it is required. If that authorisation cannot be established, we do not proceed with active testing.
Before active work begins
- A defined, written scope of systems in and out of scope
- Written authorisation from the party with authority to give it
- Provider consent where a hosted system requires it
- An agreed emergency-stop contact and process
- Confirmation that backups exist before higher-impact tests
Safe conduct
How we keep testing safe
Lockout-aware techniques
We work to avoid locking out accounts or disrupting live service during testing.
Controlled proof of concept
Higher-impact demonstrations, including any fraud proof, are non-billable by default and only run with explicit agreement.
Emergency stop
An agreed contact can pause the engagement at any point.
Least intrusive first
We start with the least intrusive methods and escalate only as scope and authorisation allow.
Data minimisation
We collect only what the assessment needs and handle findings with care.
Point-in-time honesty
A report is true on the day it is run; we say so, and offer monitoring to keep it current.
This policy describes how GoldAgent conducts engagements. It is not legal advice. Formal engagements are governed by a written agreement and an authorisation-to-test pack, which we recommend both parties review before work begins.
Find out exactly how exposed your phone system is
Request an authorised PBX, VoIP or SIP security assessment. We confirm scope and authorisation first, then show you what is exposed and what to fix.
Testing is only performed against systems you own or are explicitly authorised to test.