Testing authorization

What you are authorizing

By signing, you authorize PutThrough to review the application named in your request (the application) for security, reliability and launch readiness, using the read-only access you give us.

It covers the application’s source code, its hosting and database configuration, and its public web and mobile interfaces. It does not cover any other system, account or company.

What we will do

Within that scope, we may:

• Read the source code and configuration you give us access to
• Run automated code and dependency scanners on that code
• Send a small number of ordinary requests to the application’s public endpoints to confirm a finding, for example to check whether a table can be read without signing in
• Sign in with the test accounts you create for us, to check that one user cannot see or change another user’s data
• Keep the minimum evidence needed to show each finding, with personal data redacted

What we will never do

Anything that would write data is reproduced on a local or staging copy, never against production. We will never:

• Create, change or delete data in your production systems
• Run load tests, denial-of-service tests or anything meant to slow or stop the application
• Contact, phish or impersonate your staff, users or customers
• Test the platforms you build on, such as Supabase, Firebase, Vercel or Stripe, beyond your own project’s configuration
• Copy or keep your customers’ personal data
• Share your code, findings or report with anyone else

What you confirm

By signing, you confirm that:

• You own the application, or its owner has given you written permission to authorize this testing
• You are allowed to give us access to the accounts you share with us
• The test accounts you give us are not real customers’ accounts

When testing happens

Testing runs from the day access works until the report is delivered: normally two business days, and never more than ten. We work in Indian Standard Time.

If we find something that is exposing data or money right now, we tell you by email the same day rather than waiting for the report.

Confidentiality and access

Your code, configuration and findings are confidential. We delete our working copies within 30 days of delivering the report, unless a fix sprint you book needs them.

Remove our access once the report arrives; the delivery email lists every place you added it. An NDA and a data processing agreement are available on request and are signed before access is granted.

Withdrawing it

You can withdraw this authorization at any time by replying to our email or writing to contact@putthrough.com. We stop testing as soon as we read it. If you withdraw before we begin, we refund the fee in full.

How to sign

Reply to our email with this line: “I agree to the PutThrough testing authorization dated 1 November 2026.” Add your full name, your role and the application’s URL. Your reply is your signature, and we keep it with the engagement records.

This authorization sits alongside our terms of service, which cover the audit, its price and the guarantee.