Terms of engagement for red team and blue team work

The engagement is between App Attic Ltd (company number 13045669, England and Wales) and the client named in the statement of work. The client confirms, in the letter of authorization, that it owns or controls every asset in scope, or holds written permission from the owner.

• A merchant authorizes testing of its own store, theme, apps, staff accounts and integrations.
• An agency authorizes testing of its own systems, and supplies a separate authorization from each merchant whose store is in scope.
• A theme or app developer authorizes testing of its own code, infrastructure and development stores, not of merchants who installed the product.

Only the assets listed in the signed scope schedule are in scope: named store domains, theme IDs, app handles, API endpoints, repositories, staff and collaborator accounts, and integrations. Anything not listed is out of scope, even if it's reachable from something that is.

• Shopify's own platform is always out of scope. We don't test Shopify's infrastructure, admin, APIs or checkout beyond the way your configuration uses them. A suspected flaw in Shopify itself is reported to Shopify through its HackerOne program, under that program's rules, and we tell you we did.
• Third-party apps and themes are in scope only as installed and configured on your assets. Their vendors' infrastructure is not.
• Scope changes are agreed in writing, in a signed change to the scope schedule, before testing extends to them.

• Testing happens only inside the agreed window, in the agreed time zone, and from the source IP addresses we declare before we start.
• No denial of service or load testing against any live system. Shopify's program excludes it, and so do we.
• No destructive actions: no deleting data, cancelling orders, changing prices or settings, or sending messages to your customers, unless a specific action is listed in the rules of engagement with a named approver.
• Social engineering of your staff (phishing, pretext calls, impersonation) happens only if listed in the rules of engagement, with a named sponsor who knows the dates, and never against Shopify staff or support.
• Real customer data is touched only as far as needed to prove a finding. Where a staging or development store exists, we test there first.
• Stop conditions: you can halt testing at any moment through the emergency contact. We halt on our own if we find signs of a real, ongoing intrusion, and tell you within the hour.

• Access is granted through a Shopify collaborator request or a dedicated staff account with the least permissions the scope needs, recorded in the access record with start and end dates.
• We use dedicated accounts per engagement, with two-step authentication, never shared logins.
• Access is revoked by you, and confirmed by us, at the end of the engagement or on request at any time.

• We collect only what proves a finding: a screenshot, a record identifier, a redacted sample. We don't export customer lists, order histories or payment data.
• Everything we hold is encrypted at rest and in transit, on devices and storage controlled by App Attic, inside the UK or EU unless agreed otherwise.
• Where we may encounter personal data, a data processing agreement is signed under UK GDPR before testing starts, with App Attic as processor and you as controller.
• Working data is deleted within 30 days of the closing letter, and the report is kept for the retention period in the statement of work. Deletion is confirmed in writing.

A mutual NDA covers the engagement. Findings go only to the contacts named in the statement of work. We don't name you as a client, quote the engagement, or publish anything about it without written permission. The same confidentiality continues after the engagement ends.

• A flaw in Shopify itself goes to Shopify through HackerOne, under the program's disclosure rules, which include not disclosing publicly before resolution.
• A flaw in a third-party app or theme goes to its developer first, which is what Shopify's policy asks for. You get the finding and a workaround the same day, so you're protected while the vendor fixes it.
• We don't publish or present findings from your engagement, anonymized or not, without your written permission.

• A daily check-in during the testing window, and immediate notice of anything critical.
• A written report: each finding with severity, how to reproduce it, the evidence, the exact fix and who should do it, plus a summary for whoever signs the invoice.
• A retest of every finding you fix within the retest period in the statement of work, and a closing letter that lists what was found, what was fixed, and what you chose to accept.

Fees, payment terms, the testing window and the retest period are set in the statement of work. Work that falls outside the scope schedule is quoted separately and starts only after a signed change.

• Authorized testing carries a small risk of disruption even with the rules above. You agree to hold a current backup of theme code, settings and data before the window opens, and to tell us about anything fragile.
• We carry professional indemnity insurance; the certificate is available on request and the cover amount is stated in the statement of work.
• Each party's liability is limited as set out in the signed statement of work, except where the law doesn't allow a limit. Nothing here limits liability for fraud or for breach of the NDA.

Either party can end the engagement in writing. Testing stops the moment we receive the notice. You pay for work done to that point, we hand over what we found so far, revoke our own access, and delete your data on the normal schedule.

These terms and every signed engagement document are governed by the law of England and Wales, with the courts of England and Wales having exclusive jurisdiction, unless the statement of work says otherwise.