Authorization and exact scope
Every assessment is tied to a specific target and authorization record. Material target changes require new approval.
Careful by design, clear by default.
Our process is designed to preserve authorization evidence, limit testing impact, and protect customer information.
SunTzu follows the concept of improvement through observation and action. We observe and report what we find, and then we look at options to remediate if needed.
Non-destructive boundaries
No denial-of-service, stress testing, destructive payloads, persistence, social engineering, credential attacks, or data modification.
Human approval
Automated payment never launches a scan by itself. Authorization and risk signals are reviewed first.
Protected evidence
Authorization, workflow events, reports, and security logs are separated, encrypted, access-controlled, and retained according to policy.
Secure payment
Payment details are handled through secure hosted checkout. SunTzu systems do not store full payment-card information.
Stop and revoke
Customers can withdraw authorization. Complaints, anomalies, or authorization changes place future work on hold.