Project lifecycle
Every engagement follows a controlled delivery process. The details can vary by service, but the basic flow stays the same.
- Customer requirement — SafeYourWeb receives the requirement, objectives, assets, timeline and contacts.
- Scope and objectives — In-scope assets, exclusions and permitted activities are defined.
- Captain selection — Selection is based on verified skill, level, availability and project needs.
- Rules of Engagement — Authorization, testing window, limits, prohibited activities, escalation and evidence rules are confirmed.
- Access — Least-privilege project access is provided for the assignment.
- Authorized security work — The Captain performs only approved activities and documents evidence.
- Escalation when needed — Critical findings, instability, unexpected data exposure or scope ambiguity are escalated.
- QA — Technical accuracy, evidence, severity, remediation and report quality can be reviewed.
- Customer delivery — Approved deliverables are shared with the customer through SafeYourWeb where applicable.
- Retest when included — Remediation is validated when retest is included and authorized.
- Closeout — Access is revoked, evidence is handled according to policy and records are archived.
How matching works
Eligible Captains can be matched based on factors such as:
- Primary specialization and secondary skills
- Captain level
- Relevant project experience
- Availability
- Location or travel requirements
- Communication requirements where applicable
- Conflict-of-interest checks
- Customer-specific requirements
- Verification requirements where applicable
- Performance and quality history
Do not assume fully automated matching. Early program operation can be admin-assisted. You still review scope and terms before accepting an assignment.
Rules of Engagement
These rules protect customers, Captains and SafeYourWeb. They are not optional.
Always
- Only test systems you are authorized to test.
- Stay within the written scope, time window and permitted techniques.
- Use only assigned credentials and access.
- Escalate serious findings through the designated channel.
- Stop and escalate if testing may cause disruption.
- Follow data retention and deletion rules.
Never
- Do not keep customer data outside approved processes.
- Do not contact third parties discovered during an engagement without authorization.
- Do not publish customer data or findings without written approval.
- Do not use privileged access outside the assigned account and process.
- Do not test systems that are outside the written authorization.
Working with customer data
Customer evidence and project data must stay inside approved storage and communication channels. Do not copy customer data into personal tools, personal storage or public places.
If unexpected sensitive data appears during testing, stop, protect the data and escalate through the designated process. Do not share it outside authorized channels.
Quality and performance
Work can be reviewed for:
- Technical quality
- Evidence quality
- Report quality
- Delivery
- Customer feedback
- Policy compliance
- Communication and teamwork
Quality feedback can affect future eligibility and growth. Repeated quality or delivery problems can lead to restrictions. Serious policy issues are covered under suspension and re-activation.