Terms
These terms cover observ.si and a request sent through it. A test is governed by the scope and the engagement you sign. If those documents and this page ever differ, the signed documents govern the test.
Who we are
Observ is the pentesting service of Cipher Projects.
- Cipher Projects, 61 Ainsworth Street, Mawson, Canberra ACT 2607, Australia.
- Service email: [email protected].
- Company email: [email protected].
A booking request
The form asks for your name, company, and email, and it records which service the page offered. Sending it asks us to contact you. It does not create a contract, it does not reserve a window, and it does not start a test. This site does not take payment.
The services
Two fixed prices are published on the site, in US dollars. A host pentest is one host you name, at $3,995. An AI agent pentest is one agent or LLM app, at $5,995. Work outside that scope is quoted before anything is signed.
Cipher Projects is registered for Australian GST. The engagement states whether GST is added, before you pay.
What starts a test
A deposit reserves a window. The amount, and when it is refunded, are in the engagement we send you. Written authorization and a signed scope start the test. Payment alone does not.
We start only with written authorization for a system you control. We turn down a third party, a model provider, a request for exploit code or a weaponized payload, and a production target you will not schedule a window for.
What a test includes
Once a scope is signed, the service pages describe what is included: a report, a signed attestation letter, a debrief, and one retest of the findings you have fixed, requested inside 90 days of the report. The retest checks those fixes. It is not a second full test.
Those pages also state the usual timing. Testing starts within 10 business days of the signed scope, and the report follows within 5 business days of testing. The signed scope confirms the host or agent, the dates, and the rules of engagement for that test.
The letter
The attestation letter states what we tested, when, and the results. It is for your auditor or a customer's security review. Observ is not a SOC 2 or ISO 27001 auditor and does not certify compliance. A test is not a promise that every issue was found.
Your responsibilities
You send authorization you are allowed to give, an accurate scope, and a window when the target can be tested. You do not use the report, or anything else from the test, against a system outside that scope.
The site
The pages describe the service. Do not misuse the form, try to disrupt the site, or submit a request for a target you are not allowed to have tested. How we handle personal data is in the privacy policy.
Liability
Liability for a test is set in the engagement. Nothing on this site limits a right that the law does not allow us to limit.
Law
These website terms are governed by the laws of the Australian Capital Territory, Australia.
Changes
If these terms change, we update the effective date at the top of the page. The engagement you sign is the copy that applies to that test.
Contact
Questions can go to [email protected] or to Cipher Projects at [email protected].