Authorisation, rules of engagement and legal scope
Key takeaways
- No testing begins without a signed authorisation and rules-of-engagement document.
- The document names every system, every date, the test window, and what is excluded.
- Unauthorised access to a computer system is an offence under Section 43 of the IT Act, 2000.
- For account recovery and forensics, proof of ownership is required before we begin.
The authorisation requirement
Before any testing, AAVETech requires a written authorisation that identifies the client and confirms their authority over the systems in scope. For an organisation, that normally means a signed engagement letter from someone authorised to bind the company. For an individual, it means confirmation that the account, device or property is theirs, or that they have the owner's permission to act.
Where a client wants us to test a third party's systems, we will not do it on their authority alone. We will help them approach the third party through a legitimate channel.
What the rules-of-engagement document contains
| Clause | What it specifies |
|---|---|
| Scope | The exact systems, applications, accounts and networks in scope, listed explicitly. |
| Out of scope | The exclusions — anything not listed is not tested. |
| Time window | The dates and hours during which testing may occur. |
| Method | The permitted testing techniques, and any that are excluded. |
| Source addresses | The IP addresses we will test from. |
| Emergency contact | A named person reachable during the test, and a stop word. |
| Data handling | How client data is handled, stored and destroyed. |
| Retest terms | How remediation is verified and what a retest covers. |
The legal framework
Our work sits inside Indian cyber security law, and the obligations that apply to you depend on your sector. We work within these and flag what applies to you before we start.
| Instrument | What it requires |
|---|---|
| Information Technology Act, 2000 | Section 43 covers unauthorised access to a computer system. Section 66 covers computer-related offences. A signed authorisation is what keeps a legitimate engagement outside both. |
| CERT-In directions | Incident reporting obligations for entities in covered sectors, with a six-hour reporting window for specified incidents. We help you build a reporting path you can actually execute under pressure. |
| Digital Personal Data Protection Act, 2023 | Consent, notice, data principal rights and breach handling for digital personal data. We assess the technical and operational gap and produce findings for your counsel. |
| IT Rules 2021 (amended 2026) | Online takedown timelines and content obligations, including AI-generated content labelling. Relevant to our deepfake, impersonation and brand-protection work. |
Account recovery and proof of ownership
Services involving account recovery, forensics and deepfake removal require proof that the account or the person is yours. Acceptable evidence typically includes a registered email address, a device with a prior authenticated session, government identification matching the account, or a notarised authorisation where someone else acts on your behalf.
This is not a formality. It is the same requirement the platforms themselves impose, and it is the line between recovering your own account and accessing someone else's.
What we will decline
- Any request to access an account, device or system that the client cannot evidence ownership of.
- Surveillance of another person without their informed consent.
- Unauthorised access to a third party's systems without that third party's written permission.
- Credential stuffing, brute-force attacks against systems outside the agreed scope.
- Any work intended to cause disruption, data destruction or denial of service.
Our commitment to you
If an engagement turns out to require something outside the authorisation you have given us, we stop and come back to you. We do not quietly expand scope, and we do not treat an implied permission as permission.
Last reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.