Authenticated Testing: Pricing and Terms

Rate card

TL;DR $5,000 for one tenant, $8,000 for two, then $750 for each extra tenant, capped at $10,000 for five. Six or more is a custom quote.

A tenant is an additional customer organization or workspace on the same app, codebase and environment. A different app, a different product or a separate deployment is a new engagement at the base price.

The second tenant costs more than the rest because that's where cross-tenant isolation testing happens: with two tenants we can check that one customer can never reach another's data. Each tenant after that adds $750.

Free monitoring on larger engagements. Authenticated engagements of $10,000 or more (the five-tenant tier and custom quotes) include 12 months of Continuous External Monitoring free: weekly external (unauthenticated) scans with CVE checks, the same scope as the $375 a month plan, worth $4,500.

Our other services

Neither the external test nor monitoring logs in to your app.

What's included per tenant

TL;DR The base price covers one web app and its API (about 50 API operations, about 40 screens, up to 4 roles), one retest round and the final report and letter. Testing is time-boxed, not exhaustive.

Not part of any engagement

• Denial-of-service, load testing or rate-limit flooding
• Social engineering
• Mobile apps
• Source code review
• Internal networks
• Third-party SaaS and identity providers, such as hosted login or payment pages
• Destructive testing on production data

Testing is time-boxed and point-in-time: we spend a fixed number of days on the scope above and report what we find. It is not an exhaustive review of every possible flaw.

What multi-tenant means

TL;DR A multi-tenant app serves many customer organizations from one system. We test that one tenant can never reach another's data. That takes at least two tenants, so isolation testing starts at $8,000.

A multi-tenant app serves many customer organizations from one shared system: one codebase, one database or cluster, one login page. Each customer is a tenant. A typical SaaS gives every business that signs up its own contacts, records, API keys and billing, but all of it lives in the same app.

The security promise is isolation: tenant A can never see, change or act on tenant B's data, even though both use the same servers. Bugs here are expensive because one flaw exposes every customer at once. Buyers ask about this first, and so do SOC 2 auditors and enterprise security questionnaires.

What we test that a single-tenant test doesn't

• Cross-tenant object access (IDOR/BOLA). We take an ID from tenant A (an event, contact, invoice, file or webhook) and request it while logged in as tenant B, in the UI and directly against the API.
• Tenant switching and context. Users who belong to more than one organization, invite links, org-switch endpoints, and any tenant ID sent from the browser that the server trusts.
• API keys and tokens. A key from tenant A must fail on tenant B's resources. Scopes must actually limit what a key can do. Revoked keys must stop working.
• Roles inside a tenant. A tenant's viewer can't do admin actions, and a tenant admin can't reach platform-admin features.
• Shared features that leak. Search, exports, reports, file uploads and storage URLs, email and SMS templates, webhooks (can tenant A point a webhook at tenant B's events?), caches and background jobs.
• Billing and plan limits. Whether a cheaper plan can unlock paid features or exceed quotas by calling the API directly.

What we need from you: at least two tenants, each with two accounts per role, plus an API key for each if there's an API. With one tenant there's nothing to isolate from, so isolation testing starts at two tenants: $8,000.

Timeline

TL;DR About one week from verified access (accounts log in, our IP is allowlisted) to the draft report, then a retest within 30 days.

The clock starts when access works, not at signature. If access stays broken for more than 2 business days, your test slot may move.

Compliance coverage

TL;DR Our report is pen test evidence for SOC 2, ISO 27001, PCI DSS, HIPAA and more. Your auditor or reviewer makes the final call on whether it meets their requirement.

We don't promise acceptance. If you can share your reviewer's exact requirement, we'll tell you before you pay whether our report fits it.

Intake questionnaire

TL;DR Answer these once and we can usually start testing within a day of signature and payment. "Don't know" is a fine answer; we'll sort it on a call.

Terms for authenticated engagements

TL;DR Nothing is tested without a signed authorization and full payment, we stay inside the agreed scope, and we keep your data confidential. Testing is time-boxed and can't promise to find every vulnerability.

• Written authorization first. No testing starts until a written authorization is signed. It names the exact hosts, the testing dates and our source IP. The person who signs must own or control every host listed, or have the owner's permission in writing. Credentials arriving early are not permission to start.
• Payment. 100% of the quoted fee is due before testing starts, by Stripe payment link or invoice.
• Scope. We test only the hosts, roles and accounts listed in the authorization, during the agreed dates, from the listed source IP. Anything not listed is out of scope, and so is everything on the exclusions list above, plus brute force against real users and physical access.
• Scope changes. Any change to scope needs written approval from both sides before we test it, and is billed at the rate card.
• Access and timing. The testing timeline starts when access is verified working: every account logs in and our IP is allowlisted. If access stays broken for more than 2 business days, your test slot may move to the next opening.
• Staging preferred, production non-destructive. We prefer a staging environment with production-like data. If production is the only option, testing is non-destructive: we prove a flaw exists and stop, with no data changes outside the test accounts you give us. Active testing of a live system can still affect performance; if we see signs of that, we pause and contact your emergency contact.
• Your backups. You keep current backups of the systems and data in scope through the testing window and have a way to roll back.
• Third-party services. Services you build on but don't own (payment processors, identity providers, hosting platforms, SaaS tools) are out of scope unless you have that provider's permission to test them and tell us so in writing. You get any approval your host or vendors require before testing starts.
• Authority and indemnity. You confirm you have authority to authorize testing of every target you list. You indemnify us against claims arising from testing a target you did not have authority to authorize.
• Credentials. You create all test accounts and API keys, and you remove them and rotate any shared credentials when the engagement ends. Send credentials, keys and MFA seeds only through a password manager share or a one-time secret link, never in plain email. Use test accounts, not real users' accounts. We delete our copies when the engagement ends.
• No guarantee. Testing is time-boxed and point-in-time: a fixed number of days looking at the system as it was on the test dates. It is not exhaustive and can't find every vulnerability, and our report is not a guarantee of security or a compliance certification. Your auditor or reviewer decides whether the report meets their requirement.
• Liability. The limitation of liability and no-warranty sections of our Terms of Service apply: Fast Pen Tests and its employees, agents and affiliates are not liable for any direct, indirect, incidental, special, consequential or exemplary damages resulting from your use of our services, including loss of profits, goodwill, use, data or other intangible losses.
• Confidentiality. Confidentiality is mutual. Everything we see during the engagement, and the report itself, is confidential: we use it only to test and report, share it only with the contacts you name, and never publish findings about your systems. You may share the report and attestation letter with your auditors and customers. We're happy to sign your NDA before scoping.
• Subcontractors. We may use vetted subcontractors on an engagement. They are bound by the same confidentiality terms as we are.
• Draft review. You have 5 business days to review the draft report and raise corrections or questions before we issue the final.
• Data retention. We keep evidence and test data from an authenticated engagement for 90 days after the final report, so we can run the retest and answer questions about findings, then delete it. (Our unauthenticated services work differently: data from the $495 external test and the free scan is deleted once the report is delivered.) Our Privacy Policy says the same.
• Rescheduling and cancellation. You can reschedule the testing window for free with at least 2 business days' notice. If you cancel before testing starts, we refund the fee. Once testing has started, the fee is non-refundable.
• Retest window. One retest round is included if you request it within 30 days of the report. It covers the findings in that report only, on the same environment, and produces an updated report or retest letter. Additional retest rounds are $750 each.
• Free monitoring on larger engagements. Authenticated engagements of $10,000 or more include 12 months of Continuous External Monitoring at no charge: weekly external (unauthenticated) scans with CVE checks, the same scope as the $375 a month plan (up to 3 hostnames you verify), worth $4,500. It starts when we deliver the final report. It is non-transferable and has no cash value.
• Who you're contracting with. Engagements are with CERES BASE LLC, a New Jersey limited liability company doing business as Fast Pen Tests, and are governed by New Jersey law. These terms add to our Terms of Service. If the signed authorization or statement of work says something different, that document controls for that engagement.