Where does this policy apply?
This policy applies to use of the DTech Global website and to client portals or systems DTech manages where users have been given access. DTech Global is the trading name of Dewan Technologies, a company based in Pakistan serving clients worldwide. Contact [email protected] with questions.
Mentioning client systems here does not give every website visitor an account or portal. Access depends on the particular service and authorization. A client’s own policies and the separate written project agreement also apply. This policy does not grant access or expand the scope of anyone’s existing permission.
What does authorized use require?
Use systems only for lawful purposes and within the permissions you have been given. Follow applicable laws of Pakistan and other laws that apply to your activity. Respect the rights of other users, clients, and rights holders. A login screen may be visible to anyone. That does not give you permission to explore restricted functions.
For a client system, use only the accounts, devices, data, and administrative functions authorized for your role. If your employment, project assignment, or permission ends, stop using that access even if credentials still work. Ask the responsible client contact if the boundaries of your access are unclear.
Do not share credentials or use someone else’s identity to bypass an approval process. Keep passwords, recovery codes, access tokens, and private keys out of public messages and inquiry forms. Report a suspected compromised account promptly so the relevant administrator can assess whether access should be restricted or reset.
Which attacks and testing activities are prohibited?
Do not attack the website, client portals, managed systems, hosting infrastructure, or other users. Prohibited activity includes denial of service, credential stuffing, password guessing, exploitation attempts, session theft, and attempts to bypass authentication or rate limits. Do not interfere with logs, monitoring, backups, or controls intended to protect the system.
Do not run vulnerability scans, penetration tests, automated discovery, or intrusive probes without explicit written authorization. Authorized testing needs an agreed target list, permitted methods, timing, and reporting process. Permission to test a client application does not automatically cover Cloudflare, an email provider, another tenant, or infrastructure operated by a third party.
If you encounter a possible weakness during ordinary use, stop before accessing additional data or demonstrating further impact. Finding a weakness does not authorize exploitation. Do not extract records, create persistent access, change permissions, or disrupt services to prove that a report is valid.
What content and software must not be introduced?
Do not upload, transmit, host, or execute malware, ransomware, spyware, malicious scripts, or files designed to compromise systems. Do not use a managed environment to distribute harmful software or operate command infrastructure. Legitimate security research material requires authorization and controls appropriate to the agreed work.
Do not submit unlawful material, threats, harassment, fraudulent instructions, or content that infringes another party’s rights. Do not use systems to impersonate others, steal information, conduct phishing, or facilitate unauthorized surveillance. Having technical access to a tool does not make every use of that tool permissible.
You are responsible for checking that you have permission to provide data used in a project. Avoid placing personal information in shared locations unless that location is approved for it. Use the agreed transfer process for confidential material and ask before introducing production records into a test environment.
How may you use contact forms and email?
Use the contact form for relevant inquiries with accurate contact details. Do not submit spam, repeated unsolicited promotions, abusive messages, or automated submissions intended to consume resources. Do not enter another person’s email address to send unwanted confirmation messages or impersonate a buyer.
Our contact form sends the submitted name, email, company, phone, service, and message to us by email through Resend, an email delivery provider. It sends the visitor an automatic confirmation as well. The form is not a file exchange service, an emergency channel, or a place to transmit credentials.
Security checks may reject or limit submissions that appear abusive. Do not evade these checks by rotating addresses, changing networks, or disguising repeated requests. If a legitimate inquiry cannot be submitted, email [email protected] and describe the problem without repeating sensitive content unnecessarily.
How should managed system resources be used?
Use storage, network capacity, compute resources, and software licenses within the purpose and limits agreed for the client system. Do not run unrelated workloads, unauthorized cryptocurrency mining, bulk messaging, or traffic relay services. Do not use one client’s environment to access or interfere with another organization’s systems.
Administrative rights require particular care. Make changes only within your authority and follow any agreed approval, maintenance, and backup procedures. Do not disable safeguards simply to make a task easier. Where a change could affect other users, coordinate with the responsible administrator before proceeding.
Do not remove or conceal audit records to hide activity. If a mistake affects data or availability, report it with enough detail for recovery planning. Report it promptly. An unapproved fix may change evidence or make the damage harder to assess.
How do you report a security concern?
Email [email protected] with a concise description of the issue, the affected URL or system, the approximate time observed, and steps that led to the observation. State whether you stopped testing and whether any information appeared exposed. Do not include passwords, tokens, full customer records, or unnecessary personal information.
If evidence is sensitive, describe its nature and ask for an appropriate transfer method before sending it. Avoid public disclosure of details that would allow others to exploit an unresolved issue. We may need to coordinate with the client or infrastructure provider responsible for the affected system.
This reporting channel does not offer standing authorization for testing, a reward program, or a guaranteed response time. An acknowledgement does not expand permission to investigate. Further testing must wait for explicit written authorization covering the proposed activity and the systems involved.
What happens if this policy is breached?
Depending on the circumstances, we may reject submissions, restrict access, preserve relevant evidence, or notify the responsible client administrator. Serious or unlawful conduct may need to be reported to the appropriate authorities. Actions affecting contracted services are subject to the relevant agreement and applicable law.
We aim to make restrictions proportionate to the risk and the available evidence. Urgent containment may be necessary before a full investigation is complete. If you believe a restriction is mistaken, contact [email protected] with the affected system, relevant account details that are safe to share, and an explanation.
Where can you find related terms and changes?
The terms of service govern public website use, while the privacy policy explains handling of personal information. Separate written agreements define project obligations and any additional security requirements for managed environments. Users should read the policies relevant to their access.
We may update this policy as systems, threats, or legal requirements change. The last updated date identifies the current version. Any change affecting an agreed project must be handled in line with that project’s agreement. Send questions about permitted use or the current policy to [email protected].