Prepare your first partner engagement.

In the SpectrAI programme, partners retain the commercial relationship and set their resale price. SpectrAI invoices the partner, who invoices the customer. The portal, reports and emails can carry the consultancy’s brand. Verify applicable terms in the proposal.

Customers should understand the method. Agents test the authorised scope, with automated assessment of findings and report publication. White labelling does not turn this into a human-led assessment or establish certification.

Record the application, environment, exact domains and associated APIs. Provide test accounts and workflows for each role. For multi-tenant SaaS, identify demonstration organisations and expected isolation.

For a private application, define the internal relay, authorised services and access contact. A relay does not imply a whole-network or Active Directory audit. Bare IP addresses, source code and repositories are outside the offer described here.

• Business objective and report recipient.
• Application, environment, domains and associated APIs.
• Roles, test accounts and authorised data.
• Exclusions, constraints, contact and stopping procedure.
• Deliverables, debrief, retests and closure criteria.

Establish who may authorise testing of each asset. Managing a service for a customer does not define every permitted operation. The mandate, domain-control evidence and exclusions must be ready before launch.

Agree which access and data may be supplied, who receives evidence and how it is shared. Establish model providers, processing, locations, retention and rights in the applicable documents. French product development does not mean every processing operation takes place in France.

Review the sample report with whoever will present findings. They should explain impact, preconditions, reproduction, limitations and remediation advice. A demonstrated issue on one asset does not establish coverage of every customer workflow.

Assign ownership of remediation and verification. The offer includes 2 retest batches within 60 days of each report. A remediation retest differs from testing a new application or conducting another full evaluation. The annual programme includes 2 evaluations over 12 months.

Assess scoping, access, report comprehension and retests. Finding count alone is insufficient. No published finding does not demonstrate a secure application, while many findings do not establish usefulness.

Track consultancy effort, customer questions, remediation ownership and blocked areas. Distinguish partner account creation, an accepted proposal and an engagement actually ordered. These stages have different commercial value.

The downloadable worksheet helps prepare a first engagement. It is neither a quote, contract nor testing authorisation. Supply account secrets through the agreed access channel separately from this worksheet.