Engagement ethics
This is the standard Ramer Enterprise and its practices hold themselves to. It is public because the questions it answers are ones careful clients are right to ask.
Why this page exists
One of our practices (Chipshot Labs) performs security testing, including reconnaissance and directory-services assessment. Those are capabilities that make a responsible client ask one question: how do we know you will stay in bounds? This page answers it before you have to ask.
Rules of engagement
- Written authorization first. No testing of any kind begins without a signed authorization and a defined scope. We do not test anything we have not been authorized in writing to test.
- Scope discipline. If an engagement needs to change, the change is agreed in writing before we act on it. If something outside scope is discovered incidentally, we stop, document it, and bring it back to the client rather than acting on it unilaterally.
- Evidence handling. Findings and evidence are encrypted in transit and at rest. Access is limited to the engagement team. Material is destroyed on a schedule we agree with you before work starts.
- Confidentiality. What we learn about a client stays confidential. We do not name clients or reuse their information without written permission.
- Conflicts of interest. We decline or disclose engagements where a conflict would compromise our objectivity — prior work for a competitor, a personal relationship with the target organization, or anything else that could compromise independence.
Conduct across both practices
- We publish only what is verifiable.
- Chipshot Labs operates under the scope discipline and evidence handling rules above.
- Our practices will not accept referrals or engagements where we lack the expertise to deliver or where another provider would be a better fit.
No engagement without rules of engagement
Every engagement operates under a rules-of-engagement document defining scope, timing, emergency contacts, and escalation procedure. If that document doesn’t exist yet, the engagement hasn’t started yet.
Straylight Forge (in development)
Straylight Forge has not yet launched. The conditions below describe how it will operate once it does, not a service available today.
- Straylight Forge will distinguish clearly between clinically supervised services (delivered by, or under the documented supervision of, a licensed Oregon clinician) and non-clinical enrichment programs (social-skills practice, collaborative-storytelling groups, corporate workshops). The two will never be blurred in marketing, intake, or documentation.
- Where Straylight Forge works with minors, it will conduct background checks, document safeguarding practices, and follow the supervision the law requires. Details will be available on request.
Not legal advice. This policy describes our practices; it is not a substitute for professional legal advice.