Terminalfour Security Review
A Terminalfour API key is generated for one user and inherits that user’s role, Contributor to Administrator. We test what each role and key can reach, and whether content can skip approval. CREST-certified testers, fixed price from £2,540 for a 2-day single-site scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
New or edited content sits as Pending until it is approved, Draft content is never published unless an earlier approved version already exists, and Rejected content is never published at all.
Content status decides what actually reaches your published site
Terminalfour assigns every user one of four roles, Administrator, Power user, Moderator or Contributor, and each has a different reach across Sections, workflow and reporting. An Administrator can configure Access Control, manage Groups and view the Audit Report, rights a Contributor never gets.
Content moves through Pending, Draft and Rejected states before it reaches Approved, and only Approved content publishes to the live site unless an earlier approved version already exists to fall back on. We test whether a role can be used to push content past that check, and whether workflow steps are configured the way you intended.
Web Services API keys are generated for a specific Terminalfour user and inherit that user’s role rights, so a key created for an Administrator carries administrator-level access wherever it ends up. Sites can also restrict specific Sections with Terminalfour’s Access Control feature, which authenticates visitors by Terminalfour login, NTLM, LDAP or Shibboleth, by IP address, or by a rule profile that configures a .htaccess file, similar to the checks we run in a broader SSO and identity review, and we test whether those restrictions actually hold.
SCOPE
What we pen test on a Terminalfour site
Role and rights boundaries
We test what each of Terminalfour’s four roles, Administrator, Power user, Moderator and Contributor, can actually reach across Sections and Groups, the same boundary check we run for other headless and hybrid CMS platforms.
API key and role inheritance
We test what an exposed Web Services API key can do, since a key generated for one user inherits that user’s full role rights.
Approval and workflow bypass
We test whether content can reach Approved status, or move through a multi-step workflow, without every assigned Moderator or Administrator step actually running.
Section and Group permissions
We test whether a Contributor or Power user assigned to one Section or Group can reach content, Sections or reports outside that assignment.
Access Control rule profiles
We test the authentication method protecting a restricted Section, whether that is a Terminalfour login, NTLM, LDAP, Shibboleth, an IP address rule, or a rule profile driving a .htaccess file.
Form Builder submissions
We test how Form Builder submissions are validated and stored, and confirm that Form Submissions stay visible only to the Administrator role Terminalfour restricts them to.
Media Library and file uploads
We test file upload handling through the Media Library, including whether file extension restrictions can be bypassed to upload an unexpected file type.
External Content Syncer and HTML import
We test the External Content Syncer and HTML import features for ways an untrusted external source could push content into your site.
Channels and multi-site publishing
For sites using Channels, Publish channels or Microsites, we test whether an access restriction set on one channel actually carries over to the others.
Task Scheduler and audit trail
We test whether Task Scheduler jobs run with more privilege than they need, and whether the Audit Report actually captures who made a given configuration change.
OUR PROCESS
Terminalfour Security Review: From Scope to Attestation
Site and role intake
You give us read access to the Site Structure plus a list of roles, Groups and any API keys in scope.
Role and workflow mapping
We map every role, Group and workflow step to what it is meant to reach before active testing starts.
Active testing
We attempt to reach content, Sections and reports outside each role’s, Group’s and API key’s intended boundary.
Report and free retest
You get findings mapped to the specific role or feature involved, then a free retest once fixes are in.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Terminalfour pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Terminalfour Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Terminalfour For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Terminalfour Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Terminalfour site?
A Power user or Administrator account scoped for testing, or read-only access to the Site Structure plus the roles, Groups and API keys in use. We do not need your primary Administrator login.
Will testing touch live, published content?
We work against Pending and Draft content and a staging Section wherever possible, and confirm with you before any check that could affect Approved, published content.
How long does a Terminalfour security review take?
The 2-day single-site scope above covers one Terminalfour instance with its roles and Sections. Multiple Channels, Microsites or a heavy workflow setup can need more time, confirmed during scoping.
Is Terminalfour hosted by the vendor or by us?
Terminalfour can be self-hosted or vendor-hosted depending on your contract. We scope around whichever applies and test your configuration, roles and integrations either way.
What is out of scope?
The underlying server or hosting platform is only in scope if you host it yourself and ask us to include it. Otherwise we focus on Terminalfour’s roles, workflow, Access Control and API.
Does Terminalfour have a customer penetration testing policy?
Vendor and hosting terms vary by contract, so we confirm the current testing policy for your instance during scoping and work within it.
Do you need our source code or Content Types?
Not required, but sharing your Content Type and Page Layout definitions speeds up the review of what each role can create and edit.
Are your testers CREST certified?
Yes. Every Terminalfour review is carried out by CREST-certified, UK-based testers.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Terminalfour site
A Terminalfour API key is generated for one user and inherits that user’s role, Contributor to Administrator. We test what each role and key can reach, and whether content can skip approval. CREST-certified testers, fixed price from £2,540 for a 2-day single-site scope, quoted within 24 hours.
