How the partnership works

You make the introduction. NullSquare runs every assessment and pays commission for as long as the client stays.

The programme has one shape and it does not vary by partner type. An agency, a managed service provider, a security consultancy and a reseller all join on the same terms and do the same thing: introduce a client, and stay in the relationship.

What you will learn

You never run the testing. NullSquare performs every assessment, including for partners who could.
Commission recurs. It is paid for as long as the client keeps paying, not once at signup.

Referral, not delivery

Partners introduce clients. NullSquare scopes, tests, reports and re-tests. This holds regardless of a partner’s own security capability — a consultancy that runs its own penetration tests still refers, and still does not run ours.

This is the liability boundary and it is the reason the programme can be open to anyone with a client relationship. One party is accountable for the testing and it is always us.

What a partner actually does

Identifies clients whose systems would benefit from continuous testing.
Makes the introduction, using a referral link or a named handover.
Stays the relationship owner — you are who the client calls first.
Does the remediation work, if that is your business — on findings the client shares with you.

What you can see about a client

Your portal shows account context: who the client is, what plan they are on, whether they are paying, and enough to support them commercially. It never shows their findings, their activity, their workspace or their people.

That boundary is deliberate and it is not adjustable. A client’s security results belong to the client. If you need to work on what we found, they share it with you or invite you into their workspace — that is their decision to make, and it happens on their side rather than yours.

The badge

Every client site that is being tested can carry the NullSquare badge. It is a 200×32 image served from our own infrastructure and linked to that site’s verified profile, so it states something checkable rather than decorative.