Merge pull request mendix#7333 from mendix/MvM-PenTest

Process around PenTest

Author: MarkvanMents

content/en/docs/support/_index.md

@@ -111,8 +111,36 @@ If there is an issue with the Mendix Platform that affects multiple customers, o
 
 ## 7 Reach Out to Mendix Support
 
+### 7.1 Reporting Issues
+
 If, after your analysis, you suspect there is an issue with the Mendix Platform (or if you have questions about your analysis), you can reach out to Mendix Support. We will provide pointers on how to solve the issues yourself or redirect you to Expert Services for further assistance. If we suspect a platform issue, we will involve second- and third-line support for confirmation and, if it is a platform issue, we will fix it. If the issue is commercial (for example, because your app requires a larger app container or more file storage), we may refer you to your Customer Success Manager directly.
 
+### 7.2 Large-Scale Testing
+
+You may sometimes want to perform testing on your app which could impact cloud operations. This might include the following:
+
+* Load test
+* Performance test
+* Penetration (PEN) test 
+
+Your SLA contains the following clause:
+
+> Without first obtaining the prior written consent of Mendix, Customer may not intentionally perform any actions, such as load tests, performance tests, or similar tests that might interfere with or disrupt the integrity or performance of the App Platform or Cloud Services.
+
+If you are planning this sort of testing you must raise a ticket with Mendix Support and include as much information as possible, including:
+
+* type of test
+* IP addresses
+* environment IDs
+* exact timings
+* contact details of parties directly involved – including any third parties who are assisting
+
+Please provide this information as early as possible, at least two weeks in advance of the test date. Mendix may refuse permission to do some kinds of test if they break local laws or pose too high a risk to the Mendix infrastructure or other customers.
+
+If you want to perform penetration tests, your Customer Service Manager (CSM) can provide you with an indemnification agreement. This should be signed by all parties, confirming the information above, and agreeing that your tests are legal and do not impact other customers. If you don't know who your CSM is, Mendix Support can provide you with their contact details. 
+
+If Mendix is not aware of your tests, you may find that they are interrupted if they cause unexpected alerts to be generated for our Cloud Operations or Security teams. You may also be breaking your agreement with Mendix.
+
 ## 8 Product Support Period
 
 Mendix supports the current major release and the two prior major releases (and we support each major release for a minimum of 24 months). Because of this, Mendix recommends upgrading your apps to the latest version of Studio Pro at least once a year. We will reach out to you in time if you are running on a version that will become unsupported so that you have ample time to perform an upgrade.