Fair testing rules

The Fair testing page field by field, why each rule exists, and what a campaign shows when a person is held or skipped.

Fair testing rules keep the programme fair to staff. They decide how often one person may be called, when calls are never placed, who is never tested, and whether names appear in reports. The page is titled Fair testing and its address is /red-team/settings. A campaign page links to it as Red Team settings when it skipped someone.

Every rule is off until you turn it on. A workspace that never opens this page has no spacing, no quiet hours and no new-joiner wait.

​

Spacing between calls

Field	What it does	Default or limit
Cooling-off period (days)	After a test call, a person is left alone for this many days before another campaign may call them. 0 turns it off	0, up to 365
Most calls per person per quarter	The most test calls one person may get in a rolling 90 days. 0 means no limit	0, up to 100

Why: a person called every week learns to expect the call rather than to check it. Spacing keeps each test honest.

The page notes: “Retries and the later calls of a multi-call sequence inside the same campaign are not spaced out, so a sequence is never cut in half.”

​

Background sound

Field	What it does	Default
Default background volume	How loud the office, street or restaurant sound is behind the caller on a new campaign. Each campaign can still change it on its page	50%

​

Quiet hours

Field	What it does	Default
Never call during quiet hours	Turns the rule on	Off
From	Local time the quiet period starts
Until	Local time calls may start again
Timezone	An IANA name such as Europe/London. Leave empty to use each person’s own timezone	Empty

Why: nobody should be tested at dinner. The page notes: “A call that falls in quiet hours is held and tried again when they end. It is not skipped.”

​

Who is not tested

Field	What it does	Default or limit
New joiners wait (days)	People are not tested for this many days after they are added as a contact. 0 turns it off	0, up to 365
Excluded people	Tick anyone who should never be called, for example people on leave. They stay in your contacts. Search by name, team or role	None

Why: a new starter has not had the training yet, and someone on leave should not come back to a missed test.

​

Names in reports

Field	What it does	Default
Show employee names in campaign results and evidence packs	When off, results and the auditor pack show teams instead of names	Off

Why: the aim is to fix the process, not to single out a person. Leave this off unless your policy needs names.

​

Report a suspicious call

This section holds the public link your staff use to report a call. The page says: “Share this link with staff. When someone reports a call that was one of our tests, their result becomes ‘reported’, the best outcome. When it was not one of ours, the security contact below gets an email about a possible real attack.”

Field	What it does	Default
Copy	Copies the link
New link	Makes a new link; the old one stops working
Security contact email	Where alerts about possible real attacks go	Empty, which means the workspace owner

​

Warm-up email sender

A campaign can send a short notice by text or email a few minutes before the call. Text uses our number and needs no setup. For email you can use our sender, or add your own domain here so the notice comes from you.

Field	What it does
Sending domain	Must be your own company domain, never a third party’s
From name (optional)	Shown as the sender name on the email

After you add a domain the card lists the records to add at your domain provider, each marked found or not found.

Click Save settings to keep everything above.

​

Compliance and audit period

The last section feeds the auditor pack. See Export for auditors.

Field	What it does	Default
Frameworks you answer to	Tick the frameworks the pack should map to	None
Audit period starts / Audit period ends	The period your auditor or insurer looks at. Leave both empty to use the last 12 months	Empty
Tests per year	How many tests you committed to. Reviewers usually expect two
Signatory name / Signatory role	The person who signs the pack for your organisation

Click Save compliance settings for this section; it saves separately.

​

What a campaign shows

The rules gate the first call a campaign places to a person. Retries and the later steps of a sequence inside the same campaign go ahead. Quiet hours and exclusions apply to every call. When a person is held or skipped, the campaign page gives the reason in these words:

Reason shown	Rule	Held or skipped
excluded from testing	Excluded people	Skipped
do not call until [date]	The contact’s own do-not-call date	Skipped
new joiner ([n] days left of the [N]-day wait)	New joiners wait (days)	Skipped
cooling off ([n] days left)	Cooling-off period (days)	Skipped
already called [n] times in the last 90 days (limit [N])	Most calls per person per quarter	Skipped
quiet hours	Never call during quiet hours	Held, tried again when they end

A skipped person is not called again by that campaign. Change the rule, then run a new campaign for them.

Set the rules once, before your first real campaign. They apply to every campaign in the workspace from then on, and nothing in a campaign can override them.