> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Fair testing rules

> The Fair testing page field by field, why each rule exists, and what a campaign shows when a person is held or skipped.

Fair testing rules keep the programme fair to staff. They decide how often one person may be called, when calls are never placed, who is never tested, and whether names appear in reports. The page is titled **Fair testing** and its address is `/red-team/settings`. A campaign page links to it as **Red Team settings** when it skipped someone.

Every rule is off until you turn it on. A workspace that never opens this page has no spacing, no quiet hours and no new-joiner wait.

## Spacing between calls

| Field | What it does | Default or limit |
| - | - | - |
| **Cooling-off period (days)** | After a test call, a person is left alone for this many days before another campaign may call them. 0 turns it off | 0, up to 365 |
| **Most calls per person per quarter** | The most test calls one person may get in a rolling 90 days. 0 means no limit | 0, up to 100 |

Why: a person called every week learns to expect the call rather than to check it. Spacing keeps each test honest.

The page notes: "Retries and the later calls of a multi-call sequence inside the same campaign are not spaced out, so a sequence is never cut in half."

## Background sound

| Field | What it does | Default |
| - | - | - |
| **Default background volume** | How loud the office, street or restaurant sound is behind the caller on a new campaign. Each campaign can still change it on its page | 50% |

## Quiet hours

| Field | What it does | Default |
| - | - | - |
| **Never call during quiet hours** | Turns the rule on | Off |
| **From** | Local time the quiet period starts | |
| **Until** | Local time calls may start again | |
| **Timezone** | An IANA name such as Europe/London. Leave empty to use each person's own timezone | Empty |

Why: nobody should be tested at dinner. The page notes: "A call that falls in quiet hours is held and tried again when they end. It is not skipped."

## Who is not tested

| Field | What it does | Default or limit |
| - | - | - |
| **New joiners wait (days)** | People are not tested for this many days after they are added as a contact. 0 turns it off | 0, up to 365 |
| **Excluded people** | Tick anyone who should never be called, for example people on leave. They stay in your contacts. Search by name, team or role | None |

Why: a new starter has not had the training yet, and someone on leave should not come back to a missed test.

## Names in reports

| Field | What it does | Default |
| - | - | - |
| **Show employee names in campaign results and evidence packs** | When off, results and the auditor pack show teams instead of names | Off |

Why: the aim is to fix the process, not to single out a person. Leave this off unless your policy needs names.

## Report a suspicious call

This section holds the public link your staff use to report a call. The page says: "Share this link with staff. When someone reports a call that was one of our tests, their result becomes 'reported', the best outcome. When it was not one of ours, the security contact below gets an email about a possible real attack."

| Field | What it does | Default |
| - | - | - |
| **Copy** | Copies the link | |
| **New link** | Makes a new link; the old one stops working | |
| **Security contact email** | Where alerts about possible real attacks go | Empty, which means the workspace owner |

## Warm-up email sender

A campaign can send a short notice by text or email a few minutes before the call. Text uses our number and needs no setup. For email you can use our sender, or add your own domain here so the notice comes from you.

| Field | What it does |
| - | - |
| **Sending domain** | Must be your own company domain, never a third party's |
| **From name (optional)** | Shown as the sender name on the email |

After you add a domain the card lists the records to add at your domain provider, each marked **found** or **not found**.

Click **Save settings** to keep everything above.

## Compliance and audit period

The last section feeds the auditor pack. See [Export for auditors](https://docs.deepblocker.ai/vishing/results/auditor-pack.md).

| Field | What it does | Default |
| - | - | - |
| **Frameworks you answer to** | Tick the frameworks the pack should map to | None |
| **Audit period starts** / **Audit period ends** | The period your auditor or insurer looks at. Leave both empty to use the last 12 months | Empty |
| **Tests per year** | How many tests you committed to. Reviewers usually expect two | |
| **Signatory name** / **Signatory role** | The person who signs the pack for your organisation | |

Click **Save compliance settings** for this section; it saves separately.

## What a campaign shows

The rules gate the first call a campaign places to a person. Retries and the later steps of a sequence inside the same campaign go ahead. Quiet hours and exclusions apply to every call. When a person is held or skipped, the campaign page gives the reason in these words:

| Reason shown | Rule | Held or skipped |
| - | - | - |
| excluded from testing | **Excluded people** | Skipped |
| do not call until \[date] | The contact's own do-not-call date | Skipped |
| new joiner (\[n] days left of the \[N]-day wait) | **New joiners wait (days)** | Skipped |
| cooling off (\[n] days left) | **Cooling-off period (days)** | Skipped |
| already called \[n] times in the last 90 days (limit \[N]) | **Most calls per person per quarter** | Skipped |
| quiet hours | **Never call during quiet hours** | Held, tried again when they end |

A skipped person is not called again by that campaign. Change the rule, then run a new campaign for them.

> [!TIP]
>
> Set the rules once, before your first real campaign. They apply to every campaign in the workspace from then on, and nothing in a campaign can override them.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.