Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: 

"during the pentest there exist the possibility to delete or modify sensitive data in the production environment unintentionally due to the execution of some tools, exploits, techniques, etc."

The client says that he is not going to accept that clause and that he believes that no company would accept that clause. He thinks that during a pentest information could be accessed but never deleted or modified.

We know that the execution of some tools like web crawlers or spiders can delete data if the web application is very badly programmed, so the possibility always exists if those types of tools are going to be used.

I know that these are the conditions of the client, and should be accepted, but:

Can a skilled and professional pentester always assure that no data will be deleted or modified in production during a pentest?

Can a pentest really be done if the pentest team has the limitation that data cannot be created nor modified?

Should the pentesting company always include the disclaimer clause just in case?

There's no way that a pentester can 100% assure that data will not be modified or deleted, in the same way as they can't assure that system availability won't be affected (I've knocked systems over with a port scan or a single ' character).  as you say a web crawler can delete data from a system if it's been set-up badly.

I'd say that what should be said is something like "every care will be taken to ensure that the testing does not negatively affect the systems under review and no deliberate attempts will be made to modify or delete production data or to negatively affect the availability of in-scope systems. However with all security testing there is a risk that systems will be affected and the customer should ensure that backups of all data and systems are in place prior to the commencement of the review"
