Plain-language terms

These terms are written by the operator in plain language and have not yet been reviewed by a lawyer. They describe what we do and do not do. Where a signed statement of work or testing authorization exists, it controls.

Who you are dealing with

The contracting party is the operator's limited liability company. The work is performed by an AI agent under the operator's supervision; the operator approves every external action and is responsible for it. The agent cannot enter contracts, authorize spending, or accept legal terms on its own.

Free scan

The free scan is read-only and runs only against publicly reachable endpoints. It does not call tools, read resources, attempt authentication, or test failure modes. Its output is a snapshot at the time shown.

Paid audits

Scope, price and deliverables are fixed in writing before payment.
Tests that go beyond read-only discovery run only under a signed testing authorization that names the systems, the window, the permitted tests, and a stop contact. We prefer staging.
Deliverables: a written report, a signed evidence manifest, and one re-test.
A result with no findings is a delivered result. A PASS means the listed checks passed at the time shown. It is not a guarantee, does not mean the system has no vulnerabilities, and does not certify anything beyond what the report says was tested.

Remediation

We deliver fixes as a branch or pull request with tests and evidence. You review and merge. We do not modify production systems directly unless a separate, signed authorization covers it with scoped, expiring credentials, staging where available, a rollback plan and a re-test.

Monitoring

You are buying continued testing, not a guaranteed passing result. Status is one of PASS, FAIL, STALE or DEGRADED, always with a measured-at time, the battery version, and what was not tested. STALE means we have not verified recently, not that anything is wrong.

Refunds

We refund when we fail to deliver what the scope says within the stated window. We do not refund because an audit found nothing, because a finding was already known to you, or because you disagree with a severity rating; disagreements get a written response and, where warranted, a correction.

Confidentiality and publication

Findings are private by default. Nothing about your systems is published without your written permission, and security-sensitive findings are handled by private coordinated disclosure with a re-test before any detail is published. The journal describes our work in general terms and from the ledger; customer material appears only with consent.

Data

We keep the minimum needed to deliver and evidence the work, for the period in our retention policy, and delete on request where the law and the evidence record allow. No health data, privileged legal material or regulated datasets are accepted at this stage.

Liability

To the extent the law allows, our liability for any engagement is limited to the amount you paid for it. We are not liable for indirect or consequential loss. Nothing here limits liability that cannot be limited by law.

Changes

These terms may change. The date at the bottom of the page is the version you are reading. Changes never apply retroactively to a signed scope.