Terms and conditions

What we sell through this site is a fixed-scope, fixed-price application security assessment — penetration testing of software your organisation owns or is authorised to have tested. The scope and price are fixed at checkout from our published price list. Delivery is remote and electronic, through the CybeRapid platform.

Purchases through this checkout are made by businesses, for business purposes. We do not sell to consumers through it, and we do not sell any product or service intended to repair, maintain or service a personal device.

Authorisation to test is a condition of every engagement. After you buy, we confirm scope with you and issue an authorisation-to-test naming the systems in scope and the testing window. No testing begins until it is signed. If we cannot satisfy ourselves that you own the systems named, or are authorised by their owner to have them tested, we cancel the order and refund it in full.

Cancellation rights and refunds are set out in full in our refund and cancellation policy, which forms part of these terms. In short: a full refund at any point before testing begins, a full refund if we cannot proceed, and a pro-rata refund of unused testing days afterwards.

Everything we learn about your systems during an engagement is confidential. Findings and reports are treated as sensitive material — they are effectively a map of how to attack you. We are happy to sign your non-disclosure agreement rather than insist on ours.

How we handle your systems and data during an engagement is described on our trust page. What this website itself collects is covered by our privacy policy. Personal data we encounter while carrying out an assessment is governed by the engagement agreement and the NDA, not by the website privacy policy.

We will perform the assessment with reasonable skill and care, by qualified people, using the methodology described on this site.

What we do not warrant: no penetration test can prove the absence of vulnerabilities. An assessment is a point-in-time examination of an agreed scope, and finding nothing in a given area is not a guarantee that nothing is there. We do not warrant that your systems are secure, that they will remain secure after testing, or that they comply with any particular standard or regulation.

Liability. To the extent permitted by law, our total liability arising out of or in connection with an engagement is limited to the fees you paid us for that engagement, and we are not liable for indirect or consequential loss, loss of profit, loss of business, or loss of data. Nothing in these terms excludes or limits liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, or for fraud.

Testing carries inherent risk to the systems tested. We agree the boundaries with you in advance — what is in scope, what techniques are excluded, and who to call — and we prefer to test against a staging environment for that reason.

Changes. We may update these terms. The version in effect on the date of your purchase governs that purchase; continued use of the site means you accept the current version.

Whole agreement. Where we have signed a separate engagement agreement, statement of work or NDA with you, that document governs the engagement and prevails over these terms to the extent of any conflict.

Severability. If any part of these terms is found unenforceable, the rest continues to apply.

Governing law. These terms are governed by the laws of the State of Israel, and the competent courts of Tel Aviv-Jaffa have exclusive jurisdiction, without prejudice to any non-waivable rights you have under the law of your own country of residence.