Professional services terms

Guidance, not a guarantee

We provide security guidance, assessment and advice. We do not guarantee that any system, application or environment is or will be free of vulnerabilities, or that it cannot be breached. We do not guarantee any compliance, certification, audit or insurance outcome. You decide what to implement and you remain responsible for your systems, data and decisions.

Scope and statement of work

Each engagement is defined by a written statement of work that sets out the services, targets, access, timing and fees. Work outside that scope is not included unless agreed in writing.

Point-in-time assessments

Reviews and tests reflect the systems at the time and within the scope assessed. A report with few or no findings does not prove that no vulnerabilities exist, and your environment will change after we finish.

Authorisation and rules of engagement

• We do not begin testing until you give written authorisation and agree rules of engagement covering targets, time windows and contacts.
• You confirm you own, or have legal authority to authorise testing of, every system in scope, including systems operated by hosting, cloud or other third-party providers. You are responsible for obtaining any third-party consent that provider terms require.
• Unauthorised access to computer systems can be a criminal offence, including under the Criminal Code Act 1995 (Cth). We will not test outside the authorised scope.

Testing risks

Security testing can cause unexpected behaviour, including instability, lockouts, or changes to data. You are responsible for maintaining current backups and recovery arrangements, and for nominating a contact who can be reached during testing. Testing against production systems is at your risk, within windows we agree.

Cloud and identity work

• You control your accounts and credentials. We ask for the minimum access needed and you may revoke it at any time.
• We implement only changes you have approved through your own change process.
• You are responsible for change approval, testing, rollback and the ongoing operation of your environments after hand-over.

Confidentiality and data handling

We keep your information, test data and reports confidential and use them only to deliver the services. Reports are provided only to the people you nominate. We delete or return test data at the end of the engagement, unless you ask us to retain it or the law requires it.

Your responsibilities

• Give us accurate information, timely access and the contacts we need.
• Decide whether and how to act on our recommendations, and remediate issues.
• Tell us promptly if you suspect an incident during an engagement.

Limits of liability

Nothing in these terms excludes, restricts or modifies rights you have under the Australian Consumer Law that cannot be excluded. Otherwise, to the extent the law allows:

• we are not liable for any security breach, attack, data loss, outage or compliance failure affecting you or your customers, except to the extent we caused it through our breach of the statement of work;
• we are not liable for indirect or consequential loss, including lost profits, lost data, business interruption or reputational harm;
• our total liability for an engagement is limited to the fees you paid for that engagement;
• where the law permits us to limit liability for breach of a consumer guarantee, we limit it to resupplying the services or paying the cost of having them resupplied.

Insurance details: [Professional indemnity insurance details to be added once held].

General

These terms are governed by the laws of [State], Australia. Questions: security@strikeward.com.