1. What we provide
Independent testing of an application you own or are authorised to have tested. We use the application as a first-time user and as an adversarial one, then deliver written findings with reproduction steps, supporting evidence, and a launch verdict.
Scope depends on the service you bought:
- Launch Check — one application, its primary user journey, mobile and desktop.
- Break Test — one application, its core customer journeys, up to three user roles, standard integrations, and one round of retesting after you make fixes.
- Custom testing — scope is set out in writing before work begins and that written scope governs.
2. Authorisation to test
You confirm you own the application or are authorised by its owner to arrange testing, and you authorise us to test it. You are responsible for having that authority. We test only what you give us and we stay out of anything you list as excluded.
If you tell us an environment is production, we treat it accordingly and avoid destructive actions.
3. What this is not
This is application testing. It is not a certified penetration test, a security audit, or a compliance certification, and we do not issue certificates or attestations. We may identify security-relevant defects — you can see the kind of thing we find in our sample report — but a clean report is not a guarantee that an application is secure or defect-free.
No testing finds every defect. We do not warrant that we will find all issues, and we are not responsible for defects we did not find.
4. Access and credentials
You provide test accounts. Do not send us production administrator credentials or passwords you use elsewhere. We use the access you give us only to perform the testing, and you may revoke it at any time — including once we deliver.
5. Timing
We confirm your testing window by email before work begins. We don't publish a blanket turnaround, because it depends on the application. If we can't schedule your test within a timeframe that works for you, you can have a refund under section 7.
6. Your information
We treat your application, your data and our findings as confidential. We don't publish client names, logos or identifiable findings without your written permission. We may describe anonymised, non-identifying patterns from our work — as we do in our sample report, where all client information has been removed.
We keep what you send us only as long as we need it for the engagement and any agreed retest, and we delete access credentials on request.
7. Payment and refunds
Fees are payable up front and are stated in US dollars. Payments are processed by Stripe; we don't store your card details.
If we haven't started testing, you can cancel for a full refund — just ask. Once testing has started, fees are non-refundable, except that if we can't deliver what was described we'll refund you. We're a small business and we'd rather refund you than argue.
8. Findings are yours
The report we deliver is yours to use, share internally and act on. We keep a copy for our records and to support any agreed retest.
Fixing what we find is a separate service, quoted separately, and is never a condition of receiving your findings. We don't inflate reports to sell remediation.
9. Liability
To the extent permitted by law, our total liability arising from an engagement is limited to the fees you paid for that engagement. We are not liable for indirect or consequential loss, including lost profits or lost data.
10. Changes and contact
We may update these terms; the version in force is the one published when you purchase. Questions about these terms, your engagement, or your data — reply to your confirmation email or your Stripe receipt and it reaches us directly.