Terms of service
Starter text. This document is a draft starting point and must be reviewed by a legal professional before final publication.
1. Purpose
These terms govern the provision of web security audit services by BreachLess. The financial terms, scope and timelines of each engagement are set in the specific proposal or contract.
2. Prior authorisation
BreachLess will not test any system without the owner's written authorisation. The client declares that it owns the systems or has authority to authorise their audit, and is responsible for obtaining any third-party permissions (hosting, cloud, providers) that may be required.
3. Scope and method
Testing is limited to the agreed scope, uses controlled techniques and does not include denial of service, social engineering or destructive actions unless expressly agreed. Exploitation, privilege escalation and lateral movement are only carried out in the infrastructure pentest, and only on the systems and with the techniques authorised in writing.
4. Client obligations
- Provide the agreed information and access.
- Have up-to-date backups before testing.
- Designate a reachable contact during the testing window.
5. Confidentiality
Both parties will keep the exchanged information confidential. BreachLess will access only strictly necessary data and delete it at the end of the work as agreed.
6. Deliverables
The result of the work is a report with the findings, their severity and fix recommendations. The report belongs to the client for internal use.
7. Limitation of liability
An audit reflects the state of the system at the time of testing and within the defined scope. It does not guarantee the total absence of vulnerabilities and does not replace a certification. BreachLess's liability is limited, to the extent permitted by law, to what is agreed in the contract.
8. Governing law
These terms are governed by Spanish law.