Published so your legal team can review before you contact us. We are also willing to work under your master services agreement.
These terms govern engagements with Cetonix unless a signed master services agreement or statement of work says otherwise. They are published so your legal team can review them before you contact us.
Version 1.0 · Last updated: 1 October 2025
Every engagement is defined by a written statement of work setting out scope, deliverables, timeline, fees and, for security testing, the rules of engagement. Where you have a standard master services agreement, we are willing to work under your paper. A mutual non-disclosure agreement is signed before scoping.
Penetration testing is only performed against systems you own or are contractually authorised to test. Before testing begins you must confirm in writing: the assets in scope, systems explicitly out of scope, permitted test windows, rate limits, test accounts, and a named contact reachable during the window. Where a third party hosts the system, obtaining their authorisation is your responsibility and we will ask you to confirm it.
Testing carries inherent risk. Although we work to agreed limits and avoid destructive techniques unless specifically authorised, live systems can behave unpredictably. We recommend testing a production-parity staging environment where operational risk is material.
Certification is subject to our certification agreement, the accreditation requirements of the relevant accreditation body, and ISO/IEC 17021-1:2015. Certification decisions are made independently of any commercial relationship. Our Quality & Impartiality Policy, appeals process and complaints process form part of those terms.
On payment in full, the report and its findings are yours. You may share them with your auditors, regulators, customers and prospects. Our methodology, tooling and templates remain ours. We will not publish or reference your engagement without specific written permission.
Where Cetonix processes personal data on your behalf, our Data Processing Agreement applies. We will also execute your own DPA.
Each party protects the other's confidential information with at least the care it applies to its own, and uses it only for the engagement. For security testing, our specific handling commitments are set out in our security practices. Confidentiality obligations survive termination.
Fees are fixed for the agreed scope and stated in the statement of work. Scope changes are quoted and agreed in writing before work proceeds. Unless stated otherwise, invoices are payable within 30 days. Fees exclude applicable taxes and withholding.
A penetration test is a point-in-time assessment of the agreed scope within the agreed window. It cannot identify every vulnerability, and a clean report is not a guarantee that a system is secure or that you are compliant with any framework. Nothing in these terms excludes liability that cannot lawfully be excluded. Subject to that, and except in cases of fraud, wilful misconduct or breach of confidentiality, each party's aggregate liability is limited to the fees paid under the relevant statement of work, and neither party is liable for indirect or consequential loss or loss of profit.
Specific liability caps and indemnities are negotiated per engagement and recorded in the statement of work or master services agreement.
Either party may terminate a statement of work on written notice for material breach not remedied within 30 days. You may terminate a testing engagement at any time; fees for work performed to that point remain payable. Certification agreements follow their own notice and withdrawal provisions.
Unless a signed master services agreement states otherwise, engagements are governed by the laws of India, with the courts of Pune, Maharashtra having jurisdiction. Where a client requires a different governing law or dispute resolution mechanism, raise it at contracting — we negotiate this and have accommodated US and EU governing law on prior engagements.
We may update these terms. The terms applying to your engagement are those in force when the statement of work is signed.
Contracting questions: info@cetonix.com