Terms and Conditions

These Terms constitute a legally binding agreement between you, whether personally or on behalf of an entity (“you” or “Client”), and the Company. If you do not agree with any part of these Terms, you must not access the website or engage our services. Where services are provided under a separate Statement of Work (“SOW”) or Master Services Agreement (“MSA”), that agreement governs in the event of any conflict with these Terms.

“Company”, “we”, “us” and “our” refer to CyberLink Security, which operates under the Herodot umbrella of companies, together with its affiliates.

“Services” means the incident response, penetration testing, security engineering, advisory and related services we provide.

“Deliverables” means the reports, assessments, findings and materials we provide to the Client in the course of an engagement.

“Client Systems” means the networks, applications, systems and assets that are the subject of an engagement.

The Services are provided pursuant to the applicable SOW or MSA, which sets out the specific scope, timing, deliverables and commercial terms of each engagement. Any change to the agreed scope requires the written agreement of both parties. We do not warrant that any assessment will identify every vulnerability, weakness or exposure that may exist within the Client Systems.

Penetration testing, security assessments and any other intrusive activities are performed only under explicit, prior, written authorization from the owner of the relevant assets. The Client represents and warrants that it holds all rights and authority necessary to authorize the Services on the Client Systems and that such authorization does not violate the rights of any third party or any applicable law.

The Client is solely responsible for identifying assets that are out of scope, for notifying relevant third parties (including hosting and cloud providers where required), and for ensuring appropriate backups and continuity measures are in place before testing begins.

The Client agrees to:

• provide accurate, complete and timely information necessary for the Services;
• obtain and maintain all authorizations required for the Services;
• designate authorized points of contact for the duration of the engagement;
• maintain the confidentiality of all Deliverables and findings; and
• comply with all laws and regulations applicable to the engagement.

Each party will treat the other party’s confidential information, including all engagement details, findings and Deliverables, as strictly confidential and will not disclose it to any third party without prior written consent, except where disclosure is required by law or a competent authority. These obligations are in addition to any separate non-disclosure agreement between the parties and survive termination.

The Client retains ownership of its pre-existing intellectual property and data. The Company retains ownership of its proprietary tools, methodologies, know-how and frameworks, including any improvements developed during an engagement. Upon full payment of the applicable fees, the Company grants the Client a non-exclusive, non-transferable licence to use the Deliverables for its internal business purposes.

Fees are set out in the applicable SOW or MSA. Unless otherwise agreed in writing, invoices are payable within thirty (30) days of the invoice date. Emergency incident response engagements may require a retainer or advance payment. Amounts not paid when due may accrue interest at the rate of 1.5% per month, or the maximum rate permitted by law, whichever is lower. Fees are exclusive of applicable taxes.

The Company will perform the Services with reasonable skill and care and in a professional manner consistent with prevailing industry standards. Except as expressly stated in these Terms or the applicable SOW or MSA, the Services and Deliverables are provided “as is” and the Company disclaims all other warranties, whether express, implied or statutory, including any implied warranties of merchantability, fitness for a particular purpose and non-infringement. Security is a continuing process; no assessment can guarantee the discovery of all vulnerabilities or the prevention of all incidents.

To the maximum extent permitted by law, the Company’s total aggregate liability arising out of or in connection with an engagement, whether in contract, tort (including negligence) or otherwise, is limited to the fees paid by the Client for that engagement.

The Company will not be liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of profits, revenue, data or goodwill, however arising. The Client is responsible for its own remediation decisions and their implementation. Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law.

The Client agrees to indemnify, defend and hold harmless the Company and its affiliates, officers and personnel from and against any claims, damages, liabilities, costs and expenses (including reasonable legal fees) arising out of or related to: (a) the Client’s breach of these Terms; (b) any unauthorized use of the Deliverables; (c) the Client’s failure to obtain required authorizations; or (d) the Client’s violation of any applicable law or third-party right.

Either party may terminate an engagement on thirty (30) days’ written notice, or immediately in the event of a material breach that remains uncured after written notice. On termination, the Client remains liable for all Services performed and expenses incurred up to the effective date of termination. Provisions that by their nature should survive termination, including those relating to confidentiality, intellectual property, liability and indemnification, will survive.

Each party will comply with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) where relevant. Our handling of personal data is described in our Privacy Policy. Where the Company processes personal data on the Client’s behalf, the parties will enter into a data processing agreement as required by law.

These Terms are governed by and construed in accordance with the laws of Ireland, without regard to its conflict-of-laws principles. The parties will first attempt to resolve any dispute through good-faith negotiation for a period of thirty (30) days. Failing resolution, the dispute will be referred to mediation and, if still unresolved, to binding arbitration seated in Dublin, Ireland, save that either party may seek urgent injunctive relief from a court of competent jurisdiction.

The content on this website is provided for general information only and does not constitute professional advice. You agree not to attempt unauthorized access to, or interference with, this website or its underlying systems; such activity is prohibited and monitored. Website content may not be reproduced without our prior written permission. We may modify, suspend or discontinue any part of the website or Services at any time without notice.

We may update these Terms from time to time. Material changes will be communicated by email or by notice on this website, and the “Last updated” date above will be revised. Continued use of the website or Services after changes take effect constitutes acceptance of the revised Terms.

If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions will continue in full force and effect. Our failure to enforce any right or provision is not a waiver of that right or provision. The Client may not assign these Terms without our prior written consent. Neither party is liable for any failure or delay caused by events beyond its reasonable control. These Terms, together with the applicable SOW or MSA and our Privacy Policy, constitute the entire agreement between the parties in relation to their subject matter.

Questions about these Terms may be directed to info@cyberlinksec.com.