Legal - Services terms

1. How an engagement is agreed

An engagement starts when you and Meridal Group LLC, trading as Wardkey, sign a statement of work. The statement of work names the systems in scope, the testing dates, the price and the lead tester. If it conflicts with these terms, the statement of work wins for that engagement. A master services agreement can replace these terms for larger or repeat work.

2. Authorization to test

• We test only systems you own or are allowed to authorize for testing. You confirm this in writing before testing starts.
• Where a system runs on a third party platform, you are responsible for any notice or approval that platform requires.
• We stay inside the agreed scope, dates and rules of engagement. Anything outside them needs a written change first.
• Testing can affect the availability or data of the systems tested. We test staging or test tenants first and touch production only with your written risk acceptance.

3. Price and payment

50% when the scope is signed and 50% when the report is delivered, each due within 15 days. Work under $5,000, such as a retest after a change, is paid at signing.

Prices are in US dollars and exclude taxes and bank fees. Invoices are paid by bank transfer or card. Late invoices carry interest of 1% a month. We may pause work, including the release of the report and letter, while an invoice is more than 15 days overdue.

4. Rescheduling and cancellation

One free move of the start date with at least ten business days' notice. Later moves depend on tester availability.

Cancel ten or more business days before the start and we refund the first payment in full. Later than that, we keep 25% of the price for the tester time we reserved. Once testing starts, work done is billed.

If we cannot start on the agreed date for reasons on our side, you may move the date at no cost or cancel for a full refund of anything paid.

5. Report, fixes and retest

• The report is delivered within three business days of the last testing day. Critical findings are reported on the day we confirm them.
• Fix pull requests are opened from a fork or a branch you protect. Your engineers review and merge them. We never hold merge or deploy rights, and you are responsible for what you deploy.
• One free retest of the fixed findings within 90 days of the report. Further retests from $1,500. The retest is done by a tester who did not write the fix.
• The attestation letter is issued when the critical and high findings are closed. If a finding stays open, the letter can list it as open with your planned fix date.

6. Your responsibilities

• Provide test accounts, access and a technical contact on the testing days.
• Keep backups of the systems in scope and tell us about anything fragile before testing starts.
• Do not share live customer data or production secrets with us unless the statement of work requires it.

7. Confidentiality

Both sides keep the other's confidential information private, use it only for the engagement and share it only with people who need it and are bound by the same duty. This lasts for three years after the engagement ends, and for as long as the information stays secret where it is a trade secret or a vulnerability that is not yet fixed.

8. Who owns what

You own the report, the letter and the fixes we write for you once they are paid. You may share the report and letter with your auditors, customers, investors and regulators. We keep our methods, tools, templates and know-how. We will not name you as a client or describe your engagement without your written permission, and any example we publish is anonymized.

9. Data

Personal data we see during a test is processed under our data processing terms. Raw evidence is deleted 30 days after the retest and the final report after 12 months, unless you ask us in writing to keep it longer or delete it sooner. We keep a short register entry for each attestation letter so it can be checked.

10. What a test is not

A security test is a point in time review of an agreed scope. It is not a guarantee that a system is free of vulnerabilities, not a certification and not legal advice. Except as written in these terms and the statement of work, we give no other warranties.

11. Liability

Each side's total liability for an engagement is capped at the fees paid or payable for it in the 12 months before the claim. Neither side is liable for lost profits, lost revenue or indirect damages. These limits do not apply to a breach of confidentiality, to fraud or to anything that cannot be limited by law.

You will defend us against claims that we tested a system you were not allowed to authorize. We will defend you against claims that our deliverables infringe someone else's intellectual property.

12. Independence

We do not test systems in PCI cardholder data scope for which we also wrote fixes. The attestation letter states which fixes we wrote. We decline work that requires testers who are US persons or located in the United States.

13. Law and disputes

These terms are governed by the laws of the State of Wyoming, United States. Before any formal dispute, both sides will try to settle it in good faith for 30 days. Disputes that remain are resolved by binding arbitration under the Commercial Rules of the American Arbitration Association, held online in English, and either side may still ask a court for urgent relief.

14. General

We are an independent contractor. Neither side is liable for delays caused by events outside its reasonable control. Notices are sent by email to the contacts in the statement of work. Neither side may transfer the agreement without the other's consent, except to a buyer of its business.