Terms of Service

• Vernovi Cyber will provide only the Services included in the agreed scope.

• Any additional work may require a written change request, revised fees and revised delivery dates.

• We are not required to perform work outside the agreed scope until the change has been approved by both parties.

• Delivery dates may be adjusted where delays are caused by missing information, unavailable personnel, restricted access, third-party dependencies or changes requested by the Client.

The Client must:

• provide complete and accurate information;

• provide timely access to relevant systems, records and personnel;

• obtain all necessary internal and third-party permissions;

• maintain suitable backups and recovery arrangements;

• protect credentials and access information;

• ensure that all instructions given to Vernovi Cyber are lawful;

• maintain appropriate software and third-party licences;

• review Deliverables within agreed timescales; and

• implement recommendations unless implementation is included in the agreed Services.

• Vernovi Cyber will only access, assess, monitor or test Authorised Systems.

• The Client confirms that it owns the relevant systems or has obtained the legal authority and third-party permissions required to authorise the Services.

• The Client acknowledges that vulnerability assessments, penetration tests, migrations, remediation and configuration changes may create risks including alerts, temporary interruption, account lockouts, system degradation or compatibility issues.

• Vernovi Cyber will use reasonable care to minimise disruption but cannot remove all risks associated with technical security work.

• We may suspend testing or access where authorisation is unclear or where continuing could create an unacceptable legal, security or operational risk.

Unless expressly agreed otherwise:

• response times are service targets rather than guarantees;

• not every attack, vulnerability or security event will necessarily be detected;

• incomplete logs or incorrect configurations may affect detection;

• Vernovi Cyber will not make material system changes without appropriate authority; and

• the Client remains responsible for business continuity, backups and final incident-response decisions.

• A free consultation is an introductory session and does not include a full security assessment, formal audit, penetration test or implementation work.

• Any recommendations provided are preliminary and based on the information available during the session.

• A free consultation does not create an ongoing advisory relationship and does not guarantee that all cybersecurity, legal, regulatory or operational risks will be identified.

Unless otherwise agreed:

• invoices must be paid within the period stated on the invoice;

• recurring Services are invoiced in advance;

• project work may require a deposit or advance payment;

• fees exclude applicable taxes and approved expenses; and

• bank and currency-conversion charges are the Client's responsibility.

• Where Services are supplied on a recurring basis, the subscription term, billing frequency and cancellation notice will be stated in the relevant agreement.

• Unless otherwise agreed, recurring Services continue into the next billing period until cancelled in accordance with the applicable agreement.

• Fees already paid for a current billing period are non-refundable.

• Vernovi Cyber may revise fees where the number of systems, users, data sources, log volumes or required service coverage materially increases.

Where the Client cancels an engagement:

• work already completed remains payable;

• onboarding and preparation fees may be non-refundable;

• committed third-party charges remain payable; and

• reserved consultant time may be charged where insufficient notice is given.

However, we do not guarantee that:

• websites, platforms, dashboards or monitoring tools will always be available;

• Services will be uninterrupted or error-free;

• all vulnerabilities, attacks or compliance issues will be identified;

• every security incident will be prevented or detected;

• recommendations will eliminate all risk; or

• third-party services will remain available or unchanged.

Our Services do not guarantee that the Client will:

• avoid a cyberattack, data breach or operational interruption;

• identify every vulnerability;

• pass an audit;

• obtain or retain certification;

• satisfy every regulator; or

• meet every legal or regulatory obligation.

These obligations do not apply to information that:

• is already lawfully known;

• becomes public without breach of these Terms;

• is independently developed;

• is lawfully received from another party; or

• must be disclosed by law, court order or regulatory requirement.

• Each party will comply with applicable data protection laws.

• The Client confirms that it has a lawful basis for providing personal data to Vernovi Cyber and instructing Vernovi Cyber to process it.

• Where Vernovi Cyber processes personal data on behalf of the Client, the parties may enter into a separate Data Processing Agreement.

• Vernovi Cyber may use appropriately qualified employees, contractors, cloud providers and subprocessors, subject to suitable confidentiality and data protection obligations.

Vernovi Cyber retains ownership of its pre-existing and reusable intellectual property, including:

• software and platforms;

• methodologies;

• templates;

• frameworks;

• assessment tools;

• report formats;

• policies;

• processes; and

• technical know-how.

• Our Services may use or depend on third-party cloud platforms, software, security tools, hosting providers and data sources.

• Third-party products may be subject to separate terms, licences and fees.

• Vernovi Cyber is not responsible for third-party outages, discontinued features, licence restrictions, provider changes or defects outside our reasonable control.

• The Client remains responsible for deciding whether a recommended third-party product is suitable for its organisation.

Subject to the above, Vernovi Cyber will not be liable for:

• indirect or consequential loss;

• loss of profit, revenue, goodwill or business opportunity;

• loss caused by inadequate backups;

• losses arising from third-party systems;

• vulnerabilities or incidents not detected during the Services;

• losses caused by incorrect or incomplete Client information;

• recommendations that the Client does not implement;

• incorrect implementation by the Client or another provider; or

• activities outside the agreed scope.

Vernovi Cyber may suspend Services where:

• payment is overdue;

• required access has not been provided;

• continuing would create a security or legal risk;

• the Client requests unlawful or unauthorised activity;

• required authorisations or licences have expired; or

• the Client materially breaches these Terms.

The Client must not use our Services, systems or Deliverables for:

• unlawful activity;

• unauthorised security testing;

• malicious access;

• surveillance without lawful authority;

• attacks against another organisation; or

• interference with Vernovi Cyber systems or customers.

• Vernovi Cyber may update these Terms to reflect changes in our Services, technology, payment methods, security requirements, business practices or applicable law.

• Updated Terms will be published on our website with a revised “Last updated” date.

• An update will not retrospectively change a signed Statement of Work unless agreed by both parties or required by law.

• The Client may not transfer its rights under these Terms without Vernovi Cyber's written consent.

• Vernovi Cyber may use suitably qualified employees, contractors and specialist subcontractors to deliver the Services.