Terms of Service

1. Scope of Services

SableOffensive provides penetration testing and security assessment services for web applications, APIs, and cloud infrastructure. Our services include:

• --Pre-Launch Check: Automated and manual security review covering OWASP Top 10, secrets detection, and basic API testing. Report delivered within 24-48 hours.
• --Founder Shield: Comprehensive security assessment including IDOR testing, auth bypass attempts, business logic review, and a 30-minute debrief call.
• --Scale Secure: Full-scope penetration test including infrastructure review, CI/CD pipeline analysis, third-party integration audit, and ongoing support.
• --Custom Engagements: Tailored security assessments scoped to your specific requirements.

2. Authorization and Legal Testing

By engaging our services, you represent and warrant that:

• --You own or have explicit written authorization to test the target applications and infrastructure
• --You will provide a signed authorization form before testing begins
• --Testing will only be performed against the agreed-upon scope; we do not test systems outside the defined scope
• --You understand that penetration testing may cause temporary disruptions (we minimize this risk but cannot eliminate it entirely)
• --All testing is conducted ethically and in compliance with applicable computer fraud and abuse laws

3. Liability Limitations

To the maximum extent permitted by law:

• --SableOffensive is not liable for any indirect, incidental, or consequential damages arising from our testing
• --Our total liability for any claim related to our services is limited to the amount paid for that specific engagement
• --We are not responsible for vulnerabilities that emerge after the testing period or from code changes made after our assessment
• --We are not liable for any downtime or service disruption that may occur during authorized testing windows
• --Our reports represent findings at a specific point in time and do not guarantee future security

4. Payment Terms

Payment terms for our services:

• --Payment is required in full before testing begins for Pre-Launch Check and Founder Shield plans
• --For Scale Secure and custom engagements, a 50% deposit is required upfront with the balance due upon report delivery
• --All prices are listed in USD; applicable taxes may apply based on your jurisdiction
• --Invoices are sent via email; payment is accepted through our secure payment processor
• --Late payments may result in delayed report delivery or suspension of ongoing services

5. Refund Policy

We stand behind the quality of our work:

• --50% money-back guarantee: If our assessment finds zero security issues, you receive a 50% refund of the engagement fee
• --Refund requests must be made within 7 days of report delivery
• --Refunds do not apply if you provided incorrect, incomplete, or misleading information about the target scope
• --Refunds do not apply if you restricted access to parts of the application that prevented thorough testing
• --No refunds are issued for engagements that have been fully delivered as scoped

6. Confidentiality and NDA

Confidentiality is fundamental to our service:

• --All engagements are covered by a Non-Disclosure Agreement (NDA)
• --We will never disclose your identity, application details, or vulnerability findings to any third party without your written consent
• --Our security researchers are individually bound by confidentiality obligations
• --We do not use your specific vulnerability data for marketing, case studies, or public research without explicit permission
• --Aggregated, anonymized statistics may be used to improve our methodologies

7. Data Handling and Deletion

We follow strict data handling protocols:

• --All scan data, credentials, and vulnerability findings are permanently deleted within 30 days of report delivery
• --Staging credentials and access tokens are revoked immediately after testing concludes
• --Data is stored encrypted during the engagement period
• --You may request immediate deletion of all data at any time
• --See our Privacy Policy for complete details on data handling practices

8. Intellectual Property

Upon full payment, you receive a non-exclusive license to use the security assessment report for your internal business purposes. SableOffensive retains ownership of our testing methodologies, tools, and proprietary processes. You may not redistribute, resell, or publish our reports without written consent.

9. Termination

Either party may terminate an engagement with written notice. If you terminate before testing is complete, you are responsible for payment proportional to work completed. We reserve the right to terminate an engagement if we discover illegal activity or if you violate these Terms.

10. Governing Law and Dispute Resolution

These Terms are governed by applicable international commercial law. Any disputes arising from these Terms or our services will first be addressed through good-faith negotiation. If negotiation fails, disputes will be resolved through binding arbitration in accordance with internationally recognized arbitration procedures.