Terms & Conditions for Cybersecurity, VAPT & SOC Services

Headings are for convenience only. "Including" means "including without limitation". References to law include amendments and re-enactments.

By using the Site, submitting an enquiry or form, or engaging us for Services, you accept these Terms. If you do not agree, do not use the Site or Services.

Our Site and Services are intended for businesses and adults aged 18 or over. If you act for an organisation, you confirm that you have authority to bind it.

Order of precedence. If documents conflict, the order is: (a) the signed Agreement; (b) any rules of engagement or data-processing terms attached to it; (c) these Terms; and (d) any Site content or marketing material.

Forms on the Site may open WhatsApp or send details to our team directly. Do not submit passwords, keys, tokens, source code, live customer data or other sensitive Client Data through them. See our Privacy Policy.

Descriptions of Services on the Site are general. The exact scope, Targets, methodology, deliverables, timelines, retest window and fees are set out in your Agreement.

Figures on the Site, such as critical-finding escalation targets, on-time delivery rates, framework counts or monitoring coverage, are indicative targets and not guarantees unless your Agreement expressly states them as commitments.

We perform Services with reasonable skill and care using appropriately qualified personnel. We may use subcontractors only where permitted by your Agreement, and remain responsible for their work.

Where Services follow recognised frameworks such as OWASP, PTES, NIST, MITRE ATT&CK, CIS Benchmarks or CVSS, we apply them as methodological guidance. Alignment with a framework is not a certification by that framework's owner.

We test only within the agreed scope. If we identify a Target we reasonably believe is out of scope or not owned by you, we will stop and notify you.

Denial-of-service, social engineering, physical, and destructive tests are performed only with your explicit written consent for that specific activity.

Security testing carries inherent risk, including performance degradation, account lock-outs, unexpected behaviour, or data changes. You are responsible for maintaining backups and for informing your internal teams, providers and security-monitoring staff before testing begins. We will notify your named contact immediately of any critical finding or material disruption we observe.

The free proof of concept ("POC") covers one Target that you nominate, is offered once per organisation, and carries no fee or obligation to buy further Services.

We may decline or limit a POC request, for example where we cannot reasonably verify that the Target is yours or where the scope would be unsafe or unlawful.

A POC is a time-boxed sample of our work. It is not a full security assessment and does not certify that a Target is free of vulnerabilities.

Sections 5 (authorisation), 11 (confidentiality), 14 (disclaimers) and 15 (liability) apply to the POC in full.

Delays caused by missing access, information or approvals may extend timelines and, where they cause additional effort, fees.

Deliverables are delivered through the secure channel agreed with you and shared only with the contacts you name.

Retesting. Where your Agreement includes retesting, it covers verification of fixes for findings reported in that engagement within the retest window stated in the Agreement. It does not extend to new scope, new features, or vulnerabilities introduced after the original test.

Attestation. An attestation letter, where provided, reflects the state of the tested scope at the time of testing or retest only and may be shared with your customers, partners and auditors as evidence of testing.

Please review Deliverables promptly and raise any questions or disputed findings in writing within a reasonable period of receipt.

Fees are quoted in writing for the agreed scope. Change requests are quoted and approved before additional work starts.

Unless your Agreement says otherwise, invoices are payable within the period stated on the invoice. Fees exclude GST and other applicable taxes, which are charged at the prevailing rate.

Late payment may attract interest at a reasonable rate and, after written notice, suspension of work or withholding of Deliverables until dues are cleared.

Cancelling or rescheduling a confirmed engagement at short notice may incur reasonable charges for resources already committed.

Each party will keep the other's non-public information confidential, use it only for the engagement, and disclose it only to personnel and advisers who need it and are bound by equivalent duties. A mutual NDA is available on request and applies to any engagement.

Confidentiality does not cover information that is or becomes public through no fault of the recipient, was lawfully known before disclosure, is independently developed, or must be disclosed by law. Where legally permitted, we will notify you before a compelled disclosure.

We will not name you as a client, or disclose your vulnerabilities, systems or findings, without your permission.

Personal data is handled as described in our Privacy Policy and, for engagement-specific processing, any data-processing terms in your Agreement. Engagement data is retained or purged on the schedule agreed with you.

All Site content, including text, graphics, logos, layouts, sample reports and downloadable material, belongs to Woollemia or its licensors and is protected by intellectual-property law. You may view and download sample materials for your own internal evaluation but may not modify, republish or sell them.

You retain ownership of Client Data. On full payment, we grant you a non-exclusive, non-transferable licence to use the Deliverables for your internal business, audit, and customer-assurance purposes.

We retain all rights in our pre-existing and independently developed tools, scripts, methodologies, templates and know-how, including improvements made during an engagement that do not contain Client Data.

If you believe you have found a security vulnerability in the Site, please report it to info@woollemia.com with enough detail to reproduce it. Please give us reasonable time to investigate and remediate before any public disclosure.

Do not access, modify or exfiltrate data beyond what is needed to demonstrate the issue, and do not degrade the Site for other users. Good-faith research that follows these rules will not be pursued by us.

Security assessments are point-in-time and limited by scope, time and the information available. We do not warrant that all vulnerabilities will be identified, that your systems will be free from attack or compromise, or that you will obtain or retain any certification or pass any audit.

The Site and its content, including the compliance readiness check, are provided "as is" and "as available". To the fullest extent permitted by law, we disclaim all other warranties, express or implied, including merchantability and fitness for a particular purpose. Nothing on the Site is legal advice.

To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, punitive or consequential loss, including loss of profit, revenue, data, business or goodwill.

Our total aggregate liability arising from or relating to an engagement is limited to the fees you paid us for that engagement in the twelve months preceding the event giving rise to the claim. For free Services, including the POC, and for the Site, our liability is limited to the extent permitted by law.

Nothing in these Terms limits liability that cannot be limited by law, including liability for fraud, wilful misconduct, or death or personal injury caused by negligence.

You will indemnify and hold harmless Woollemia, its directors, employees and consultants against third-party claims, losses and reasonable legal costs arising from (a) your breach of these Terms or an Agreement; (b) testing of any Target for which you lacked authority to grant permission; or (c) Client Data that you were not entitled to provide.

We will give you prompt notice of any claim, allow you reasonable control of its defence, and cooperate at your cost.

We may suspend or restrict access to the Site, or pause or decline work, if you breach these Terms, request activity we reasonably believe is unlawful, or put our systems or people at risk.

Either party may terminate an engagement as provided in the Agreement, or for the other's material uncured breach after written notice. On termination you will pay for Services performed and costs committed up to the termination date.

Sections that by their nature should continue, including 5.4, 8.1, 10, 11, 12, 14, 15, 16, 19 and 20, survive termination.

Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disaster, epidemic, war, government action, power or internet failure, or widespread cloud or telecom outages. The affected party will notify the other promptly and use reasonable efforts to resume performance. Payment obligations for Services already performed remain due.

These Terms are governed by the laws of India, without regard to conflict-of-law rules.

The parties will first try to resolve any dispute in good faith through written notice and discussion between senior representatives for at least 30 days.

Any unresolved dispute is subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka, unless your Agreement provides for arbitration or another dispute-resolution mechanism, in which case that mechanism applies.

Entire agreement. These Terms, the Privacy Policy and any Agreement are the whole agreement on their subject and supersede earlier understandings.

Severability. If a provision is held unenforceable, the rest remains in effect and the provision will be enforced to the maximum extent permitted.

No waiver. Failure to enforce a right is not a waiver of it.

Assignment. You may not assign these Terms without our written consent. We may assign them to an affiliate or a successor to our business on notice.

Independent parties. The parties are independent contractors. Nothing creates a partnership, agency or employment relationship.

Notices. Formal notices must be in writing and sent to the contact details in Section 21, or to the address stated in your Agreement.

We may update these Terms from time to time. The current version will always be published on this page with its effective date. Continued use of the Site after an update means you accept it. Updates do not change the terms of an Agreement already signed.