Terms of Service
Last Updated: June 3, 2026 • MSME Reg. UDYAM-AP-21-0044317
1. Rules of Engagement & Authorization
By scheduling a security review or VAPT audit, you represent and warrant that you own or have explicit, documented authorization from the asset owner to perform active security scans, manual logical attacks, and authorization test vectors on target staging or production systems specified in our scoping document. Scoping boundaries agreed upon prior to testing must be strictly adhered to by both parties.
2. Safe Harbor & Operational Safeguards
TrustLayerLabs conducts offensive security testing using non-destructive, practitioner-guided methodologies designed to avoid service interruptions. However, clients acknowledge that testing interactive application logic and API endpoints carries inherent operational risks on fragile systems. Testing should ideally take place in dedicated staging, sandbox, or pre-production environments whenever feasible.
3. Mutual Confidentiality & NDA Integration
All proprietary technical architectures, source code excerpts, API endpoints, vulnerability proofs of concept, and business data disclosed during an engagement are treated as Strictly Confidential. Each engagement is governed by our bilateral Mutual Non-Disclosure Agreement (NDA), ensuring zero third-party disclosure, encrypted storage in transit and at rest, and permanent evidence purging post-retest.
4. Deliverables & Intellectual Property Ownership
Upon receipt of final payment, the client retains full and exclusive ownership of all customized vulnerability assessment reports, remediation recommendations, and specific proof-of-concept scripts generated for their environment. TrustLayerLabs retains ownership of its underlying assessment methodologies, pre-existing research, proprietary toolchains, and generic testing frameworks.
5. Retesting Policy & Verification Timelines
Retesting guarantees cover only the specific vulnerabilities highlighted in our initial VAPT report. Retesting must be requested within 30 days of initial report delivery unless extended in writing under an enterprise retainer agreement. One complimentary verification cycle is included with every standard penetration testing tier.
6. Retest Verification Letter & Attestation
A Retest Verification Letter and Security Badge suitable for SOC 2 auditors, enterprise procurement teams, and cyber insurance underwriters are issued only after independent verification confirms that all critical and high-severity flaws identified during scoping have been fully remediated.
7. Limitation of Liability & Governing Law
In no event shall either party be liable for any indirect, incidental, punitive, or consequential damages arising out of or related to security assessments. These terms shall be governed by and construed in accordance with the laws of India, and disputes shall be resolved through binding commercial arbitration in accordance with applicable statutory provisions.