Engagement Terms

Scope. Audits cover the environment agreed at the kickoff call (one environment for Baseline; up to three agreed environments for Standard; on-prem sites up to 25 systems each). Work outside that boundary requires a separate engagement.

Access. Client provides read-only credentials. ZuluSec does not modify client systems during an audit and does not perform active exploitation.

Deliverables. Findings report delivered as agreed at kickoff (typically within one week for Baseline, two for Standard, from the date access is granted).

Confidentiality. Everything we see and everything we report is confidential. Findings are shared only with the client. Credentials are destroyed at engagement end.

Refunds. Full refund any time before the kickoff call. After work begins, fees are non-refundable, but we will make reasonable efforts to address concerns about the deliverable.

Liability. An audit is a point-in-time review and does not guarantee the absence of vulnerabilities or future breaches. Liability is limited to fees paid for the engagement.