Home / Terms of Service
Terms of Service
These terms govern security services, incident response and training provided by Blackbourne Worldwide. Where a signed engagement agreement or statement of work exists, that document takes precedence over these terms.
1. Authorisation is a condition of service
We will not begin testing without written authorisation from a person with the authority to grant it, naming the targets, exclusions, stop conditions and emergency contacts. If authorisation is withdrawn, testing stops immediately. The client warrants that it has the right to authorise testing of everything in scope, and that any third-party systems have been excluded or separately authorised.
2. Scope and conduct
Testing is limited to the agreed scope. We will not target individuals outside the agreed population, will not use techniques excluded by the scope, and will observe agreed stop conditions. Where a finding requires action beyond the scope to demonstrate, we will ask before proceeding.
3. Client responsibilities
- Provide accurate scope information and timely access to the people who can answer questions.
- Keep a named emergency contact reachable during testing, including out of hours.
- Maintain backups and inform us of systems where testing carries operational risk.
- Not withhold relevant regulatory or contractual restrictions that apply to the systems in scope.
4. Findings and reporting
Findings are reported to the client confidentially. Reports represent our professional assessment based on the scope and time available; they are not a guarantee that no other weakness exists, and a clean result means only that we did not find a path within scope and schedule.
5. Confidentiality
Each party will protect the other's confidential information with at least the care it applies to its own. We will not name a client publicly or use an engagement as a reference without written permission.
6. Malware and artefacts
Samples and artefacts recovered during an engagement remain the client's property. We retain them only as the engagement agreement permits, for the agreed retention period, and analyse them in an isolated environment.
7. Emergency response
Incident response is provided on the terms of the applicable retainer or, where no retainer exists, on terms agreed at the time of the incident. Our containment target is under 30 minutes from confirmation of a threat; this is a target, not a guarantee, and depends on access, information and the authority granted in advance.
8. Fees
Fees are set out in the engagement agreement or order and are payable as stated. Retest and additional scope are charged separately. Training fees are payable on enrolment and are non-refundable within 14 days of the course date.
9. Intellectual property
Reports, methodologies, tooling and training materials remain our intellectual property, licensed to the client for internal use. The client may share reports with its auditors, insurers and counsel.
10. Limitation of liability
To the extent permitted by law, we are not liable for indirect or consequential loss, and our total liability in relation to an engagement is limited to the fees paid for that engagement. This does not limit liability for wilful misconduct, breach of confidentiality, or liability that cannot lawfully be limited.
11. Refusal and termination
We may decline or terminate an engagement where a request would require testing without authorisation, would target individuals outside an agreed population, or would put us in breach of law or professional ethics. Either party may terminate for material breach not cured within 14 days of notice.
12. Governing law
These terms are governed by the laws of the State of Michigan, United States, and the state and federal courts located in Wayne County, Michigan have exclusive jurisdiction.
13. Contact
Questions about these terms: legal@blackbourneco.com, or through the contact page.