Terms of Service

We run penetration tests: we attack the systems you name, the way an attacker would, using AI agents built on open-weight models. A human expert checks every result before it reaches you. You receive a written report with fix steps, and a retest as described in your package.

• The price of each package is shown on the site. Government and enterprise work is quoted in writing. You always see the full price before you commit.
• Half of the price is paid as a deposit to book the test. The other half is due when we deliver the report.
• Prices don’t include taxes or bank charges that apply where you are.
• Payments are taken by Polar (polar.sh), which sells the test or the call to you on our behalf as merchant of record. Your receipt comes from Polar, and Polar’s checkout terms also apply to the payment.
• An order is confirmed when the testing authorization is signed and the deposit has arrived.

• You can book a 30-minute video call with one of our security experts for $99, paid when you book.
• The call is a conversation: general advice based on what you tell us. We don’t test or look into your systems during it, and it is not a security assessment.
• You choose the time when you book, from the times shown as free, and you receive a calendar invitation by email. If we have to cancel and can’t offer another time that suits you, we refund the $99.
• You can move or cancel the call free of charge up to 24 hours before it starts. After that, or if you don’t join, the $99 is not refunded.
• Booking a call doesn’t oblige you to order anything.

Testing a system without its owner’s permission is a crime in most countries. We don’t test anything until a signed testing authorization is in place. It sets the scope, the dates and the rules.

• You confirm that you own every system in scope, or have written permission from its owner to have it tested.
• If a system is run by someone else, such as a cloud or hosting provider, you are responsible for getting any permission they require.
• The person who signs confirms they have the authority to allow the test.
• Anything outside the agreed scope stays untouched.
• We may refuse or stop a test if we have reason to doubt that it is properly authorized. If that doubt was caused by wrong information from you, the deposit is not refunded.

• Give us accurate details of what to test and when.
• Name a security contact we can reach during the testing window.
• Keep working backups of the systems in scope.
• Tell the people who need to know, such as your hosting provider or the team that monitors your network, so the test is not mistaken for a real attack.

• Testing is non-destructive by default and rate-limited. Anything riskier is agreed with you in writing first.
• You choose the testing window, and you can ask us to test a staging copy instead of production.
• If we find something critical, we tell your security contact straight away. We don’t wait for the report.
• Even careful testing can slow a system down or interrupt it. By authorizing the test you accept that risk for work done inside the agreed scope and rules.

The delivery times shown for each package are what we aim for, not a guarantee. They start when the testing window opens and can move if we can’t reach the systems or your contact. The retest covers the findings in the report, within the retest period of your package.

A penetration test shows what we found, in the agreed scope, in the time agreed. No test finds every weakness. New flaws appear and systems change after we finish. Our report is not a certificate and not a guarantee that your systems are secure or that you meet any standard or law.

We keep everything we learn about your systems confidential, including the fact that you are a client, and use it only to deliver the service. We don’t publish findings or name clients without written permission. You keep our methods, tools and prices confidential in the same way. This continues after the work ends.

We keep only the evidence needed to prove a finding, store it encrypted, and delete it when your retest period ends. How we handle personal data is set out in our Privacy Policy and in the data processing agreement that forms part of your order.

The report is yours. You may use it inside your organization and share it with your auditors, insurers, regulators and the suppliers who need it to fix a finding. Our tools, methods and templates stay ours.

• If you cancel before the testing window opens, we refund the deposit, less a fair charge for work already done on your scope.
• Once testing has started, the deposit is not refundable.
• You can move the testing window once at no cost if you tell us at least 3 business days before it opens.
• If we can’t carry out the test for reasons on our side, we refund everything you paid for it.

Nothing in these terms limits liability that the law does not allow to be limited, such as liability for intentional harm or gross negligence.

Apart from that, we are not liable for lost profit, lost business, lost data or other indirect loss, or for anything caused by testing done inside the agreed scope and rules. Our total liability for an order is limited to the price you paid for that order.

Don’t misuse the site: no attempts to break in, overload it or scrape it, unless you have our written permission. If you find a security problem, please report it to us (see Company details).

The news stories we link to are written and owned by their publishers. We summarize them in good faith, and we are not responsible for other sites. Nothing on this site is legal advice.

These terms are governed by the law of the Republic of Moldova. If something goes wrong, tell us first and we will try to settle it with you within 30 days. If that fails, the courts of Chișinău, Republic of Moldova, decide the dispute.

We may update these terms. The version in force when you place an order applies to that order. Questions: hello@deckardsecurity.com.