The terms you're agreeing to, in language you can follow.
Authorising a security test is a real legal act. These pages set out what we may do, what we may not, how we handle your data, and where liability sits.
Responsible testing & authorisation
Security testing without permission is a criminal offence in the UK under the Computer Misuse Act 1990. Your written authorisation is what makes our work lawful, so we treat it as the foundation of every engagement.
By requesting an assessment you confirm you are the owner of the site, or are authorised by the owner to commission testing on their behalf. Agencies must hold their client's written permission.
The scope document names the exact domains, endpoints and time window we may test. Anything not listed is out of bounds, including third-party services your site depends on.
We do not delete data, place real orders, take systems offline, or run denial-of-service tests. Where a proof of concept requires a state change, we ask first and document it.
If a finding exposes personal data, we record only what is needed to evidence it, redact it in the report, and securely destroy any extracted sample once the engagement closes.
One message pauses or ends an engagement immediately, no reason required. We will report on whatever was completed to that point.
Terms of service
Scope and quotes
Quotes are fixed for the scope described and valid for 30 days. If the scope changes materially — additional domains, a platform migration, significantly more assets than declared — we will re-quote before continuing rather than invoice the difference.
Payment
One-off assessments are invoiced on acceptance of the scope and payable before the report is released. Monitoring subscriptions are billed monthly in advance and may be cancelled at any time, effective at the end of the current period. Prices exclude VAT where applicable.
Cancelling before work starts
Paying for an assessment does not start it — nothing runs until you have signed the scope document. Cancel at any point before that signature and we refund the payment in full, because no work has been done. Once the scope is signed the engagement is under way, and we invoice for the work delivered up to the point you stop it.
Monitoring terms
Monitoring is priced per website. Rolling monthly plans can be cancelled at any time and end with the current period. Terms paid up front are not refundable part-way through, but they can be transferred to another website you own, or paused once for up to 60 days — tell us and we will move the remaining time.
What we deliver
A written report covering the agreed scope, a remediation plan, and a walkthrough call. The Deep Test and Fix & Verify tiers include a retest of remediated critical and high findings within 30 days of report delivery.
What an assessment is not
An assessment is a point-in-time review of the agreed scope. It is not a guarantee that your site is secure, a certification, a compliance audit, or an incident-response service. No testing method can prove the absence of vulnerabilities, and your site's risk changes every time you install an app or update your theme.
Liability
We take reasonable care to avoid disruption. Our aggregate liability is limited to the fees paid for the engagement giving rise to the claim. We are not liable for losses arising from vulnerabilities you chose not to remediate, from systems outside the agreed scope, or from indirect or consequential loss. Nothing limits liability for death, personal injury, or fraud.
Confidentiality
Findings are confidential to you. We will not name you as a client, publish details of your findings, or share your report with anyone without written permission. We are happy to sign your own NDA before scoping.
Governing law
These terms are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Privacy policy
ARMASEC LTD is the data controller for information collected through this site and our engagements. We process personal data under UK GDPR and the Data Protection Act 2018.
Who we share it with
Only the processors needed to run the business — hosting, email, and payment processing — each under a data processing agreement. We do not sell data, do not share it for advertising, and do not transfer it outside the UK/EEA without appropriate safeguards.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to processing, or request portability. Email [email protected] and we'll respond within 30 days. If you're unhappy with how we've handled it, you can complain to the Information Commissioner's Office (ico.org.uk).
Vulnerability disclosure
We hold ourselves to the standard we sell. If you find a weakness in Armasec's own systems, report it to [email protected]. We acknowledge within 24 hours, keep you updated, and will not pursue legal action against research conducted in good faith.
Company details
Comfortable with the terms?
Get a fixed price for your site. Nothing runs until you sign the scope.