Professional Services Terms

1. Engagement and scope

• Each engagement is defined by a statement of work that names the objectives, targets, deliverables, assumptions, exclusions, and schedule.
• No testing begins until the statement of work and the customer’s written authorization for the targets are in place.
• The parties agree any change to scope, targets, or schedule in writing before the change takes effect.

2. Customer responsibilities

• Provide timely access, credentials, points of contact, and the written authorization described in the Responsible Scanning Policy.
• Ensure the customer has the right to authorize testing of every named target, including third-party or cloud-hosted systems.
• Notify Eresus promptly of any system that must not be tested, and of any change that affects a target during the engagement.
• Designate a decision-maker who can approve scope and accept deliverables.

3. Conduct and safety

Eresus performs services professionally, within the agreed scope and time window, and in line with the Responsible Scanning Policy. Where an activity risks instability, outage, or loss of data, Eresus raises it before proceeding unless the customer has authorized the activity in writing. Either party may pause the engagement to protect a system or a person.

4. Deliverables and reporting

• Deliverables are provided in the format named in the statement of work, typically through the Workbench workspace and a written report.
• Findings are reported with the evidence needed to reproduce and prioritize them, and with the caveats the engagement requires.
• A report reflects conditions during the testing window and is not a warranty that no other weakness exists.

5. Acceptance

Unless the statement of work says otherwise, the customer reviews each deliverable within ten business days and either accepts it or gives specific, reasonable comments tied to the agreed scope. Eresus corrects a deliverable that does not conform to the statement of work within a reasonable time, and the customer then re-reviews it. A deliverable is deemed accepted if no comments are given within the review window.

6. Personnel and subcontracting

Eresus uses appropriately skilled personnel bound by confidentiality obligations. Where Eresus proposes to subcontract part of an engagement, it names the subcontractor and remains responsible for the work. Eresus may replace personnel for continuity, availability, or security reasons, and will keep the required skill level.

7. Fees and expenses

Fees, the billing schedule, and any pre-approved expenses are stated in the statement of work. Unless stated otherwise, fees are exclusive of applicable taxes, including Turkish VAT and any withholding, which the customer bears as required by law. Pre-approved travel and third-party costs are invoiced at cost.

8. Intellectual property

• The customer owns its own systems, data, and content, and the findings about them.
• Eresus owns its tools, methods, and templates, including anything reused across engagements.
• The customer receives a right to use the deliverables for its internal security purposes. Reusing raw tooling or templates outside that purpose requires written agreement.
• Eresus may describe an engagement in general terms and may name the customer as a client only with the customer’s written permission.

9. Confidentiality and data protection

Each party keeps the other’s confidential information confidential and uses it only for the engagement. Where Eresus processes personal data during the engagement, the Data Processing Addendum applies. Real data encountered during testing is handled as described in the Responsible Scanning Policy and is not copied outside the agreed workspace.

10. Warranties and liability

• Eresus performs the services with reasonable skill and care and in line with applicable law.
• Security testing is a sampling exercise. Eresus does not warrant that all vulnerabilities will be found, or that a tested system is free of vulnerabilities.
• Liability is governed by the limitations and exclusions in the agreement, subject to mandatory law. Nothing excludes liability that cannot lawfully be excluded.

11. Term, suspension, and termination

• The engagement runs for the period in the statement of work.
• Either party may suspend or terminate immediately if the other materially breaches the agreement and does not cure within a reasonable time after written notice, or if continuing would be unlawful or unsafe.
• On termination, the customer pays for work performed and approved expenses up to the termination date, and Eresus delivers work in progress and hands back or deletes customer data as agreed.

12. Governing law

These terms are governed by the laws of the Republic of Türkiye, and the parties submit to the competent courts of the Republic of Türkiye at the forum named in the order; failing that, the courts that have jurisdiction under Turkish law.