Terms of Service

1. Parties & Definitions

"Owlzops" refers to Owlzops, LLC, a Delaware limited liability company.

"Client" refers to the individual or legal entity purchasing services from Owlzops.

"Engagement" means any paid consulting service, defined by a Statement of Work (SOW) or an order confirmation.

"Deliverables" means the specific written outputs described in the applicable SOW - such as assessment reports, risk matrices, architecture diagrams, runbooks, and documentation.

"Services" means the professional consulting activities performed to produce the Deliverables.

"Audit" (or "Assessment") means an Infrastructure Security Audit: a read-only, point-in-time examination of Client systems to identify indicators of compromise, attack surface, and security misconfigurations.

"Hardening" means an Infrastructure Hardening Engagement: hands-on remediation work performed on Client systems.

"Indicators of Compromise" ("IoC") means observable artefacts that suggest a system may have been accessed, modified, or controlled by an unauthorised party.

"In Scope Systems" means the specific hosts, environments, and infrastructure identified in the SOW and authorised by Client under Section 6.1.

2. Services & Scope

2.1 Defined Scope

All Engagements are scoped in a Statement of Work or order confirmation before work begins. The SOW defines: the specific service tier, the In Scope Systems and host count limits, deliverables, timeline, and any explicit exclusions.

2.2 Engagement Tiers

Owlzops offers the following fixed-price service tiers. Each has defined deliverables and limits published on owlzops.com and confirmed in the SOW. Scope beyond the published limits requires a custom quote.

• Infrastructure Security Audit - a read-only, point-in-time audit producing an IoC review, attack-surface map, risk matrix, findings call, and a written remediation plan. Diagnostic only; no changes are made to Client systems.
• Infrastructure Hardening - hands-on remediation of findings, delivered in staged and reversible changes, with a before/after comparison and documentation handover. Offered in fixed-price tiers scoped by host count (Essentials and Standard), as published on owlzops.com and confirmed in the SOW.
• Continuous Hardening (Retainer) - a rolling monthly service providing weekly drift scans against an established baseline, monthly posture reporting, and a fixed allocation of engineering hours per month as specified in the applicable tier. Unused hours do not roll over.

2.3 Point-in-Time Nature of Assessments

An Assessment describes the state of the In Scope Systems as observed during the assessment window only. It is not continuous monitoring, and it makes no statement about the state of any system before or after that window. Client acknowledges that infrastructure state can change at any time, including immediately after an Assessment concludes.

2.4 What Is Not Included

Unless explicitly stated in the SOW, Services do not include:

• Implementation of any changes or fixes identified in an Assessment (this is the separate Hardening Engagement)
• Incident response, threat containment, eradication, or attacker eviction
• Forensic investigation intended to support litigation, insurance claims, or law-enforcement referral, including evidence preservation or chain-of-custody handling
• Penetration testing, red teaming, exploitation, or application source-code review
• Regulatory breach notification, or determination of whether a notification obligation has arisen
• Formal certification, attestation, or audit sign-off for SOC 2, ISO 27001, or any other framework. Owlzops is not an accredited auditor. Findings may be mapped to CIS Benchmark references as engineering evidence only.
• 24/7 on-call or emergency coverage (available as a separate add-on)
• Support for systems, environments, or host counts beyond those specified in the SOW
• Any work outside the primary stack defined at the start of the Engagement

2.5 Assessment Credit

Where Client proceeds to a Hardening Engagement, the fee paid for a preceding Infrastructure Security Audit is credited in full against the Hardening fee, provided the Hardening SOW is signed within ninety (90) days of delivery of the Audit report. The credit is applied once, is not redeemable for cash, and does not apply to Retainer fees.

2.6 Escalation on Discovery of Active Compromise

If Owlzops identifies evidence suggesting an active compromise during an Engagement, we will notify Client without undue delay. Client is solely responsible for deciding on and executing any response. Where the situation exceeds the scope of the Engagement, Owlzops may recommend that Client retain a dedicated incident response provider, and may decline to continue work that would fall outside the agreed scope.

2.7 Subcontractors

Owlzops does not subcontract Engagement work without written Client consent. The engineer who scopes the work is responsible for its delivery.

2.8 Source-Available Tools

Owlzops uses its source-available tool, owlzops-mapper, as part of the audit process. In its standard and deep-forensics modes the tool performs read-only operations and makes no changes to Client systems. Its source code is publicly available at github.com/OWLZOPS/owlzops-mapper, and Client is free to review or run it independently, before or without any Engagement.

3. Payment Terms

3.1 Fixed-Price Billing

All Engagements are billed at a fixed price agreed upon before work starts. There are no hourly rates or open-ended billing for scoped services.

3.2 Deposit

A non-refundable deposit (typically 33% of the Engagement fee, or as specified in the SOW) is required before work commences. The deposit secures the start date and reserves engineering time.

3.3 Milestone Billing

For Engagements over $3,000, the remaining balance is billed at milestones defined in the SOW (e.g., mid-engagement and on final delivery). Payment is due within 14 calendar days of the invoice date.

3.4 Published Pricing & Discounts

Prices published on owlzops.com are indicative starting prices for the published scope. Where Client supplies a valid owlzops-mapper report at the point of scoping, a discount may be applied to the Assessment fee as published. Final pricing is that stated in the SOW.

3.5 Retainers

Retainer fees are billed monthly in advance. Either party may cancel a Retainer with 30 days' written notice, effective at the end of the then-current billing month. Unused engineering hours do not roll over between months unless stated in the SOW.

3.6 Late Payment

Invoices unpaid after 14 days accrue interest at 1.5% per month. Owlzops reserves the right to pause or terminate the Engagement if payment remains outstanding after 30 days.

3.7 Currency & Processing

All prices are in US Dollars (USD) unless otherwise agreed in writing. Card payments are processed by Stripe; Owlzops does not receive or store raw card data. Corporate settlement may be handled via Payoneer. Client is responsible for any bank or intermediary fees applied on their side.

3.8 Taxes

Client is responsible for any applicable taxes in their jurisdiction. Owlzops will provide invoices suitable for VAT reclaim where applicable.

3.9 Refunds

The initial deposit is non-refundable once work has begun. If Owlzops is unable to complete an Engagement due to our own fault, we will refund fees paid for undelivered work on a pro-rata basis.

Audit fees are not refundable on the basis that the Audit found fewer issues than Client expected. The Deliverable is the examination and its findings, not a particular outcome: an Audit that reports few findings is a completed Audit, and the evidence it produces is the thing Client purchased.

Owlzops publishes a free scanner precisely so that Client can see the likely shape of the findings before entering into any Engagement. Where Client has run it and the result appears clean, Owlzops will say so and decline the Engagement rather than accept the fee.

4. Intellectual Property

4.1 Client Owns Deliverables

Upon full payment of all fees for an Engagement, Owlzops assigns to Client all rights, title, and interest in the Deliverables specific to that Engagement (assessment reports, risk matrices, runbooks, architecture diagrams, custom documentation).

4.2 Owlzops Retains Pre-Existing IP

Owlzops retains all rights to its pre-existing tools, methodologies, frameworks, detection logic, and source-available software (including owlzops-mapper). Use of these tools during an Engagement does not transfer ownership of those tools to the Client.

4.3 No Exclusivity

Owlzops may use similar methods, approaches, and tools for other clients. The specific Deliverables are yours; the general knowledge and methodology remain ours.

4.4 No Client Attribution Without Consent

Owlzops will not name Client, or publish any detail identifying Client's infrastructure, in marketing material, case studies, or public writing without Client's prior written consent.

5. Confidentiality & Findings Data

5.1 Mutual Confidentiality

Both parties agree to keep confidential any non-public information received from the other party in connection with an Engagement ("Confidential Information"). This includes infrastructure details, credentials, scan output, security findings, source code, business data, and pricing.

5.2 Security Findings Are Client Confidential Information

All findings, reports, and scan output generated during an Engagement are treated as Client Confidential Information. Owlzops will not disclose the existence or content of any security finding to any third party except where required by law or court order, and will notify Client of any such requirement to the extent legally permitted.

5.3 Exceptions

Confidentiality obligations do not apply to information that: (a) is or becomes publicly known through no breach by the receiving party; (b) was rightfully known before disclosure; (c) is independently developed without reference to the disclosing party's information; or (d) must be disclosed by law or court order.

5.4 Duration

Confidentiality obligations survive termination of the Engagement for a period of three (3) years. Obligations relating to security findings and credentials survive indefinitely.

5.5 Retention & Deletion of Findings Data

Owlzops retains raw scan output and working data only as long as necessary to deliver and support the Engagement, and in any case no longer than ninety (90) days after final delivery, after which it is deleted. Client may request earlier deletion in writing at any time. Owlzops retains the final Deliverable and Engagement records as required for business and legal purposes.

5.6 Credentials & Access

Owlzops takes the minimum access required to perform the Services, and will confirm in writing when its access is no longer required. Client is responsible for revoking any access credentials provided to Owlzops upon conclusion of the Engagement. Owlzops will not retain, store, or reuse credentials beyond the Engagement period.

5.7 NDA

A separate mutual NDA is available on request and can be signed before any discovery call if preferred.

6. Client Access & Responsibilities

6.1 Authorisation to Assess

This is a condition of every Engagement. Client represents and warrants that it owns, controls, or is otherwise fully authorised to permit examination and modification of every In Scope System, and that it has obtained all consents required from any third party - including hosting providers, cloud providers, parent or affiliate entities, and data processors - before work begins.

Client will not instruct Owlzops to access, scan, or modify any system it is not authorised to authorise. Client indemnifies and holds Owlzops harmless against any claim, penalty, or loss arising from Client's failure to hold that authority. Owlzops may suspend or terminate any Engagement immediately, without refund of work performed, where it reasonably believes this warranty has been breached.

6.2 Required Access

Client agrees to provide reasonable access to systems, environments, and personnel necessary to perform the Services. Assessment work generally requires root or sudo access to produce complete results. Delays caused by access issues may extend timelines; Owlzops is not liable for delays attributable to Client.

6.3 Staging Environments

Where an Engagement includes infrastructure changes, Client is responsible for providing a staging or test environment representative of production. Owlzops will not perform destructive tests or changes on live production systems unless explicitly agreed in writing.

6.4 Change Windows & Backups

Hardening changes are applied at times agreed with Client. Client is responsible for maintaining working, restorable backups of all In Scope Systems before any Hardening work begins. Owlzops is not a backup provider and does not assume responsibility for Client's data resilience.

6.5 Accuracy of Information

Client is responsible for providing accurate information about their environment. Findings are based on the state of systems at the time of the scan and the information provided by Client. Incomplete or inaccurate disclosure - including undisclosed hosts, environments, or third-party access - directly limits what an Assessment can find.

6.6 Implementation Responsibility

Following an Assessment or advisory Engagement, Client is solely responsible for implementing any recommended changes. Owlzops is not responsible for outcomes resulting from Client's implementation, partial implementation, or non-implementation of recommendations.

6.7 Legal & Notification Obligations

Client is solely responsible for determining and discharging any legal, regulatory, contractual, or insurance obligation arising from findings - including breach notification to regulators, customers, or data subjects, and any law-enforcement referral. Owlzops provides engineering findings, not legal advice, and does not assess whether a notification duty has arisen. Client should consult its own counsel.

7. Warranties & Disclaimers

7.1 Owlzops Warranty

Owlzops warrants that Services will be performed in a professional manner consistent with industry standards by qualified personnel.

7.2 No Guarantee of Detection

Client acknowledges and agrees that no assessment can prove the absence of compromise. An Infrastructure Security Audit identifies indicators that are observable, on the In Scope Systems, within the assessment window, using the methods described in the SOW. A sophisticated or well-concealed intrusion may leave no observable indicator, and an attacker may actively defeat detection.

An Audit that reports no indicators of compromise is not, and must not be relied upon as, a certification, guarantee, or representation that Client's systems are secure, uncompromised, or free of intrusion. Absence of evidence is not evidence of absence.

7.3 No Guarantee of Outcomes

Security and infrastructure engineering involve assessment of complex systems under conditions we do not control. Owlzops does not warrant that following its recommendations, or completing a Hardening Engagement, will prevent any incident, security breach, intrusion, downtime, or data loss. Hardening reduces risk; it does not eliminate it. Recommendations are made in good faith based on information available at the time of the Engagement.

7.4 Changes & Availability

Hardening involves changing the configuration of live systems. Owlzops stages changes, tests them where a representative environment is provided, and defines a rollback path before applying them. Client nonetheless acknowledges that any change to a production system carries inherent risk, and that Owlzops does not warrant uninterrupted availability during or after an Engagement.

7.5 Third-Party Components

Owlzops does not warrant the security, availability, or behaviour of third-party software, providers, or services present in Client's environment.

7.6 Source-Available Software

owlzops-mapper is provided "as is" under the Apache 2.0 license with Commons Clause. No warranty is made regarding its fitness for any particular purpose. Use of the tool outside a paid Engagement creates no relationship between Client and Owlzops and no obligation on Owlzops' part.

7.7 Disclaimer

EXCEPT AS EXPRESSLY STATED IN THESE TERMS, OWLZOPS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

8. Limitation of Liability

8.1 Cap on Liability

To the maximum extent permitted by law, Owlzops' total liability to Client for any claim arising out of or relating to an Engagement shall not exceed the total fees paid by Client for that specific Engagement in the three (3) months preceding the claim.

8.2 Excluded Damages

IN NO EVENT SHALL OWLZOPS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, LOSS OF DATA, BUSINESS INTERRUPTION, REPUTATIONAL HARM, REGULATORY FINES, OR THE COSTS OF ANY SECURITY INCIDENT OR ITS REMEDIATION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

8.3 Third-Party Acts

Owlzops is not liable for the acts of any attacker, intruder, or other third party, including where such acts occur before, during, or after an Engagement, and including where an Assessment did not identify the relevant indicator.

8.4 Essential Basis

Client acknowledges that these limitations are an essential basis of the bargain between the parties and that Owlzops would not provide Services at the stated prices without these limitations.

9. Termination

9.1 Termination for Convenience

Either party may terminate an Engagement with 14 days' written notice. In such case, Client pays for all work completed to date on a pro-rata basis; fees paid for unstarted future milestones will be refunded. Retainers are governed by Section 3.5.

9.2 Termination for Cause

Either party may terminate immediately if the other party materially breaches these Terms and fails to cure the breach within 7 days of written notice. Material breach includes non-payment, failure to provide access necessary for the Services, breach of confidentiality, or breach of the authorisation warranty in Section 6.1.

9.3 Effect of Termination

Upon termination, Owlzops will deliver all completed Deliverables to Client and confirm that its access has been relinquished. Sections 4 (IP), 5 (Confidentiality), 6.1 (Authorisation), 6.7 (Legal Obligations), 7 (Warranties), 8 (Liability), and 10 (Governing Law) survive termination.

10. Governing Law & Disputes

10.1 Governing Law

These Terms are governed by the laws of the State of Delaware, United States, without regard to its conflict-of-law provisions.

10.2 Dispute Resolution

The parties agree to attempt in good faith to resolve any dispute through direct negotiation before initiating formal proceedings. If negotiation fails within 30 days, disputes shall be resolved by binding arbitration under the rules of the American Arbitration Association (AAA), conducted in English.

10.3 International Clients

For clients outside the United States, these Terms and any Engagement are subject to Delaware law regardless of the Client's jurisdiction. Clients in the European Union additionally benefit from applicable mandatory consumer protection provisions of their local law where those provisions cannot be waived by contract.

11. Changes to These Terms

Owlzops may update these Terms from time to time. Material changes will be announced via email to active Clients and reflected in an updated "Last updated" date above. Continued engagement with Owlzops after changes take effect constitutes acceptance of the revised Terms. Changes do not affect Engagements already in progress under a signed SOW.

12. Contact

For questions about these Terms, or to request a mutual NDA:

Owlzops, LLC
Delaware, United States
[email protected]