General Terms and Conditions
1. When these terms apply
These terms apply to every quotation and agreement between us. Your own purchase or general conditions do not apply, unless we agree to them in writing. We work for businesses and organizations, not consumers. If one provision of these terms turns out to be invalid, the rest still stands.
2. Quotes and agreements
Our quotations are valid for 30 days and are based on what you have told us. An agreement exists once you accept in writing (email is fine) or once we start the work at your request. Estimates of hours or duration are honest estimates, not promises — unless we explicitly agree a fixed budget or cap.
3. What you can expect from us
We do the work carefully, to the best of our knowledge, and in line with good professional practice. Under Dutch law this is an obligation of effort, not of result.
One thing we want to be direct about: no security work can find every vulnerability or guarantee that your systems, devices, or people are — or will remain — secure. Our work reduces risk; it cannot eliminate it. If we find nothing, that is not a certificate that nothing is there. Our recommendations are advice: whether and how to implement them is your decision, and your systems, data, and backups remain your responsibility.
4. What we need from you
Give us the information, access, and cooperation the work reasonably requires, on time, and make sure it is accurate and complete. You confirm that you are authorized to give us access to the systems, devices, and data involved — if a third party later claims otherwise, that is between you and them, not us. If the work is delayed because we are waiting on you, we may charge the extra hours and costs that causes.
5. Changes and extra work
If you want to expand or change the scope mid-way, we will tell you as soon as possible what that means for the schedule and the fee before we proceed. Extra work is charged at our usual rates unless we agree otherwise in writing.
6. Prices and payment
Our prices exclude VAT and agreed expenses (such as travel), which are charged at cost. Our payment term is 30 days. If an invoice is ever a problem, tell us early — we would much rather solve it together than let it linger. That said, Dutch law attaches statutory commercial interest (art. 6:119a Dutch Civil Code) and reasonable collection costs to invoices that stay unpaid, and after a reminder we may put the work on hold until things are settled. A disagreement about the work itself doesn't pause the invoice (see article 10).
7. Confidentiality and your data
We keep everything confidential — both ways. We never name you as a client or reveal the engagement without your written consent, and you treat our methods and materials the same way. This survives the end of our agreement. The usual exceptions apply: information that is already public, independently known, or that the law forces one of us to disclose (in which case we tell you first, where legally allowed).
We follow the GDPR: we process as little personal data as possible, protect what we do process, sign a data processing agreement where one is required, and delete or return your data when the work is done, unless the law requires us to keep it.
8. Who owns what
Everything we made for you — reports, assessments, policies — is yours to use internally once the invoice for that work is settled. Please do not publish or resell it without asking. Our own methods, templates, tools, and know-how stay ours, so we can keep using them for others (never with your confidential information in them).
9. Working with specialists
We sometimes bring in trusted specialists — forensic labs, trainers, responders — to do the job properly. They are bound to the same confidentiality. Where we engage a third party at your request or with your approval, our liability for their work is limited to what we can actually recover from them.
10. If something goes wrong
Tell us in writing within 14 days of noticing a problem with our work or an invoice, and give us a fair chance to fix it. We take every complaint seriously and will fix what needs fixing — raising one just doesn't pause the invoice itself.
Our total liability is limited to the amount you paid us in the six months before the event, with an absolute maximum of € 25,000. We are not liable for indirect damage — lost profit, lost data, business interruption, reputational harm — or for security incidents that occur despite our work. These limits do not apply if the damage was caused by our intent or deliberate recklessness, or where Dutch law does not allow them. Claims lapse 12 months after you discovered, or should have discovered, the damage.
11. Ending the agreement
A one-off engagement ends when the work is done. An ongoing engagement can be ended by either of us in writing with one month's notice. Either of us can end the agreement immediately if the other seriously breaches it and does not fix it after written notice, or goes bankrupt. We only charge for the work actually done up to that point.
If circumstances beyond our reasonable control (illness, infrastructure failures, government measures) block the work, obligations pause while we jointly look for a solution. If that lasts more than 60 days, either of us may end the affected part of the agreement without owing damages.
12. Dutch law
Dutch law governs these terms and our agreements. If we have a dispute, we first make a genuine effort to solve it together; only then does it go to the competent Dutch court in the district where we are established.