Professional Services Terms

1. Introduction & Scope

These Professional Services Terms govern professional-services engagements that Vexaro performs for a Customer, including security testing and assessment (Vexaro Security), custom software and engineering services (Vexaro Development), and related consulting. They form part of, and are incorporated into, the Terms of Service, and they are to be read together with the Security Services Supplement and the Development Supplement, which contain the Product-specific terms for those engagements.

These Professional Services Terms apply to services that are delivered by Vexaro as an engagement, as distinct from the subscription Service (Vexaro Desk and Vexaro Mesh), which is governed by the Terms of Service and the applicable Product Supplement. Where a single arrangement includes both a subscription and professional services, each part is governed by the terms applicable to it.

Capitalised terms used here have the meaning given in the Terms of Service. In these Professional Services Terms, Vexaro, we, us, and our mean Vexaro, LLC, a limited liability company organized under the laws of the State of Delaware, USA, unless a different Vexaro contracting entity is expressly identified in your Order Form, Statement of Work, invoice, or account record; Customer, you, and your mean the organisation that engages Vexaro. If these Professional Services Terms conflict with an Order Form or Statement of Work, that document controls; otherwise the order of precedence in the Terms of Service applies.

2. Statement of Work / Engagement

Each professional-services engagement is defined by a Statement of Work or engagement letter, which is an Order Form for the purpose of the Order Form Terms and the order of precedence. The Statement of Work (SoW) controls the commercial and delivery terms of the engagement, including:

• the scope of the work and any express exclusions;
• the deliverables and their form;
• the fees and fee model (Section 6), and the currency and invoicing arrangements;
• the timeline, milestones, and any dependencies; and
• the assumptions, responsibilities, and prerequisites on which the engagement depends, including the Customer inputs, access, and approvals Vexaro requires to perform.

Where the SoW conflicts with these Professional Services Terms or with a Supplement, the SoW controls for that conflict, in accordance with the order of precedence in the Order Form Terms. Work outside the agreed scope is a change to the engagement. A change is agreed and recorded as described in Section 7 (Changes to the Order) of the Order Form Terms (and, for additional quantities, Section 4): by a signed amendment, a new SoW, or an additional order referencing the existing SoW. Vexaro is not obliged to perform out-of-scope work until it is agreed in writing.

3. Authorisation & Rules of Engagement

For any engagement that involves testing, assessing, or accessing a target system, network, application, account, or data, in particular a Vexaro Security engagement, the Customer represents and warrants that:

• it owns the target, or is duly authorised by the owner to instruct the testing, and has obtained all consents and authorisations required for Vexaro to perform the agreed work on that target; and
• it has the authority to grant, and does grant, Vexaro the access and permissions necessary to perform the engagement.

Before testing begins, the parties must agree rules of engagement that define the in-scope targets and assets, the permitted techniques and any prohibited or out-of-bounds actions, the testing window and any rate or load limits, the points of contact and escalation, and the handling of any sensitive findings. The rules of engagement are agreed in, or as an annex to, the SoW. Vexaro performs only the work that is in scope and authorised, and the Customer is responsible for ensuring that its authorisation is valid and that any required third-party permissions are in place. The detailed terms for security engagements, including authorisation, scope control, and safe-testing obligations, are set out in the Security Services Supplement, and the Customer’s use of the Service in connection with any engagement remains subject to the Acceptable Use Policy.

In return, Vexaro will perform testing only within the agreed rules of engagement and scope, will use reasonable care to avoid unauthorised disruption to the Customer’s systems and data, and remains responsible for damage caused by testing it conducts outside the agreed scope or rules of engagement. That responsibility is subject to the limitations of liability in the Terms of Service, except that Vexaro cannot rely on any exclusion or limitation for its own breach of the agreed rules of engagement.

4. Deliverables & Acceptance

Vexaro delivers the deliverables described in the SoW, in the form and on the timeline stated there. For a security engagement, the deliverable is typically a report of findings and recommendations; for a development engagement, it is the agreed software, configuration, or documentation.

Unless the SoW sets a different acceptance process, the following applies. On delivery of a deliverable (or an agreed milestone), the Customer has the review period stated in the SoW (or, where none is stated, a commercially reasonable period) to review it against the acceptance criteria in the SoW. Within that period the Customer either accepts the deliverable or gives Vexaro a written notice specifying how the deliverable materially fails to meet the agreed acceptance criteria. Vexaro will then, within a reasonable period, correct the specified material non-conformities and re-deliver. A deliverable is deemed accepted if the Customer accepts it, or if the Customer uses it in production for its ordinary business operations beyond evaluation after the review period has ended and where no conforming notice of rejection has been given, or if the Customer does not provide a conforming notice of rejection within the review period. Use of a deliverable to evaluate it, or before the review period has ended, is not by itself acceptance. If a deliverable still materially fails the agreed acceptance criteria after a second re-delivery, the Customer may, at its option, reject the deliverable and receive a refund of the fees paid for it, or extend the cure period, as the SoW provides. Acceptance relates to conformity with the agreed criteria; it does not expand the warranty in Section 8 or convert a service into a guaranteed outcome.

5. Intellectual Property

Subject to full payment of the fees due for the relevant deliverable, Vexaro assigns or otherwise grants to the Customer the rights in the Custom Deliverables (as defined in the Development Supplement) created specifically for the Customer under the SoW, to the extent and on the basis stated in the SoW and the Development Supplement. Until the fees for a deliverable are paid in full, all rights in that deliverable remain with Vexaro, and any licence to use it is conditional on payment. This is tied to material non-payment: where the Customer is withholding only a good-faith disputed portion of the fees for a deliverable and has paid all undisputed fees due for that deliverable, the assignment and licence for that deliverable are not suspended, and rights in that deliverable are conditional only on payment of the undisputed amounts. Vexaro may treat the rights as suspended under this Section only where fees remain materially unpaid after Vexaro has given the Customer notice and a reasonable opportunity to pay.

Vexaro retains all rights in its pre-existing and general intellectual property, and in anything developed independently of the engagement. This includes its methodologies, know-how, frameworks, libraries, tools, templates, and any general-purpose components, and any improvements to them. To the extent any such pre-existing or general material is embedded in, or is necessary to use, a Custom Deliverable, Vexaro grants the Customer, on full payment, a non-exclusive, worldwide, perpetual, royalty-free licence to use, operate, maintain, and modify that material solely as part of, and to the extent necessary to use, the Custom Deliverable for the Customer’s own business purposes. This licence does not permit extraction or use of that material independently of the Custom Deliverable. Vexaro may continue to use the general skills, experience, and know-how gained during the engagement. These terms are consistent with, and supplemented by, the intellectual-property terms in the Development Supplement; where the Supplement or the SoW addresses a point in more detail, that detail applies.

6. Fees & Expenses

Fees for an engagement are charged on a time-and-materials basis, on a fixed-fee basis, or on another basis, as stated in the SoW. For time-and-materials work, Vexaro charges for the time spent at the rates in the SoW; for fixed-fee work, the fee covers the agreed scope, and out-of-scope work is charged separately as a change (Section 2). Reasonable expenses that the SoW provides are reimbursable are charged at cost, and any travel or third-party costs are handled as the SoW provides.

Professional-services engagements are contracted by Order Form or Statement of Work and invoiced directly by Vexaro. They are not sold through merchant-of-record checkout unless the applicable checkout or Order Form expressly states otherwise. The Merchant-of-Record path is used only where supported for digital subscriptions and software licences, and is not used to sell Vexaro Security or Vexaro Development engagements unless expressly stated in the applicable checkout or Order Form. Invoices are due within the net payment period stated on the invoice or the SoW, and applicable Taxes (as defined in the Billing Terms) are added and handled as described there. Overdue, undisputed amounts may accrue interest and may lead to suspension of the engagement as the SoW and the Terms of Service provide, and the Customer should raise any good-faith dispute about an invoiced amount promptly while continuing to pay undisputed amounts on their original terms.

7. Subcontractors

Vexaro may engage vetted subcontractors to perform part of an engagement. Where it does, Vexaro remains responsible for the performance of the engagement and for ensuring that each subcontractor is bound by confidentiality and other obligations equivalent in substance to the obligations Vexaro owes the Customer under these Professional Services Terms and the SoW, including, where the subcontractor Processes Personal Data, the data-protection obligations described in the Data Processing Addendum. The use of a subcontractor does not relieve Vexaro of its obligations to the Customer.

8. Warranty & Disclaimer

Vexaro will perform the professional services with reasonable skill and care and in a professional and workmanlike manner, consistent with generally accepted practices for services of the relevant kind. This is Vexaro’s warranty for the services.

Because professional services depend on factors that are not wholly within Vexaro’s control, Vexaro does not guarantee a particular result. In particular, and without limiting the disclaimers in the Terms of Service:

• a security-testing or assessment engagement is performed within the agreed scope, time, and techniques, and is a point-in-time exercise; Vexaro does not guarantee that it will identify all vulnerabilities, weaknesses, or risks, that the absence of a reported finding means a system is secure, or that a system is or will remain free of vulnerabilities; and
• a development or consulting engagement is performed to the agreed scope and acceptance criteria; Vexaro does not guarantee any particular business, commercial, performance, or operational outcome, or that software will be uninterrupted or error-free beyond the agreed warranty.

Except for the express warranty in this Section, the professional services are provided without other warranties, to the fullest extent permitted by applicable rules, and the disclaimers and limitations of liability in the Terms of Service apply to the engagement. Nothing in this Section limits any non-waivable rights the Customer has under applicable mandatory rules.

Liability for testing. A security-testing or assessment engagement is performed at the Customer’s direction and on targets the Customer owns or is authorised to have tested (Section 3). Active testing of live systems carries an inherent risk of disruption; the Customer is responsible for selecting and authorising the targets, for the rules of engagement and any rate or load limits, and for maintaining backups and appropriate safeguards for the systems it puts in scope. The Customer will defend and indemnify Vexaro against third-party claims arising from the testing of any target that the Customer authorised but did not own or have authority to authorise, except to the extent the claim arises from Vexaro testing outside the agreed scope or rules of engagement (for which Vexaro remains responsible under Section 3). The limitation of liability in the Terms of Service applies to the engagement, except that the SoW may set an engagement-specific liability cap for that engagement, in which case that cap applies for that engagement. This Section is read together with the indemnity and limitation-of-liability terms of the Terms of Service and the Security Services Supplement.

9. Confidentiality & Data Handling

Each party’s confidentiality obligations for an engagement are those set out in the Terms of Service, which apply to the information exchanged in connection with the engagement, including the SoW, the rules of engagement, and the deliverables. Findings, reports, and other engagement materials, and the Customer’s systems information and data that Vexaro receives, are treated as the Customer’s Confidential Information under the Terms of Service, subject to the exclusions stated there and to Vexaro’s retained rights in its methodologies and general know-how under Section 5.

Where an engagement generates evidence or sensitive findings, such as security findings, captured data, credentials, or proof-of-concept material from a Vexaro Security engagement, Vexaro handles that material with appropriate care: it is stored securely, transmitted through secure channels, restricted to the personnel who need it for the engagement, retained only for as long as needed for the engagement and any agreed follow-up (and otherwise as the SoW provides), and then disposed of securely. Where Vexaro Processes Personal Data on the Customer’s behalf in the course of an engagement, it does so as a processor under the Data Processing Addendum, and the secure-handling and incident-notification commitments described in the Trust Center and the Security Overview apply.

10. Publicity

Neither party will use the other’s name, logo, or trademarks in any public statement, customer list, press release, or marketing material without the other’s prior written consent. Any consent given under this Section may be revoked prospectively on reasonable notice. This Section does not restrict either party from making a disclosure required by law or legal process. An Order Form or Statement of Work may set a different publicity arrangement, in which case that arrangement controls; see the Order Form Terms.

11. Survival

Sections 5 (Intellectual Property), 8 (Warranty & Disclaimer), and 9 (Confidentiality & Data Handling), and any accrued payment obligations, survive completion, expiry, or termination of an engagement and of these Professional Services Terms, together with any other provision that by its nature is intended to survive.

12. Contact

• Professional-services engagements, Statements of Work, and contracting: [email protected]
• Security engagement and disclosure matters: [email protected]

Contracting and notice details are provided on invoices and Order Forms.

---

This document is part of the Vexaro Legal Center.