Vexaro Security Services Supplement

1. Introduction & Precedence

This Vexaro Security Services Supplement (this Supplement) refines and supplements the Terms of Service for the Vexaro Security Service: security-testing and assessment services performed for the Customer on an engagement-scoped basis (for example, application, network, infrastructure, or configuration testing, incident response under a retainer (Section 12), and related advisory work).

Capitalised terms used here have the meaning given in the Terms of Service. In this Supplement, Vexaro, we, us, and our mean Vexaro, LLC, a limited liability company organized under the laws of the State of Delaware, USA, unless a different Vexaro contracting entity is expressly identified in your Order Form, Statement of Work, invoice, or account record; Customer, you, and your mean the organisation or person that engages the service or signs the Order Form.

This Supplement applies only to the Vexaro Security Service and is read together with the Professional Services Terms, which set out the general framework for professional-services engagements (delivery, fees, intellectual property, confidentiality, liability, and similar), and with the Order Form Terms. Where this Supplement addresses a matter specific to security testing, this Supplement governs that matter; the Professional Services Terms govern the remaining engagement terms. The general terms of the Terms of Service, and the policies it incorporates, apply except where this Supplement, the Professional Services Terms, or an Order Form states otherwise.

If this Supplement conflicts with an Order Form or Statement of Work, the Order Form or Statement of Work controls; otherwise the order of precedence in the Terms of Service applies.

2. Engagement Scope

Each Vexaro Security engagement is defined by a written scope recorded in the applicable Order Form or Statement of Work (SoW) and, where used, the rules of engagement described in Section 3. The written scope identifies what may be tested and how: for example, the in-scope targets (such as named systems, hosts, networks, applications, accounts, or environments), the categories of testing to be performed, and any explicit exclusions and constraints.

Testing and assessment activity is authorised only within that written scope. Anything not expressly placed in scope is out of scope and is not authorised. Where the scope is unclear or incomplete, the parties will clarify and confirm it in writing before the relevant activity proceeds; Vexaro will not expand the scope without the Customer’s written agreement (which may be recorded by a change to the Order Form or SoW, or through the change process in the Professional Services Terms).

The Customer is responsible for ensuring that the scope it authorises is accurate and complete, that in-scope targets are correctly identified, and that any data, environment, or system characteristics relevant to safe testing (for example, production status, fragile components, or data sensitivity) are disclosed to Vexaro before testing begins.

3. Rules of Engagement

Before any testing begins, the parties will agree written rules of engagement for the engagement, recorded in or attached to the Order Form or SoW. The rules of engagement establish how the work is conducted safely and by mutual authorisation, and typically address:

• Targets: the specific in-scope systems, hosts, networks, applications, accounts, environments, and identifiers, together with any out-of-scope items and exclusions.
• Testing windows: the dates and times during which testing is permitted, and any periods (such as business-critical windows) during which it must not occur.
• Methods and constraints: the categories of testing authorised and any techniques that are restricted or prohibited (for example, denial-of-service or destructive testing, social engineering, physical access, or testing that could affect availability of production systems), together with rate, intensity, or volume limits.
• Accounts and access: any test accounts, credentials, environments, allow-listing, or access prerequisites the Customer will provide.
• Contacts: the named points of contact for each party for the duration of the engagement.
• Escalation and stop conditions: how to reach the parties urgently, how a critical finding or a suspected live incident is escalated, and the conditions under which testing is paused or halted (including a Customer instruction to stop).

If a finding, condition, or instruction during the engagement requires testing to pause or stop, Vexaro will follow the agreed escalation and stop conditions. The rules of engagement may be updated by written agreement of the parties during the engagement.

4. Customer Authorisation Warranty

The Customer warrants and represents that, for every in-scope target, it either owns the target or is fully and lawfully authorised to permit security testing and assessment of that target, and that it has obtained all consents and authorisations required for Vexaro to perform the engagement as scoped.

The Customer will not include in scope any system, network, application, account, data, or other asset that belongs to or is operated by a third party (for example, a service provider, hosting platform, customer, or affiliate) unless the Customer has that party’s authorisation for the testing, and the Customer is responsible for obtaining and evidencing that authorisation. Where an in-scope target is hosted or operated by a third party, the Customer is responsible for satisfying any notification or approval requirement that party imposes for testing.

This warranty is a condition of the engagement. Vexaro relies on it to perform the work, and testing is conducted as authorised activity on the Customer’s behalf and at the Customer’s direction. Authorised security testing must remain within the boundaries set by the Acceptable Use Policy; the Customer’s authorisation does not permit activity directed at Vexaro’s own systems or at any party that has not authorised it. If the Customer becomes aware that an authorisation is missing, withdrawn, or in doubt for any target, it will notify Vexaro promptly, and Vexaro may suspend testing of the affected target until the position is confirmed in writing.

5. No Out-of-Scope Testing

Vexaro will not knowingly test, access, or attempt to access any target, system, or data outside the written scope and the agreed rules of engagement. If Vexaro identifies, during the engagement, that a system or asset appears relevant to the Customer’s security but is not in scope, Vexaro will raise it with the Customer rather than test it, and any extension of scope to cover it will be agreed in writing before testing of that item proceeds.

If Vexaro encounters, while operating within scope, evidence indicating a serious or active security issue (including one that appears to extend beyond the agreed scope), Vexaro will report it to the Customer’s escalation contact without continuing to test the out-of-scope element, so that the Customer can decide how to proceed. Out-of-scope activity is neither authorised nor expected, and nothing in an engagement may be read as authorising it.

6. Evidence Handling & Retention

In the course of testing, Vexaro may collect findings and supporting evidence, which can include screenshots, request and response captures, logs, extracted data samples necessary to demonstrate a finding, configuration excerpts, and notes. Such material is Customer Content and may contain Personal Data; Vexaro handles it as Confidential Information of the Customer under the Professional Services Terms.

Vexaro applies the following handling principles, as further detailed in the Order Form or SoW where the engagement requires specifics:

• Minimisation. Vexaro collects only the evidence reasonably necessary to identify, demonstrate, and support a finding, and limits the extraction of live or sensitive data to what is needed for that purpose.
• Secure storage. Findings and evidence are stored on access-controlled systems, encrypted at rest, with access restricted to engagement personnel on a need-to-know basis.
• Secure transmission. Reports, findings, and evidence are transmitted to the Customer over encrypted channels (for example, TLS) or another secure method agreed in the Order Form or SoW; the Customer’s secure delivery and storage requirements are accommodated where stated.
• Retention and deletion. Findings, evidence, and working materials are retained for the period stated in the Order Form or SoW, or otherwise for a limited period sufficient to support delivery, any agreed Retest, and the engagement record, after which they are deleted or returned in accordance with the Order Form, SoW, or Professional Services Terms. Where Vexaro must retain certain records for the period required by applicable financial-record, professional-record, and tax rules, it retains only what is necessary for that purpose and continues to protect it.

Handling of any Personal Data processed in connection with the engagement is governed by the Data Processing Addendum where it applies. The Customer is responsible for ensuring that the data present in in-scope environments, and any test data it provides, may lawfully be processed for testing.

7. Deliverables

Unless the Order Form or SoW states otherwise, the deliverable for a Vexaro Security engagement is a written report that documents the work performed within scope and the findings identified. A report typically includes:

• an executive summary describing the scope, approach, the overall security posture observed, and the significance of the findings in business terms;
• a technical appendix detailing each finding, including a description, the affected in-scope target, an assessment of severity or risk, and supporting evidence sufficient to understand and reproduce the finding; and
• remediation guidance: practical recommendations for addressing each finding, prioritised by the assessed risk.

Remediation guidance is advisory. It describes options and recommended actions; the Customer decides what to implement, and implementation, configuration, and operation of any change remain the Customer’s responsibility. Ownership of, and rights in, the report and other engagement deliverables are determined by the Professional Services Terms and the Order Form or SoW.

8. Retest

A Retest verifies whether specified findings from a prior report have been remediated. A Retest is limited to confirming the status of the identified findings against the same in-scope targets and is not a new or broader assessment; it does not re-examine areas outside the original scope or detect issues introduced after the original testing.

Unless the Order Form or SoW states otherwise, one Retest of the findings in Vexaro’s report for an engagement is included at no extra charge, within the window set in the Order Form or SoW. The scope, timing, and method of a Retest, and the fee and window for any further Retest, are set in the Order Form or SoW, or agreed through the change process in the Professional Services Terms. A Retest depends on the Customer having implemented the relevant changes and on continued access to the in-scope targets; results reflect the state of those targets at the time of the Retest. The outcome of a Retest is recorded in an updated report or a Retest summary, as agreed.

9. No Guarantee

Security testing is time-boxed and scope-limited. It examines the in-scope targets, using the agreed methods, during the agreed windows, and reflects their state at the time of testing. Findings describe issues observed during that activity; they are a point-in-time assessment, not a continuing or comprehensive statement about the security of any system.

Vexaro performs the work with reasonable skill and care and in a professional manner, but does not guarantee that all vulnerabilities, weaknesses, or misconfigurations will be found, or that an absence of findings means a target is free of vulnerabilities or cannot be compromised. Testing cannot examine every possible condition, input, configuration, or change over time, and a target may contain issues that are out of scope, not reachable by the agreed methods, dependent on conditions not present during the windows, or introduced after testing. Vexaro does not warrant that any system is secure, and the Customer remains responsible for its own security program, for deciding which findings to remediate, and for verifying that remediations are effective in its environment. This Section is consistent with, and does not limit, the disclaimers in the Professional Services Terms and the Terms of Service.

10. Vulnerability Disclosure Interaction

This Supplement governs contracted security testing of the Customer’s own in-scope targets under an Order Form or SoW. It is separate from, and should not be confused with, the Vulnerability Disclosure Policy, which governs unsolicited reports of potential security issues in Vexaro’s own systems.

A Vexaro Security engagement does not authorise the Customer, or anyone acting for it, to test, probe, or access Vexaro’s own systems; any such report must be made through the Vulnerability Disclosure Policy and within its scope and rules. Conversely, the Vulnerability Disclosure Policy does not create or imply any engagement to test the Customer’s systems. Where a finding from an engagement concerns a third party’s system or a component Vexaro does not control, the Customer is responsible for any coordinated or responsible disclosure to that party.

11. Contracting & Payment

Vexaro Security engagements are contracted via an Order Form or Statement of Work and invoiced directly by Vexaro. They are not sold through an online merchant-of-record checkout unless the applicable checkout or Order Form expressly states otherwise. The merchant-of-record checkout path is used only where supported for digital subscriptions and software licences; it is not used to sell Vexaro Security (testing or consulting) engagements unless expressly stated in the applicable checkout or Order Form. Accordingly, merchant-of-record buyer terms apply to a security engagement only where the checkout or Order Form expressly states that a merchant-of-record path is used.

Fees, currency, payment schedule, net payment terms, and any expenses for an engagement are set in the Order Form or SoW and invoiced as stated there; invoices are due within the period stated on the invoice or Order Form. For the full ordering, invoicing, and precedence terms, see the Order Form Terms; for how Vexaro charges, who processes payments for the different checkout paths, and the merchant-of-record restriction, see the Billing Terms.

12. Incident-Response Retainer

Where the Order Form or SoW provides for an incident-response retainer, it sets out how the Customer reaches Vexaro when an incident occurs, the response time Vexaro commits to, the hours during which that commitment applies, and the fees. Vexaro will respond within that response time. The response time is the time to a first response by a qualified member of Vexaro’s team; it is not a commitment to contain, resolve, or recover from an incident within any period. Incident-response work under a retainer is otherwise performed as described in this Supplement, including Section 9, and in the Professional Services Terms.

Contact

• Security engagements and findings: [email protected]
• Contracting and commercial matters: [email protected]
• Support: [email protected]

Contracting and notice details are provided on invoices and Order Forms.

This document is part of the Vexaro Legal Center.