Terms of Service

3.2 Third-Party Systems

You represent and warrant that you have obtained all necessary permissions and authorisations to allow testing of any third-party systems, cloud services, or hosted infrastructure. You are solely responsible for obtaining consent from third-party service providers (AWS, Azure, GCP, etc.) where required by their terms of service.

3.3 Rules of Engagement

Unless explicitly authorised in writing, we will NOT:

• Conduct denial-of-service (DoS) attacks or resource exhaustion testing
• Perform destructive testing that could cause data loss or system damage
• Access, modify, or delete production data
• Conduct social engineering against individuals without consent
• Test physical security controls without explicit permission
• Engage in any activity prohibited by law or regulation

4.1 Accurate Information

You agree to:

• Provide accurate, current, and complete information about your infrastructure and systems
• Disclose all relevant security controls, third-party dependencies, and regulatory requirements
• Update us promptly of any changes to scope, systems, or contact information
• Not withhold information that could impact the safety or effectiveness of our services

4.2 Cooperation and Access

• Provide timely access to systems, documentation, and personnel as required
• Designate a technical point of contact with appropriate authority and knowledge
• Respond to our inquiries and requests for information within agreed timeframes
• Provide test accounts, credentials, or access as specified in the SOW

4.3 Remediation Responsibility

You acknowledge that our security assessments identify vulnerabilities and provide recommendations, but you are solely responsible for implementing remediation measures. We do not guarantee that our recommendations will prevent all security incidents or that identified vulnerabilities represent a complete inventory of all security issues.

4.4 Regulatory Compliance

You are responsible for ensuring your use of our services complies with all applicable laws, regulations, and industry standards, including but not limited to the Privacy Act 1988, Cybercrime Act 2001, Notifiable Data Breaches scheme, and any sector-specific regulations (APRA CPS 234, HIPAA, PCI DSS, etc.).

6.1 Our Intellectual Property

All content on our Site and all deliverables, tools, methodologies, frameworks, and reports we provide (except for Client-specific data) are the exclusive property of CyberCorp Australia and are protected by copyright, trademark, and other intellectual property laws.

This includes but is not limited to:

• Proprietary testing methodologies and frameworks
• Security assessment tools and scripts
• Report templates and formatting
• Training materials and documentation
• Threat intelligence data and analytics

6.2 License to Client

We grant you a limited, non-exclusive, non-transferable license to use our deliverables (reports, recommendations, documentation) solely for your internal business purposes. You may not:

• Reproduce, distribute, or publicly display our deliverables without consent
• Modify or create derivative works from our methodologies
• Use our deliverables for commercial purposes or to provide services to third parties
• Remove or obscure any proprietary notices or attributions

6.3 Client Data Ownership

You retain all ownership rights to your data, systems, and infrastructure. We claim no intellectual property rights over your proprietary information. However, we may retain anonymized, aggregated data for threat intelligence purposes as outlined in our Privacy Policy.

6.4 Work Product

Upon full payment, you own the specific security reports and recommendations produced for your engagement. However, the underlying methodologies, tools, templates, and frameworks remain our property. We retain the right to use general knowledge, skills, and experience gained during the engagement for other clients.

7.2 Data Handling Standards

We handle your data in accordance with:

• Privacy Act 1988 (Cth) and Australian Privacy Principles
• Information Security Manual (ISM) published by ACSC
• ISO 27001 information security controls
• Essential Eight Maturity Model requirements

7.3 Data Retention and Destruction

We retain client data only for the duration necessary to provide services and comply with legal obligations (typically 7 years for audit purposes). Upon request or engagement completion, we will securely delete or return your confidential data using cryptographic erasure or DoD 5220.22-M compliant deletion methods.

7.4 Exceptions to Confidentiality

Confidentiality obligations do not apply to information that:

• Is or becomes publicly available through no breach of these Terms
• Was rightfully known prior to disclosure
• Is independently developed without access to confidential information
• Must be disclosed by law, court order, or regulatory requirement

8.1 Fees and Invoicing

• Fee Structure: Fees and payment terms will be specified in your Statement of Work or Service Agreement
• Currency: All fees are in Australian Dollars (AUD) unless otherwise specified
• GST: All fees are exclusive of GST unless otherwise stated; GST will be added to invoices where applicable
• Payment Terms: Payment is due within 30 days of invoice date unless otherwise agreed

8.2 Late Payment

Late payments may incur interest at the rate of 2% per month (or the maximum allowed by law, whichever is less) on the outstanding balance. We reserve the right to suspend services for accounts more than 30 days overdue.

8.3 Expenses and Travel

Unless otherwise agreed, reasonable out-of-pocket expenses (travel, accommodation, specialist tools) will be billed separately with supporting documentation. We will obtain approval for expenses exceeding $500 AUD.

8.4 Refund Policy

Due to the nature of cybersecurity services, fees are generally non-refundable once work has commenced. If you are dissatisfied with our services, please contact us immediately to discuss resolution.

Consumer Guarantees:

Nothing in these Terms excludes, restricts, or modifies any consumer rights or guarantees under the Australian Consumer Law that cannot be excluded, restricted, or modified by agreement. Where applicable law implies a warranty or condition that cannot be excluded, our liability is limited to re-supplying the services or paying the cost of having the services re-supplied.

11.1 Client Indemnification

You agree to indemnify, defend, and hold harmless CyberCorp Australia and our officers, directors, employees, contractors, and agents from any claims, damages, losses, liabilities, and expenses (including reasonable legal fees) arising from:

• Your breach of these Terms or any applicable laws
• Unauthorised testing or access to systems you do not own or control
• Failure to obtain necessary third-party permissions or authorisations
• Inaccurate or incomplete information provided to us
• Your failure to implement recommended security measures
• Third-party claims arising from your use of our deliverables
• Violation of third-party intellectual property rights

11.2 CyberCorp Indemnification

We agree to indemnify you against third-party claims alleging that our services, when used as authorised, infringe upon third-party intellectual property rights. This indemnity is subject to:

• Prompt written notice of the claim
• Sole control of the defence and settlement
• Reasonable cooperation in the defence

This indemnity does not apply to claims arising from modifications you make, your combination of our services with other products, or your use of services outside the authorised scope.

11.3 Professional Indemnity Insurance

We maintain professional indemnity insurance covering our cybersecurity services. Upon request, we will provide a certificate of currency demonstrating adequate insurance coverage.

12.2 Emergency Contact

You must provide a 24/7 emergency contact for critical security issues. We will attempt to reach this contact via multiple channels (phone, email, SMS) for incidents requiring immediate attention.

12.3 Coordinated Disclosure

For vulnerabilities discovered during testing, we follow responsible disclosure practices. We will not publicly disclose vulnerabilities before coordinated disclosure timelines (typically 90 days) or until you have patched critical issues, whichever comes first.

13.1 Termination for Convenience

Either party may terminate project-based engagements by providing 30 days' written notice. For managed services, termination requires 60 days' notice. You remain liable for fees for services rendered prior to the effective termination date.

13.2 Termination for Cause

Either party may terminate immediately upon written notice if:

• The other party materially breaches these Terms and fails to cure within 14 days
• The other party becomes insolvent or files for bankruptcy
• Continuing the engagement would violate applicable law
• The authorised testing scope is materially misrepresented

13.3 Effect of Termination

Upon termination:

• Your right to use our services and deliverables will immediately cease
• You must pay all outstanding fees for services rendered
• We will return or destroy your confidential data as requested
• Sections on confidentiality, intellectual property, liability, and indemnification survive
• We will provide final reports for work completed prior to termination

13.4 Suspension of Services

We reserve the right to suspend services immediately if we believe continued testing poses a legal risk, violates these Terms, or could harm third parties. We will notify you of any suspension and work with you to resolve the issue.

14.1 Governing Law

These Terms are governed by and construed in accordance with the laws of the Commonwealth of Australia and the State of New South Wales. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

14.2 Jurisdiction

Any disputes arising from these Terms shall be subject to the exclusive jurisdiction of the courts of New South Wales, Australia. Both parties submit to the personal jurisdiction of these courts.

14.3 Dispute Resolution

Before commencing legal proceedings, the parties agree to:

• Good Faith Negotiation: Attempt to resolve disputes through good faith negotiations for 30 days
• Mediation: If negotiation fails, submit to mediation before an agreed mediator
• Cost Sharing: Share mediation costs equally unless otherwise agreed

This clause does not prevent either party from seeking injunctive relief for intellectual property infringement, confidentiality breaches, or other urgent matters.

Notification of Changes:

• Material Changes: We will notify you by email at least 30 days before material changes take effect
• Minor Updates: Posted on this page with an updated "Last Updated" date
• Active Engagements: Changes do not affect existing Service Agreements unless mutually agreed