Terms & Conditions

1. Definitions, Formation & Precedence

These Terms and Conditions ("Terms") constitute the entire default contractual framework between BROOT SECURITY, its successors and permitted assigns ("the Company"), and any natural or juridical person procuring, receiving or benefiting from the Company's services ("the Client"). Solicitation of, or payment for, any deliverable, assessment, engagement or consultation shall be deemed conclusive, irrevocable acceptance of these Terms in their entirety, without necessity of countersignature.

In the event of conflict between these Terms and any executed Statement of Work, Master Services Agreement, Non-Disclosure Agreement or exclusivity instrument, the executed instrument shall prevail solely to the extent of the express conflict; all residual provisions herein shall continue in full force and effect.

Unless expressly and severally contracted for in an executed written instrument, a development engagement comprises the build of the commissioned application only. Deployment, release management, hosting, infrastructure provisioning, environment configuration, testing beyond the Company's internal development verification, user acceptance support, security assessment, data migration, training, monitoring, maintenance, support and updates of any description are each excluded from scope, are owed under no implied obligation, and shall be rendered, if at all, only under a separately signed and separately remunerated agreement.

The individual accepting these Terms on behalf of a Client that is a juridical person represents and warrants that they possess full authority to bind that entity. The Client acknowledges that it has not relied upon any representation, proposal, estimate or statement, oral or written, not expressly recorded herein or in an executed Statement of Work, and all such extrinsic representations are hereby excluded to the fullest extent permitted by law.

2. Non-Exclusivity & Reuse of Work Product

Unless and until the Client executes a separate, written, duly consideration-supported exclusivity agreement with the Company, all engagements are rendered on a strictly non-exclusive basis. Without limitation of the foregoing, the Company expressly reserves the unencumbered, perpetual, worldwide right to:

1. re-utilize, re-license, adapt, refactor or re-deploy any generic code modules, libraries, boilerplate, scaffolding, architectural patterns, build pipelines, infrastructure definitions, testing harnesses, methodologies, heuristics or know-how conceived, authored or improved in the course of any engagement, for the benefit of any other client or of the Company itself;
2. incorporate any such non-exclusive work product, in whole or in part, into the Company's own present or future products, platforms, software-as-a-service offerings, internal tooling, frameworks and commercial offerings, and to market, license, sell or otherwise commercialize the same without attribution, accounting, royalty or compensation to the Client;
3. retain and exploit all residual knowledge, being information in non-tangible form retained in the unaided memories of the Company's personnel;
4. develop, market or deliver materially similar or functionally equivalent deliverables to third parties, including competitors of the Client, absent an executed exclusivity instrument.

No course of dealing, usage of trade, or expectation of the Client, howsoever communicated, shall be construed to create exclusivity by implication, estoppel or otherwise.

3. Intellectual Property & Conditional Assignment

All right, title and interest in and to deliverables specifically commissioned by the Client shall vest in the Client only upon irrevocable receipt by the Company of all fees due, whereupon assignment shall be effective solely in respect of Client-specific customizations and shall expressly exclude:

1. Background IP: all pre-existing works, tooling, frameworks and materials owned by or licensed to the Company prior to or independently of the engagement;
2. Generic Components: any element of the work product of general applicability not embodying the Client's confidential information, which the Company may reuse pursuant to Section 2;
3. Third-Party & Open-Source Materials: which remain governed exclusively by their respective licenses, in respect of which the Company disclaims all warranty and liability.

Pending full payment, all deliverables are furnished under a limited, revocable, non-transferable evaluation license, and the Company may suspend, disable or repossess the same without notice or liability.

4. Fees, Invoicing & Suspension of Performance

Engagements are performed in phases, sections or milestones as recorded in the applicable Statement of Work or proposal. Payment for each phase is due and must be received in full and in cleared funds prior to commencement of that phase; absent such receipt, commencement of the phase is at the Company's sole and absolute discretion, and the Company bears no liability for delay, non-commencement or any consequence thereof, nor shall any schedule commitment bind the Company in respect of an unpaid phase.

Invoices are payable within the period stipulated therein, failing which the Company may, without prejudice to any other remedy: (a) levy interest at 1.5% per month or the maximum lawful rate, whichever is lower, compounded monthly; (b) suspend all performance, hosting, support and access; and (c) withhold deliverables, source code, credentials and documentation until all arrears, including accrued interest and collection costs, are discharged in full.

All fees are exclusive of applicable taxes, levies and duties, which are the sole responsibility of the Client. Fees paid are non-refundable save where expressly stipulated in an executed Statement of Work. Each invoice shall be conclusively deemed accepted unless disputed in writing, with particularized grounds, within seven (7) days of issuance.

1. Any work falling outside the scope recorded in the applicable Statement of Work, including revisions beyond those expressly provided for, constitutes a change requiring a written change order and is chargeable at the Company's then-prevailing rates;
2. the determination of whether any addition, request or requirement falls within or outside the agreed scope rests with the Company, acting reasonably by reference to the executed Statement of Work or proposal, and its classification shall be final and binding absent manifest error; the Client's characterization of any request as in-scope creates no obligation, disputed work shall proceed only under a written change order, and all work classified as out-of-scope is chargeable separately from, and in addition to, the originally agreed fees;
3. all timelines are automatically extended by the duration of any delay attributable to the Client, including late provision of content, credentials, approvals, access or payment, and personnel time held idle by such delay is billable;
4. the Company may suspend or terminate any engagement upon material breach by the Client not cured within seven (7) days of written notice, whereupon all fees for work performed and committed become immediately due and payable;
5. where services are quoted or procured as a bundle (including without limitation design, testing, backend or platform builds taken together) at a consolidated price lower than the aggregate of the Company's standalone rates, such bundled pricing is conditional upon completion of the entire bundle; should the Client abandon, terminate or curtail the engagement prior to completion, the bundled discount is forfeited retroactively, and all work performed shall be re-rated and charged at the Company's standalone rates for each component severally — which may exceed the proportionate bundle price — with the resulting balance immediately due and payable;
6. the Client irrevocably waives recourse to card or banking chargeback mechanisms in respect of any invoice, the exclusive avenue for billing disputes being the seven (7) day written procedure above; initiation of a chargeback constitutes material breach, whereupon all licenses granted stand automatically revoked and the Company may disable, repossess or withhold deliverables and access pending full resolution; a chargeback does not extinguish the underlying debt, which survives as a contractual obligation together with a reasonable administration charge and all costs of recovery.

5. Client Authorizations, Representations & Warranties

In respect of any offensive security engagement, penetration test, vulnerability assessment or adversarial simulation, the Client represents, warrants and undertakes on a continuing basis that:

1. it possesses full legal authority over every asset, address range, application, tenant or environment submitted for testing, and shall indemnify the Company against any assertion to the contrary;
2. all requisite third-party, hosting-provider and regulatory consents have been procured prior to commencement;
3. scope submissions are accurate and complete, and any asset erroneously included therein is included at the Client's sole risk;
4. it has taken, and shall maintain throughout the engagement, complete and restorable backups of all systems and data within or adjacent to the authorized scope, and the Company bears no liability for loss recoverable from backups the Client failed to maintain.

The Company shall bear no liability whatsoever for degradation, interruption or data alteration arising from testing activities performed within the authorized scope in accordance with industry-standard methodologies.

6. Disclaimer of Warranties

All services and deliverables are provided strictly "as is" and "as available", without warranty of any kind, express, implied, statutory or otherwise, including without limitation warranties of merchantability, fitness for a particular purpose, non-infringement, uninterrupted operation or error-free performance, all of which are hereby disclaimed to the maximum extent permissible at law.

Without limiting the generality of the foregoing, no security assessment, howsoever thorough, can identify every vulnerability; the Company does not warrant, and expressly disclaims, that any system tested, hardened or developed by it is or will remain free from compromise, defect or exploit.

The Client's sole and exclusive remedy for any non-conformity in services or deliverables, notified in writing within thirty (30) days of delivery, shall be re-performance or remediation of the non-conforming portion by the Company; all other remedies, howsoever arising, are excluded to the maximum extent permitted by law.

7. Acceptance of Deliverables & Exclusion of Third-Party Reliance

Each deliverable shall be conclusively deemed accepted upon the earlier of: (a) written acceptance; (b) any productive use thereof by the Client; or (c) the expiry of ten (10) business days following delivery without written rejection specifying the non-conformity with particularity. Deemed acceptance extinguishes all claims of non-delivery or patent non-conformity.

Where, during the course of an engagement, the Company seeks the Client's approval by email in respect of any design, specification, approach, milestone, work-in-progress or other matter requiring the Client's decision — such request being dispatched to the designated authorized representative's notified email address and conspicuously identifying itself as requiring approval — and the Client fails to respond substantively within five (5) working days of dispatch, the matter shall be conclusively deemed approved as submitted, the request being presumed received upon dispatch absent evidence of non-delivery. The Company may proceed in reliance thereon, and any subsequent revision thereto constitutes a change order under Section 4.

Upon completion of an engagement and commencement of productive operation, the Company shall issue a project sign-off by email, whereupon the engagement stands conclusively closed. Unless the Client has executed a separate written maintenance or support agreement with the Company, no modification, enhancement, update or other change to the delivered work shall be undertaken, owed or accepted under the closed engagement or these default Terms in respect thereof — save that material defects in the work as delivered, notified in writing within thirty (30) days of sign-off, shall be remediated by re-performance in accordance with Section 6 as the Client's sole remedy. Any other work requested thereafter constitutes a new engagement, subject to fresh scoping, quotation and payment in accordance with Section 4.

All reports, assessments, attestations and deliverables are prepared solely for the internal use of the named Client. No third party — including without limitation investors, insurers, acquirers, regulators, auditors or customers of the Client — may rely thereon for any purpose, and the Company assumes no duty of care to any such third party. These Terms confer no rights upon any third-party beneficiary. Redistribution of any report outside the Client's organization requires the Company's prior written consent.

8. Limitation of Liability

To the maximum extent permitted by applicable law, the aggregate cumulative liability of the Company, whether in contract, tort (including negligence), breach of statutory duty, restitution or otherwise, arising out of or in connection with any engagement shall not exceed the fees paid or properly payable by the Client in respect of the specific engagement giving rise to the claim during the three (3) months immediately preceding the event first giving rise thereto, such cap operating to limit, and not to extinguish, liability.

In no event shall the Company be liable for loss of profits, revenue, anticipated savings, goodwill, data, business interruption, or any indirect, incidental, special, punitive, exemplary or consequential loss, even if advised of the possibility thereof. No claim may be brought more than twelve (12) months after the cause of action accrued.

9. Corporate Dissolution, Insolvency & Cessation of Services

In the event of the winding-up, dissolution, liquidation, administration, insolvency, cessation of business or analogous event affecting the Company (each a "Cessation Event"), all executory obligations of the Company shall, to the maximum extent permitted by law, stand automatically discharged and void ab initio in respect of undelivered performance, and:

1. all licenses, warranties, support commitments, retest entitlements and maintenance obligations shall terminate ipso facto without notice;
2. the Client's sole recourse shall be a claim as unsecured creditor for fees paid in respect of demonstrably undelivered work, subordinate to all statutory priorities;
3. no director, officer, employee, contractor or affiliate of the Company shall bear any personal liability arising from or in connection with a Cessation Event.

10. Client Cooperation, Dormancy & Termination for Convenience

Where the Client suspends, stalls or fails to progress an engagement — including by non-payment, non-response or withholding of requisite inputs — for a continuous period of thirty (30) days, the engagement shall be conclusively deemed abandoned by the Client, whereupon all work performed shall be invoiced at the Company's standalone rates (any bundled pricing standing forfeited pursuant to Section 4), all schedule commitments lapse, and any resumption shall constitute a new engagement subject to fresh scoping, quotation and a remobilization fee.

The Client may terminate an engagement for convenience only by written notice, and upon such termination shall pay: (a) all fees for work performed and in progress; (b) all non-cancellable commitments incurred; and (c) a termination charge equal to the greater of the bundled discount forfeited under Section 4 or twenty-five percent (25%) of the fees that would have accrued over the remainder of the engagement. The aggregate of (a) through (c) constitutes genuine pre-estimated compensation for reserved capacity and foregone opportunity and not a penalty, and standalone re-rating under Section 4 shall not be applied cumulatively with the termination charge.

Only communications issued by email from the Client's designated authorized representative shall bind the Client or oblige the Company. Instructions, approvals or requests conveyed by instant message, telephone, social media or by personnel other than the designated representative are of no contractual effect unless confirmed by such email, and the Company may disregard them without liability.

11. Client Materials, Third-Party Platforms & Data Protection

The Client warrants that all content, marks, fonts, imagery, software, data and other materials furnished by it are owned by or duly licensed to it for the intended use, and shall indemnify the Company against all claims arising therefrom. Delay in furnishing such materials entitles the Company, at its election, to proceed with placeholders or to extend timelines under Section 4; the accuracy, legality and fitness of Client-furnished materials remain at all times the Client's sole responsibility.

All third-party accounts and subscriptions — including without limitation domains, hosting, cloud tenancy, repositories, and Apple App Store or Google Play developer accounts — shall be registered in and owned by the Client, who bears their fees and compliance obligations. Rejection, delisting, suspension, deprecation, repricing or policy change by any third-party platform or service does not constitute a defect in the Company's work, and any remediation occasioned thereby constitutes new chargeable work.

In respect of personal data processed within the Client's systems, the Client is and remains the data controller, solely responsible for lawful basis, notices, consents and regulatory compliance; the Company acts, where at all, as a processor upon the Client's documented instruction and bears no liability for the Client's regulatory obligations or breaches thereof.

12. Third-Party Alteration & Forfeiture of Support

Should the Client, or any third party engaged, permitted or suffered by the Client, modify, patch, extend, refactor, reconfigure, migrate, redeploy or otherwise alter any code, application, infrastructure or service delivered by the Company, in whole or in part, without the Company's prior written consent, then automatically and without notice:

1. all warranty, defect-remediation, support and maintenance obligations of the Company in respect of the delivered work — including the thirty (30) day remediation window under Section 7 and, at the Company's election, any subsisting maintenance or support agreement — shall stand terminated and forfeited, without refund of fees paid thereunder;
2. the Company may, at its sole election, treat all subsisting support, maintenance and service commitments to that Client, across all engagements, as terminated, and shall bear no obligation to resume them;
3. the Company bears no liability of any nature for defects, vulnerabilities, outages, data loss, security compromise or other consequences arising in or from the altered work, whether or not traceable to the alteration, the burden of demonstrating that any claimed defect pre-existed the alteration and is unrelated thereto resting solely upon the Client;
4. no prior or subsequent commitment, assurance or representation of support — written, oral, or conveyed over any medium whatsoever, including email, telephone, or messaging platforms — shall bind the Company in respect of the altered work, support being resumable, if at all, only under a newly executed and separately remunerated written instrument;
5. any security assessment, report, attestation or finding previously issued by the Company ceases to describe the altered system and may not be relied upon, cited or represented as current in respect thereof.

Diagnosis of any issue subsequently shown to arise from third-party alteration is chargeable at the Company's prevailing rates notwithstanding any maintenance agreement, and any re-engagement with an altered system is conditional upon a paid re-assessment thereof. The Client is solely responsible for the acts and omissions of every third party to whom it grants access to source code, repositories, credentials or production environments, and alteration includes changes to the hosting environment, runtime configuration, dependencies or integrated third-party services on which the delivered work relies.

13. Compatibility, Outcomes, Service Levels & Expenses

Deliverables are verified solely against the browser, operating system, device and platform versions current at the date of delivery. Subsequent releases, updates or deprecations of any third-party environment that impair the delivered work do not constitute defects, and accommodation thereof constitutes new chargeable work.

The Company warrants professional workmanship only and gives no representation, warranty or undertaking as to commercial outcomes of any nature, including without limitation traffic, search ranking, conversion, revenue, user adoption, app-store approval or investment outcomes.

Services are rendered during the Company's ordinary business hours, Monday through Friday (IST), excluding public holidays. No out-of-hours availability, on-call cover or response-time commitment exists absent a separately signed retainer; work the Client requires to be expedited or performed out-of-hours is chargeable at one-and-one-half (1.5) times prevailing rates.

On-site attendance, travel time, travelling expenses, accommodation and subsistence are not included in any quoted fee and are chargeable separately at the Company's prevailing rates against receipts or standard allowances.

14. Confidentiality

Each party shall preserve in strict confidence all non-public information of the other disclosed in connection with an engagement, applying no lesser standard of care than it applies to its own confidential information and in no event less than reasonable care. This obligation survives termination for a period of three (3) years, save for trade secrets, which are protected for so long as they remain trade secrets, and save for the Company's residual-knowledge rights under Section 2.

Any suggestion, enhancement request or feedback furnished by the Client is assigned to, and may be exploited by, the Company without restriction, attribution or compensation. Unless the Client opts out by written notice, the Company may identify the Client by name and logo and describe the general nature of the services rendered in its marketing materials, proposals and case studies, without disclosing the Client's confidential information.

15. Indemnification

The Client shall defend, indemnify and hold harmless the Company, its officers, employees and contractors from and against all claims, demands, proceedings, damages, fines, penalties, costs and expenses (including reasonable legal fees on a full-indemnity basis) arising out of or in connection with: (a) any breach of the Client's representations under Section 5; (b) the Client's use, misuse or unauthorized redistribution of deliverables; (c) content, data or instructions furnished by the Client; or (d) the Client's violation of applicable law.

16. Force Majeure

Neither party shall be liable for any failure or delay in performance attributable to causes beyond its reasonable control, including without limitation acts of God, epidemic, governmental action, sanction, embargo, civil commotion, war, terrorism, supply-chain failure, upstream provider outage, denial-of-service or other malicious third-party activity, power or telecommunications failure — provided that nothing in this Section relieves the Client of the obligation to pay for work already performed. Performance shall be suspended for the duration of the impediment, and either party may terminate without further liability where the impediment persists beyond sixty (60) days, subject to payment for work performed to date.

17. Non-Solicitation

During the term of any engagement and for twelve (12) months thereafter, the Client shall not, directly or indirectly, solicit, induce or engage any employee or contractor of the Company who was materially involved in the engagement, save with the Company's prior written consent, which may be conditioned upon payment of a placement fee equal to fifty percent (50%) of the individual's annualized remuneration.

18. Governing Law, Jurisdiction & Dispute Resolution

These Terms and all engagements hereunder shall be governed by and construed in accordance with the laws of India, without regard to conflict-of-laws principles. The courts at New Delhi, India shall have sole and exclusive jurisdiction, and the Client irrevocably submits thereto and waives all objections on grounds of venue or forum non conveniens.

19. Amendments, Waiver, Severability & Assignment

The Company may amend these Terms prospectively at any time by publication at this URL; continued procurement of services following publication constitutes acceptance. No waiver shall be effective unless in writing, and no failure to enforce shall constitute waiver. If any provision is held invalid, it shall be severed and reformed to the minimum extent necessary, the remainder continuing in full force. The Client may not assign its rights or obligations without the Company's prior written consent; the Company may assign freely in connection with any merger, reorganization or transfer of assets.

These Terms shall be construed as if drafted jointly by the parties, and no rule of construction resolving ambiguity against the drafting party shall apply.

All notices under these Terms shall be given in writing by email — to the Company at contact@brootsec.com, and to the Client at the address of its designated authorized representative — and shall be deemed received on the next business day following dispatch absent evidence of non-delivery.

The Company may engage subcontractors and affiliates in the performance of any engagement, remaining responsible for the work so performed; obligations of confidentiality shall bind such subcontractors equally.

The parties are independent contractors; nothing herein creates any partnership, joint venture, fiduciary or employment relationship, and neither party may bind the other. All provisions which by their nature ought to survive — including without limitation Sections 2, 3, and those governing confidentiality, acceptance, reliance, indemnification, limitation of liability, non-solicitation and governing law — survive completion, termination or expiry of any engagement.