Terms of Service

1. Definitions

• "INLD", "we", "us" means INLD Limited, a company registered in England and Wales under company number 12040493, with its registered office at Redhill Marina, Ratcliffe-on-Soar, Nottingham, England, NG11 0EB.
• "Client", "you" means the organisation that engages INLD to provide Services.
• "Services" means the security assessment, advisory or training services described in an Engagement Letter.
• "Engagement Letter" means the written document setting out the scope, timing, fees and specific terms of a particular engagement, including the Rules of Engagement.
• "Rules of Engagement" means the agreed technical boundary, permitted techniques, constraints, testing window and escalation contacts for an assessment.
• "Deliverables" means the reports and documents produced under an Engagement Letter.

2. Application of these terms

These terms apply to all Services unless expressly varied in an Engagement Letter. Where there is a conflict, the Engagement Letter prevails for that engagement. Nothing on this website constitutes an offer capable of acceptance; a contract is formed only when an Engagement Letter is signed by both parties.

3. Scope of services

The Services are limited to what the Engagement Letter describes. A security assessment examines the systems within the agreed boundary, at the time of testing, using the methods permitted by the Rules of Engagement. It does not constitute a guarantee that the systems are free of vulnerabilities, and it does not cover systems, components or timeframes outside that boundary.

We state plainly what we are not: INLD is not a certification body, is not accredited to issue certifications under any scheme, and does not hold ISO/IEC 27001 certification, CREST membership or PCI QSA status. Where our documentation refers to a standard, it refers to methodological alignment with that standard, not certification against it.

4. Engagement process

Engagements proceed as follows: scoping discussion; issue of an Engagement Letter including Rules of Engagement; written authorisation from the Client; delivery of the Services; reporting; and, where included, retest and attestation.

The Client is responsible for confirming that it holds all authorisations necessary to permit testing, including from hosting providers, platform operators and any third party whose systems fall within the boundary. INLD will not begin testing without that confirmation, and the Client indemnifies INLD against claims arising from an authorisation the Client stated it held and did not.

The Client will provide accurate scope information, agreed access and credentials, and a named escalation contact available during the testing window. Delays or additional work caused by inaccurate scope information may require a variation to fees and timing, which will be agreed in writing before the additional work is performed.

5. Confidentiality

Each party will keep the other's confidential information confidential, use it only for the purposes of the engagement, and disclose it only to personnel and advisers who need it and are bound by equivalent obligations. We are willing to enter a mutual non-disclosure agreement before technical detail is exchanged, and we recommend doing so.

These obligations do not apply to information that is or becomes public through no breach, is independently developed, is lawfully received from a third party without restriction, or must be disclosed by law or by a competent authority. Where disclosure is compelled, the disclosing party will notify the other where it is lawfully able to do so.

Confidentiality obligations survive termination and continue for the period stated in the Engagement Letter.

6. Data handling

We take the minimum evidence necessary to demonstrate a finding, redact personal data in Deliverables where it is not necessary for the finding, and do not remove production personal data from the Client environment except where expressly agreed. Evidence and working papers are retained for the period stated in the Engagement Letter and then securely destroyed.

Where INLD processes personal data on the Client's behalf, the parties will enter the data processing terms required by applicable data protection law.

7. Intellectual property

The Client owns the Deliverables produced specifically for it, on payment in full. INLD retains ownership of its methodologies, tooling, templates, know-how and any pre-existing material, together with a licence to use anonymised, non-attributable learning from engagements to improve its methods. Nothing in this clause permits disclosure of Client confidential information.

Deliverables are prepared for the Client and for the purpose stated in the Engagement Letter. They may be shared with the Client's auditors, regulators, insurers and professional advisers. Publication or distribution beyond that, including use in marketing, requires our prior written consent, which will not be unreasonably withheld for a factual attestation.

8. Fees and payment

Fees are stated in the Engagement Letter, exclusive of VAT and reasonable pre-agreed expenses. Invoices are payable within 30 days of the invoice date unless otherwise agreed. Statutory interest may be charged on overdue amounts.

9. Limitation of liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot lawfully be limited.

Subject to that, neither party is liable for loss of profit, revenue, business, anticipated savings, goodwill or data, or for indirect or consequential loss, however arising. Each party's total aggregate liability arising out of an engagement is limited to the total fees paid and payable under the relevant Engagement Letter, unless a different limit is agreed in writing.

INLD is not liable for loss arising from the Client's failure to act on findings reported to it, from systems or timeframes outside the agreed boundary, or from changes made to the environment after the testing window.

10. Term and termination

Either party may terminate an engagement on written notice if the other commits a material breach that is not remedied within 30 days of notice, or becomes insolvent. The Client may terminate for convenience on written notice, in which case fees for work performed and irrevocably committed costs remain payable. Clauses on confidentiality, data handling, intellectual property, liability and governing law survive termination.

11. Website use

This website is provided for information. Its content does not constitute security, legal or regulatory advice and should not be relied on as such. We take reasonable care over accuracy but make no warranty that the content is complete or current. Content is our copyright and may be quoted with attribution but not reproduced in substantial part without consent.

12. General

These terms, together with the applicable Engagement Letter, form the entire agreement between the parties in relation to the Services. No variation is effective unless agreed in writing. If any provision is held unenforceable, the remainder continues in effect. A person who is not a party has no right to enforce these terms.

13. Governing law and jurisdiction

These terms and any dispute arising out of them, whether contractual or non-contractual, are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Questions about these terms should be sent to contact@inld-ltd.com.