This Return & Refund Policy explains how cancellations, rescheduling, and refunds are handled for services provided by VULNHAT (Pvt) Ltd(“VULNHAT”, “we”, “us” or “our”), a company incorporated in Colombo, Sri Lanka.

VULNHAT provides professional, bespoke cybersecurity services rather than physical or off-the-shelf products. Because each engagement is scoped, scheduled, and resourced specifically for the client, the terms below reflect the nature of professional services. This policy should be read together with our Terms & Conditions and any signed engagement agreement, which prevails in the event of conflict.

Our services — including penetration testing, red team operations, threat intelligence, compliance support, and incident response — are delivered as professional engagements. As such:

• There is no physical product to return;
• Deliverables (such as reports) are produced specifically for each client;
• Resources, scheduling, and expert time are committed in advance of an engagement.

You may request to cancel or reschedule a booked engagement by contacting us in writing at info@vulnhat.com. The following general guidelines apply unless your engagement agreement states otherwise:

• More than 14 days before the scheduled start: cancellation or rescheduling at no charge; any deposit paid is fully refundable or may be credited to a future engagement.
• 7–14 days before the scheduled start: the deposit may be retained to cover reserved resources and scheduling; the remaining balance is not charged.
• Fewer than 7 days before the scheduled start: a cancellation fee of up to 50% of the engagement value may apply to cover committed resources.

We will always try to accommodate reasonable rescheduling requests where our availability allows.

Refunds are considered on the following basis:

• Before work begins: amounts paid, less any non-refundable deposit described above, are refundable.
• After work begins: fees are generally non-refundable for work already performed. Where an engagement is terminated part-way, you are charged for work completed up to the date of termination, and any balance is refunded.
• Completed engagements: once deliverables have been provided, fees are non-refundable, except as set out under “Service Quality” below.

We stand behind the quality of our work. If you believe a delivered engagement did not meet the agreed scope or professional standards, contact us within 14 days of receiving the deliverables. We will review the matter in good faith and, where a shortfall on our part is identified, our primary remedy is to re-perform or remediate the affected work at no additional cost.

Where re-performance is not practicable, we may, at our discretion, offer a partial or full refund of the fees relating to the affected portion of the work. Please note that the discovery — or non-discovery — of specific vulnerabilities is not, by itself, grounds for a refund, as no assessment can guarantee complete coverage.

The following are generally non-refundable:

• Work already performed and time already expended by our team;
• Third-party costs, licences, or fees incurred on your behalf;
• Engagements cancelled by you after work has commenced, for the completed portion;
• Non-refundable deposits clearly identified as such at the time of booking.

To request a cancellation or refund, email us at info@vulnhat.com with:

• Your name and organisation;
• The engagement or invoice reference;
• The reason for your request.

We aim to acknowledge requests within 5 business days and to process approved refunds within 14 business days, using the original payment method where possible.

We may update this Return & Refund Policy from time to time. The “Last updated” date at the top of this page reflects the latest revision. The policy in effect at the time you booked an engagement applies to that engagement.