These Terms & Conditions (“Terms”) govern your access to and use of the vulnhat.com website and the cybersecurity services provided by VULNHAT (Pvt) Ltd (“VULNHAT”, “we”, “us” or “our”), a company incorporated in Colombo, Sri Lanka.

By accessing our website or engaging our services, you agree to be bound by these Terms. If you do not agree, you must not use our website or services. Where a separately signed engagement agreement, statement of work, or master services agreement exists, that document governs the specific engagement and prevails over these Terms in the event of any conflict.

VULNHAT provides professional cybersecurity services, which may include penetration testing, threat intelligence, red team operations, compliance and audit support, and incident response. The precise scope, deliverables, timeline, and fees for any engagement are defined in a written proposal or statement of work agreed by both parties.

All security testing is performed strictly within the authorised scope and only against assets you own or are explicitly authorised to test. You are responsible for obtaining any third-party authorisations (for example, from hosting providers) required before testing begins.

Engaging our offensive security services requires you to provide valid, written authorisation confirming that you have the legal right to permit testing of the in-scope systems. You agree that:

• You will not request testing of systems you do not own or control without authorisation;
• You will not use our deliverables to harm third parties or for any unlawful purpose;
• You will not misrepresent the scope of your authority over target systems.

You may not use this website or our services to violate any law, infringe any rights, distribute malware, or attempt to gain unauthorised access to any system. We reserve the right to decline or terminate any engagement that we reasonably believe to be unlawful, unethical, or outside our risk tolerance.

To enable us to deliver effectively, you agree to:

• Provide accurate and complete information about the in-scope environment;
• Designate a point of contact and respond to reasonable requests in a timely manner;
• Maintain appropriate backups of any systems or data prior to testing;
• Act promptly on critical findings communicated during an engagement.

You acknowledge that security testing carries inherent risk and that, despite reasonable care, certain activities may affect system availability or performance.

Fees are set out in the applicable proposal or statement of work. Unless otherwise agreed in writing, invoices are payable within the period stated on the invoice. We may suspend work or withhold deliverables where invoices remain unpaid beyond their due date.

Quoted fees exclude taxes, duties, and third-party costs unless expressly stated. Any cancellation, refund, or rescheduling of services is governed by our Return & Refund Policy.

All content on vulnhat.com — including text, logos, graphics, and design — is owned by or licensed to VULNHAT and is protected by intellectual property laws. You may not reproduce, distribute, or create derivative works from our content without our prior written consent.

Reports and deliverables produced for an engagement are licensed to the client for internal use as set out in the engagement agreement. Methodologies, tools, and know-how used to produce those deliverables remain the property of VULNHAT.

Each party agrees to protect the other’s confidential information and to use it only for the purposes of the engagement. We treat all findings, system details, and data accessed during an engagement as strictly confidential, as further described in our Privacy Policy. Confidentiality obligations survive the completion or termination of any engagement.

We provide our services with reasonable skill and care in line with industry standards. However, no security assessment can guarantee the discovery of every vulnerability, and the absence of findings does not guarantee that a system is secure.

To the maximum extent permitted by law, our website and services are provided “as is” without warranties of any kind, whether express or implied, including implied warranties of merchantability or fitness for a particular purpose.

To the maximum extent permitted by law, VULNHAT shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, data, or business, arising out of or in connection with the use of our website or services.

Our total aggregate liability arising out of or relating to any engagement shall not exceed the total fees paid by the client for that engagement, except where liability cannot be excluded or limited under applicable law.

Either party may terminate an engagement in accordance with the terms of the applicable agreement. We may suspend or terminate your access to the website at any time where we reasonably believe these Terms have been breached. Provisions relating to confidentiality, intellectual property, and liability survive termination.

These Terms are governed by and construed in accordance with the laws of the Democratic Socialist Republic of Sri Lanka. The courts of Sri Lanka shall have exclusive jurisdiction over any dispute arising out of or in connection with these Terms, without prejudice to any dispute-resolution mechanism agreed in a separate engagement agreement.

We may revise these Terms from time to time. The “Last updated” date at the top of this page reflects the latest revision. Your continued use of our website or services after changes take effect constitutes acceptance of the revised Terms.