Terms andprivacy policy.

Acceptance and scope

These terms govern your use of this website and any engagement with Cybercraft Labs Pvt Ltd (“Cybercraft Labs”, “we”, “our”, “us”). By accessing the site, contacting us, or instructing us to carry out work, you confirm that you have read and accept them, together with the privacy policy below.

Where we sign a separate engagement letter, statement of work, master services agreement or non-disclosure agreement with you, that document governs the work it describes. These terms fill the gaps it leaves; they do not override it.

We may revise these terms to reflect changes in our services or in the law. The date at the top of this page records the last revision. Continued use of the site after a revision constitutes acceptance of it.

What our services are

We provide security testing, infrastructure and deployment work, software engineering, and technical advisory. Each engagement is scoped in writing before it begins: the systems in scope, the method, the deliverables, the schedule, and the fee.

Security testing is a point-in-time exercise against a defined scope. It is bounded by the time agreed, the access granted, and the state of the system at the time of testing. It is not a certification, a compliance approval, or a guarantee that a system contains no other defects.

Advice given in a consultation, including a free one, is informational. It does not by itself create an engagement, and no client relationship arises until both parties have agreed scope and fee in writing.

Authorisation for security testing

We will not test a system without written authorisation. Before an engagement begins, you must give us rules of engagement identifying the systems in scope, the systems explicitly out of scope, the permitted testing window, and a named contact reachable during it.

You confirm that you own the systems in scope or hold the authority to authorise testing against them. Where a system is hosted, operated or supplied by a third party, obtaining that party’s consent is your responsibility, and you must confirm it to us in writing before we begin.

We stop and notify you if we find evidence of a pre-existing compromise, if testing appears to affect a system outside the agreed scope, or if continuing would risk the availability of a production service. We will not act on a finding beyond what is needed to demonstrate it.

Where we find a critical issue, we report it to your named contact on the day we find it rather than holding it for the final report.

Your responsibilities

You agree to give us accurate and complete information, and to tell us promptly when something material changes — an architecture change mid-engagement, a system leaving your control, or a contact becoming unreachable.

You are responsible for maintaining current backups of any system we test or work on, and for having a route to restore service. Testing carries an inherent risk of disruption even when conducted carefully.

You agree not to use our services, our reports, or our communications for an unlawful purpose, including unauthorised access to systems you do not control. We may refuse or end an engagement where a request falls outside legal, ethical or professional boundaries, and we will say why.

Confidentiality

We treat your systems, your data, our findings, and the existence and detail of the engagement as confidential. We disclose them only to the people working on your engagement, and only as far as the work requires.

Credentials, access tokens and extracted data are held only for the duration of the engagement and the retest window, kept encrypted at rest, and destroyed afterwards. We do not retain client data to build a corpus, train a model, or seed future work.

These obligations survive the end of the engagement. They do not apply to information that is already public, that we hold independently, or that we are compelled to disclose by law — and where we are compelled, we will tell you unless we are prohibited from doing so.

We will not name you as a client, publish a case study, or describe your systems in our writing without your prior written consent. Our published research concerns software and techniques, not identifiable clients.

Fees and payment

Engagements are quoted at a fixed price against an agreed scope. The price is set before work begins and does not change because the work took longer than we estimated.

Where you change the scope mid-engagement, we will quote the change in writing before carrying it out. Work outside the agreed scope is not performed on assumption.

Invoices are payable within the period stated on them. Where an engagement is staged, we invoice at the stages set out in the engagement letter.

One retest of the findings we report is included in the engagement fee. It is not charged as an extra.

Warranties and limitation of liability

We perform our work with the reasonable skill and care expected of a competent security and engineering practice. Beyond that, and to the maximum extent permitted by law, our services and this website are provided “as is” and all implied warranties are disclaimed.

We do not warrant that testing will identify every vulnerability in a system, that a system will be secure after remediation, or that a deployment will be free of defects. Security is a property of a system over time, not a state a report confers on it.

To the fullest extent permitted by applicable law, we are not liable for indirect or consequential loss, including loss of data, revenue, profit or business opportunity. Our total liability arising out of an engagement is limited to the fees paid for that engagement. This limit applies however the claim is framed.

Nothing in these terms limits liability that cannot be limited by law, including liability for fraud.

Intellectual property

Reports, findings and remediation guidance produced for you are yours on payment of the engagement fee. You may share them freely inside your organisation and with your auditors, insurers and regulators.

Code we write specifically for you under an engagement is yours on payment, unless the engagement letter says otherwise.

We retain ownership of our methodology, our internal tooling, and anything we developed before or independently of your engagement. Where such a component is delivered as part of your system, you receive a perpetual, non-exclusive licence to use it for that system.

Our open-source projects, including Berserk Arch, are governed by their own licences and are unaffected by these terms.

Third-party services

Our work may reference or depend on third-party platforms, libraries and infrastructure providers. We do not control them and are not responsible for their content, availability, security or practices.

Where you choose to use such a service, reviewing and complying with its terms is your responsibility.

Governing law

These terms and any engagement with Cybercraft Labs Pvt Ltd are governed by the laws of India.

We would rather resolve a dispute by talking to you than by litigating it. If something goes wrong, raise it with us in writing first and we will try to settle it directly.