DRAFT FOR SOLICITOR REVIEW. Not final, not in force, and not to be shown to a customer as agreed terms (VEY-58).
Veydr terms of service
Version: draft 1 (18 Oct 2026). Values in square brackets, such as [company number], are for Amadis to fill in.
1. Who we are and who these terms are for
1.1 Veydr is a security readiness service provided by Amadis Consultancy Ltd, a company registered in England and Wales ([company number], registered office [address]) ("Amadis", "we", "us").
1.2 These terms apply between Amadis and the business that buys a Veydr assessment ("you"). Veydr is sold only to businesses. By buying, you confirm that you act for a business and not as a consumer, and that the person accepting these terms is authorised to bind that business.
1.3 The contract is made up of these terms, the data processing agreement (Data processing agreement), the refund policy (Refund policy), the order you place on the sign-up page, and the scope and authorisation form you sign. If they conflict, the scope and authorisation form wins on what may be tested, the data processing agreement wins on personal data, and these terms win on everything else.
2. What we provide
2.1 Core assessment: automated checks of your code, dependencies and committed secrets, run in your own CI with our scanning kit; a review by Amadis of every result; a written readiness report; and a 30-minute walk-through call.
2.2 Add-ons, if you buy them: passive checks of your public domains; a manual access-control test of your beta or QA environment; a review of your backend and sign-in settings; an inventory of the third-party SDKs in your apps; and further retests.
2.3 We do only what your signed scope and authorisation form allows, in the time window it gives, from the source it names. Work starts only once that form is signed.
3. What the service is and is not
3.1 The report records what we observed, at the date of the scan, within the agreed scope and at the depth stated in the report. It is not an accreditation, a certification, a penetration test by a CREST-accredited body, a guarantee that your systems are secure, or legal advice. An area with no findings may have been only partly assessed; the report says which.
3.2 Automated checks find some kinds of problem and not others, and they produce false positives. We review every result, but we cannot promise to find every vulnerability.
3.3 Where the report refers to a law or a framework (for example the UK GDPR or the OWASP Top 10), it maps observations to it. It does not say whether you comply. Take your own legal advice.
4. Your responsibilities
4.1 You warrant that you own or are authorised to have tested every repository, domain, IP address, environment and account you list in the scope and authorisation form, and that each hosting or backend provider's testing policy allows the checks you authorise. You will tell us at once if that changes.
4.2 You provide test accounts and synthetic data for any manual test. You must not give us production credentials or real users' accounts, and you name any endpoint we must not touch (for example payments or production data).
4.3 You keep your own backups and remain responsible for your systems. We never push to your repositories; any fix we suggest is yours to review, test and merge.
4.4 You give us an emergency stop contact who can be reached during the test window.
5. How we work with your code and data
5.1 Our scanning kit runs in your CI. Results leave your CI only as one file encrypted to Amadis, which only Amadis can open. We do not take a copy of your repository unless the scope form allows temporary read-only access, which we delete at the end of the engagement.
5.2 Your code, results, evidence and forms are handled by people at Amadis only. No AI system is given them.
5.3 Personal data is processed under the data processing agreement.
6. Fees, payment and refunds
6.1 You pay the price shown on the sign-up page when you order, through our payment provider, Stripe. Prices are [exclusive / inclusive] of VAT.
6.2 Refunds are set out in the refund policy. In particular, if the scope and authorisation form can't be signed (for example because your hosting provider does not allow the testing), you get a full refund.
7. Timing
7.1 We aim to deliver the report within [10] working days of the later of: the signed scope form, and the first scan result reaching us. Delays caused by missing access, accounts or answers extend that time.
8. Confidentiality
8.1 Each of us keeps the other's confidential information confidential and uses it only for the engagement. Your report, findings and code are your confidential information. Our kit, methods, templates and report format are ours.
8.2 We do not name you as a customer without your written permission.
9. Intellectual property
9.1 Once you have paid, you may use, copy and share the report within your business and with your advisers, investors, insurers and auditors.
9.2 The kit and everything we use to produce the report remain ours. You may run the kit image only for the engagement, and only in your own CI.
10. Liability
10.1 Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law does not allow to be limited.
10.2 Subject to 10.1, neither of us is liable for loss of profit, revenue, business, goodwill or data, or for any indirect or consequential loss.
10.3 Subject to 10.1, our total liability under or in connection with an engagement is limited to [the fees you paid for that engagement / a multiple of them].
10.4 We are not liable for a vulnerability we did not find, for an attack on your systems, or for the effect of a fix you choose to apply.
11. Ending the engagement
11.1 Either of us may end the engagement by written notice if the other materially breaches these terms and does not put it right within [14] days of being asked to.
11.2 You may stop the testing at any time through the emergency stop contact. Refunds after testing has started follow the refund policy.
11.3 At the end of an engagement we delete your data as the data processing agreement requires and confirm it to you in writing.
12. General
12.1 We hold professional indemnity insurance covering security assessment advice [insurer, limit]. [Not yet in place (18 Oct 2026): this clause must be true before any engagement with an outside customer.]
12.2 Neither of us is responsible for delay caused by events outside its reasonable control.
12.3 We may change these terms for future orders. The terms in force when you ordered apply to that engagement.
12.4 These terms are governed by the law of England and Wales, and its courts have exclusive jurisdiction.
Questions for the solicitor
- Is the liability cap in 10.3 enforceable against a business customer under the Unfair Contract Terms Act 1977, and what figure or multiple of fees is reasonable for this kind of service?
- Is the business-only statement in 1.2 enough to keep the Consumer Contracts Regulations 2013 out, given sole traders may buy?
- Does the warranty of authority in 4.1 sufficiently protect Amadis under the Computer Misuse Act 1990 if the signatory had no authority over a listed asset?
- Is the order of precedence in 1.3 right, and should the scope form be a separate signed document or an order form?
- Does 9.2 adequately protect the kit, given the kit image is publicly downloadable?
- Is accepting these terms by a checkbox at checkout sufficient, or should they be signed with the scope form?
- What notice and wording does 12.3 need to change terms for future orders?