Terms & Conditions

1About us

Xium Labs Ltd is a company registered in England and Wales under company number 16702035, with its registered office at 124 City Road, London, EC1V 2NX, United Kingdom. You can contact us at [email protected].

2Definitions

• "Client", "you" means the person or organisation using our website or engaging our services.
• "Deliverables" means any reports, code, software, designs, documentation or other materials we provide under an engagement.
• "Engagement Terms" means the statement of work, proposal, quotation or order that describes the specific services, scope, fees and timelines agreed between us.
• "Services" means the product development, artificial intelligence, security testing and related services we provide.
• "Systems" means the applications, networks, infrastructure, accounts and other assets that are the subject of a security testing engagement.

Where these Terms conflict with signed Engagement Terms, the Engagement Terms prevail for that engagement.

3Use of our website

You may use our website for lawful purposes only. You must not:

• use the website in any way that breaches applicable law or regulation;
• attempt to gain unauthorised access to the website, its servers or any connected system;
• introduce malicious code, or conduct any security testing, scanning or automated data collection against the website without our prior written permission;
• use the website to transmit unsolicited marketing; or
• copy, reproduce or exploit any part of the website except as permitted by these Terms.

We may suspend or withdraw the website, or restrict your access, at any time and without notice. We do not guarantee that the website will always be available or uninterrupted.

4Intellectual property in our website and materials

All intellectual property rights in the website and in our brand, content, designs, software and materials are owned by or licensed to us. Nothing in these Terms transfers any of those rights to you. You may view and print pages for your own internal business use only.

5How our services are provided

The specific services, scope, deliverables, fees and timelines for any engagement are set out in the applicable Engagement Terms. These Terms apply to every engagement unless we agree otherwise in writing.

We will provide the services with reasonable skill and care. Any dates or estimates we give are indicative only, unless expressly agreed as fixed in the Engagement Terms.

6Quotations, fees and payment

• Quotations are valid for 30 days unless stated otherwise and are exclusive of VAT and expenses, which will be added where applicable.
• Unless agreed otherwise, invoices are payable within 14 days of the invoice date.
• We may require a deposit or stage payments before or during an engagement.
• We reserve the right to charge interest on overdue amounts under the Late Payment of Commercial Debts (Interest) Act 1998, and to suspend services while payment is outstanding.
• Fees paid are non-refundable except where required by law or expressly agreed in the Engagement Terms.

7Your responsibilities

To enable us to provide the services, you agree to:

• provide accurate, complete and timely information, access, materials and cooperation;
• ensure you have all necessary rights, licences and authorisations for the work we are asked to perform;
• obtain and maintain any consents required from third parties;
• keep secure backups of your data and systems; and
• nominate a point of contact with authority to make decisions.

We are not liable for any delay or failure to perform caused by your failure to meet these responsibilities, and we may charge for resulting additional work.

8Ownership of deliverables

Unless the Engagement Terms say otherwise, and subject to full payment of all sums due, we assign to you the intellectual property rights in the Deliverables created specifically for you under an engagement.

We retain ownership of all pre-existing materials, tools, methodologies, know-how and any general components we use, and we grant you a non-exclusive, perpetual licence to use those elements to the extent they are incorporated in the Deliverables. We may re-use general knowledge and experience gained during an engagement.

9Security testing: authorisation and scope

This clause applies where we provide penetration testing, security assessment or related services. Security testing involves simulating attacks against Systems and carries inherent risk. You acknowledge and agree that:

• you own the Systems in scope, or you are fully authorised by their owner to instruct us to test them, and you will provide written authorisation on request;
• you are responsible for ensuring that our testing is lawful, and you authorise us to perform the agreed testing on the Systems, which authorisation is essential for the purposes of the Computer Misuse Act 1990;
• testing is strictly limited to the Systems, methods, times and scope set out in the Engagement Terms, and we will not test anything outside that scope;
• where Systems are hosted or operated by a third party, you are responsible for obtaining that party's permission before testing begins; and
• you will notify relevant internal teams and any hosting or security providers, as appropriate, before testing.

You agree to indemnify us against any claim arising from your failure to hold the necessary rights or authorisations for the Systems we are instructed to test.

10Security testing: limitations and risk

• A security test is a point-in-time assessment. We do not warrant that we will identify every vulnerability, or that Systems are or will remain secure. The absence of findings is not a guarantee of security.
• Testing may, despite reasonable care, cause disruption, degradation or unavailability of Systems or data. You accept this risk and are responsible for maintaining backups and business continuity arrangements.
• We will handle any findings and data accessed during testing confidentially and securely, and will report them only to your nominated contacts.
• We do not exploit vulnerabilities beyond what is necessary to demonstrate them, and we do not perform any "hack-back" or offensive action against third parties.
• Remediation of findings is your responsibility. Any re-testing is subject to the Engagement Terms.

11AI and software development

• We do not warrant that any AI system, model or software will be error-free, uninterrupted, or produce any particular result, accuracy or business outcome.
• AI outputs are probabilistic and may be incorrect or unexpected. You are responsible for reviewing outputs and for decisions taken in reliance on them, and for ensuring appropriate human oversight.
• Where we use third-party models, platforms or services, their use is subject to the relevant third party's terms, and we are not responsible for their availability, changes or performance.
• You are responsible for the data you provide, for having the rights to use it, and for ensuring its use complies with applicable law.
• Following handover and acceptance, ongoing maintenance, monitoring and security of software is your responsibility unless we have agreed otherwise in writing.

12Confidentiality

Each party will keep confidential the other party's confidential information and use it only for the purposes of the engagement, except where disclosure is required by law or regulation. This obligation continues after the engagement ends. Security testing reports and findings are confidential to you.

13Data protection

Each party will comply with applicable data protection law. Where we process personal data on your behalf as a processor, we will do so in accordance with a data processing agreement forming part of the Engagement Terms. Our handling of personal data as a controller is described in our Privacy Policy.

14Warranties and disclaimers

We warrant that we will provide the services with reasonable skill and care. Except as expressly stated in these Terms or the Engagement Terms, and to the fullest extent permitted by law, all other warranties, conditions and terms, whether express or implied by statute, common law or otherwise, are excluded. The website and any content are provided "as is" and "as available".

15Limitation of liability

Nothing in these Terms limits or excludes our liability for: death or personal injury caused by our negligence; fraud or fraudulent misrepresentation; or any other liability that cannot be limited or excluded by law.

Subject to the above, and to the fullest extent permitted by law:

• we are not liable for any loss of profit, revenue, business, goodwill, anticipated savings, or for any indirect or consequential loss, however arising;
• we are not liable for any loss or corruption of data or systems, or business interruption, arising from security testing, save where caused by our gross negligence;
• we are not liable for any loss arising from your failure to hold the necessary rights or authorisations, from your instructions, or from your failure to act on our findings or recommendations; and
• our total aggregate liability arising out of or in connection with an engagement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total fees paid by you to us for that engagement in the 12 months preceding the event giving rise to the claim.

Our liability in connection with the free use of our website (as opposed to a paid engagement) is limited to GBP 100 in aggregate.

16Indemnity

You agree to indemnify us and keep us indemnified against all liabilities, costs, expenses, damages and losses (including reasonable legal fees) arising out of or in connection with: your breach of these Terms; your failure to hold the rights or authorisations required for any Systems or data; your use of the Deliverables; and any claim by a third party arising from the engagement where caused by your act or omission.

17Third-party services and materials

The services may rely on, or the Deliverables may incorporate, third-party products, platforms, open-source components or services. Your use of those elements is subject to the relevant third party's terms and licences, and we are not responsible for them.

18Term, suspension and termination

• Either party may terminate an engagement as set out in the Engagement Terms, or on 30 days' written notice where no term is stated.
• We may suspend or terminate immediately on written notice if you materially breach these Terms, fail to pay when due, or become insolvent.
• On termination, you must pay for all services performed and costs committed up to the date of termination.
• Clauses that by their nature should survive termination (including confidentiality, intellectual property, liability and indemnity) will continue in force.

19Force majeure

We are not liable for any delay or failure to perform caused by events beyond our reasonable control, including power or internet failures, third-party provider outages, cyber attacks, industrial action, epidemics, or government action.

20General

• Assignment. You may not assign or transfer your rights without our written consent. We may subcontract or assign our obligations, and we remain responsible for any subcontractor's performance.
• Entire agreement. These Terms and the applicable Engagement Terms are the entire agreement between us and supersede any prior arrangements. You confirm you have not relied on any statement not set out in them.
• Severability. If any provision is found to be invalid or unenforceable, the remaining provisions continue in full effect.
• Waiver. A failure to enforce any provision is not a waiver of it.
• Third-party rights. No one other than the parties has any right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.
• Notices. Notices must be in writing and sent to the contact details in these Terms or the Engagement Terms.

21Governing law and jurisdiction

These Terms, and any dispute or claim arising out of or in connection with them or their subject matter, are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, and the parties will first seek to resolve any dispute in good faith.

22Changes to these Terms

We may update these Terms from time to time. The date at the top shows when they were last revised. The Terms in force at the time of an engagement apply to that engagement.