These Terms apply to every Pilum.io engagement. Consent to scan is given by a signed client agreement or authorization document, which names the assets in scope and the depth of testing permitted. No scan begins before that document is on file, and no payment is taken through this website — engagements are scoped on a call and invoiced.
Pilum.io offers the following engagements:
A point-in-time penetration test of a web application and its API, delivered as a written report. A passive engagement uses GET, HEAD and OPTIONS requests only against publicly served content, and covers HTTP security headers, publicly served JavaScript, DNS and TLS configuration, dependency CVE matching and infrastructure signals. An active engagement additionally probes authentication, access control and API behaviour as defined in the signed authorization document, and may include review of a source repository you provide. Active testing never begins without that document.
Continuous coverage: a delta scan when you ship a significant change, reported as NEW, RESOLVED or UNCHANGED against your last baseline, plus a full re-scan each month. A single authorization covers the subscription period.
Wholesale delivery for agencies, vCISO practices and managed service providers. The report is delivered under the partner’s brand; the partner sets the retail price and holds the client relationship. The partner is responsible for obtaining authorization from the asset owner, and warrants to Pilum.io that it has done so.
Client represents and warrants:
Client indemnifies Pilum.io against all claims arising from testing assets the client did not have authorization to test.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:
Security auditing is not a guarantee of security. Pilum.io’s reports represent the findings discovered during the engagement scope using the methodology described. Absence of findings does not mean absence of vulnerabilities. The report documents what was tested, what was found, and what was not tested. Client acknowledges this inherent limitation of all security auditing services.
Pilum.io treats all client data, codebases, findings, and engagement details as strictly confidential. We do not share, sell, or disclose client findings to any third party without written consent.
Exception: We may use anonymized, non-attributable aggregate data (vulnerability type frequencies, severity distributions) to improve our detection accuracy. No client-identifying information is included in aggregate data.
Per our published Data Retention Policy. Clients may request early deletion at security@pilum.io.
Engagements are invoiced against a written quote agreed before work begins. No payment is taken through this website, and the price is fixed at quote — we do not bill above it for scope we failed to ask about.
Security Audit: invoiced on agreement of scope. Non-refundable once scanning has begun. If we are unable to complete the engagement, a full refund is issued.
Larger or active engagements: 50% deposit on authorization. Remainder on delivery. If we abort per the breach discovery protocol and client elects not to continue, deposit is refunded minus time already spent, charged at the hourly rate stated in your engagement quote.
Parties agree to attempt good-faith resolution before any legal action. Disputes not resolved within 30 days may be submitted to binding arbitration under the rules of JAMS (for US clients) or ICC (for international clients). Governing law: State of Delaware, USA (pending LLC formation; currently Republic of Indonesia, Jakarta courts for PT-governed engagements).
If a confirmed finding in a delivered report is proven to be a false positive, Pilum.io will issue an errata PDF within 72 hours of verified notification. The errata replaces the affected finding in the official record. No additional fee is charged for errata. This does not create additional liability beyond Section 4.
Pilum.io operates under a responsible disclosure policy (pilum.io/legal/disclosure). Third-party vulnerabilities discovered incidentally are reported to the relevant party per responsible disclosure norms, not to the client. Client-side findings affecting third-party services are noted INFORMATIONAL.
Pilum.io may update these Terms. Material changes will be communicated via email to clients with active engagements. Continued use constitutes acceptance.