By purchasing any Pilum.io service you agree to these Terms. Tier 1 consent is via the Polar.sh checkout ToS checkbox. Tier 2+ consent is via signed authorization document plus these Terms.
Pilum.io offers the following service tiers:
Passive-only scan. Zero active API calls. URL only. Covers: HTTP headers, publicly served JS analysis, DNS, SSL/TLS, dependency CVE matching, infrastructure signals. Does NOT cover: authenticated testing, active API probing, repo analysis, database queries, form submissions.
Active testing with signed authorization. Covers everything in Tier 1 plus active probing as defined in the authorization document.
Ongoing delta scanning per GitHub webhook trigger plus monthly full audit.
Coming soon. Not currently offered.
Client represents and warrants:
Client indemnifies Pilum.io against all claims arising from testing assets the client did not have authorization to test.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:
Security auditing is not a guarantee of security. Pilum.io’s reports represent the findings discovered during the engagement scope using the methodology described. Absence of findings does not mean absence of vulnerabilities. The report documents what was tested, what was found, and what was not tested. Client acknowledges this inherent limitation of all security auditing services.
Pilum.io treats all client data, codebases, findings, and engagement details as strictly confidential. We do not share, sell, or disclose client findings to any third party without written consent.
Exception: We may use anonymized, non-attributable aggregate data (vulnerability type frequencies, severity distributions) to improve our detection accuracy. No client-identifying information is included in aggregate data.
Per our published Data Retention Policy. Clients may request early deletion at security@pilum.io.
Tier 1: Payment via Polar.sh. Non-refundable once scan has begun. If we are unable to complete the scan, a full refund is issued.
Tier 2+: 50% deposit on authorization. Remainder on delivery. If we abort per the breach discovery protocol and client elects not to continue, deposit is refunded minus time already spent (hourly rate $150).
Parties agree to attempt good-faith resolution before any legal action. Disputes not resolved within 30 days may be submitted to binding arbitration under the rules of JAMS (for US clients) or ICC (for international clients). Governing law: State of Delaware, USA (pending LLC formation; currently Republic of Indonesia, Jakarta courts for PT-governed engagements).
If a confirmed finding in a delivered report is proven to be a false positive, Pilum.io will issue an errata PDF within 72 hours of verified notification. The errata replaces the affected finding in the official record. No additional fee is charged for errata. This does not create additional liability beyond Section 4.
Pilum.io operates under a responsible disclosure policy (pilum.io/legal/disclosure). Third-party vulnerabilities discovered incidentally are reported to the relevant party per responsible disclosure norms, not to the client. Client-side findings affecting third-party services are noted INFORMATIONAL.
Pilum.io may update these Terms. Material changes will be communicated via email to clients with active engagements. Continued use constitutes acceptance.