Terms and Conditions

1. About Secusy

Secusy.ai ("Secusy") is ValueMentor's digital platform for discovering, purchasing, onboarding, managing and receiving cybersecurity and related services.

Services available through Secusy may include software-enabled services, automated assessments, cybersecurity testing, compliance and assurance services, consulting, managed security services, subscriptions, and expert-led professional services.

Certain Services may be delivered directly through the Secusy platform, by ValueMentor personnel, through approved technology providers or subcontractors, or through a combination of these methods.

2. Business Use Only

Secusy and the Services are intended exclusively for businesses and persons acting for purposes relating to their trade, business, craft or profession.

You confirm that you are not purchasing or using the Services as a consumer.

If you accept these Terms on behalf of a company or other organisation, you represent that you have authority to bind that organisation.

3. Definitions

Customer means the business or organisation purchasing or using a Service.

Customer Content means information, documents, files, evidence, credentials, configurations, logs, system information, source material or other content supplied by or on behalf of the Customer.

Order means an order, subscription, quotation, statement of work or other purchasing mechanism through which the Customer purchases a Service.

Platform means the Secusy.ai website, portals, dashboards, software and related functionality.

Service means any cybersecurity, compliance, assurance, consulting, testing, managed, software-enabled or other service purchased or accessed through Secusy.

Service Terms means the scope, package description, service specifications, deliverables, limitations, prerequisites, usage allowances and other terms applicable to a particular Service or Order.

4. Contract Formation

The contract between the Customer and ValueMentor consists of:

1. the applicable Order and Service Terms;
2. any applicable Data Processing Agreement;
3. these Terms; and
4. any other document expressly incorporated into the Order.

If there is a conflict, the more specific document will take precedence over the more general document in relation to the subject matter of that conflict. For data-processing matters, the Data Processing Agreement will take precedence.

Information presented on Secusy before purchase does not constitute an offer capable of acceptance unless expressly stated otherwise.

An Order becomes binding when we accept the Order, confirm the purchase, commence delivery, or otherwise expressly accept it.

We may reject or cancel an Order before Service commencement where we reasonably determine that we cannot lawfully, safely or practically provide the requested Service. If we cancel a prepaid Order for this reason and the Customer is not responsible for the cancellation, we will refund the amount paid for the undelivered Service.

5. Service Scope

Each Service is provided according to its applicable Service Terms.

Service Terms may specify matters including:

• assets, applications, systems or entities covered;
• number of users, applications, IP addresses, domains, endpoints or other scope units;
• assessment or testing methodology;
• deliverables;
• included meetings or consulting hours;
• retests or rescans;
• evidence reviews;
• turnaround or estimated delivery times;
• subscription allowances;
• prerequisites;
• exclusions; and
• Customer responsibilities.

Anything not expressly included in the applicable Service Terms is outside the scope of the Service.

Changes to scope may require additional fees and may affect delivery timelines.

6. Customer Responsibilities

The Customer must provide accurate, complete and timely information reasonably required for delivery of the Services.

This may include scope information, URLs, IP addresses, applications, credentials, documentation, evidence, system access, cloud access, technical contacts, authorization and other information relevant to the Service.

The Customer is responsible for:

• the accuracy of information it supplies;
• maintaining appropriate backups and recovery arrangements;
• obtaining necessary internal and third-party approvals;
• maintaining appropriate licences and permissions;
• ensuring that its instructions are lawful;
• maintaining the security of its Secusy account credentials; and
• promptly informing us of material changes affecting the Service.

The Customer must not provide credentials, personal data, confidential information or other information that is unnecessary for the Service.

7. Customer Delays

Any stated delivery or turnaround period depends on the Customer providing all required information, payment, authorization, access and cooperation.

Unless the applicable Service Terms expressly state otherwise, delivery periods begin only when all material prerequisites required to commence the relevant work have been satisfied.

If the Customer delays providing required information, access, approvals, responses or other dependencies, the corresponding delivery dates may be extended.

We will not be responsible for delays caused by the Customer, its personnel, its systems or third parties outside our reasonable control.

8. Authorization for Cybersecurity Testing

Where a Service involves vulnerability scanning, penetration testing, attack-surface assessment, security validation or other interaction with computer systems, networks, applications, APIs, cloud environments or infrastructure, the Customer expressly authorizes ValueMentor to perform the activities included within the agreed scope.

The Customer represents and warrants that:

• it owns the systems or assets being tested; or
• it has obtained sufficient authorization from the owner or other responsible party to authorize ValueMentor to perform the testing.

The Customer must not request testing against systems for which it does not have appropriate authority.

We may request evidence of authorization and may refuse or suspend testing where we reasonably believe sufficient authorization has not been obtained.

Authorization applies only to the assets and activities included within the agreed scope.

9. Risks Associated With Security Testing

The Customer acknowledges that legitimate cybersecurity testing can involve operational risk.

Despite reasonable precautions, testing may result in temporary degradation, service interruption, account lockout, application instability, alerts, increased system load or other unintended effects.

The Customer is responsible for maintaining appropriate backups, recovery arrangements and operational safeguards before testing begins.

Where we reasonably believe an activity may create an unacceptable risk to systems or data, we may pause or modify testing and consult with the Customer where appropriate.

Nothing in this section excludes liability that cannot lawfully be excluded or limited.

10. No Guarantee of Security or Compliance

Cybersecurity assessments and testing represent an assessment of the agreed scope using the applicable methodology and information available during the assessment period.

No cybersecurity assessment can identify every vulnerability, threat or security weakness.

A successful assessment, clean scan, penetration test, report, attestation or similar result does not guarantee that a system is secure or will remain secure.

Similarly, consulting, readiness, implementation or compliance Services do not guarantee:

• certification;
• regulatory approval;
• audit success;
• continued compliance;
• acceptance by a regulator, auditor, customer or third party; or
• the absence of future security incidents.

Certification, regulatory and audit decisions made by independent organisations remain under the control of those organisations.

Where a Service expressly includes a third-party audit, certification activity or attestation, the applicable Service Terms will describe what is included.

11. Accounts and Platform Access

Customers may be required to create a Secusy account.

The Customer is responsible for activities carried out through its authorised accounts and must maintain appropriate security over login credentials.

Accounts must not be shared with unauthorised persons.

You must promptly notify us if you reasonably suspect unauthorised access to your account.

We may implement security measures including multifactor authentication, access restrictions, session controls and other safeguards.

12. Acceptable Use

You must not use Secusy or the Services to:

• conduct unauthorised security testing;
• attack, compromise or disrupt systems without permission;
• introduce malicious software;
• circumvent Platform security controls;
• gain unauthorised access to data or systems;
• infringe intellectual property rights;
• violate applicable law;
• resell or commercially exploit Services unless expressly permitted; or
• interfere with the operation or security of Secusy.

We may suspend access where we reasonably believe use of the Platform or Services creates a security, legal or operational risk.

13. Fees and Payment

Prices are displayed in the applicable Order or Service page.

Unless stated otherwise, prices exclude applicable taxes, duties and similar governmental charges.

Payment may be made using supported online payment methods or, where approved by ValueMentor, by invoice or bank transfer.

Invoices must be paid within the payment period stated on the invoice or Order.

We may suspend Services where undisputed amounts remain overdue after reasonable notice.

The Customer remains responsible for amounts properly due under the applicable Order.

14. Subscriptions and Automatic Renewal

Some Services are offered on a recurring subscription basis.

Unless the applicable Order states otherwise, subscriptions automatically renew for successive periods equivalent to the original subscription period until cancelled.

The applicable price, billing frequency and subscription period will be displayed before purchase.

The Customer may cancel a subscription before its next renewal date using available account functionality or by contacting us.

Cancellation prevents the next renewal but does not normally result in a refund for the current billing period.

Access to the relevant Service will normally continue until the end of the paid subscription period.

We may change subscription pricing by giving reasonable advance notice. Any price change will apply from a subsequent renewal and not retrospectively to a billing period already paid.

15. Cancellation and Refunds

Before Service delivery has commenced, the Customer may request cancellation.

Where we accept the cancellation, we may deduct reasonable non-recoverable costs already incurred specifically for that Order.

Once Service delivery has materially commenced, payments are generally non-refundable except where required by law or expressly provided in the applicable Service Terms.

Service delivery may be considered to have commenced when we perform a material delivery activity, including:

• assigning delivery personnel specifically to the engagement;
• reviewing onboarding information;
• validating scope;
• configuring an assessment;
• commencing scanning or testing;
• reviewing evidence;
• conducting assessment work; or
• beginning another material activity required to deliver the purchased Service.

Different cancellation provisions stated in an Order or Service Terms take precedence over this section.

16. Customer Content and Intellectual Property

The Customer retains ownership of Customer Content.

The Customer grants ValueMentor a limited right to access, process, copy, transmit and otherwise use Customer Content as reasonably necessary to provide, secure, support and administer the Services and comply with applicable law.

ValueMentor retains ownership of its pre-existing and independently developed intellectual property, including methodologies, templates, tools, software, assessment techniques, frameworks, know-how and Platform technology.

Unless otherwise stated in the applicable Service Terms, once all applicable fees have been paid, the Customer may use reports and deliverables created specifically for it for its internal business purposes and legitimate compliance, assurance, customer, regulatory and audit purposes.

The Customer must not resell, commercially redistribute or represent ValueMentor materials as its own product without written permission.

Nothing prevents ValueMentor from using general knowledge, experience, skills, methodologies or know-how gained in performing the Services, provided this does not disclose Customer Confidential Information.

17. Confidentiality

Each party must protect confidential information received from the other party using reasonable care and use it only for purposes connected with the Services.

Confidential information includes non-public technical, security, commercial and business information and, in the Customer's case, may include security findings, system configurations, vulnerability information, credentials and assessment evidence.

Confidentiality obligations do not apply to information that:

• is or becomes public through no breach of these Terms;
• was lawfully known to the receiving party without confidentiality restrictions;
• is independently developed without use of the other party's confidential information; or
• is lawfully received from a third party without confidentiality restrictions.

A party may disclose confidential information where required by law, court order or competent authority, subject to applicable legal restrictions.

18. Liability

Nothing in these Terms excludes or limits either party's liability where liability cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation.

Subject to the preceding paragraph, neither party will be liable for indirect or consequential loss, or for loss of profit, revenue, anticipated savings, business opportunity or goodwill, arising from the Services.

Subject to liabilities that cannot lawfully be limited and any different liability arrangement expressly stated in an Order, ValueMentor's total aggregate liability arising out of or in connection with a particular Service or Order, whether in contract, tort (including negligence), breach of statutory duty or otherwise, will not exceed the fees paid or payable by the Customer for the affected Service during the twelve months immediately preceding the event giving rise to the claim.

Where the affected Service has been provided for less than twelve months, the cap will be the fees paid or payable for that Service during that shorter period.

Nothing in these Terms limits the Customer's obligation to pay properly due fees.

19. Customer Indemnity

The Customer will indemnify ValueMentor against third-party claims, losses and reasonable costs arising directly from:

• the Customer requesting testing of systems it was not authorised to test;
• unlawful instructions provided by the Customer;
• Customer Content that infringes a third party's rights; or
• the Customer's material misuse of the Services,

except to the extent the claim results from ValueMentor's own breach of these Terms, negligence or unlawful conduct.

20. Data Protection

Each party will comply with applicable data-protection law in relation to personal data processed under the Services.

For personal data relating to Secusy accounts, purchasing, billing, website operation and ValueMentor's own business administration, ValueMentor may act as an independent controller.

Where ValueMentor processes personal data contained in Customer Content on behalf of and under the instructions of the Customer, ValueMentor will act as a processor to the extent applicable.

Such processor activities will be governed by the applicable Data Processing Agreement.

Our handling of personal data in our capacity as controller is further described in the Secusy Privacy Policy.

Privacy enquiries may be sent to privacy@valuementor.com.

21. Aggregated and Anonymised Information

ValueMentor may generate and use statistical, aggregated or anonymised information derived from use of the Services for purposes including analytics, cybersecurity research, benchmarking, improving the Services and developing or improving machine-learning and AI capabilities.

Where information is treated as anonymised under this section, it must be processed so that it no longer identifies the Customer or an identifiable individual in accordance with applicable data-protection requirements.

We will not use Customer Content containing identifiable personal information, credentials, identifiable confidential documents or identifiable customer-specific security findings to train general-purpose AI models unless separately agreed with the Customer.

Nothing in this section limits obligations relating to personal data or Confidential Information that has not been effectively anonymised.

22. Third-Party Services

The Services may integrate with or depend upon third-party products, cloud providers, payment processors, security technologies, auditors, certification bodies or other providers.

Third-party services may be subject to their own terms.

ValueMentor is not responsible for the independent acts, omissions, outages or decisions of third parties outside its reasonable control, except where applicable law or an express contractual obligation provides otherwise.

Where third-party fees are included in a Service, this will be stated in the applicable Service Terms or Order.

23. Service Changes

Cybersecurity standards, regulatory requirements, technology platforms and third-party programmes may change.

We may make reasonable modifications to the Services where necessary to address security requirements, legal or regulatory changes, third-party programme changes or technical developments.

We will not materially reduce the core functionality or contracted deliverables of a prepaid Service without reasonable justification or an appropriate alternative remedy.

24. Suspension

We may suspend access to some or all Services where reasonably necessary because of:

• non-payment;
• suspected unauthorised or unlawful use;
• security risk;
• breach of these Terms;
• a legal or regulatory requirement; or
• conduct that threatens Secusy, ValueMentor, the Customer or a third party.

Where reasonably practicable, we will provide notice and an opportunity to remedy the issue.

25. Termination

Either party may terminate an Order where the other party commits a material breach and, where the breach can be remedied, fails to remedy it within a reasonable period following written notice.

We may terminate immediately where continued provision of a Service would be unlawful or create a material security risk.

Termination does not affect rights or liabilities accrued before termination.

Provisions intended by their nature to survive termination, including confidentiality, intellectual property, payment obligations, limitations of liability and applicable data-protection obligations, will continue after termination.

26. Force Majeure

Neither party will be liable for delay or failure caused by events beyond its reasonable control.

Such events may include natural disasters, widespread internet or telecommunications failures, war, civil disturbance, government action, major cloud-provider failures, widespread cyber incidents, labour disruption or failure of essential third-party infrastructure.

The affected party must take reasonable steps to mitigate the impact.

27. Changes to These Terms

We may update these Terms from time to time.

Material changes will apply prospectively and, where appropriate, we will provide reasonable notice.

Changes will not retrospectively alter the commercial terms of an already purchased fixed-term Service unless required by law, agreed by the parties, or reasonably necessary to address an urgent security or legal requirement.

Continued use of a recurring Service after updated Terms become effective may constitute acceptance of those updated Terms where legally permitted and after appropriate notice.

28. Electronic Contracting

Orders may be concluded electronically.

Before submitting an online Order, the Customer will have an opportunity to review relevant Order information and correct input errors using the functionality provided.

We may acknowledge electronic Orders by email, through the Platform or by another electronic method.

The Customer should retain copies of the applicable Order and these Terms for its records.

29. Notices

Legal notices to ValueMentor may be sent to:

Privacy enquiries should be sent to privacy@valuementor.com.

Operational and Service communications may be delivered through Secusy, email or the contact details associated with the Customer's account.

30. Assignment and Subcontracting

The Customer may not assign its rights or obligations under an Order without our prior written consent, such consent not to be unreasonably withheld.

ValueMentor may use affiliates, qualified personnel and subcontractors to perform parts of the Services while remaining responsible for its contractual obligations to the Customer.

Where subcontracting involves processing personal data on behalf of the Customer, the applicable Data Processing Agreement will govern the use of sub-processors.

31. Entire Agreement

The applicable Order, Service Terms, Data Processing Agreement where applicable, and these Terms constitute the agreement between the parties concerning the relevant Services and supersede prior discussions or representations concerning those Services.

Nothing in this section excludes liability for fraud or fraudulent misrepresentation.

32. Severability

If any provision of these Terms is found invalid or unenforceable, the remaining provisions will continue in effect.

The invalid or unenforceable provision will be treated as modified to the minimum extent necessary to make it valid and enforceable where permitted by law.

33. Waiver

A failure or delay by either party to exercise a right under these Terms does not waive that right.

34. Third-Party Rights

Unless expressly stated otherwise, a person who is not a party to the applicable contract has no right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.

35. Governing Law and Jurisdiction

These Terms and any dispute or claim arising out of or in connection with them, their subject matter or formation are governed by the laws of England and Wales.

The courts of England and Wales will have exclusive jurisdiction over disputes or claims arising out of or in connection with these Terms or the Services.

36. Contact

Secusy.ai is operated by:

Privacy: privacy@valuementor.com

For general support and Service enquiries, please use the contact options provided on Secusy.ai or within your Secusy account.