Terms and conditions

These terms are between ANPO Pty Ltd (ACN 698 868 147), trading as ANPO Digital (“we”, “us”, “our”), and you. Part A applies to anyone using this website. Part B applies when you engage us for services.

Part A: Using this website

General information only. The content on this website describes our services in general terms. It is not security, legal or compliance advice for your situation and should not be relied on as such. We work to keep it accurate and current but do not promise that it is complete or free of errors.

Enquiries are not authorisation. Sending an enquiry, including a website or application address, does not authorise us to test anything, and we will not. We never scan or probe a system named in an enquiry.

Acceptable use. You must not use this website or its contact form to send spam, malicious code or unlawful content, or attempt to disrupt or gain unauthorised access to it.

Intellectual property. The content, design and branding on this website belong to us unless stated otherwise. You may link to it and share it for non-commercial purposes, but must not copy substantial parts of it without our permission.

Other websites. Links to other websites are provided for convenience. We do not control and are not responsible for their content.

Part B: Standard terms for services

These terms apply to every engagement unless a signed agreement with you says otherwise. If there is a conflict, the order of priority is: the signed scope and testing authorisation, then the accepted quote or proposal, then these terms.

1. Quotes and scope

• We quote a fixed price for an agreed scope. Quotes are valid for 30 days.
• An engagement starts when you accept our quote or proposal in writing, including by email.
• The scope sets out the systems, environments, accounts, testing window and deliverables. Work outside that scope needs a written change, which may change the price and timing.

2. Authorisation to test

• We only test systems listed in a written authorisation signed by someone with authority to approve it.
• You confirm that you own, or have the right to authorise testing of, every system in scope, and that you have obtained any consent needed from hosting providers, platforms and other third parties.
• Testing of third-party platforms is limited to what those platforms’ own testing rules allow.
• Either of us can pause testing at any time if there is a risk of harm. We will stop immediately if you ask us to.

3. Your responsibilities

• Provide accurate information, timely access, test accounts and a contact who can be reached during testing.
• Keep current backups of systems in scope, and tell us about anything fragile or critical before testing starts.
• Use a staging or test environment where one is available. We do not need production credentials.

Delays caused by missing access or information may move the delivery date, and extended delays may be charged as agreed in the quote.

4. How we carry out the work

We perform the services with the care and skill expected of a competent security professional, using methods suited to the scope. Security testing carries some inherent risk of disruption. We design our testing to minimise it and will tell you promptly if anything unexpected happens.

5. No guarantee of security

An assessment finds weaknesses within an agreed scope, at a point in time, using the access and information provided. It cannot find every vulnerability, and changes made after testing can introduce new ones. Our services are consultancy services. They are not a compliance certificate, accreditation or audit opinion, and we do not represent that any system is secure.

6. Fees and payment

• Prices are in Australian dollars. Where GST applies, it is shown on the quote and invoice.
• We may ask for a deposit before work is scheduled. Invoices are payable within 14 days unless the quote says otherwise.
• If an invoice is overdue, we may pause work and withhold deliverables until it is paid.
• If you cancel or reschedule a booked testing window with less than two business days’ notice, we may charge for time that cannot be reallocated.

7. Confidentiality

• We treat your information, systems details, findings and reports as confidential. We share them only with people who need them to do the work, and only under the same obligations.
• We will not name you as a client, publish a case study or refer to your findings in a way that could identify you without your written consent.
• We may use general knowledge and experience gained from the work, such as common vulnerability patterns, provided nothing identifies you or your systems.
• These obligations do not apply to information that is public through no fault of ours, or that the law requires us to disclose.

8. Data handling

We access only the data needed to confirm and demonstrate a finding, store working evidence encrypted, and delete it within 30 days of delivering the final report unless agreed otherwise. Access you grant us is removed or returned at the end of the engagement. Our privacy policy explains how we handle personal information.

9. Reports and intellectual property

• Once paid in full, you own the reports and deliverables prepared for you and may share them with your team, customers, auditors and advisers.
• We keep ownership of our pre-existing tools, methods, templates and know-how, and grant you a licence to use anything of ours that is built into a deliverable.
• Code changes and fixes we write for you belong to you once paid for.

10. Liability

Nothing in these terms excludes, restricts or modifies any right or remedy you have under the Australian Consumer Law that cannot lawfully be excluded.

To the extent permitted by law:

• where our services are not of a kind ordinarily acquired for personal, domestic or household use, our liability for failure to comply with a consumer guarantee is limited, at our option, to supplying the services again or paying the cost of having them supplied again
• our total liability arising from an engagement, whether in contract, negligence or otherwise, is limited to the fees paid for that engagement
• neither of us is liable for indirect or consequential loss, including loss of profit, revenue, data or opportunity
• we are not liable for loss caused by a vulnerability that was outside the agreed scope, not reasonably detectable within it, or reported to you and not fixed

These limits do not apply to liability that cannot be limited by law, or to loss caused by fraud or wilful misconduct.

11. Indemnity

You indemnify us against claims by third parties arising from testing of a system you authorised us to test but did not have the right to authorise.

12. Ending an engagement

Either of us may end an engagement by written notice. You pay for work done and costs committed up to that point. Either of us may end it immediately if the other materially breaches these terms and does not fix the breach within 10 business days of notice. Clauses on confidentiality, data handling, payment, liability and indemnity continue after an engagement ends.

13. Disputes

If a dispute arises, we will first try to resolve it in good faith by talking. If it is not resolved within 20 business days, either of us may refer it to mediation in Melbourne before starting court proceedings, except where urgent relief is needed.

14. General

• We work as an independent contractor. Nothing in these terms creates an employment, partnership or agency relationship.
• Neither of us is responsible for delay caused by events outside our reasonable control.
• We may use trusted subcontractors only with your prior written consent, and remain responsible for their work.
• These terms are governed by the laws of Victoria, Australia, and both of us submit to the courts of Victoria.
• We may update these terms. The version that applies to an engagement is the one current when you accepted the quote.

Contact

ANPO Pty Ltd, trading as ANPO Digital, Melbourne, Victoria, Australia. Email hello@anpodigital.com.au.