Terms of Service

1. Binding Agreement & Hierarchy of Documents

These Terms of Service ("Terms") constitute a legally binding agreement between BHISHMASEC CYBERSECURITY SOLUTIONS (OPC) PRIVATE LIMITED ("BhishmaSec", "Company", "we", or "us") and the corporate entity or individual contracting our services ("Client"). If a separately executed Master Services Agreement ("MSA") or Statement of Work ("SoW") has been executed between the parties, the terms of such executed MSA/SoW shall prevail over these Terms to the extent of any express conflict.

2. Authority & Rules of Engagement (RoE)

Security testing, DevSecOps pipeline reviews, and penetration testing involve intrusive technical simulations. Consequently, the following statutory representations apply:

• Client Authorization Warranty: Client explicitly represents and warrants that it is the legal owner or possesses valid, verified written authorization from the underlying infrastructure or application owner to subject all target domains, IP blocks, APIs, and cloud tenancies specified in the SoW to offensive security evaluation.
• Scope Delimitation: BhishmaSec shall restrict testing exclusively to the scoped assets specified in the written Rules of Engagement (RoE). Third-party shared multitenant infrastructure outside the designated scope is expressly excluded.
• Non-Destructive Professional Care: BhishmaSec shall exercise professional care to avoid Denial of Service (DoS), business disruption, permanent data alteration, or degradation of production services, unless a destructive test scenario is specifically mandated in writing by Client.

3. Intellectual Property Rights & Deliverables Ownership

Intellectual property allocation is governed as follows:

• Client Deliverables: Upon receipt of full and final payment of all agreed fees under the applicable Statement of Work, Client shall own all proprietary rights, title, and interest in the custom vulnerability assessment reports, remediation summaries, and executive presentations delivered by BhishmaSec specifically for Client.
• Company Retained IP: BhishmaSec retains exclusive ownership of all pre-existing methodologies, automated scanning tools, script libraries, proprietary algorithms, know-how, and generic security benchmarks utilized or developed prior to or independently of the engagement.

4. Bilateral Confidentiality & Non-Disclosure

Both parties agree that all technical findings, system architectures, credentials, proprietary source code, and business discussions exchanged during the engagement constitute Confidential Information. Each party agrees to maintain strict confidentiality, using the same degree of care as it uses for its own confidential materials (and not less than reasonable care), and shall not disclose Confidential Information to any third party without prior written consent.

5. Limitation of Liability & Disclaimers

Point-in-Time Assessment Disclaimer: A cybersecurity assessment or penetration test is a point-in-time evaluation based on known vulnerability definitions and threat vectors as of the date of execution. Passing an assessment or obtaining an attestation does not warrant that Client systems are invulnerable to future undiscovered zero-day exploits, novel attack techniques, or post-audit configuration drift.

Liability Cap: To the maximum extent permitted by applicable law, in no event shall BhishmaSec's total aggregate liability arising out of or related to any engagement—whether in contract, tort (including negligence), indemnity, or otherwise—exceed the total fees actually paid by Client to BhishmaSec under the applicable Statement of Work in the twelve (12) months preceding the incident giving rise to liability.

6. Governing Law & Dispute Resolution

These Terms, all Statements of Work, and any dispute or claim arising out of or in connection with them shall be governed by and construed in accordance with the substantive laws of India. The courts located in Vellore, Tamil Nadu, India shall have exclusive jurisdiction over any legal proceedings arising from or relating to this agreement.

7. Automated Communications & Contact Data Retention

When you submit an inquiry, contact form, or sample report request via our website, the following applies:

• Automated Follow-Up: You may receive automated follow-up emails from BhishmaSec sent via our email outreach platform (Instantly.ai) and CRM system (Clarify). These communications relate solely to your inquiry and our services.
• Opt-Out: Every automated email includes an unsubscribe link. You may also opt out at any time by emailing [email protected]. Opt-out requests are processed within 5 business days.
• Data Retention: Contact data (name, business email, company, inquiry content) submitted through website forms is retained for a maximum of 24 months from the date of last interaction, after which it is securely deleted. Where an engagement has proceeded to contract, data retention follows the applicable DPA and engagement-specific SoW.
• B2B Prospecting: BhishmaSec may conduct outbound business-to-business prospecting using publicly available company and professional contact information. This activity is conducted under GDPR Article 6(1)(f) legitimate interests and Recital 47, with appropriate opt-out mechanisms in every communication.

9. Legal Notices

All formal legal notices under this agreement shall be served in writing to:

Legal Counsel: BHISHMASEC CYBERSECURITY SOLUTIONS (OPC) PRIVATE LIMITED
Registered Address: 18/1, Venkataramana Bhagawadhar Street, Walajapet, Vellore, Tamil Nadu – 632513, India
Email: [email protected]
Jurisdiction: Vellore, Tamil Nadu, India