Version 3.2 · Last updated: 20 May 2026 · Effective: 15 June 2026
These Terms of Service ("Terms") govern your use of the website at sentinelforge.example (the "Site") and any services described on the Site. They form a binding agreement between you and SentinelForge Security, Inc., a Delaware corporation with its principal place of business at 1201 Third Avenue, Suite 2200, Seattle, WA 98101, USA ("SentinelForge", "we", "us").
For engagements where we deliver security services, our Master Services Agreement and each executed Statement of Work ("SOW") govern the engagement and, in case of conflict with these Terms, control.
You may browse the Site for lawful business purposes. You may not: (a) attempt to reverse engineer or scrape the Site outside of a robots-permitted crawl; (b) impersonate any person or entity; (c) upload malicious code; (d) use the Site to develop a competing service.
No engagement begins until (a) a Master Services Agreement is executed by both parties and (b) an SOW is signed by both parties. Proposals, scoping calls, and email exchanges are non-binding.
Any material change to the scope, timeline, or fees of an SOW requires a written change order signed by both parties. Verbal agreements are not binding.
We assign personnel to engagements. Named individuals may change with reasonable notice, but any successor will have equivalent seniority and relevant certifications. Client may object in good faith to any personnel; we will make reasonable efforts to replace.
Every SOW that involves offensive security testing includes an Authorization to Test appendix identifying: the systems in scope, permitted techniques, testing windows, points of contact who may halt the engagement, and any excluded actions.
Client represents and warrants that (a) it owns or has the legal right to authorize testing of every in-scope system, (b) it has notified any third-party hosts or providers whose consent may be required (AWS, Azure, GCP, hosted SaaS, etc.), and (c) the individuals signing the SOW have authority to grant this authorization.
We will not knowingly perform any testing outside the authorized scope. If we discover in-scope systems that are actually owned or operated by a third party without proper authorization, we will stop and notify Client.
Deliverables are delivered in accordance with the schedule in the SOW. Client has ten (10) business days after delivery to review and either accept in writing or provide a written statement of specific deficiencies. If no response is received within that window, Deliverables are deemed accepted.
Free re-test of remediated findings is included for 30 days after Deliverable acceptance, subject to the re-test scope not exceeding the original scope.
Fees are stated in the SOW and are exclusive of taxes. Invoices are issued per the SOW payment schedule and are payable Net 30 in USD unless otherwise stated. Late payments accrue interest at 1.0% per month or the maximum allowed by law, whichever is lower.
Client is responsible for all applicable sales, use, VAT, or similar taxes, except those imposed on our net income.
"Confidential Information" means any information disclosed by one party to the other that is marked or reasonably understood as confidential, including Client Environment details, findings, business information, and personal data.
Each party will (a) use the other's Confidential Information only to perform under the engagement, (b) protect it with at least the same care as its own confidential information and no less than reasonable care, and (c) disclose it only to personnel who have a need to know and are bound by written confidentiality obligations at least as protective as these Terms.
The confidentiality obligations survive termination of the engagement for a period of five (5) years, and indefinitely for trade secrets or personal data.
Exceptions. Confidential Information does not include information that (i) is or becomes public through no fault of the receiving party, (ii) was known to the receiving party before disclosure without confidentiality obligation, (iii) is independently developed without reference to the disclosing party's information, or (iv) is received from a third party without confidentiality obligation.
Compelled disclosure. A party may disclose Confidential Information as required by law or subpoena, provided (where lawful) it gives the other party prompt notice and reasonable cooperation to seek protective treatment.
Each party retains ownership of its pre-existing intellectual property. Nothing in these Terms transfers ownership of pre-existing IP.
Upon Client's payment in full for an engagement, we assign to Client all rights, title, and interest in the final Deliverables (the report and PoC scripts), except for our pre-existing tools, methodologies, frameworks, and generic techniques ("Retained Materials").
Where Deliverables incorporate Retained Materials, we grant Client a perpetual, worldwide, non-exclusive, royalty-free license to use those Retained Materials solely as part of and to the extent embedded in the Deliverables.
We may use aggregated, anonymized, non-Client-identifying learnings from engagements to improve our services, benchmarks, and research. We will not publish Client-identifying information without written consent.
Where an engagement involves the processing of Client personal data, the parties will execute our Data Processing Addendum (DPA), which is incorporated into these Terms by reference.
Our internal security program is documented in our SOC 2 Type II report and ISO/IEC 27001 certificate, both available under NDA.
All Client data collected during an engagement is stored in AES-256-encrypted volumes on infrastructure hosted in the United States (or, at Client's election, the EU). Access is limited to engagement-assigned personnel. Data is retained for 90 days after Deliverable acceptance and then securely deleted, or retained longer only where required by regulation.
Where we identify a vulnerability in third-party software (open source or commercial) during an engagement, we will notify Client and coordinate any vendor disclosure per our public responsible-disclosure policy. We will not disclose Client-specific information as part of any vendor coordination.
Each party warrants that it has full authority to enter into these Terms and any related SOW.
We warrant that services will be performed in a professional manner consistent with generally accepted industry standards. This warranty runs for 30 days after Deliverable acceptance. Client's sole remedy for breach of this warranty is re-performance of the deficient service.
SECURITY TESTING IS INHERENTLY LIMITED: NO ENGAGEMENT CAN IDENTIFY EVERY VULNERABILITY. WE MAKE NO WARRANTY THAT A DELIVERABLE IDENTIFIES EVERY VULNERABILITY IN THE CLIENT ENVIRONMENT OR THAT THE CLIENT ENVIRONMENT WILL BE SECURE AFTER REMEDIATION. EXCEPT AS EXPRESSLY STATED IN SECTION 12 AND EXCEPT WHERE NON-EXCLUDABLE BY LAW, ALL SERVICES AND DELIVERABLES ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY.
EXCEPT FOR (I) A PARTY'S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS, (II) A PARTY'S INDEMNIFICATION OBLIGATIONS, (III) LIABILITY THAT CANNOT BE LIMITED BY LAW, (IV) A PARTY'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, OR (V) CLIENT'S PAYMENT OBLIGATIONS:
By us: We will defend and indemnify Client against any third-party claim alleging that a Deliverable, as delivered, infringes any US patent, US copyright, or trade secret. Our sole obligation is to (a) obtain the right for Client to continue using the Deliverable, (b) modify it to become non-infringing, or (c) refund the fees paid for the infringing Deliverable.
By Client: Client will defend and indemnify us against any third-party claim arising from (a) Client's breach of its representations in section 5, (b) Client's failure to obtain proper authorization for the systems it identified as in-scope, or (c) Client's use of a Deliverable in a manner outside its intended purpose.
We maintain the following insurance throughout each engagement:
Certificates of insurance are available on request from legal@sentinelforge.example.
Each SOW runs for the period stated in it. Either party may terminate an SOW for material breach on 30 days' written notice if the breach is not cured within that period. Either party may terminate an SOW immediately for the other party's insolvency or assignment for the benefit of creditors.
On termination, Client will pay for services performed and expenses incurred through the effective date of termination. Sections that by their nature should survive (confidentiality, IP, disclaimers, liability, indemnification, disputes) will survive.
During any engagement and for twelve (12) months after its termination, neither party will solicit for employment any personnel of the other who has been substantially involved in the engagement, without written consent. General public job postings that do not target such personnel are not a breach.
Each party will comply with all applicable US export-control laws and economic sanctions programs administered by the US Office of Foreign Assets Control (OFAC). Client represents that it is not, and is not owned or controlled by, any person listed on OFAC's Specially Designated Nationals list or subject to comprehensive US sanctions.
These Terms and any SOW are governed by the laws of the State of Washington, USA, excluding conflict-of-laws principles.
Escalation. Before filing a dispute, the parties will first attempt to resolve it through good-faith discussions between senior executives for at least 30 days.
Arbitration. Any unresolved dispute will be finally settled by binding arbitration under the JAMS Streamlined Arbitration Rules, seated in Seattle, Washington, by one arbitrator. The arbitrator's award may be entered in any court of competent jurisdiction.
Injunctive relief. Notwithstanding the above, either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidentiality rights.
Entire agreement. These Terms, together with any executed MSA, SOW, DPA, and referenced policies, constitute the entire agreement between the parties.
Order of precedence. Where these Terms conflict with the MSA or SOW, the MSA controls. Where the MSA and an SOW conflict, the SOW controls for that specific engagement.
Assignment. Neither party may assign these Terms without the other's written consent, except in connection with a merger, acquisition, or sale of substantially all of its assets.
Force majeure. Neither party is liable for delays or failures due to events beyond its reasonable control.
Notices. Legal notices must be in writing and sent to legal@sentinelforge.example (for us) or the notice address in the MSA (for Client).
Severability, no waiver, counterparts. Standard terms apply.