General Terms and Conditions

The contract is formed once the client accepts an AYSOLI proposal in writing (email is sufficient). The proposal or individual agreement sets out, in particular, the service description and scope, timeline, billing model, prices and payment terms, and the point of contact on each side.

Depending on the service and as stated in the proposal, one of the following billing models applies:

• ▸Time & materials: billed for time actually spent at the agreed rates.
• ▸Fixed price: a total price fixed in the proposal for the agreed scope of work.
• ▸Findings-based (penetration testing only): a reduced base fee plus a fee per confirmed finding, tiered by severity as documented in the final report and agreed with the client. Fewer confirmed findings result in a lower total price.

EASM services are provided as a subscription for the term stated in the proposal (see clause 10).

The client provides AYSOLI, in a timely manner, with all information, access and points of contact required to perform the services, and defines the scope (systems, IP ranges, applications, testing windows) in writing before work begins.

The client confirms that it owns the systems listed in scope, or holds the necessary authorization from the respective owner to have those systems tested, and indemnifies AYSOLI against any third-party claims arising from an authorized security assessment carried out within the agreed scope and rules of engagement.

AYSOLI performs testing with reasonable care and recognized methodologies (including OWASP). Despite careful execution, disruption or instability of the tested systems cannot be fully excluded. The client is responsible for adequate backups and contingency planning before testing begins. Intentionally destructive testing (e.g. denial-of-service) is only performed if expressly agreed in writing.

All prices are net, excluding VAT and any other applicable duties. Unless agreed otherwise, invoices are payable in full within 30 days of the invoice date. In the event of late payment, AYSOLI may charge default interest at the statutory rate and make further performance conditional on payment in full.

Both parties treat all information received in the course of the engagement as strictly confidential and use it solely to perform the contract. This obligation survives termination of the contract without time limit. Reports, results and client data are not disclosed to third parties, nor cited as a reference, without the client's express written consent.

The report produced for the engagement, including the client-specific findings it contains, is licensed to the client for use once payment has been made in full. AYSOLI retains ownership of its own, non-client-specific methodologies, tools, templates and general know-how, and may continue to use and reuse them for other clients, subject to confidentiality.

AYSOLI performs its services in line with the recognized state of the art at the time of delivery and with the diligence of a competent service provider. A penetration test or assessment is a point-in-time exercise and provides no guarantee that every vulnerability in a system has been identified, nor that the system is free of vulnerabilities afterwards.

AYSOLI is liable without limitation for damage caused by intent or gross negligence. For slight negligence, liability is limited to the value of the engagement in question. Liability for indirect damage, consequential damage and loss of profit is excluded to the extent permitted by law.

EASM subscriptions and consulting retainers run for the minimum term stated in the proposal and renew automatically for the agreed renewal period unless terminated in writing with 30 days' notice before the end of the then-current term. Individual engagements (penetration test, workshop) end upon acceptance of the agreed deliverable.

The client agrees not to actively solicit AYSOLI's staff or subcontractors during the term of the contract and for twelve months after its end.

Neither party is liable for delay or non-performance caused by circumstances beyond its reasonable control (e.g. natural events, government orders, or failure of essential infrastructure or suppliers).

Both parties comply with applicable data protection law. Details on how AYSOLI CyberSecurity handles personal data are set out in its Privacy Policy. Where the engagement involves AYSOLI processing personal data on the client's behalf, the parties will enter into a separate data processing agreement as needed.

Should individual provisions of these Terms be invalid, the remaining provisions remain unaffected. Assignment of rights and obligations under the contract requires the other party's prior written consent. AYSOLI may amend these Terms with effect for future contracts; the version published on aysoli.li at the time the contract is formed governs.

These Terms are governed by the law of Liechtenstein. The exclusive place of jurisdiction for disputes arising out of or in connection with these Terms is Vaduz, Liechtenstein (Princely Court of Justice).