top of page

Terms & Conditions

A LEGAL DISCLAIMER

1. Acceptance of Terms
By accessing and using this website and engaging our services, you accept and agree to be bound by these terms. If you do not agree, please do not use our services.
2. Service Description
2cross provides IT services, cybersecurity assessments, privacy impact assessments (PIAs), and compliance consulting services. Our services include but are not limited to:

  • Security audits and vulnerability assessments

  • Privacy impact assessments and data protection reviews

  • Compliance consulting (GDPR, HIPAA, SOC 2, ISO 27001, etc.)

  • Incident response guidance

  • Security policy development

  • Risk assessment and mitigation strategies

  • Training and awareness programs

3. Scope of Engagement
A detailed Statement of Work (SOW) or Service Agreement will outline the specific scope, deliverables, timeline, and fees for each engagement. These terms apply in conjunction with any signed agreement. In case of conflict, the SOW takes precedence.
4. Professional Standards & Limitations
Disclaimer: While we employ industry-standard methodologies and best practices, no assessment can guarantee 100% detection of all vulnerabilities or threats. Cybersecurity is an evolving field, and new vulnerabilities may emerge after our assessment. Our services represent a point-in-time analysis based on available information.
5. Confidentiality and Data Protection
5.1 Sensitive Information
During our engagement, you may share confidential, proprietary, or sensitive data (including customer data, system configurations, and security posture details). We agree to:

  • Maintain strict confidentiality and handle all data according to applicable data protection laws

  • Use data solely for the purposes outlined in the engagement

  • Implement appropriate technical and organizational security measures

  • Limit access to authorized personnel only

  • Not disclose findings to third parties without your written consent

5.2 Data Processing
If personal data is processed, we will comply with GDPR, CCPA, LGPD, and other applicable privacy regulations. A Data Processing Agreement (DPA) may be required and will be provided upon request.
5.3 Data Retention
We will retain assessment data and reports only for the duration specified in the SOW or as required by law. Upon engagement conclusion, data will be securely deleted unless otherwise agreed in writing.
6. Compliance & Regulatory Compliance
Important: Our services are advisory and informational. We do not provide legal advice. Compliance with regulations (GDPR, HIPAA, PCI-DSS, PIPEDA, SOC 2, ISO 27001, etc.) remains your responsibility. We recommend you:

  • Consult with legal counsel regarding regulatory obligations

  • Implement our recommendations based on your risk appetite and business needs

  • Conduct regular reassessments to maintain compliance

  • Maintain adequate compliance documentation

7. Client Responsibilities
To ensure effective service delivery, you agree to:

  • Provide accurate information and necessary system access

  • Designate a primary point of contact

  • Ensure all necessary permissions and authorizations are in place before we begin work

  • Implement reasonable security measures to protect shared data

  • Notify us immediately of any security incidents or policy changes

  • Maintain backups of critical systems before assessments

  • Follow remediation recommendations in a timely manner

8. Limitation of Liability & Warranties
8.1 No Warranties
Our services are provided "as is" without warranties of any kind, express or implied, including:

  • Merchantability or fitness for a particular purpose

  • Completeness or accuracy of findings

  • Prevention of future security incidents

  • Compliance with specific regulations

8.2 Liability Cap
In no event shall 2cross be liable for indirect, incidental, consequential, special, or punitive damages, including but not limited to loss of data, revenue, business interruption, or reputational harm, even if advised of the possibility of such damages.
Our total liability shall not exceed the fees paid for the specific engagement that gave rise to the claim.
8.3 Exclusions
We are not liable for:

  • Security incidents resulting from non-implementation of our recommendations

  • Failures caused by third-party systems or services beyond our control

  • Incidents resulting from your misuse, neglect, or unauthorized modifications

  • Breaches caused by employee misconduct or social engineering unrelated to system vulnerabilities

9. Incident Response & Breach Notification
If we discover evidence of a data breach, unauthorized access, or security incident during our engagement, we will:

  1. Notify you promptly

  2. Document findings in our assessment report

  3. Provide remediation guidance

You remain responsible for notification obligations to regulators and affected parties per applicable law (GDPR Article 33, HIPAA Breach Notification Rule, etc.).
10. Assessment Methodology & Tools
We use industry-recognized assessment methodologies and both commercial and open-source tools. By engaging our services, you authorize us to:

  • Conduct security testing and vulnerability scanning

  • Access systems and networks as outlined in the SOW

  • Use third-party security tools and services

  • Document and report findings

Note: Aggressive testing may impact system performance. We will coordinate timing to minimize disruption.
11. Third-Party Tools & Integrations
Our assessments may involve third-party security tools, cloud platforms, or SaaS solutions. You acknowledge:

  • Third-party tools are subject to their respective terms of service and privacy policies

  • We are not responsible for third-party outages or data handling

  • You must review and accept third-party terms before we proceed

  • Additional fees may apply for premium tool licenses

12. Audit Rights & Remediation Verification
We reserve the right to:

  • Request evidence of remediation implementation

  • Conduct follow-up assessments to verify fixes

  • Audit your compliance posture periodically if specified in the SOW

  • Request system access to validate security controls

13. Intellectual Property
13.1 Our IP
All methodologies, templates, frameworks, tools, and proprietary processes remain our intellectual property. You receive a license to use reports and deliverables for internal purposes only.
13.2 Your IP
You retain ownership of all data and systems we assess. You grant us a limited license to access and analyze systems solely for engagement purposes.
13.3 Improvements
You may not reverse engineer, reproduce, or commercialize our assessment frameworks without written permission.
14. Fees & Payment Terms

  • Fees are as specified in the SOW or service agreement

  • Payment terms: [Net 30 days / Upon completion / As agreed]

  • Expenses (travel, third-party tools, etc.) are billed separately unless included

  • Late payments accrue interest at [X]% per month or as permitted by law

  • We reserve the right to suspend services for non-payment

15. Modifications & Term Limits
15.1 Updates to Terms
We may update these terms with 30 days' notice. Continued use constitutes acceptance.
15.2 Engagement Duration
Services are provided for the duration specified in the SOW. Ongoing monitoring or advisory services require separate renewal agreements.
15.3 Termination
Either party may terminate an engagement with written notice if the other party materially breaches these terms and fails to cure within 15 days.
16. Insurance & Professional Indemnity
We maintain professional liability insurance appropriate to our services. You may request a certificate of insurance upon request.
17. Regulatory & Legal Compliance
We comply with all applicable laws in [Your Jurisdiction] and relevant data protection regulations. However:

  • We are not legal advisors; consult qualified counsel for regulatory interpretation

  • Our findings may have legal implications; you should review reports with counsel

  • We may be required to comply with law enforcement requests

18. Limitation on User Behavior
By engaging our services, you agree not to:

  • Misrepresent your authorization to request assessments

  • Request us to conduct unauthorized testing on systems you don't control

  • Use our services for malicious, illegal, or unethical purposes

  • Interfere with or disrupt our assessment activities

  • Violate laws in conducting or responding to assessments

19. Indemnification
You agree to indemnify and hold harmless [Your Company Name], its officers, employees, and agents from:

  • Third-party claims arising from your systems, data, or business operations

  • Claims related to your non-implementation of recommendations

  • Legal consequences of regulatory non-compliance

  • Damages from unauthorized access or system modifications post-assessment

20. Limitation of Assessment Scope
Assessments are limited to the scope defined in the SOW. We are not responsible for:

  • Systems or networks outside the defined scope

  • Threats emerging after the assessment end date

  • Vulnerabilities in undocumented or legacy systems

  • Third-party vendor vulnerabilities we're not authorized to test

21. Subcontractors & Partners
We may engage subcontractors or partners to assist with delivery. They are bound by equivalent confidentiality and data protection obligations. You may request details on subcontractors before engagement begins.
22. Governing Law & Dispute Resolution
22.1 Jurisdiction
These terms are governed by the laws of [Your Jurisdiction] without regard to conflict of law principles.
22.2 Dispute Resolution
Before pursuing litigation:

  1. Both parties attempt good-faith resolution

  2. If unresolved, disputes may proceed to [mediation/arbitration/litigation]

22.3 Venue
You irrevocably consent to jurisdiction of courts located in [Your Jurisdiction].
23. Entire Agreement
This agreement, together with any signed SOW or Service Agreement, constitutes the entire understanding between parties and supersedes all prior discussions or agreements.

bottom of page