1. Scope comes first

Every engagement runs under a written scope agreed before work starts: the system or register covered, what is tested or reviewed, exclusions, effort, and dates. The checkout purchase reserves the engagement; the written scope governs it. If the agreed scope turns out to differ from what was understood, the difference is settled before work continues — by adjusting scope, price, or both.

2. What each product includes

Each product's Stripe description states its inclusions, caps, and time windows. Those descriptions are part of these terms. In short: audits deliver a severity-ranked findings register with evidence and one included retest round of Critical and High findings; remediation covers one cycle of fixes and retests for up to 15 agreed findings with a closure letter; the SOC 2 program delivers audit readiness by day 30 with an auditor handoff package; Security Partner delivers the monthly inclusions listed on its page. Counts and windows are caps, not targets.

3. Authorization

Security testing requires the client's written authorization for the systems in scope, including the right to test them. Production systems are touched only with explicit written permission naming the routes or hosts. The client confirms it owns the systems or holds the right to have them tested.

4. Payment

One-off products are paid upfront through Stripe at purchase. Security Partner bills monthly through Stripe and renews until cancelled; cancellation takes effect at the end of the current month with 30 days' notice. Prices are in Canadian dollars. Applicable taxes (GST/PST) are added at checkout. A discount coupon applies at checkout where Stripe accepts it; it does not create a standing price.

5. Delivery and timelines

Timelines in each product description (typical engagement length, retest booking windows, the day-30 SOC 2 handoff) start when the written scope is agreed and required access is provided. Client delays pause the clock. Retest rounds are booked by the client within their stated windows and expire if unused, unless an agreement says otherwise.

6. Confidentiality

Client identity, engagement data, findings, and evidence are confidential by default and shared only with the people the client names. Findings are vulnerabilities in the client's systems; they are the client's to fix, disclose, or hold. Siddicky keeps its copy of engagement data only as each agreement provides and never publishes client-identifying material without written permission.

7. What the work does not claim

A security audit reduces risk; it cannot eliminate it. No audit finds every vulnerability. The SOC 2 program delivers audit readiness — controls operating and evidence assembled; the Type I or Type II examination is performed by an independent CPA, not by Siddicky. Retests verify that specific findings are fixed as of the retest date; they do not warrant the system against new issues.

8. Liability

Testing is performed with professional care on isolated rigs against staging builds, and production systems only as expressly authorized in writing. To the maximum extent permitted by law, Siddicky's total liability under an engagement is limited to the fees paid for that engagement. Neither party is liable to the other for indirect or consequential losses. Nothing in these terms limits liability that cannot be limited by law.

9. Cancellation and refunds

One-off engagements may be cancelled before the written scope is agreed for a full refund. After scoping begins, work performed is billed and the balance is refunded. Security Partner cancellations take effect at the end of the notice month. If Siddicky cannot deliver an engagement, fees for undelivered work are refunded in full.

10. Governing law

These terms are governed by the laws of British Columbia, Canada. Disputes are resolved in the courts of British Columbia. This document is provided in plain language for clarity; the written scope agreement for each engagement takes precedence where the two differ.