Engagement Prerequisite: All cybersecurity assessments, vulnerability scans, and penetration tests executed by FQRS require prior formal authorization under a signed Statement of Work (SOW) or digital authorization agreement. FQRS performs testing strictly within approved IP/domain bounds.
1. Authorization & Scope of Testing
By engaging FQRS (Forensic Quality Reporting Solutions) for vulnerability testing or cybersecurity advisory services, the Client explicitly warrants that they possess full legal ownership, administrative authority, or written authorization to subject designated target systems, mobile applications, APIs, and cloud networks to penetration testing.
- Testing shall be conducted exclusively against assets listed in the agreed Statement of Work (SOW).
- Any unauthorized target expansion during testing is strictly prohibited unless explicitly authorized in writing.
- FQRS engineers operate under strict "Rules of Engagement" (RoE) designed to minimize service disruptions.
2. Professional Standards & Methodology
FQRS conducts security assessments in accordance with recognized international cybersecurity standards, including OWASP Top 10, OWASP Mobile Application Security Verification Standard (MASVS), NIST SP 800-115, and PTES (Penetration Testing Execution Standard).
3. Confidentiality & Non-Disclosure (NDA)
FQRS treats all client information, source code, system credentials, infrastructure layouts, and vulnerability findings as Strictly Confidential:
- All security findings are delivered through encrypted, password-protected security reports.
- FQRS personnel are bound by strict corporate non-disclosure agreements (NDAs).
- Neither party shall disclose confidential project details to third parties without prior written consent.
4. Deliverables & Remediation Retesting Guarantee
Upon completion of an assessment, FQRS delivers a comprehensive, forensic-quality vulnerability report detailing executive summaries, risk severities (CVSS v3.1), proof-of-concept steps, and remediation guidance. As part of our commitment to client security, FQRS provides a complementary re-test window for verified patches within 30 days of report delivery.
5. Official Security Partnerships (e.g. Sales Funda®)
Where FQRS serves as the designated Official Cybersecurity Partner for third-party enterprises (such as Sales Funda®), FQRS maintains continuous security oversight, periodical vulnerability audits, and API protection. Such engagements are subject to dedicated Master Service Agreements (MSA) and SLA addendums.
6. Client Obligations & Prerequisites
To ensure the successful execution of security assessments, the Client agrees to:
- Provide necessary access credentials, API documentation, or staging environments as specified in the SOW.
- Maintain a stable testing environment. The Client shall not deploy major architectural changes to the target systems during the active testing window without prior notification.
- Ensure that testing target databases are backed up prior to the commencement of active penetration testing.
7. Intellectual Property Rights
Client Ownership: The Client retains full intellectual property rights to their systems, source code, and data. FQRS claims no ownership over the target assets being tested.
FQRS Ownership: FQRS retains all intellectual property rights to its proprietary testing methodologies, custom exploit scripts, automated toolchains, and report formatting structures. The final Vulnerability Assessment Report is licensed to the Client for internal remediation and compliance purposes.
8. Payment Terms & Invoicing
Payment terms for VAPT engagements are strictly defined within the individual Statement of Work (SOW) or invoice. Standard engagements require a mobilization advance, with the remaining balance due upon the delivery of the initial forensic report (prior to the retesting window). Late payments may result in the suspension of retesting services or withholding of Final Security Certificates.
9. Indemnification & Force Majeure
The Client agrees to indemnify and hold harmless FQRS and its security engineers from any claims, damages, or service interruptions that arise as a direct result of authorized testing on the designated target systems. Furthermore, neither party shall be held liable for delays or failure to perform obligations due to circumstances beyond reasonable control, including but not limited to natural disasters, internet backbone outages, or acts of government (Force Majeure).
10. Limitation of Liability
While FQRS employs industry-leading security practices and manual verification to identify vulnerabilities, cybersecurity is an evolving domain. FQRS provides assessments based on system state during the audit window and does not guarantee absolute immunity against future unknown zero-day exploits. In no event shall FQRS's total liability exceed the total fees paid by the Client for the specific engagement in question.
11. Governing Law & Jurisdiction
These Terms of Service are governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with these terms shall be subject to the exclusive jurisdiction of the competent courts in India.
12. Contact Legal & Compliance
FQRS — Legal & Compliance Office
Forensic Quality Reporting Solutions
Email: [email protected]
Phone: +91 9022893397 | +91 8898784181