
devwalls security
Terms of Service & Engagement
The legal and technical framework governing our offensive assessments, rules of engagement, liability boundaries, and verified 90-day retest guarantee.
1. Acceptance and Purpose
These Terms of Service & Engagement (“Terms”) constitute a legally binding agreement between you or the entity you represent (“Client”, “you”) and Devwalls Security (“Devwalls”, “we”, “us”).
By contracting Devwalls for security services (including penetration testing, red teaming, cloud security audits, digital investigations, advisory retainers), accessing our web platforms, or purchasing educational programs, you agree to these Terms. Specific technical parameters are governed by a mutually executed Statement of Work (SOW) and Rules of Engagement (ROE) document.
2. Authorization to Conduct Offensive Security Testing
Security testing involves controlled adversary emulation, simulated cyber attacks, and vulnerability exploitation. To ensure compliance with cybercrime legislation (including the Cybercrimes Prohibition Act of Nigeria and international CFAA equivalents):
Mandatory Authorization Warranty
The Client expressly warrants that it is the legitimate owner, licensee, or authorized controller of all hostnames, IP addresses, APIs, applications, cloud accounts, and physical premises specified in the applicable SOW.
Client grants Devwalls full authorization to conduct the testing activities outlined in the ROE during the agreed assessment window. If third-party cloud hosting providers (e.g. AWS, Microsoft Azure, Google Cloud) require notification, Client warrants it has submitted appropriate penetration testing notifications.
3. The Devwalls 90-Day Free Fix Retest Policy
We stand behind our work. Unlike firms that deliver a PDF report and walk away, every Devwalls penetration testing and cloud security engagement includes our verified 90-day fix retest guarantee at no additional charge.
- Scope of Retest: Retests apply to all identified findings (Critical, High, Medium, Low) documented in the original assessment report that Client developers have patched.
- Window: Client may invoke the retest at any point within 90 calendar days from delivery of the initial draft report.
- Verification Deliverable: Upon re-execution, Devwalls issues an updated Clean Bill of Health verification letter and attestation certificate detailing whether each fix successfully holds or requires further remediation.
- Exclusions: Major architectural rewrites or entirely new endpoints deployed after the initial testing window conclude represent new scope and are subject to separate scoping.
4. Strict Confidentiality and Mutual Non-Disclosure
Given the sensitive nature of security findings, Devwalls enforces rigorous confidentiality standards:
- Client Proprietary Data: Devwalls treats all Client architecture diagrams, credentials, source code snippets, vulnerability disclosures, and commercial information as Strictly Confidential.
- No Public Disclosure: Devwalls will never disclose findings, publish case studies, or use Client names or logos in marketing materials without explicit, written prior authorization from Client leadership.
- Data Segregation: Client testing artifacts reside in encrypted enclaves and are never used for training machine learning or AI models.
5. Intellectual Property Rights
Ownership of materials is structured cleanly across two categories:
Client Ownership
Upon full payment of assessment fees, Client retains 100% exclusive ownership of all custom deliverables, including executive summaries, technical reports, attestation letters, and specific configuration recommendations.
Devwalls Ownership
Devwalls retains all ownership and rights in pre-existing methodologies, proprietary testing scripts, internal red-team tooling, custom payload generators, and general technical trade secrets developed independently.
6. Limitation of Liability & Disclaimers
Offensive security testing carries inherent operational risks, such as potential service degradation or log flooding on fragile legacy endpoints. While Devwalls engineers take every professional precaution:
- Standard of Care: Devwalls performs all testing with the skill, diligence, and care standard among senior offensive cybersecurity professionals.
- No Guarantee of Zero Risk: Security testing evaluates an organization at a specific point in time. A successful assessment or Clean Bill of Health does not guarantee that a system is impervious to future zero-day attacks or novel threat actor techniques.
- Aggregate Liability Cap: To the maximum extent permitted by applicable law, neither party shall be liable for indirect, incidental, or consequential damages. Devwalls’ total aggregate liability arising out of any engagement shall not exceed the total fees paid by Client to Devwalls under the specific SOW giving rise to liability during the preceding twelve (12) months.
7. Fees, Invoicing, and Payment Terms
Assessment fees are scoped on a fixed-fee milestone basis or ongoing advisory retainer as specified in the SOW:
- Invoices are payable in Nigerian Naira (NGN), US Dollars (USD), or British Pounds (GBP).
- Standard commercial payment terms are net 15 or net 30 days unless specified otherwise.
- Work commences following contract execution and receipt of the agreed deposit or purchase order.
8. Governing Law and Dispute Resolution
These Terms and any dispute or claim arising out of or in connection with them shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria.
Any dispute that cannot be resolved amicably through good-faith executive escalation within thirty (30) days shall be submitted to binding arbitration in Abuja, Federal Capital Territory, Nigeria, conducted in English under the Arbitration and Mediation Act 2023.
Trust, Privacy, and Disclosure Inquiries
For contract inquiries, custom MSA amendments, or enterprise legal reviews: