Engagement and indemnification for automated security testing

This document describes the (additional) terms and indemnification arrangements for the automated security testing engagement, with reference number [NUMBER], that the parties wish to agree upon.

The engagement described in this document (and any documents that refer to and/or incorporate this document), as well as the agreement to that effect, is formed upon mutual written acceptance or signing of this document, the payment by Client of the amounts described in this document, and the subsequent automated or non-automated (order) confirmation by Cruxa.

1. Scope of the testing

1.1 In-scope objects

Only the systems, applications, and network components explicitly designated by Client fall within the scope of the automated penetration testing service.

Category	Specification
Domains	e.g. example.nl, example.com
Subdomains	e.g. portal.example.nl, api.example.nl
Web applications	e.g. customer portal, CMS
API endpoints	e.g. api.example.nl/v1/

All other systems, applications, network components, and environments are deemed to fall outside the scope and will not be approached by automated scans, unless they are subsequently explicitly added by Client.

1.2 Declaration of ownership

Client declares that it is the rightful owner or holder of the above objects, or is authorized to grant third parties permission to perform security testing activities on these objects.

1.3 Declaration of establishment

Client declares that it is not established in the United States or Canada, that no law of the United States or Canada applies to this engagement, and that disputes will not be submitted to any court in the United States or Canada. If this declaration proves to be incorrect, Cruxa is entitled to terminate the engagement with immediate effect without being liable for any compensation; work already performed will not be credited.

2. Testing period

The engagement commences at the moment Cruxa has confirmed receipt of payment for the scan (the “Start Date”) and ends upon delivery of the final report, but no later than 14 days after the Start Date (the “End Date”). Within this period Cruxa performs the scan and may re-verify findings. Testing activities are performed in an automated manner and are not restricted by days or times. The load on Client's systems is low and non-disruptive; Denial-of-Service and the disruption of business processes are excluded at all times.

3. Nature of the service

3.1 AI-driven security testing

Client acknowledges that Cruxa's service makes use of AI-driven tooling and automation to perform security scans and penetration tests. AI functionalities are deployed under remote human supervision, whereby the operator monitors the execution and can intervene at any time, while individual testing actions are performed autonomously by the AI (‘human-on-the-loop’ supervision), unless otherwise agreed. The application of LLMs takes place under a data processing agreement, whereby personal data in scan results is minimized through technical redaction before it reaches external models; complete elimination is not guaranteed thereby. Raw scan data is automatically deleted after a maximum of 3 months in accordance with the data processing agreement. See the privacy statement and data processing agreement for further information.

To the extent technically possible and applicable, the service may include, among other things:

• Automated reconnaissance and mapping of the external attack surface (subdomains, endpoints, and exposed services).
• Automated vulnerability scans on all in-scope systems, applications, and endpoints.
• Detection of known vulnerabilities, misconfigurations, and exposed services.
• Authentication, authorization, and rate limiting tests where technically possible.
• Active, non-destructive verification (exploitation) of identified vulnerabilities to demonstrate actual impact, solely for evidentiary purposes and without deleting or modifying existing data.
• AI-assisted analysis, classification, and prioritization of security findings.
• Automated validation, reproduction, and correlation of scan results, including the combination of individual findings into an attack chain with higher impact.
• Analysis of configurations, headers, certificates, and software components in use.
• Automated reporting, including technical evidence, screenshots, reproduction steps, and concrete remediation advice (code fixes) for mitigation.

3.2 Permitted techniques

In order to comply with the requirements of the Dutch Criminal Code and Civil Code, Client acknowledges that Cruxa uses, among others, the following techniques, and that Client has no objection to the use of these by Cruxa.

Permitted by default:

Unless otherwise agreed in writing, the following techniques may, among others, be applied in the context of regular security testing:

• Technical actions, false signals, keys, or identities to gain access to the automated systems.
• Copying and storing data found on the automated systems, solely for reporting and validation purposes.
• Use of a public telecommunications infrastructure or system to use the computing capacity of Client's automated systems.
• Recording, transferring, or — solely to the extent strictly necessary to demonstrate a vulnerability — temporarily modifying or adding data found on Client's automated systems, without damaging, deleting, or permanently altering existing data.
• Recording logging and testing information necessary for reporting and validation of findings.
• Analysis of configurations, headers, certificates, and software components in use.
• Automated reconnaissance and mapping of the external attack surface.
• Automated subdomain enumeration via public certificate transparency logs and passive sources.
• Detection of subdomain takeover and exploitable DNS misconfigurations (dangling records).
• DNS analysis, including reading public DNS records (including SPF) for the purpose of attack surface and infrastructure reconnaissance.
• Detection of known TLS/SSL-related vulnerabilities and outdated protocol versions where relevant for exploitation.
• HTTP header analysis (security headers, CORS configuration, CSP).
• Analysis of publicly accessible JavaScript bundles on exposed endpoints and secrets.
• Detection of known vulnerabilities based on identified software components and versions (CVE matching).
• Automated authentication tests, including session and token management.
• Automated authorization tests (horizontal and vertical privilege escalation / IDOR).
• Injection tests (SQL, XSS, SSRF, GraphQL) — solely on in-scope endpoints.
• Business logic tests at the transaction and workflow layer.
• Non-destructive exploitation (proof-of-concept) of confirmed vulnerabilities to substantiate the actual impact.

3.3 Prohibited techniques

During the security testing, procedures and mechanisms may be used that can temporarily affect overall system security. Unless expressly agreed otherwise in writing, the following techniques are not permitted:

• Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) attacks.
• Intentional damage, destruction, or rendering inaccessible of systems or data.
• Deliberately disrupting business processes or production environments.
• Processing or exfiltrating data beyond what is necessary for the execution of the service.
• Social engineering, phishing, or other forms of human-targeted attacks.
• Physical security testing.
• Installing persistent access, backdoors, or malware on Client's systems.
• Lateral movement to systems outside the agreed scope.
• Mass brute-force or credential stuffing at scale (where accounts are locked or production traffic is disrupted).
• Taking over accounts whereby existing users are locked out.
• Permanently modifying or deleting production data — write operations are permitted solely to the extent strictly necessary to demonstrate a vulnerability, and are reversed immediately where possible.
• Exfiltrating or storing personal data of end users beyond what is necessary for evidentiary purposes.
• Modifying configurations, secrets, or access rights of Client's systems.
• Attacks on third-party systems that serve as infrastructure for in-scope objects but are not themselves in scope (e.g. CDN providers, DNS registrars, hosting parties).
• Actually taking over or claiming third-party-hosted resources upon a detected subdomain takeover; detection and signaling take place, but the dangling resource is not claimed by Cruxa.
• Erasing, manipulating, or disabling log files, security measures, or detection mechanisms (anti-forensics or defense evasion).
• Sending unsolicited messages (email, SMS, push notifications) to actual end users of Client, or otherwise involving end users in the testing activities.

4. Indemnification, liability, and third parties

Client guarantees that all third parties who may experience nuisance, inconvenience, or damage as a result of the security testing, including but not limited to IT suppliers, customers, and cooperation partners, have been by Client:

• Informed about the nature of the investigation
• Informed about the period in which the investigation takes place
• Informed about the manner in which the investigation is performed
• In agreement with the execution of the investigation insofar as it may affect their systems, services, or interests

Client fully indemnifies Cruxa against all claims, damages, costs, and consequences arising from the failure to comply, or incomplete compliance, with the above guarantee.

Client declares that it indemnifies and holds harmless Cruxa, its employees, and undertakings affiliated with Cruxa for:

• Any damage, claims, demands, or liabilities
• Material or immaterial damage
• Consequential or indirect damage

That may arise from or relate to the execution of the security testing activities, insofar as these fall within the scope and conditions of the agreement.

The indemnification does not apply in the event of:

• Gross negligence of Cruxa
• Recklessness of Cruxa
• Intentional unlawful conduct by Cruxa
• Acting outside the agreed scope without consent

In all cases, Cruxa's liability is limited to the amount paid out by Cruxa's professional liability insurance, or, if no payout is made, to a maximum of the invoice amount of the relevant engagement.

5. Confidentiality

The parties undertake to maintain strict confidentiality of all confidential information they receive from each other in the context of this declaration. Confidential information includes in any case:

• All information about vulnerabilities, security risks, and findings from the security testing
• Technical documentation and configuration data
• Reports, log files, and evidence
• Business-sensitive information, including customer and personnel data
• All other information designated as confidential or whose confidential nature should reasonably be understood

Confidential information is used solely for the purpose for which it was provided and is not disclosed to third parties, unless disclosure is required by law or regulation, a court ruling, or an order of a competent authority; or the information was demonstrably already publicly known or becomes so without any action by Cruxa.

The confidentiality obligation remains in effect during the term of the agreement and for a period of 1 year after its termination, unless the nature of the information justifies a longer period.

6. Operational arrangements

Client and Cruxa adhere to the following operational arrangements:

• Cruxa informs the contact persons of Client throughout the engagement. There is at least one contact between Cruxa and the designated contact person of Client. In the event of critical findings, the operator of Cruxa contacts the designated contact person manually as soon as possible.
• Client ensures reasonable availability of its designated contact person during the testing period, and guarantees that critical notifications from Cruxa can be acted upon by the contact person (or their replacement) within [24] hours.
• Client refrains from actions that may disrupt the scan, such as blocking Cruxa's IP addresses, modifying WAF rules, or resetting test accounts created by Cruxa, unless agreed in consultation.
• If it is necessary for Cruxa to be whitelisted in Client's firewall or WAF configurations, this is clearly stated by Client prior to the start of the engagement, and Client bears responsibility for this.
• Cruxa keeps a log of testing activities. Upon completion of the operational activities, an overview of the testing activities is delivered with the final report; interim access is possible on request. Reports contain evidence (anonymized where necessary) to substantiate findings.
• In the event of unforeseen problems or incidents, Cruxa immediately contacts the contact person listed below and ceases all testing activities.
• Client is responsible for making and maintaining adequate back-ups prior to the execution of the testing activities.
• Client may have the scan stopped at any time by sending a message to [email protected], stating the reference of this engagement. Cruxa ceases the testing activities as soon as reasonably technically possible after receipt of this request. Amounts already paid are not refunded.
• Changes to the scope during an ongoing scan are not possible without written agreement.
• A report of the engagement is available for seven (7) days after the end of the agreed testing period via a download link (maximum 5 downloads). Client is responsible for saving the report in a timely manner.
• The parties do not publish findings from the security testing without the prior written consent of the other party.
• If Cruxa encounters findings that affect third-party systems outside the scope, Cruxa informs the client immediately. Further steps are determined in consultation.

7. Costs

The costs for the engagement amount to EUR 300, which are invoiced prior to the engagement.

8. Additional terms

• In the event of any conflict between the documents that together form the agreement, the following order of precedence applies: (1) this engagement and indemnification statement, (2) the data processing agreement, (3) the terms and conditions. The data processing agreement nevertheless prevails insofar as it concerns the processing of personal data.
• This engagement is governed exclusively by Dutch law. Disputes are submitted to the competent court in the district where Cruxa is established.
• This choice of law and forum is exclusive and mandatory. Any purchasing, general, or other terms and conditions of Client that designate a different applicable law or a different competent court — in particular the law or a court of the United States or Canada — are hereby expressly rejected and do not apply.
• All amounts stated are exclusive of VAT and other government levies.
• Payments are due immediately during/after the formation of the engagement.
• Execution of this engagement commences immediately after its formation, and the costs associated with this engagement cannot be refunded, not even if the operational execution of this engagement is paused or stopped at Client's request during the agreed testing period.

9. Signing