Terms and Conditions

1. Definitions

1. Cruxa: the sole proprietorship providing the Service, operating under the name Cruxa, registered in the Netherlands and listed in the Dutch Commercial Register (Chamber of Commerce) under number 42044115.
2. Client: the legal entity or the natural person acting in the exercise of a profession or business who requests and confirms a Scan via the onboarding process. The Service is intended exclusively for business customers; Cruxa does not contract with consumers.
3. Service: the automated security scan as described in article 2.
4. Scan: the automated testing of Client's selected domains for security vulnerabilities.
5. Report: the document containing Scan results, including identified vulnerabilities, evidence, and remediation advice.
6. Scope: the domains and subdomains selected and confirmed by Client to be tested.
7. AI agents: the automated software processes that execute the Scan.

2. Description of the Service

1. Cruxa performs automated security scans on web applications and associated infrastructure of Client. The Scan is executed by AI agents that actively probe for security vulnerabilities.
2. The Scan includes but is not limited to: attack surface reconnaissance, authentication and authorization testing, injection testing (SQL, XSS, SSRF), business logic testing, and configuration analysis.
3. The Scan is minimally invasive: Cruxa performs limited write operations solely to verify vulnerabilities, but does not delete or modify existing data of Client. Test data created during the Scan (such as test accounts or test orders) is to be removed by Client.
4. The Report contains only confirmed vulnerabilities with reproducible evidence. Each finding is independently verified by the system before inclusion in the Report.

3. Formation of the agreement

1. The agreement is formed when Client checks the four consent statements on the confirmation page, clicks "Confirm and proceed to payment", and successfully completes payment via Stripe. The Scan starts as soon as payment is completed.
2. By confirming, Client declares that:
   1. the provided company and contact details are accurate;
   2. they are authorized by their organization to grant consent;
   3. they own or are authorized for the selected domains;
   4. they agree to these Terms and Conditions, the Data Processing Agreement, and the Indemnification Statement.
3. Domain verification via email provides additional proof of ownership but does not relieve Client of the responsibility under paragraph 2.
4. Client's confirmation constitutes authorization for the execution of security tests (Letter of Authorization). Cruxa records for each Scan the identity of the confirming person, the time of confirmation, the selected Scope, and the IP address. This record serves as proof of authorization within the meaning of Article 138ab of the Dutch Criminal Code.

4. Execution of the Service

1. Cruxa starts the Scan within 24 hours of Client's confirmation, unless otherwise agreed. The Scan is typically completed within 48 hours of commencement. Cruxa will inform Client of any delays.
2. Cruxa performs the Scan exclusively within the Scope approved by Client.
3. Cruxa endeavors to perform the Scan carefully and professionally but does not guarantee that all vulnerabilities will be found. The Scan is a point-in-time assessment.
4. Client receives the Report via email upon completion of the Scan.
5. Client may cancel the Scan at any time by emailing [email protected]. Cruxa will stop the Scan as soon as technically possible. Work already performed is not refundable.
6. Cruxa is entitled to engage third parties in the execution of the Service, including cloud infrastructure and sub-processors. Such third parties are bound by the same confidentiality and due care obligations as Cruxa.
7. If Client requests changes to the Scope after confirmation of the Scan, the parties will consult on the consequences for planning and costs. Cruxa is entitled to charge additional costs for scope changes.
8. Complaints regarding the execution of the Service or the Report must be reported to Cruxa in writing and with reasons within 14 days of delivery of the Report. After this period has expired, the Service is deemed to have been accepted.

5. Client obligations

1. Client guarantees they are authorized to grant consent for the Scan on all selected domains. Client fully indemnifies Cruxa against all claims, damages, and costs arising from the absence of such authorization.
2. Client informs Cruxa prior to the Scan of any special circumstances relevant to the execution, including but not limited to: production environments with high availability requirements, third-party systems, or ongoing certification processes.
3. Client is responsible for implementing the measures recommended in the Report. Cruxa is not liable for damage resulting from the failure to act on recommendations.

6. Confidentiality

1. Cruxa treats all information obtained during the Scan as strictly confidential. This includes the Report, identified vulnerabilities, technical details, and any data encountered.
2. Cruxa does not share information about the Scan or the Report with third parties, unless:
   1. Client provides written consent;
   2. Cruxa is legally required to do so.
3. Client treats the Report as confidential and shares it only with persons within their organization who need it to remediate the identified vulnerabilities.
4. The confidentiality obligations remain in effect for the duration of the agreement and for a period of 1 year after completion of the Scan.

7. Intellectual property

1. The Report becomes the property of Client upon full payment. Cruxa retains the right to use anonymized, non-traceable statistical data for improvement of the Service.
2. The methodology, tooling, AI agents, and software of Cruxa remain the full property of Cruxa.

8. Pricing and payment

1. The price of the Scan is communicated prior to confirmation. All prices exclude VAT unless stated otherwise.
2. For digital formation via cruxa.io, payment is made in advance via Stripe and the Scan starts after successful payment. For a manually agreed engagement, payment is due within 30 days of the invoice date, unless otherwise agreed in writing.
3. Late payment incurs statutory commercial interest as applicable under Dutch law, as well as all reasonable extrajudicial collection costs.
4. Cruxa is entitled to suspend delivery of the Report for as long as Client has not fulfilled their payment obligations.

9. Liability

1. Cruxa's total liability is limited to the amount paid out by Cruxa's professional liability insurance, or, if no payout is made, to a maximum of the invoice amount of the relevant Scan.
2. Cruxa is not liable for:
   1. indirect damages, consequential damages, lost profits, missed savings, or damages due to business interruption;
   2. damages caused by Client providing incorrect or incomplete information;
   3. damages resulting from failure to act on recommendations in the Report;
   4. damages to third-party systems that Client included in the Scope without their consent;
   5. security incidents occurring after delivery of the Report.
3. The liability limitation does not apply in cases of intent or deliberate recklessness by Cruxa.

10. Force majeure

1. Cruxa is not required to fulfill any obligation if prevented by force majeure. Force majeure includes but is not limited to: internet connection failures, DDoS attacks on Cruxa's or Client's systems, and government measures.
2. If force majeure persists for more than 30 days, both parties have the right to terminate the agreement without compensation.

11. Duration and termination

1. The agreement is entered into per Scan and ends upon delivery of the Report and full payment.
2. Client may cancel the Scan in accordance with article 4, paragraph 5.
3. Cruxa may terminate the agreement with immediate effect if:
   1. Client has provided false information regarding authorization or ownership;
   2. the target domain contains third-party systems for which no consent exists;
   3. continued scanning poses a legal or ethical risk.

12. Privacy and data processing

1. Cruxa processes personal data in accordance with the General Data Protection Regulation (GDPR).
2. The processing of personal data in the context of the Scan is set out in the Data Processing Agreement, which forms an integral part of these Terms and Conditions.
3. Client data is never used to train AI models.
4. Scan data, including logs, raw results, and any data encountered, is automatically deleted 3 months after delivery of the Report. The Report itself is automatically deleted 12 months after delivery, in accordance with the Data Processing Agreement. Client is responsible for storing the Report in a timely and secure manner.
5. If Cruxa encounters personal data of third parties during the Scan, Cruxa will notify Client without delay. Client, as data controller, is responsible for assessing whether a notification to the supervisory authority is required. Cruxa will provide reasonable cooperation.

13. Responsible disclosure and notification

1. If Cruxa discovers vulnerabilities in third-party software during the Scan (such as open-source components or external plugins), Cruxa reserves the right to responsibly disclose these to the relevant software vendor in accordance with the Coordinated Vulnerability Disclosure (CVD) policy, without revealing any Client data.
2. If Cruxa finds evidence of active exploitation by third parties or an ongoing data breach, Cruxa will notify Client without delay so that Client can take appropriate action.

14. Transfer

1. Neither party may transfer rights or obligations under this agreement to third parties without the prior written consent of the other party.

15. Governing law and disputes

1. These Terms and Conditions and all agreements between Cruxa and Client are exclusively governed by Dutch law.
2. Disputes are first resolved through mutual consultation. If unsuccessful, disputes are submitted to the competent court in the district where Cruxa is registered.

16. Amendments

1. Cruxa reserves the right to amend these Terms and Conditions. The version in effect at the time of Client's confirmation remains applicable to that specific agreement.
2. The current version is always available at cruxa.io/terms.