Terms of Service

These Terms of Service govern access to and use of CyGhost websites, services, platforms, deliverables and professional engagements.

By using CyGhost services, requesting work, signing a proposal, accessing a CyGhost platform, or otherwise engaging CyGhost, you agree to these Terms unless a separate written agreement states otherwise.

If there is a conflict between these Terms and a signed agreement, the signed agreement takes priority.

CyGhost services may include:

• Penetration testing
• Vulnerability assessments
• Security audits
• Security consulting
• Secure software development
• IT infrastructure support
• Cloud security
• Microsoft 365 and identity security
• Security automation
• Incident support
• Compliance support
• SIEM, SOAR or monitoring solutions
• Cybersecurity platforms and dashboards
• AI-assisted security workflows

Specific services, scope, pricing, timing and deliverables may be defined in a proposal, statement of work, order form, subscription plan, or separate agreement.

Unless clearly stated otherwise, CyGhost services are intended for business and professional use.

You confirm that you have authority to act for the company or organisation you represent.

The customer is responsible for:

• Providing accurate information
• Giving timely access where needed
• Ensuring systems are properly backed up
• Obtaining internal approvals
• Ensuring legal authorisation for testing
• Reviewing and approving scope
• Protecting credentials
• Acting on security recommendations
• Maintaining its own compliance obligations
• Informing CyGhost of high-risk systems or special legal requirements

CyGhost is not responsible for delays, incomplete results or service limitations caused by missing information, restricted access, incorrect scope, third-party outages, or customer-side decisions.

For penetration testing, vulnerability assessments, red team work or any offensive security activity, the customer confirms that:

• It owns or is legally authorised to test the target systems
• The agreed scope is accurate and complete
• Testing does not violate third-party rights
• Required approvals have been obtained
• CyGhost is authorised to perform the agreed testing
• Emergency contacts will be available where needed

CyGhost may refuse, pause or stop testing if the scope is unclear, illegal, unsafe, or likely to harm third parties.

CyGhost will only test systems, applications, users, accounts, networks and assets included in the agreed scope.

Out-of-scope testing requires written approval.

If CyGhost discovers serious risk, active compromise, exposed sensitive data, or potential third-party impact, CyGhost may pause work and notify the customer.

Cybersecurity is constantly changing.

CyGhost provides services using professional skill, reasonable care and current security practices. However, CyGhost does not guarantee that:

• Every vulnerability will be found
• Every attack will be prevented
• A system is fully secure
• A platform is free from all defects
• A report guarantees compliance
• A customer will pass an audit
• Security controls will stop every threat

Security reports represent findings identified during the agreed scope, time period, access level and methodology.

Deliverables may include reports, dashboards, code, documentation, recommendations, screenshots, proof-of-concept evidence, configuration advice, roadmaps or other materials.

Unless otherwise agreed:

• Deliverables are for the customer’s internal business use
• Deliverables are confidential
• Deliverables may not be published publicly without CyGhost approval
• CyGhost may retain internal notes needed for legal, security, quality or business records
• Remediation work is not included unless agreed separately

If CyGhost provides access to a platform, dashboard, agent, API, portal or SaaS environment, the customer must:

• Keep accounts secure
• Use strong passwords and MFA where available
• Assign correct user permissions
• Remove inactive users
• Avoid uploading unnecessary personal data
• Avoid unlawful monitoring
• Configure log retention responsibly
• Use the platform only for authorised systems

CyGhost may update, improve, replace or remove platform features over time.

CyGhost may use AI-assisted features in current or future services, including alert summarisation, security recommendations, automation support, report drafting, risk scoring or workflow assistance.

AI-assisted output may be incomplete or inaccurate and must be reviewed by qualified personnel before relying on it for security, legal, compliance, financial or operational decisions.

CyGhost does not guarantee that AI-assisted output is error-free.

You must not use CyGhost services to:

• Attack systems without authorisation
• Distribute malware
• Perform unlawful surveillance
• Steal credentials
• Exfiltrate data unlawfully
• Send spam or phishing
• Abuse, overload or disrupt CyGhost infrastructure
• Reverse engineer CyGhost software unless legally allowed
• Bypass access controls
• Violate intellectual property rights
• Break applicable law

CyGhost may suspend or terminate access if misuse is suspected.

The customer retains ownership of customer data.

CyGhost may process customer data only to:

• Provide the service
• Maintain security
• Troubleshoot issues
• Improve reliability
• Comply with law
• Follow customer instructions
• Enforce agreements

Customer data is handled according to the Privacy Policy and, where applicable, a Data Processing Agreement.

Where CyGhost processes personal data on behalf of a customer, the parties should enter into a Data Processing Agreement.

If no separate DPA is signed, the customer remains responsible for ensuring that the use of CyGhost services is lawful and properly documented.

Both parties must protect confidential information received from the other party.

Confidential information includes:

• Security findings
• Vulnerabilities
• Technical reports
• Credentials
• Source code
• Architecture information
• Business plans
• Customer data
• Pricing and commercial terms
• Non-public communications

Confidentiality obligations continue after the end of the service.

CyGhost retains ownership of its:

• Brand
• Website
• Software
• Tools
• Templates
• Methodologies
• Scripts
• Internal know-how
• Documentation frameworks
• Pre-existing intellectual property

The customer retains ownership of its systems, data and pre-existing intellectual property.

Unless otherwise agreed, CyGhost grants the customer a limited, non-exclusive, non-transferable right to use the final deliverables for internal business purposes.

CyGhost may use open-source or third-party tools as part of service delivery.

Third-party tools may be subject to their own licences and terms.

CyGhost is not responsible for third-party services, platforms, outages, licence changes, vulnerabilities, pricing changes or discontinued features.

Fees, payment terms and invoicing details are defined in the proposal, order form, subscription plan, invoice or agreement.

Unless otherwise stated:

• Prices are exclusive of VAT and taxes
• Invoices are payable by the due date stated on the invoice
• Late payment may result in suspension of work
• Expenses must be agreed in advance where applicable
• Work outside the agreed scope may be billed separately

Any work outside the agreed scope may require a new quote, change request or written approval.

CyGhost is not required to perform additional work without agreement on scope, timing and price.

CyGhost aims to provide reliable services.

However, services may be unavailable due to:

• Maintenance
• Updates
• Security actions
• Third-party provider issues
• Internet outages
• Force majeure
• Misconfiguration
• Customer-side problems
• Emergency incident response

Any uptime commitment must be agreed in a separate SLA.

CyGhost maintains internal incident response procedures.

If CyGhost becomes aware of a security incident affecting customer data, CyGhost will assess the incident and notify affected customers where required by law or contract.

Customers are responsible for their own incident reporting obligations unless otherwise agreed.

CyGhost may suspend services if:

• Payment is overdue
• Use is unlawful
• Use creates security risk
• Customer systems endanger CyGhost infrastructure
• Required authorisation is missing
• The customer breaches these Terms
• A third-party provider requires suspension

CyGhost will try to provide notice where reasonable, unless urgent action is needed.

Either party may terminate services according to the applicable agreement.

Upon termination:

• Customer access may be disabled
• Outstanding invoices remain payable
• Confidentiality obligations continue
• Certain records may be retained for legal, tax, security or dispute purposes
• Customer data return or deletion may be handled according to the agreement or DPA

CyGhost provides services with reasonable professional care and skill.

Except as expressly stated in writing, services and deliverables are provided without warranties of any kind, whether express, implied or statutory.

To the maximum extent permitted by applicable law, CyGhost is not liable for:

• Indirect damages
• Consequential damages
• Loss of profit
• Loss of revenue
• Business interruption
• Loss of goodwill
• Loss of data
• Reputational damage
• Third-party outages
• Customer-side security failures
• Decisions made based on reports or AI-assisted output without proper review

Unless otherwise agreed in writing, CyGhost’s total liability for any claim is limited to the fees paid by the customer for the specific service giving rise to the claim during the three months before the event causing the claim.

Nothing in these Terms excludes liability where exclusion is not allowed by law.

The customer agrees to defend and indemnify CyGhost against claims, damages, fines, losses or costs arising from:

• Unauthorised testing requested by the customer
• Incorrect scope information
• Illegal use of services
• Customer breach of these Terms
• Customer data submitted unlawfully
• Third-party claims caused by customer instructions

CyGhost may provide guidance related to GDPR, NIS2, security policies, risk management, technical controls or compliance readiness.

Such support is not legal advice unless provided by a qualified legal professional under a separate legal engagement.

The customer remains responsible for its own legal and regulatory compliance.

CyGhost may not publicly disclose confidential security findings.

CyGhost may use the customer’s name or logo as a business reference only with permission, unless otherwise agreed.

CyGhost is not liable for delays or failure caused by events outside reasonable control, including internet failures, cloud provider outages, war, strikes, natural disasters, government action, cyberattacks, power failures or force majeure events.

These Terms are governed by Belgian law.

Unless mandatory law requires otherwise, disputes are subject to the competent courts of Belgium.

CyGhost may update these Terms from time to time.

The latest version will be published on this page.

For active contracts, material changes will not override signed agreements unless agreed.

For legal questions: