No High or Critical finding?
You don't pay for the audit.

04 / Terms

No High or Critical Finding Guarantee: terms and conditions

These terms apply to the “No High or Critical Finding Guarantee” (the “Guarantee”) offered by Hackstack Security (“we”, “us”). They supplement, and do not replace, the engagement agreement and statement of work (“SOW”) signed by you (the “Client”). If these terms conflict with a signed SOW, the SOW prevails.

1. What the Guarantee provides

If an Eligible Engagement is completed and the final report does not contain at least one Qualifying Finding, Hackstack Security will not charge the professional fee for that engagement. If the fee has already been paid, Hackstack Security will refund it within thirty (30) days of issuing the final report. The Guarantee is the Client’s sole remedy relating to the absence of Qualifying Findings.

2. Eligible Engagements

The Guarantee applies only to the following engagements, and only where the SOW expressly states that the Guarantee applies:

• Web Application Security Testing
• API Security Testing
• Mobile Application Security Testing
• Infrastructure VAPT
• Cloud Security Review
• AI & LLM Security Testing

It does not apply to red team or attack simulation exercises, AI red teaming, retests, compliance and gap assessments, architecture or code reviews, threat intelligence, incident readiness, PSIRT, advisory, or any other consulting service, unless the SOW states otherwise in writing.

3. Qualifying Findings and severity

• A “Qualifying Finding” is a vulnerability within the agreed scope that is reproducible, supported by evidence in the final report, and rated High or Critical.
• Unless the SOW specifies another methodology, severity is based on the CVSS v3.1 base score (High: 7.0–8.9; Critical: 9.0–10.0), which may be adjusted for documented environmental context. The CVSS vector for each finding is included in the report.
• A finding counts as a Qualifying Finding whether or not the Client chooses to remediate or accept the risk, and regardless of whether the Client was previously aware of it, unless it was disclosed to Hackstack Security in writing before testing began.
• Informational, Low, and Medium findings are not Qualifying Findings.

4. Conditions

The Guarantee applies only if all of the following are met:

• Testing is performed against the full agreed scope for the full agreed test window.
• The Client provides, on time, the access, credentials, test accounts, test data, environments, and points of contact defined in the SOW.
• After kickoff, the Client does not restrict agreed testing, for example by blocking Hackstack Security source addresses, disabling test accounts, narrowing scope, or changing security controls specifically to obstruct testing, without Hackstack Security’s written agreement.
• The in-scope systems are not materially replaced, redeployed, or taken offline during the test window without Hackstack Security’s agreement.
• The same target has not been assessed by Hackstack Security under the Guarantee in the preceding twelve (12) months. The Guarantee applies once per target per twelve-month period.
• The Client’s account is not overdue for any other Hackstack Security invoice.

If a condition is not met, Hackstack Security will notify the Client in writing, and the Guarantee will not apply to that engagement.

5. Amounts that remain payable

The Guarantee covers the professional fee for the Eligible Engagement only. The following remain payable: pre-agreed travel and expenses; third-party tools, licences, or infrastructure procured at the Client’s request; AI model or cloud usage incurred at the Client’s request; and any services outside the Eligible Engagement, including retests, additional scope, or consulting.

6. Disputes about severity

If the Client disagrees with a severity rating, the Client must notify Hackstack Security in writing within fourteen (14) days of receiving the final report. Both parties will review the evidence in good faith. If the disagreement is not resolved within fourteen (14) days, the rating is determined by the documented CVSS vector and the agreed methodology.

7. No warranty of security

Security testing is time-bound and scope-limited. The Guarantee does not warrant that the in-scope systems are secure, that all vulnerabilities have been identified, or that systems will remain free of vulnerabilities after testing.

8. Changes and withdrawal

Hackstack Security may change or withdraw the Guarantee for future engagements at any time by updating this page. Changes do not affect SOWs signed before the change. Effective date: September 28, 2026.

Questions

Email info@hackstacksecure.com before signing your SOW if you would like any part of the Guarantee clarified.