Terms of service

The terms our security tests are performed under. Business customers (B2B) unless agreed otherwise. Version of 2 September 2026.

1. Scope

These terms apply to all services provided by Polaris1 (“we”, “us”) to its clients. Deviating terms from the client apply only if we accept them in writing.

2. Services

We test the client’s systems from outside for security weaknesses and report the findings in writing. A run delivers two documents: a summary without reproduction steps or raw evidence, and a technical report containing both.

We owe a diligent examination, not a guarantee that a system is free of vulnerabilities. No security test can prove the absence of all weaknesses. A finding is reported only after it has been reproduced; what cannot be reproduced is not reported, and its absence from the report is not a statement that it does not exist.

3. Authorisation and scope of testing

Testing begins only after the client has proven ownership of the target — by a DNS TXT record that two independent resolvers must both see — and has warranted that they are entitled to authorise testing of the listed systems, including where those systems are operated by a third party. Nothing outside the confirmed scope is touched.

Before a run starts, the client is shown what it will do: the target, whether subdomains are included, the request rate, the HTTP methods used, the paths excluded, and the fixed source addresses our traffic comes from.

Testing is non-destructive. We send only GET, HEAD, OPTIONS and POST requests and do not write, delete or modify data. Load tests, denial-of-service attempts, social engineering and write operations require separate written agreement. The client can stop a running test at any moment; it ends within seconds.

4. Client’s obligations

• Provide accurate scope information and a technical contact.
• Take a current backup before the testing window.
• Inform their own hosting provider where their contract requires it.
• Add our source addresses to their monitoring allowlist, so our traffic is not mistaken for an attack — and so a real attack during the window is not mistaken for us.

5. Confidentiality

Both parties keep all information received confidential for an unlimited period. Findings are delivered to the client alone. We name no client and reference no engagement in public without the client’s written permission.

Our own staff cannot read a client’s findings unless the client grants access, with a reason recorded; the grant is revocable at any time and every access is written to the audit log.

6. Handling of data encountered

Where a test makes personal data reachable, we document that it was reachable. We do not extract, copy or retain it. Secrets are redacted before storage: we keep what proves a finding, not the records it was found in.

Evidence is encrypted with a key bound to the client’s organisation and is deleted after 30 days. Data is stored on servers inside the EU; the processors outside it are named in our privacy policy. Where required, the parties conclude a processing agreement under Art 28 GDPR.

7. Prices and payment

Prices are end prices and include value added tax where it applies. The price of a single test is shown before the run starts and does not change afterwards.

There are two ways to pay, depending on how the engagement came about:

• Self-service. A run and its severity counts are free. Unlocking the findings is paid immediately by card through our payment provider. There is no subscription and no minimum term.
• By offer. For engagements agreed in writing, invoices are due within 14 days without deduction.

“Nothing serious, no invoice.” If a run proves no finding rated High or Critical, no fee is charged and the client still receives the written result. A run that cost nothing carries no re-test, because there is nothing to verify.

The re-test. Each paid run includes one free re-test within 14 days — not one per finding. The client marks what they fixed and starts it once; it checks all of them together.

8. Deadlines

A self-service run starts when the client starts it and both reports are available when it ends. For engagements agreed in writing, reporting dates are agreed per engagement. Delays caused by missing information or access on the client’s side extend them accordingly.

9. Liability

We are liable without limitation for intent and gross negligence, and for damage to life, body or health.

For slight negligence we are liable only for the breach of material contractual duties — duties whose fulfilment makes the proper performance of the contract possible in the first place and on which the client may regularly rely — and in that case limited to ten times the order value of the engagement concerned.

Liability for indirect damage, loss of profit and loss of data is excluded to the extent legally permitted. Claims lapse twelve months after the service was rendered; this shortening does not apply to intent, gross negligence, or damage to life, body or health.

Mandatory liability under the Austrian Product Liability Act remains unaffected.

10. Term and termination

Each test is a self-contained engagement. It ends when the reports are delivered — there is nothing to terminate and nothing that renews. The client’s account can be closed at any time; findings and reports are deleted with it.

We may refuse or stop a run where the authorisation under section 3 is doubtful, where a target was not proven, or where continuing would breach the law.

11. Governing law and venue

Austrian law applies, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. Venue is determined by the statutory rules.

12. Severability

If a provision is or becomes invalid, the remaining provisions stay in force. The invalid provision is replaced by one that comes closest to its economic intent.

Version of 2 September 2026. Earlier versions are available on request.