Terms of Service | Velqor Stack

1. Who we are and what these terms cover

These Terms of Service (“Terms”) govern your use of the website at velqorstack.com (the “Site”), the Velqor Stack platform (the “Platform”) and the security testing services described in Section 3 (together, the “Services”). The Services are provided by Velqor Stack LLC, a Montana limited liability company (Montana Secretary of State file no. 17386114) with its mailing address at 145 W Broadway, Long Beach, CA 90802-4413, USA (“Velqor Stack”, “we”, “us”).

By creating an account, submitting an assessment request, paying for a scan or using the Platform, you (“Client”, “you”) agree to these Terms on your own behalf and on behalf of the organisation you represent. If you do not agree, do not use the Services.

2. Definitions

Target means the application, API, repository, host, network range or other system you ask us to test, as identified in the Scope.
Scope means the written description of what will be tested, how, and when, agreed before any testing starts. The Scope includes any exclusions.
Scan means one unit of testing of one Target at the service level and price shown on the Pricing page at the time of order.
Findings means the vulnerabilities, misconfigurations and observations we identify, with their severity ratings and evidence.
Report means the document delivered after a Scan containing the Findings, their evidence and fix guidance.
Retest means a repeat of agreed checks after you have applied fixes, to confirm whether a Finding still reproduces.
Statement of Testing means the document we issue after a Retest that records the Scope, dates and the Findings still open.
Badge means the “Tested by Velqor Stack” image and link we may supply for display on your website.

3. The Services

We provide security testing and related services, including:

Code analysis – static review of source code, dependency and secret scanning.
Web application testing – vulnerability testing of web pages and web applications.
API testing – endpoint discovery and vulnerability testing of APIs.
Server scans – infrastructure, configuration and exposure scanning of hosts.
Reports and consultation – written Reports and walk-throughs of Findings.
Vulnerability and patch management – tracked remediation and Retests, where ordered as an ongoing service.
Quantum programming and post-quantum security services, where separately agreed.

Each service is described, with its starting price and what is included and excluded, on the Site. The description on the Site at the time you order, together with the agreed Scope, defines what we will deliver.

4. Authorisation to test

Security testing involves sending requests and payloads to systems that, without permission, could be unlawful. Therefore:

You represent and warrant that you own each Target, or that you have the written authority of the owner to have it tested, and that you have obtained any consent required from hosting providers, cloud platforms or third parties whose terms apply to the Target.
Before any Scan starts, you will confirm the Scope in writing and complete our ownership confirmation process. We will not test a Target until this is done, and we may refuse or stop testing at any time if we reasonably believe authorisation is missing or incomplete.
You are responsible for informing anyone who needs to know that testing is taking place, including your hosting provider, internal security team and any monitoring or incident-response provider.
Testing is limited to the Scope. We will not attempt to access systems, data or accounts outside the Scope. If we encounter anything outside the Scope we will stop and notify you.
You must not use the Platform or any Report to test, attack or gain access to systems you are not authorised to test.

5. Ordering and Scope

You request a Scan through the Site or by contacting us. We reply with a proposed Scope, price and timing.
A contract for a Scan is formed when you accept the Scope in writing (including by email or by completing checkout) and we confirm the order. Until then, either party may withdraw.
Changes to the Scope after confirmation require written agreement and may change the price and timing.
Turnaround times stated on the Site or in a Scope are estimates. They depend on timely access and information from you.

6. Pricing

Prices are shown on the Pricing page in United States dollars (USD) per Scan and are starting prices for one Target at the stated service level. The price for your order is the price confirmed in the Scope.
Prices exclude sales tax, VAT, GST or similar taxes. Where we are required to collect tax, it will be added at checkout or on the invoice.
Ongoing services (for example patch management or scheduled Retests) are billed at the recurring price and interval stated in the Scope, in advance, until cancelled under Section 8.
We may change the prices on the Site at any time. Changes do not affect orders already confirmed.

7. Payment

Payments are processed by Stripe, Inc. (“Stripe”). By paying, you also agree to Stripe’s terms and privacy policy. We do not receive or store your full card number; Stripe does.
Unless the Scope says otherwise, payment for a Scan is due in full at order confirmation and before testing starts. Invoices for ongoing services are due within 14 days of the invoice date.
If a recurring payment fails, we will notify you and retry. If payment is not received within 10 days we may suspend the ongoing service until paid.
You are responsible for any bank or currency-conversion charges applied by your payment provider.
Chargebacks: if you believe a charge is wrong, please contact us first at billing@velqorstack.com. We will respond within 5 business days.

8. Refunds and cancellation

Our full Refund and Cancellation Policy forms part of these Terms. In summary:

Scans (one-time purchases)

Before testing starts: you may cancel for a full refund, provided the ownership confirmation and Scope have not yet been completed and no work has begun.
After testing starts: fees are non-refundable, because the work has been performed, except as set out in paragraph 4.
If you cancel after scoping work has been done but before testing starts, we may deduct a reasonable charge for that work, not exceeding 25% of the Scan price, and refund the balance.
If we are unable to deliver the Report for reasons within our control, you will receive a full refund. If we cannot complete a Scan because the Target was unavailable, access was not provided, or authorisation could not be confirmed, we will offer one rescheduling at no charge; if the Scan still cannot proceed, we may retain a charge for work done and refund the balance.

Ongoing services (subscriptions)

You may cancel at any time with written notice. Cancellation takes effect at the end of the current billing period; fees already paid for that period are not refunded.
We may cancel an ongoing service on 30 days’ written notice, refunding any prepaid fees for the period after the cancellation date.

How refunds are paid

Approved refunds are returned to the original payment method through Stripe within 10 business days of approval. Your bank may take additional time to show the credit.
To request a refund or cancellation, email billing@velqorstack.com with your order reference.

9. Your obligations

You agree to:

Provide accurate information about the Target, including hostnames, repositories, environments, test accounts and documentation needed for the Scope.
Keep backups of the Target and its data. Testing in an agreed window can affect availability; staging environments are recommended where available.
Tell us promptly about anything that could affect testing, such as rate limits, web application firewalls, scheduled maintenance or third-party components.
Keep your account credentials confidential and notify us of any unauthorised use of your account.
Comply with all laws that apply to you, including those governing the data held on the Target.
Not resell, sublicense or provide the Services to third parties, and not use the Platform to build a competing service.

10. Confidentiality

Each party will keep the other’s confidential information confidential and use it only to perform or receive the Services. Confidential information includes the Scope, Findings, Reports, credentials, source code, system details and pricing.
We will not disclose that you are a client, or any Finding, Report or system detail, without your written consent, except: to our staff and contractors bound by confidentiality who need it to deliver the Services; to Stripe and our hosting and email providers as needed to operate the Services; or where required by law, in which case we will notify you where lawful.
If we discover a vulnerability in third-party software during testing, we may report it to that vendor in a way that does not identify you.
These obligations survive for 3 years after the Services end, and indefinitely for source code, credentials and unfixed Findings.

11. Deliverables and intellectual property

Reports and Statements of Testing are delivered to you for your internal use, including sharing with your auditors, customers and advisers under confidentiality. You may not publish a Report or present Findings as a certification.
You own your Target, source code and data. We claim no rights in them. You grant us a limited licence to access and test them solely to deliver the Services.
We own the Platform, our methodologies, tooling, templates, the Velqor Stack name and marks, and the Badge. Nothing in these Terms transfers them to you.
We may use anonymised, aggregated information about Findings (for example, the proportion of scans with a given class of issue) for research and to improve the Services, provided it cannot identify you or your systems.

12. Use of the “Tested by Velqor Stack” Badge

After a Retest we may supply a Badge and a verification page at velqorstack.com/verify/[reference]. You may display the Badge on the website or product that was within the Scope, subject to this Section.
You must display the Badge exactly as supplied, keep its link to the verification page, and not alter, recolour, crop or reword it. The Badge states that testing took place; it must not be presented as a certification, guarantee or endorsement.
The Badge is valid for 12 months from the Retest date, or until the Scope changes materially, whichever is earlier. You must remove the Badge when it expires, if we withdraw it, or if these Terms end.
We may withdraw a Badge at any time if it is misused, if the Scope has changed, or if we become aware of a Critical or High Finding that remains open.
We provide no warranty to third parties who rely on the Badge, and you will not state or imply that we do.

13. What we do and do not promise

We will perform the Services with reasonable skill and care, using testers with appropriate experience, and in line with the agreed Scope.
No system is ever fully secure, and no test finds everything. A Scan reflects the state of the Target during the testing window and the techniques used within the Scope. We do not warrant that a Target is free of vulnerabilities, that all vulnerabilities will be found, or that the Target will be secure against future attacks.
A Report, Retest or Statement of Testing records what was tested, when, and what was found. It is not a certification, an audit opinion, or a guarantee of security or compliance. You remain responsible for your own security decisions, for fixing Findings, and for meeting any legal or regulatory obligations.
Severity ratings are our professional assessment using CVSS banding and may differ from ratings assigned by others.
Except as expressly stated in these Terms, the Services are provided “as is”, and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement, to the fullest extent permitted by law.

14. Limitation of liability

We take care to avoid disruption, but security testing can affect the availability or performance of a Target. Provided we stay within the Scope and act with reasonable care, we are not liable for downtime, degraded performance or data loss caused by testing. Section 9.2 (backups) applies.
To the fullest extent permitted by law, neither party is liable to the other for any indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, data or goodwill, arising out of or relating to the Services, even if advised of the possibility.
To the fullest extent permitted by law, our total liability arising out of or relating to the Services in any twelve-month period will not exceed the amount you paid us for the Services in that period.
Nothing in these Terms limits liability for death or personal injury caused by negligence, fraud, wilful misconduct, or any liability that cannot be limited by law.

15. Indemnification

You will defend, indemnify and hold us harmless from claims, losses and expenses (including reasonable legal fees) arising from: (a) testing performed on a Target that you were not authorised to have tested; (b) your breach of Section 4 or Section 9; (c) your use of a Report, Finding or the Badge in breach of these Terms; or (d) data on the Target that you were not entitled to hold or process.
We will defend, indemnify and hold you harmless from third-party claims that the Platform, as provided by us, infringes that third party’s intellectual property rights, provided you notify us promptly and allow us to control the defence.

16. Term, suspension and termination

These Terms apply from the first time you use the Services and continue until all orders are completed or cancelled and any account is closed.
We may suspend or end your access to the Platform immediately if you breach Section 4 (authorisation), use the Services unlawfully, fail to pay when due, or act in a way that threatens the security of the Platform or other clients.
Either party may end an ongoing service under Section 8.
On termination, you must stop using the Badge, and each party will return or delete the other’s confidential information on request, except for copies kept to meet legal or record-keeping obligations.
Sections 10 to 15 and 17 to 19 survive termination.

17. Governing law and disputes

These Terms are governed by the laws of the State of Montana, USA, without regard to its conflict-of-laws rules.
Before starting any formal proceedings, the parties will try in good faith to resolve a dispute by discussion between senior representatives for at least 30 days.
Any dispute not resolved that way will be brought exclusively in the state or federal courts located in Flathead County, Montana, and each party submits to their jurisdiction.
Nothing in this Section prevents either party seeking an injunction to protect confidential information or intellectual property.

18. Changes to these Terms

We may update these Terms. We will post the new version on the Site with a new effective date and, for material changes, email account holders at least 14 days before they take effect. Orders confirmed before the effective date remain under the Terms in force when they were confirmed. Continued use of the Services after the effective date is acceptance of the new Terms.

19. General

These Terms, the Scope and any order confirmation are the entire agreement between us about the Services and replace any earlier discussions.
If any provision is unenforceable, the rest remains in effect.
Neither party is liable for delay caused by events beyond its reasonable control, except for payment obligations.
You may not assign these Terms without our written consent. We may assign them to a successor of our business.
Notices to us go to the email address in Section 20, with a copy to our registered agent for formal legal notices; notices to you go to the email address on your account.
Nothing in these Terms creates a partnership, joint venture, agency or employment relationship.

20. Contact

Velqor Stack LLC, a Montana limited liability company, Montana Secretary of State file no. 17386114 Mailing address: 145 W Broadway, Long Beach, CA 90802-4413, USA Registered agent for legal notices: Zero Tax Tags LLC, 525 Railway St, Ste 206, Whitefish, MT 59937-2521 General: hello@velqorstack.com · Billing: billing@velqorstack.com · Security: security@velqorstack.com