Terms of Service

These terms govern the use of Shieldome Siege (the "Service"), a platform for running authorized penetration testing engagements. By signing up for or using the Service, you agree to these terms on behalf of yourself and the organization you represent (the "Customer").

1. What the Service is

Shieldome Siege runs scope-checked reconnaissance and vulnerability identification, and, on applicable plans, human-approval-gated exploit confirmation (including SQL injection testing and Metasploit module execution) against systems the Customer has designated for testing. No exploit ever runs without a specific human approving that exact action.

2. Authorization is on you

This is the core of the agreement: the Customer represents and warrants that it owns the systems being tested, or holds documented, current authorization from the owner to have them tested, for every target submitted to the Service.

The Customer is solely responsible for defining accurate scope and for obtaining that authorization before any target is added to an engagement. Shieldome Siege enforces scope as defined by the Customer, but it cannot verify that the Customer actually has the right to authorize testing against a given target - that determination is the Customer's alone.

3. Rules of Engagement

Every engagement is scoped to a written Rules of Engagement (ROE): the specific targets, testing windows, and permitted techniques. The Service will not knowingly test outside that scope, and every finding, scan, and approval is written to a tamper-evident audit log. The Customer is responsible for keeping the ROE accurate and for updating it before scope changes.

4. Acceptable use

No submitting a target you do not own or have documented authorization to test.
No using the Service, or anything it surfaces, to cause damage, exfiltrate data beyond what's needed to confirm a finding, or disrupt a system beyond what the ROE permits.
No attempting to bypass the Service's scope enforcement or approval gates.
No reselling or sublicensing access to the Service without our written consent.

5. Fees and billing

Plans and pricing are listed at shieldomesiege.com/#pricing and inside the platform. Subscriptions are billed monthly unless a B2B invoice arrangement has been agreed in writing. Add-ons (white-label reporting, a dedicated worker VM) are billed alongside the base plan they're attached to.

6. Findings and confidentiality

Engagement data, findings, and reports belong to the Customer. We treat them as confidential and will not share them outside the Customer's own organization except as needed to operate the Service (for example, infrastructure providers who host the platform) or as required by law.

7. Disclaimer

Penetration testing is a best-effort exercise: it can reduce risk, but it cannot guarantee that every vulnerability in a system will be found. The Service is provided "as is," and we disclaim all warranties, express or implied, to the maximum extent the law allows.

8. Limitation of liability

To the maximum extent permitted by law, Shieldome Siege's total liability arising out of or related to the Service is limited to the amount the Customer paid us in the twelve months before the claim, and we are not liable for indirect, incidental, or consequential damages.

9. Indemnification

The Customer agrees to indemnify and hold Shieldome Siege harmless from any claim arising out of a target that was submitted for testing without proper authorization, or out of the Customer's breach of the Rules of Engagement or these terms.

10. Termination

Either party may terminate a subscription in accordance with the plan's billing terms. We may suspend or terminate access immediately if we reasonably believe the Service is being used to test a target without authorization.

11. Governing law

These terms are governed by the laws of the Republic of Serbia, without regard to its conflict-of-law principles, unless a separately signed engagement agreement states otherwise.

12. Changes to these terms

We may update these terms from time to time. If we make a material change, we'll update the date at the top of this page and, where practical, notify active customers directly.

Contact

Questions about these terms: [email protected]. If your organization needs a signed Data Processing Agreement for GDPR purposes, see our DPA.