These terms apply to every quote and assignment of HackIndex. They are short on purpose. Agreements per assignment, such as scope, rules of engagement, confidentiality and data processing, are in the SLA, the non-disclosure agreement and the data processing agreement. Every quote comes with a PDF of these terms. The Dutch text prevails.
Version 1.0, 13 November 2026.
These terms apply to all quotes, assignments and work of HackIndex. The client's terms do not apply, not even when a purchase order refers to them. If documents contradict each other, the more specific one prevails: the data processing agreement, then the non-disclosure agreement, then the SLA, then the quote and finally these terms. Deviations are only valid in writing, an email counts.
HackIndex may transfer an assignment with all rights and obligations to a legal successor, such as its own private limited company. The client is told in writing beforehand. Nothing else changes for the client. Not enforcing a provision straight away does not mean HackIndex or the client loses the right to it.
A quote is without obligation, valid for 30 days and based on what the client shared during scoping. The assignment is formed as soon as the client accepts the quote in writing or by email. If that information is wrong or the scope changes, the quote is supplemented. Extra work only starts after approval. An obvious error in a quote, such as a calculation or typing error, does not bind HackIndex. Oral agreements only count once HackIndex has confirmed them in writing, an email counts.
If an agency or other intermediary places the order, it is the client and pays the invoices, also when the report is in the name of its own client. The owner of the systems gives the permission in article 3. Acceptance by email counts as written acceptance. Articles 6:227b and 6:227c of the Dutch Civil Code do not apply.
Testing only starts after written permission from the owner of all systems in scope. The client warrants that it may give that permission, and arranges permission from hosting, cloud and SaaS providers where needed. The client indemnifies HackIndex against third-party claims that arise because that permission was missing. If the permission is in doubt, HackIndex may pause testing until it is settled.
HackIndex carries out the assignment to the best of its ability and according to accepted practice in the field. That is a best-efforts obligation. A test is a snapshot: there is no guarantee that all vulnerabilities are found, or that a system is secure after the test. If a test threatens to disrupt something, HackIndex may pause it. Subcontractors are not used.
During the test HackIndex keeps a log of what was done, when and from which IP address. That log serves as evidence of what did and did not happen, unless the client proves otherwise.
The client provides access, test accounts, a contact with an emergency number and recent backups in time. Despite all care, testing can cause a disruption. The client accepts that residual risk, within what article 10 sets out. If the assignment is delayed by the client, it is rescheduled. Any extra costs are discussed first. A certification body assessing the work of HackIndex may, under confidentiality, observe a test and review the file of an assignment.
If HackIndex sets up a test environment on request, the client provides access to the hosting, a backup or the code for it. HackIndex uses these only for the assignment, keeps the copy encrypted and deletes it no later than 30 days after the retest, or after the end of the assignment if there is no retest. If the copy holds personal data, the data processing agreement applies.
The report is confidential and only goes to the client's contacts. The client uses it internally and may share it with an accountant, auditor, regulator or the supplier fixing the findings. A retest of the reported findings is included within the period stated in the quote.
Fixing findings is not part of a test. HackIndex can do it as a separate assignment with its own quote, for applications in Laravel, WordPress, WooCommerce, Magento, other PHP frameworks, Node.js and Python. If HackIndex fixes a finding itself, the report says so at the retest.
Prices are fixed and exclude VAT, unless the quote says otherwise. Invoicing happens on delivery of the report, or as the quote agrees. An invoice is paid within 14 days. After that the statutory commercial interest is due, and in case of collection also the collection costs. Set-off is not allowed.
Invoices are sent by email. The client reports any objection to an invoice within 14 days of the invoice date, after that the invoice counts as accepted. If an invoice is not paid on time, HackIndex may postpone the work, the delivery of the report or the retest until it is paid.
Both parties keep the other's confidential information secret, also after the assignment ends. The non-disclosure agreement covers the details. Evidence and test data are stored encrypted and deleted after the period in the SLA. Personal data falls under the data processing agreement. HackIndex may share confidential information with its own lawyer, accountant and insurer, as far as needed and when they are bound to confidentiality themselves.
HackIndex keeps the rights to its methods, tools, templates and knowledge. After payment the client may use the report internally without limits. HackIndex may reuse general knowledge from an assignment, but never in a way that can be traced back to the client.
HackIndex is only liable for direct damage, up to the amount invoiced for the assignment, excluding VAT. For an ongoing assignment that is the amount of the last 12 months. Indirect damage, such as consequential loss, lost profit, loss of data and reputational damage, is excluded. HackIndex is not liable for damage caused by actions within the agreed scope and rules of engagement. These limits do not apply in case of intent or deliberate recklessness of the management of HackIndex. Damage is reported within 30 days of discovery. A claim lapses 12 months after the damage occurred.
A test can be rescheduled free of charge up to 5 working days before the start. After that HackIndex may charge the reserved days. If the client stops halfway, the work already done is paid. Either party may end the assignment if the other goes bankrupt, or in case of a serious breach that is not remedied after a written notice. In case of force majeure the obligations are suspended. Force majeure is a circumstance beyond a party's fault that reasonably makes performance impossible, such as illness of the tester, outages at hosting, cloud or internet providers, and government measures. HackIndex lets the client know as soon as possible when force majeure affects the planning, and the test is then rescheduled in consultation. If the force majeure lasts longer than 60 days, either party may end the assignment.
Dutch law applies. A dispute goes to the competent court where HackIndex is established. The Dutch text of these terms prevails over the English. If an article is invalid, the others still apply and it is replaced by a rule that comes closest to its purpose. HackIndex may change these terms. For an ongoing assignment the version that applied when the quote was accepted stays in force.
