Legal

Terms of service

The service

Northstead Security provides automated assessments of the externally observable security of websites you control, written reports, optional remediation work, and optional monitoring. Assessments are governed by our authorization and acceptable-use policy.

What an assessment is, and is not

An assessment reports what was observed within a stated scope, coverage and period. It is not a certification, an audit opinion, a penetration test by a named individual, or a guarantee that a website is secure or will remain so. Absence of findings is not evidence of absence of vulnerabilities.

Payments and refunds

Reviews are paid in advance through Stripe. If an assessment cannot be completed for reasons on our side, we will re-run it or refund it. Subscriptions renew until cancelled from the billing page; cancellation takes effect at the end of the paid period.

Remediation work

Remediation is quoted per project and performed only with your written approval. We do not deploy changes to production without your explicit approval. A finding is reported as resolved only when a follow-up assessment no longer observes it.

Confidentiality

We treat assessment results as confidential to your organization and the people you authorize.

Liability

To be completed following legal review.

Third-party technology

Assessments use the open-source Penthera engine (MIT licence) together with Northstead Security’s own processing, review and reporting.