Terms of Business
Version 1.0, September 2026. These apply to every engagement unless a signed statement of work says otherwise. Clients accept them when they sign the mutual NDA; the version accepted is recorded against the engagement.
Who these terms are between
These terms apply to services provided by Remedy Nine Limited (“Remedy Nine”, “we”) to the client named in the engagement (“you”). Together with the agreed scope and any mutual non-disclosure agreement already signed, they form the whole agreement for the work. If a signed statement of work says something different, the statement of work wins for that engagement.
How work is agreed
We first establish the scope, dependencies and access needed, then set out the proposed work, deliverables, assumptions and price. Work starts when you confirm that proposal in writing (email is fine). Sending us findings, or talking to us, does not commit you to paid work.
Changes to scope are agreed in writing before they are carried out, with any effect on price and timing stated. Where investigation is needed before we can quote implementation, that investigation is quoted separately.
Fees and payment
Fees are as stated in the proposal, either fixed for a defined piece of work or at the day or hour rates given. Fees exclude VAT, which is added where applicable, and reasonable pre-agreed expenses.
Invoices are payable within 30 days of the invoice date unless the proposal says otherwise. We may invoice in stages for longer engagements. We may suspend work while an invoice is overdue and charge statutory interest on late payment.
What we need from you
Timely access to the systems, environments, documentation and people the work depends on; a named contact with authority to make decisions; and current backups of anything we are asked to change. Where you ask us to work in production, you confirm you have the right to authorise that and have taken the backups you need.
We rely on the information you give us, including penetration test reports and system descriptions, being accurate and complete to the best of your knowledge.
Our commitments
We carry out the work with reasonable skill and care, by suitably experienced people, and in line with good industry practice. We tell you promptly if something in the scope cannot be achieved as planned, explain the constraint and set out the options.
For remediation work, we describe what was changed, how it was verified and what remains open. Verification evidence supports retesting and audit review; the outcome of any independent retest or certification assessment is the tester’s or certification body’s decision, not ours to guarantee.
Intellectual property
You keep ownership of your systems, code and data. Once the related invoice is paid, you own the deliverables created specifically for you and receive a perpetual licence to any of our pre-existing tools or components embedded in them. We keep ownership of our own methods, tools and know-how, and may reuse general learning that does not disclose your confidential information.
Confidentiality and data protection
Confidential information is protected by the mutual non-disclosure agreement signed before findings are shared, which continues to apply. Where we process personal data on your behalf while carrying out the work, we act as your processor: we process it only on your instructions, keep it secure, do not appoint sub-processors without telling you, and delete or return it when the work ends, in line with the UK GDPR, the EU GDPR and the Data Protection (Jersey) Law 2018 as applicable. Details of how we handle data you send us are in our privacy notice.
Liability
Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything that cannot lawfully be limited. Subject to that, our total liability arising from an engagement is limited to the fees paid or payable for that engagement in the 12 months before the claim, and neither party is liable to the other for loss of profit, business, goodwill or data, or for indirect or consequential loss.
We are not liable for problems caused by changes made by others, by instructions you give us, by inaccurate information supplied to us, or by third-party products and services outside our control.
Ending an engagement
Either party may end an engagement on 14 days’ written notice, or immediately if the other commits a material breach that is not put right within 14 days of being asked. You pay for work done and committed costs up to the end date; we hand over work in progress and any deliverables you have paid for. Clauses on confidentiality, intellectual property, liability and payment survive the end of the engagement.
General
Neither party is liable for delay caused by events outside its reasonable control. Neither party may assign the agreement without the other’s consent, not to be unreasonably withheld. Notices go to the email addresses given in the engagement. If any clause is found unenforceable, the rest still applies. In line with the mutual NDA, these terms and any non-contractual obligations arising from them are governed by the laws of England and Wales, and the courts of England and Wales have non-exclusive jurisdiction, unless a signed statement of work says otherwise.