Service Agreement
The master terms for security-testing services provided by Verfend; the scope lives in Annex A (the Proposal & Statement of Work, Document 02) and the rules of engagement in the Authorisation to Test (Document 04).
This Agreement is made between:
Provider: Provider legal name, trading as Verfend (Independent Security Operations), operating in Brazil as ME under Simples Nacional / MEI, CNPJ or CPF, established at address, Recife, Pernambuco, Brazil, email email ("Verfend", "we").
Client: Client legal name, CNPJ / company no. / VAT no., address, country, represented by name, role ("Client", "you").
Effective date: date. Engagement ID: VF-2026-001.
This Agreement is available in English for international clients and in Portuguese (PT-BR) for clients in Brazil; in case of conflict, the Portuguese / English version prevails.
1. Purpose
Verfend provides independent website and web-application security services — Validate (finding validation), Assess (security audit), Resolve (remediation support and retest) and Monitoring (ongoing checks) — as selected in Annex A.
2. Authorisation (essential)
2.1. The Client confirms it owns or is duly authorised to permit security testing of the systems listed in Annex A (the "In-Scope Assets") and grants Verfend written authorisation to perform the agreed activities against those assets only.
2.2. Verfend will not access, test or probe any system outside Annex A.
2.3. Testing begins only after this Agreement, Annex A and the Authorisation to Test are signed.
2.4. Unauthorised access to information systems is a criminal offence (Brazil: Lei nº 12.737/2012, art. 154-A, Código Penal; EU: Directive 2013/40/EU; and applicable computer-misuse laws elsewhere). This authorisation is what makes the agreed testing lawful; either party may pause or narrow the scope in writing at any time.
3. Rules of engagement
3.1. The Authorisation to Test (Document 04) governs the authorised assets, the testing window, the permitted techniques, the named contacts and the stop-word. It is incorporated into this Agreement. If the documents differ on what may be tested, the narrower reading applies.
3.2. Work follows recognised practice (OWASP WSTG/ASVS, PTES, CVSS v3.1). Verfend favours non-disruptive techniques and agrees in advance any test that could affect availability.
3.3. Work outside Annex A requires a written change order and may adjust fees and timeline.
4. Prohibited actions
Unless separately authorised in writing, Verfend will not:
- (a) perform denial-of-service, stress or load testing;
- (b) conduct social engineering, phishing or physical intrusion;
- (c) take destructive actions or intentionally degrade a service;
- (d) exfiltrate data beyond the minimum needed to prove a finding; and
- (e) continue once sensitive personal data is encountered — Verfend captures only minimal proof, stops, and notifies the Client's named contact.
5. Stop-word & incident protocol
5.1. Either party may invoke the stop-word STOP at any time. Verfend halts the affected activity within 15 minutes and confirms in writing.
5.2. If testing appears to affect the availability or integrity of a system, Verfend stops the affected activity, notifies the Client's named contact without undue delay, assists reasonable recovery, and documents what happened.
6. Credentials & evidence handling
6.1. Any test accounts are dedicated, least-privilege and provided by the Client; the Client revokes them within 24 hours after the testing window closes (see Access Provisioning, Document 05).
6.2. Findings, evidence and Client data are stored encrypted, kept strictly confidential, and used only to deliver the services.
6.3. Evidence is limited to the minimal proof of each finding and is retained for 90 days after report delivery and then deleted, unless the parties agree otherwise in writing or the law requires longer. Personal data is redacted in notes, screenshots and reports wherever possible, and Verfend does not retain personal data beyond that minimal proof.
7. Deliverables
7.1. A written report: executive summary, confirmed findings with evidence and context, severity and prioritisation (CVSS v3.1), and remediation guidance.
7.2. Where Resolve is in scope, a retest statement covering the original findings within the tested scope.
7.3. Reports are prepared for the Client and delivered through an agreed secure channel.
8. Fees and payment
As set out in the Payment Terms (Document 13) and the quote in Annex A (Document 02). Fees are quoted in BRL for clients in Brazil and in USD or EUR for international clients. Remediation and monitoring are scoped and priced separately. A nota fiscal de serviço (NFS-e) is issued where the Provider's tax regime requires it.
9. Confidentiality
9.1. Each party keeps the other's non-public information confidential and uses it only to perform this Agreement.
9.2. Verfend does not disclose findings, evidence or Client data to third parties without the Client's written consent, except where required by law.
9.3. On request after the engagement, Verfend deletes or returns findings and evidence, retaining only what is needed for legal/accounting obligations.
10. No subcontracting
Consistent with our promise that nothing is outsourced, Verfend does not subcontract or delegate any part of the services without the Client's prior written consent, and remains responsible for the work in all cases.
11. Client warranty & indemnity
11.1. The Client warrants that it owns or is authorised to permit testing of every In-Scope Asset, that its hosting/cloud provider's terms permit the agreed testing, and that it has obtained any separate consent the provider requires.
11.2. The Client indemnifies Verfend against third-party claims arising from any asset included in scope in error or without the Client's proper authority.
12. Data protection (LGPD / GDPR)
12.1. The parties comply with the Brazilian LGPD (Lei nº 13.709/2018) and ANPD guidance. The Client is controller (controlador); Verfend acts as operator (operador) and, where it processes personal data, the parties sign a data-processing addendum defining roles and instructions.
12.2. Where the Client or the data subjects are in the EU/UK, the parties additionally give effect to applicable GDPR obligations.
13. Hosting provider terms
Before testing begins, the Client confirms in writing (Authorisation to Test, Document 04, §7) that the terms of any hosting or cloud provider for the In-Scope Assets permit the agreed testing, and obtains any separate provider consent required. Denial-of-service and stress testing remain excluded by default.
14. Intellectual property
14.1. On full payment, the report and the findings prepared for the Client become the Client's property.
14.2. Verfend's methodology, tools, templates and general know-how remain Verfend's property; nothing in this Agreement transfers them to the Client.
15. No guarantee
A security assessment reflects the tested scope at a point in time. It does not guarantee the absence of all vulnerabilities, and later changes may introduce new issues. Verfend gives no warranty of complete or continued security.
16. Liability
16.1. Verfend performs the services with reasonable professional skill and care.
16.2. To the extent permitted by law, Verfend's total liability under this Agreement is limited to the fees paid for the engagement giving rise to the claim. Neither party is liable for indirect or consequential loss. Nothing limits liability that cannot be limited by law.
17. Publicity
Neither party names or identifies the other in marketing without prior written consent; Verfend will not name the Client as a client without that consent. Any case study is anonymised unless the Client agrees otherwise.
18. Force majeure
Neither party is liable for delay or failure caused by events beyond its reasonable control; the affected party notifies the other and resumes as soon as practicable.
19. Independent contractor
Verfend acts as an independent contractor. Nothing in this Agreement creates employment, partnership or agency between the parties.
20. Term and termination
20.1. This Agreement covers the engagement in Annex A and any agreed renewals.
20.2. Either party may terminate for material breach not remedied within 15 days of written notice. The Client pays for work properly performed up to termination.
20.3. The Client may narrow or revoke the Authorisation to Test (Document 04) in writing at any time. Work properly performed up to that point is payable per the Payment Terms (Document 13), including the scheduling fee in its §9.1 where the engagement is cancelled before work begins; the narrowing or revocation itself gives rise to no other charge.
21. Governing law and forum
21.1. This Agreement is governed by the laws of the Federative Republic of Brazil.
21.2. The parties elect the courts of the Comarca de Recife, Estado de Pernambuco, waiving any other however privileged.
21.3. For international clients, the parties may instead agree in Annex A on arbitration (seat, rules and language to be stated) or another forum/governing law.
22. Notices
Formal notices are given in writing to the email addresses above (or as updated in writing) and are effective on confirmed delivery.
23. Counterparts & e-signature
This Agreement may be signed in counterparts and by electronic signature, each of which is an original and all of which together form one agreement.
24. Entire agreement
This Agreement, Annex A (Proposal & Statement of Work, Document 02), the Authorisation to Test (Document 04), the Payment Terms (Document 13) and, where Monitoring is selected, the Monitoring Terms (Document 10) are the entire agreement between the parties and supersede prior discussions. Changes must be in writing and signed by both parties.
Signatures
Provider: ______________ Date: ________
Client: ______________ Date: ________
Annex A is the signed Proposal & Statement of Work (Document 02). The Authorisation to Test (Document 04) is a separate signed document naming the assets, window and techniques.
Verfend · Independent Security Operations · email · website · Document 03 v1.0 · date