Terms of Business
Effective date: October 2026 | Version 1.0
These Terms of Business govern the provision of penetration testing and related professional services by AppTest Direct Ltd.
1. About us
AppTest Direct Ltd is a company registered in England and Wales under company number 17459475, with its registered office at 9 Market Place, Hedon, Hull, England, HU12 8JA.
In these Terms:
“AppTest Direct”, “we”, “us” and “our” mean AppTest Direct Ltd.
“Customer”, “you” and “your” mean the organisation purchasing or commissioning the Services.
Our Services are provided on a business-to-business basis.
2. Definitions
In these Terms:
“Authority to Test” means the Customer's formal authorisation for AppTest Direct to perform the agreed security testing against the identified targets.
“Engagement” means the particular penetration testing or related Services commissioned by the Customer.
“Order” means an order placed through our website, checkout, quotation, invoice or other agreed purchasing process.
“Report” means the penetration testing report or other agreed deliverable produced following the Services.
“Rules of Engagement” means the operational conditions governing how an Engagement will be conducted, including scope, permitted testing, exclusions, dates and emergency arrangements.
“Services” means the penetration testing and related professional services supplied by AppTest Direct.
“Test Details” means the technical, operational and scope information provided for an Engagement.
“Working Day” means Monday to Friday, excluding public and bank holidays in England and Wales.
3. The agreement
The agreement between AppTest Direct and the Customer may consist of:
- these Terms of Business;
- the applicable Order, checkout confirmation, quotation or invoice;
- the relevant service description;
- the Test Details and Authority to Test;
- the applicable Rules of Engagement;
- any agreed changes to scope; and
- any other document expressly incorporated into the Engagement.
Where documents conflict, the Test Details, Authority to Test and Rules of Engagement take precedence in relation to authorised targets, testing activities, exclusions and operational controls.
The Order or quotation takes precedence in relation to agreed pricing and specific commercial arrangements.
4. Orders and acceptance
An Order may be placed through our online checkout or through our business quotation and invoice process.
Submitting an Order or making payment does not, by itself, authorise AppTest Direct to begin penetration testing.
Payment reserves the requested Engagement subject to:
- validation of the requested scope;
- confirmation of technical feasibility;
- confirmation of the Customer's authority to commission the testing;
- completion and approval of the Test Details and Authority to Test;
- agreement of any applicable Rules of Engagement;
- provision of appropriate access and credentials where required; and
- agreement of the testing date or testing window.
An automated checkout confirmation or payment receipt acknowledges receipt of the Order but does not constitute approval of the testing scope or permission for testing to begin.
If we determine that the requested Service falls outside the applicable fixed-price scope, is technically unsuitable, cannot safely or lawfully be performed, or requires additional work, we will contact the Customer before testing begins.
We may propose a revised scope, alternative approach or additional quotation.
Where an Order cannot reasonably be accepted and no alternative arrangement is agreed, any amount paid for Services that have not commenced will be refunded.
5. Services
AppTest Direct provides tester-led penetration testing and related security assessment services.
The exact Services to be performed will be defined by the applicable service description, Order and approved Test Details and Authority to Test.
Testing may include appropriate:
- manual security testing;
- automated security testing;
- specialist security tooling;
- tester-controlled automation;
- investigation of identified weaknesses; and
- responsible use of supporting technologies where appropriate.
All vulnerabilities included in the final Report will be reviewed and verified by a qualified human penetration tester before reporting.
Testing is performed on a point-in-time basis and within an agreed scope and testing window.
The Customer acknowledges that penetration testing cannot identify every possible vulnerability or guarantee that a system is secure or will remain secure.
6. Test Details and Authority to Test
No penetration testing will begin until AppTest Direct has approved the scope and received satisfactory authority to perform the testing.
The Customer must provide complete and accurate information about the systems, applications, APIs, infrastructure and other assets included within scope.
The Customer warrants that it:
- owns the systems being tested; or
- has obtained sufficient permission from the relevant owner or authorised third party for AppTest Direct to perform the agreed testing.
Where systems, infrastructure, hosting environments or services are owned or operated by a third party, AppTest Direct may require evidence of that third party's permission before testing begins.
The person providing the Authority to Test confirms that they have sufficient authority to do so on behalf of the Customer.
AppTest Direct may refuse, suspend or stop testing where authority is unclear, incomplete or withdrawn.
Testing will only be performed against targets that have been expressly approved as being within scope.
7. Rules of Engagement
Testing will be performed in accordance with the agreed Rules of Engagement and approved scope.
The Rules of Engagement may define matters including:
- authorised targets;
- testing dates and times;
- testing source addresses where applicable;
- test accounts and access;
- permitted testing techniques;
- excluded systems or activities;
- production or non-production environments;
- security controls and allow-listing arrangements;
- emergency contacts;
- notification requirements; and
- stop-testing procedures.
AppTest Direct will only test systems, applications, APIs, infrastructure and other assets that are expressly included within the Test Details and Authority to Test.
If information discovered during testing requires investigation outside the approved scope, AppTest Direct will stop that activity and obtain additional authorisation before proceeding.
8. Customer responsibilities
The Customer is responsible for:
- providing accurate scope and technical information;
- ensuring it has sufficient authority to commission the Services;
- identifying any systems or activities that must not be tested;
- supplying appropriate access and test credentials where required;
- providing credentials for relevant user roles where authenticated testing is required;
- notifying AppTest Direct of material changes to the target environment;
- providing suitable technical and emergency contacts;
- maintaining appropriate backups and recovery arrangements;
- informing AppTest Direct of functionality that could generate financial transactions, messages, notifications, account lockouts or other material effects when tested;
- identifying fragile, safety-critical or particularly sensitive functionality before testing;
- informing relevant hosting providers or other third parties where required; and
- taking reasonable steps to ensure that the target environment is suitable for testing.
Where production systems are included, the Customer acknowledges that security testing carries an inherent risk of disruption or unintended effects.
The Customer should not provide credentials through ordinary email or other insecure methods where a secure method supplied or approved by AppTest Direct is available.
9. Security controls and testing conditions
Security products, rate limits, web application firewalls, intrusion prevention systems and other defensive controls may interfere with testing.
Where appropriate, AppTest Direct may recommend temporary allow-listing or configuration changes so that testing can assess the underlying application or service rather than primarily assessing an intermediary defensive control.
Different arrangements may apply where the agreed purpose of the Engagement is to assess:
- externally visible infrastructure;
- security controls themselves;
- resilience against an external attacker; or
- a production environment where disabling controls would introduce unacceptable operational risk.
Any such arrangements will be agreed as part of the Test Details or Rules of Engagement.
10. Testing risk and suspension
Penetration testing involves techniques intended to identify, investigate and validate security weaknesses.
Testing may generate traffic, logs and security alerts that resemble genuine malicious activity.
Although AppTest Direct will use reasonable care, professional judgement and appropriate controls, penetration testing cannot be entirely risk-free.
AppTest Direct may pause or stop testing where we reasonably believe that:
- testing may cause unacceptable disruption or damage;
- a target may be outside the authorised scope;
- authority to test is uncertain or has been withdrawn;
- a third party raises a legitimate concern regarding testing;
- the Customer requests testing to stop;
- continuing would create an unacceptable security, legal or operational risk;
- the target becomes unstable; or
- circumstances prevent the Services from being performed safely or effectively.
Where practical, we will contact the Customer using the agreed emergency contact details.
Suspension or disruption caused by circumstances outside our reasonable control may require testing to be rescheduled.
11. Delivery and reporting
Following testing, AppTest Direct will provide a professional penetration testing Report.
The Report may include:
- an executive summary;
- details of the agreed scope;
- methodology information;
- verified security findings;
- affected assets;
- risk or severity information;
- supporting evidence;
- technical descriptions; and
- remediation guidance.
All vulnerabilities included in the final Report will be subject to human review and verification before reporting.
Reports are typically delivered within 10 Working Days of the confirmed testing start date.
Where the size, complexity, access arrangements or circumstances of an Engagement require additional time, we will communicate this to the Customer.
Unless expressly agreed otherwise, stated delivery periods are estimates and time is not of the essence.
12. Retesting
One complimentary retest is included with each penetration testing Engagement.
The Customer must notify AppTest Direct which reported findings have been remediated or mitigated and provide any information or access reasonably required to perform the retest.
The complimentary retest must be requested within 90 calendar days of the date of the original penetration testing Report.
AppTest Direct will reassess the findings identified by the Customer and issue a retest Report recording the outcome.
The complimentary retest is intended as a single retest cycle.
The Customer should therefore identify the findings it wishes to have reassessed before the complimentary retest begins.
Where:
- findings are submitted for retesting in separate stages;
- further retesting is required after the complimentary retest has been completed;
- material changes have been made to the application, API, infrastructure or environment;
- new functionality requires assessment; or
- testing extends beyond findings identified in the original Report,
additional testing may be subject to a separate fee agreed with the Customer in advance.
13. Fees, VAT and payment
The Customer will pay the fees shown during checkout, stated in the applicable quotation or otherwise agreed in writing.
Unless expressly stated otherwise, prices are exclusive of VAT.
VAT will be charged at the applicable rate where required.
Online Orders are payable through the available checkout payment methods.
Where an Order is placed through the business invoice process, payment must be made in accordance with the payment terms shown on the invoice or quotation.
Additional work outside the agreed scope will not be undertaken for an additional charge without the Customer's approval.
AppTest Direct may suspend Services or withhold further deliverables where an undisputed invoice is overdue.
14. Cancellation and rescheduling
The Customer may request cancellation or rescheduling by contacting AppTest Direct in writing.
An Engagement may be rescheduled without charge where the Customer provides at least two Working Days' notice before the scheduled testing start date.
Where the Customer cancels an Engagement at least two Working Days before the scheduled testing start date, and testing has not commenced, AppTest Direct will provide a full refund of fees paid for the cancelled Services.
Where less than two Working Days' notice is provided, AppTest Direct will make reasonable efforts to reschedule the Engagement.
If the Customer instead chooses to cancel, AppTest Direct may deduct reasonable costs that have already been incurred or irrecoverably committed specifically for that Engagement and will refund the remaining balance.
Once testing has commenced, the Customer may request that testing stops.
AppTest Direct may charge for Services already performed and any reasonable costs already incurred or committed.
Any remaining refundable balance will be determined according to the work completed at the point testing is stopped.
Where testing cannot proceed because the Customer has not provided required:
- access;
- credentials;
- authority;
- technical information;
- contacts; or
- other agreed prerequisites,
AppTest Direct may pause or reschedule the Engagement.
If AppTest Direct cancels an Engagement and cannot provide the Services within a reasonable alternative timeframe, the Customer will receive a refund for any affected Services that have not been provided.
15. Confidentiality
Each party will keep confidential any confidential information received from the other in connection with the Services.
AppTest Direct will treat information relating to the Customer's:
- systems;
- credentials;
- application data;
- infrastructure;
- vulnerabilities;
- security findings;
- testing evidence;
- technical documentation; and
- security arrangements
as confidential.
Confidential information will only be used as reasonably necessary to provide or receive the Services.
Confidential information may only be disclosed to employees, contractors, professional advisers or service providers who reasonably require access for the relevant purpose and who are subject to appropriate confidentiality obligations.
These obligations do not apply to information that:
- is or becomes publicly available other than through a breach of confidentiality;
- was lawfully known before disclosure;
- is lawfully received from a third party without a confidentiality restriction;
- is independently developed without use of the confidential information; or
- must be disclosed by law, court order or a competent regulatory authority.
Where legally permitted, the receiving party will provide reasonable notice before making a legally required disclosure.
The confidentiality obligations continue after completion or termination of the Engagement.
AppTest Direct will not publicly identify the Customer, use the Customer's name or logo, publish testing results or use an Engagement as a case study without permission.
16. Data protection and security
Each party will comply with applicable data protection legislation in relation to personal data processed in connection with the Services.
AppTest Direct will apply appropriate technical and organisational measures to protect information entrusted to it.
Where AppTest Direct processes personal data on behalf of the Customer as a data processor, the parties will comply with applicable data-processing requirements and any Data Processing Agreement or Data Processing Schedule incorporated into the Engagement.
Customer information will only be retained for as long as reasonably required for:
- delivery of the Services;
- contractual purposes;
- legal or regulatory obligations;
- security requirements; or
- legitimate business purposes.
Information will be handled in accordance with the AppTest Direct Privacy Notice and applicable internal retention procedures.
The Customer should avoid providing unnecessary:
- live personal data;
- production credentials;
- confidential customer information; or
- sensitive information
where suitable test data or dedicated test accounts can reasonably be used instead.
17. Credentials and sensitive information
Credentials and other authentication information supplied for testing will be treated as highly sensitive.
Customers should use the secure credential-sharing method provided or approved by AppTest Direct wherever reasonably possible.
Customers should provide dedicated test accounts rather than personal or shared business accounts where practicable.
Credentials must only provide the level of access reasonably required for the Engagement.
AppTest Direct may store credentials securely for the duration of the Engagement where necessary to provide the Services.
AppTest Direct may store credentials securely for the duration of the active testing activity where necessary to provide the Services.
Credentials will be securely removed when they are no longer required for the active testing activity. Where credentials are required for a subsequent retest, the Customer may be asked to provide them again using the approved secure method.
18. Intellectual property and Reports
Each party retains ownership of intellectual property that it owned before the Engagement.
AppTest Direct retains ownership of its:
- methodologies;
- templates;
- internal processes;
- testing techniques;
- automation;
- software;
- tools;
- know-how; and
- other pre-existing intellectual property.
The Customer retains ownership of its systems, data, documentation and materials supplied to AppTest Direct.
Subject to payment of the applicable fees, the Customer may use, copy and share the final penetration testing Report for its legitimate business purposes.
This may include sharing the Report with:
- employees;
- directors;
- professional advisers;
- customers;
- suppliers;
- insurers;
- auditors;
- regulators; and
- other organisations with a legitimate need to review the results.
The Customer is responsible for ensuring that security-sensitive Reports and findings are shared appropriately.
The Customer must not materially alter a Report in a way that misrepresents AppTest Direct's findings, conclusions or the scope of testing.
No intellectual property rights are transferred except where these Terms expressly state otherwise.
19. Professional standard and limitations
AppTest Direct will perform the Services with reasonable skill and care and in accordance with generally accepted professional penetration-testing practices appropriate to the Engagement.
Security testing is inherently limited by factors including:
- the agreed scope;
- available testing time;
- provided access and credentials;
- the functionality available during testing;
- the state of the target at the time of testing;
- security controls;
- third-party services;
- environmental conditions;
- technical restrictions; and
- information supplied by the Customer.
A penetration test is not a guarantee that all vulnerabilities will be identified.
The Report describes the security conditions and vulnerabilities identified during the agreed testing period.
Subsequent system changes, newly discovered vulnerabilities, configuration changes, new attack techniques or changes to the threat environment may affect the conclusions of the Report.
20. Liability
Nothing in these Terms excludes or limits either party's liability to the extent that such liability cannot lawfully be excluded or limited, including liability for:
- death or personal injury caused by negligence;
- fraud or fraudulent misrepresentation; or
- any other liability that cannot lawfully be excluded or limited.
Subject to the above, neither party will be liable to the other for:
- any indirect or consequential loss; or
- loss of profits, revenue, anticipated savings, business opportunities or goodwill, whether such loss arises in contract, tort (including negligence), breach of statutory duty, misrepresentation or otherwise.
Subject to the liabilities that cannot lawfully be excluded or limited above, AppTest Direct's total aggregate liability arising out of or in connection with an Engagement shall not exceed £1,000,000.
The liability cap applies to all claims arising out of or in connection with the relevant Engagement, whether arising in contract, tort (including negligence), breach of statutory duty, misrepresentation or otherwise.
Nothing in these Terms limits the Customer's obligation to pay any fees properly due to AppTest Direct.
21. Customer authority and third-party claims
The Customer is responsible for ensuring that the testing it commissions is properly authorised.
The Customer is responsible for losses, claims or reasonable costs arising from materially inaccurate or misleading representations that it:
- owns a target;
- controls a target; or
- has permission to authorise testing of a target,
except to the extent that the relevant loss is caused by AppTest Direct's own breach, negligence or unlawful conduct.
AppTest Direct may require evidence of authority where appropriate.
22. Personnel and service providers
Penetration testing Services will be delivered by AppTest Direct personnel and, where appropriate, suitably qualified contractors engaged by AppTest Direct.
Anyone involved in delivering the Services who is given access to confidential Customer information will be subject to appropriate confidentiality and security obligations.
AppTest Direct may use third-party service providers to support its business operations and delivery of the Services, including services used for communications, secure file handling, hosting, administration and other supporting functions.
Where a third-party service provider processes Customer personal data on behalf of AppTest Direct, AppTest Direct will comply with applicable data-protection requirements relating to processors and sub-processors.
AppTest Direct remains responsible for the Services it has contracted to provide.
23. Changes to scope
The Customer may request changes to the agreed scope.
No change or deviation that expands the authorised testing scope will be acted upon until it has been approved in writing by an authorised representative of the Customer and confirmed by AppTest Direct. Where appropriate, an updated Authority to Test or Rules of Engagement will be required before testing proceeds.
A change may affect:
- pricing;
- testing dates;
- delivery dates;
- required access;
- testing effort;
- technical feasibility; or
- the applicability of the original fixed-price Service.
AppTest Direct will communicate any material commercial change before undertaking additional chargeable work.
Where an additional target, application, API, environment, IP address or other asset falls outside the original agreed scope, additional fees may apply.
24. Force majeure
Neither party will be liable for delay or failure to perform an obligation, other than an obligation to pay amounts already due, where the delay or failure results from circumstances outside its reasonable control.
The affected party will take reasonable steps to minimise the impact and resume performance when reasonably possible.
Such circumstances may include significant:
- internet or telecommunications failure;
- cloud or hosting provider outages;
- power failure;
- natural disasters;
- industrial disputes;
- government action;
- civil emergencies;
- widespread cyber incidents; or
- other events outside the affected party's reasonable control.
If such circumstances continue for a prolonged period and materially prevent the Services from being provided, either party may terminate the affected Engagement by written notice.
25. Termination
Either party may terminate an Engagement where the other party commits a material breach and, where the breach can reasonably be remedied, fails to remedy it within a reasonable period after receiving written notice.
AppTest Direct may immediately suspend or terminate an Engagement where:
- continuing would be unlawful;
- valid Authority to Test is absent or withdrawn;
- the Customer deliberately provides materially false authority or scope information;
- continuing testing creates an unacceptable security, legal or operational risk;
- the Customer requests termination; or
- an undisputed payment remains materially overdue after appropriate notice.
Termination does not affect rights and obligations that arose before termination.
Terms relating to:
- confidentiality;
- intellectual property;
- data protection;
- liability;
- payment; and
- any provisions intended by their nature to continue
will survive termination.
26. Third-party systems and services
The Customer acknowledges that some Services may involve systems, hosting providers, cloud services or other infrastructure operated by third parties.
The Customer is responsible for obtaining any permissions required by those third parties unless expressly agreed otherwise.
AppTest Direct is not responsible for the availability or operation of third-party systems outside its reasonable control.
Where a third-party provider restricts, blocks or otherwise prevents authorised testing, this may affect the testing that can reasonably be completed.
AppTest Direct will inform the Customer where such restrictions materially affect the Engagement.
27. Communications
The Customer must provide accurate and current contact information for the Engagement.
Notices and operational communications may be sent by email to the contact details supplied by the Customer.
The Customer is responsible for ensuring that appropriate personnel monitor relevant communications during the Engagement.
Where an urgent issue arises during testing, AppTest Direct may use the emergency contact details supplied through the Test Details or Rules of Engagement.
28. General
Neither party creates a partnership, joint venture, employment relationship or agency relationship with the other through these Terms.
Neither party may represent that it has authority to bind the other.
The Customer may not assign an Engagement without AppTest Direct's prior written consent, such consent not to be unreasonably withheld.
AppTest Direct may assign its rights and obligations as part of a genuine business transfer or reorganisation, subject to applicable law.
A person who is not a party to the agreement has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms.
If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions will continue in effect.
A failure or delay in exercising a contractual right does not waive that right.
These Terms and the documents incorporated into the Engagement constitute the agreement between the parties in relation to the Services and supersede previous discussions or representations concerning that Engagement, except in cases of fraud or fraudulent misrepresentation.
29. Changes to these Terms
The version of these Terms that applies to an Engagement is the version accepted when the relevant Order is entered into, unless the parties expressly agree otherwise.
AppTest Direct may update these Terms from time to time for future Engagements.
Updates will not retrospectively alter an existing Engagement without agreement between the parties.
The current version and effective date will be displayed on the AppTest Direct website.
30. Governing law and jurisdiction
These Terms, the Engagement and any dispute or claim arising out of or in connection with them are governed by the laws of England and Wales.
The courts of England and Wales will have exclusive jurisdiction, unless the parties expressly agree otherwise in writing.
31. Contact
Questions about these Terms or an existing Engagement can be sent to:
AppTest Direct Ltd
Email:
hello@apptestdirect.com
Registered office:
9 Market Place, Hedon, Hull, England, HU12 8JA.
Company number:
17459475