Terms of Service

1. Acceptance of terms

These terms are between you and verrou, Inc., a Delaware corporation trading as verrou (“verrou”, “we”, “us”). By accessing this website, contacting us, or engaging verrou for any service, you agree to be bound by these Terms of Service and by any additional terms referenced here. If you are entering into these terms on behalf of a company or other legal entity, you represent that you have the authority to bind that entity. If you do not agree with these terms, please do not use our website or services.

2. Description of services

verrou is a boutique security consultancy. We provide post-quantum cryptography (PQC) readiness, artificial intelligence security, and product penetration testing services, delivered by senior practitioners. This website provides general information about those offerings. Content on the website is for informational purposes only and does not constitute security, legal, or professional advice, and does not create a consulting relationship on its own.

3. Engagement terms

Specific work is governed by a signed statement of work (SOW), proposal, or master services agreement between you and verrou. That signed document defines the scope, deliverables, timeline, fees, and any service-specific terms for your engagement.

Where a signed SOW, proposal, or agreement conflicts with these Terms of Service, the signed document controls for that engagement. These terms apply to your general use of the website and fill any gaps not addressed by a signed agreement.

4. Client responsibilities & authorization

Our security testing services are intended to be performed only against systems, applications, networks, and data that you own or are expressly authorized to test. Before any testing begins, you agree to:

• Confirm, in writing, that you have full authority to authorize testing of the in-scope targets, and that this authority extends to any third-party infrastructure or hosting providers involved.
• Obtain any consents, notifications, or approvals required from hosting providers, cloud platforms, or other affected parties before work begins.
• Provide accurate scope information, access, and points of contact, and promptly flag any systems that must be excluded.
• Maintain your own backups and, where appropriate, test in an environment that will not disrupt production or third parties.

You are responsible for the accuracy of the authorization and scope you provide. verrou is not liable for consequences arising from targets that you did not have the right to authorize for testing.

5. Intellectual property

The verrou name, logo, website content, methodologies, and proprietary tooling — including our in-house PQC scanner — are the property of verrou or its licensors and are protected by applicable intellectual property laws. Except as granted in a signed agreement, no license to our marks, software, or materials is transferred to you.

Deliverables prepared specifically for your engagement — such as reports, findings, and roadmaps — are addressed in your signed SOW or agreement, which sets out ownership and permitted use. Unless that agreement states otherwise, we retain ownership of our underlying know-how, templates, and tooling, and any generalized knowledge, techniques, and experience gained during an engagement.

6. Confidentiality

Security work involves sensitive information. Both parties agree to protect the other’s confidential information, to use it only for the purposes of the engagement, and to disclose it only to personnel who need it to perform the work. Testing results, findings, and reports produced for you are treated as your confidential information. The specific terms, duration, and any exclusions of these obligations are set out in your signed agreement or non-disclosure agreement, which governs in the event of a conflict with this section.

7. Warranties & disclaimers

verrou performs services in a professional and workmanlike manner, consistent with recognized industry practices, and using appropriately experienced practitioners. This is the extent of our warranty for the services.

Security cannot be guaranteed to be absolute. A penetration test, assessment, or advisory engagement reflects a point in time and a defined scope; it cannot identify every vulnerability, and it does not guarantee that your systems are secure or that a breach will not occur. To the fullest extent permitted by law, and except for the express warranty above, our services and this website are provided "as is" and "as available," and we disclaim all other warranties, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

8. Limitation of liability

To the fullest extent permitted by applicable law, verrou will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, data, or goodwill, arising out of or relating to the website or our services, even if we have been advised of the possibility of such damages.

Any specific cap on verrou’s total aggregate liability for a given engagement is set out in the applicable signed agreement. Where no such cap is stated, our total aggregate liability is limited to the fees paid to verrou for the engagement giving rise to the claim. Some jurisdictions do not allow certain limitations or exclusions of liability, so parts of this section may not apply to you.

9. Indemnification

You agree to indemnify, defend, and hold harmless verrou and its personnel from and against any claims, damages, losses, liabilities, and reasonable expenses (including legal fees) arising out of your breach of these terms, your misuse of our website or deliverables, or your failure to hold the necessary authorization for any system submitted for testing. The specific indemnification terms for a paid engagement are set out in the applicable signed agreement, which controls in the event of a conflict with this section.

10. Acceptable use of this website

Do not attack, disrupt, or probe this website beyond what our responsible disclosure policy at /.well-known/security.txt covers, scrape it abusively, or use the contact form to send spam. Our pages link to external sites — including rouage, our development practice — and we are responsible for our own sites, not the rest of the internet.

11. Governing law

These terms, and any dispute arising out of or relating to them or to our services, are governed by the laws of the State of Delaware, without regard to its conflict-of-laws principles. The parties submit to the exclusive jurisdiction of the courts located in the State of Delaware, unless a signed agreement specifies a different forum or a binding dispute-resolution process.

12. Changes to these terms

We may update these Terms of Service from time to time. When we do, we will revise the "Last updated" date above. Material changes take effect when we post the updated terms on this website, and your continued use of the website or services after that constitutes acceptance of the revised terms. We encourage you to review this page periodically.

13. Contact

Questions about these terms can be directed to hello@verrou.ai or through our contact page. For details about how we handle personal data, see our Privacy Policy.