LEGAL · TERMS

Terms of Service

Effective October 7, 2026 · Last updated October 7, 2026

Short version: no authorization, no testing. Every intrusive engagement starts with written authorization and rules of engagement.

Agreement to these terms

These Terms of Service (“Terms”) govern your access to weblumelabsllc.com (the “Site”) and any intake request, proposal, or engagement with Weblume Labs LLC, a Kentucky limited liability company (“Weblume Labs,” “we,” “us”). By using the Site or submitting an intake request you agree to these Terms. If you are acting for an organization, you confirm that you have authority to bind it.

Paid work is performed only under a written engagement agreement, statement of work, or accepted proposal (together, an “Engagement Agreement”). If an Engagement Agreement conflicts with these Terms, the Engagement Agreement controls for that engagement.

What we do

Weblume Labs provides cybersecurity and information-security services, including security audits, vulnerability assessments, authorized penetration testing, security configuration and hardening, recommendations and reports, remediation planning, re-test and validation passes, and security awareness briefings. Descriptions and starting prices on the Site are summaries; the scope, deliverables, schedule, and fee for any engagement are those stated in the Engagement Agreement.

Authorization requirement

We do not test, scan, probe, or change any system without written authorization. This is a condition of every engagement, not a courtesy.

Before work begins, you must give us written authorization that identifies the systems, networks, applications, accounts, and IP ranges in scope
You must be the owner of each in-scope system, or hold documented legal authority to permit testing on the owner’s behalf
For hosted, cloud, or third-party-operated systems, you are responsible for obtaining any permission the provider requires and for telling us about provider rules we must follow
Authorization covers only the targets, methods, time windows, and intensity named in the rules of engagement; anything not named is out of scope
We may pause or end work immediately if we believe authorization is missing, incomplete, or has been withdrawn

Rules of engagement

For penetration testing and any intrusive assessment, a written rules-of-engagement document (“RoE”) is required before work starts. The RoE records, at a minimum:

In-scope and out-of-scope targets
Permitted techniques and prohibited actions, such as denial-of-service, destructive payloads, social engineering, or physical entry, which are excluded unless expressly contracted
Testing windows, rate limits, and escalation contacts, including an emergency contact reachable during testing
Handling of credentials, test accounts, and any data encountered
Conditions for stopping work and procedures if a critical issue or active incident is observed

No unauthorized testing

The Site, our proposals, and any published information about our methods are not permission to test any system, and nothing we publish should be used to test systems you do not own or are not authorized to test. You agree not to ask us to test systems without authorization, and not to use our deliverables to attack, access, or disrupt any system without permission. Requests that we believe involve unauthorized access will be declined and may be reported where the law requires.

Client responsibilities

You agree to:

Provide accurate scope information, contacts, and access that we reasonably request
Back up in-scope systems and data before testing or configuration changes, and maintain your own recovery capability
Notify your hosting providers, internal teams, and any managed security provider about testing windows where appropriate, so that testing is not mistaken for an attack
Review and approve configuration changes before they are applied to production systems
Act on findings at your own discretion; remediation decisions and their consequences remain yours

Risks inherent in security testing

Security assessment can cause unintended effects, such as service slowdowns, lockouts, log noise, or, in rare cases, instability of fragile systems. We design engagements to be careful and non-destructive by default, but you accept that some residual risk exists and that testing is carried out on the systems as you operate them. Our responsibility for such effects is limited as set out in these Terms and the Engagement Agreement.

Confidentiality of findings

We treat your non-public information and all findings, reports, and working notes as confidential. We will use them only to perform the engagement and will disclose them only to people with a need to know who are bound by confidentiality duties, or where required by law. You agree to keep our proposals, pricing, and methodology documents confidential and not to share deliverables outside your organization in a way that would expose us to third-party claims. If we are compelled by law to disclose confidential information, we will, where permitted, tell you first.

Fees, quotes, and payment

Starting prices on the Site (“From $X”) describe the minimum scope listed with each offering and are not binding quotes. Final fees are set in the Engagement Agreement after a fit review. Unless the Engagement Agreement says otherwise: invoices are payable in U.S. dollars within 14 days of the invoice date; deposits may be required before scheduling; work outside the agreed scope is quoted and approved in writing before it begins; and late amounts may accrue interest at the lesser of 1% per month or the maximum permitted by law. You are responsible for applicable taxes other than taxes on our income.

Deliverables and acceptance

Reports and recommendations reflect conditions observed during the engagement window. Because systems change, findings describe a point in time and are not a statement that a system is or will remain secure. Starting prices include one revision round on written recommendations unless stated otherwise. A deliverable is deemed accepted if you do not raise a written, specific concern within 10 business days of delivery.

Intellectual property

The Site, its design, text, marks, and our methodologies, templates, tooling, and know-how are owned by Weblume Labs or its licensors. On full payment, you receive a non-exclusive, non-transferable license to use the reports and deliverables prepared for you for your internal business and compliance purposes. You keep ownership of your systems, data, and pre-existing materials. We keep ownership of general knowledge, techniques, and tools developed or used in the course of our work, provided they do not contain your confidential information.

Acceptable use of the Site

You agree not to:

Probe, scan, or test the Site or its hosting infrastructure for vulnerabilities without our prior written permission
Submit unlawful, deceptive, or malicious content, or attempt to inject code through the intake form
Use automated means to submit the form in volume, scrape the Site in a way that burdens it, or interfere with its operation
Impersonate another person or submit a request on behalf of an organization you are not authorized to represent
Misuse the Site in violation of applicable law

What we do not provide

Weblume Labs is not a certification or accreditation body, insurer, law firm, managed security operations center, or incident-response retainer provider. We do not provide 24/7 monitoring, legal advice, or guarantees of compliance, audit results, insurance eligibility, or freedom from breach. Compliance determinations remain with your organization and its advisers.

Disclaimer of warranties

The Site is provided “as is” and “as available.” To the fullest extent permitted by law, we disclaim all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement. We perform services with reasonable care and skill, but we do not warrant that testing will find every vulnerability, that systems will be free of defects, or that any remediation will prevent an incident.

Limitation of liability

To the fullest extent permitted by law, Weblume Labs will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, goodwill, or data, arising from the Site or any engagement. Our total aggregate liability for any claim relating to an engagement is limited to the fees you paid to us for that engagement in the three months before the event giving rise to the claim. These limits do not exclude liability that cannot be excluded by law. Nothing in these Terms limits your liability for unauthorized instructions or for providing scope or authorization you were not entitled to give.

Indemnification

You agree to indemnify and hold harmless Weblume Labs and its members and personnel from third-party claims, losses, and reasonable expenses arising from: (a) your lack of authority over, or failure to obtain permission for, systems you placed in scope; (b) your breach of these Terms or the Engagement Agreement; or (c) your misuse of deliverables.

Suspension and termination

We may decline, suspend, or end any engagement or your use of the Site if you breach these Terms, if authorization is unclear, or if continuing would put people or systems at undue risk. You may end an engagement as described in our Cancellation & Refund Policy. Sections that by their nature should survive termination, including confidentiality, intellectual property, payment, disclaimers, limitation of liability, indemnification, and governing law, will survive.

Governing law and disputes

These Terms and any dispute arising from the Site or an engagement are governed by the laws of the Commonwealth of Kentucky, without regard to conflict-of-law rules. The parties agree to try first to resolve a dispute through good-faith written discussion for 30 days. Any claim not resolved that way must be brought in the state or federal courts located in Fayette County, Kentucky, and each party consents to that venue and jurisdiction, unless the Engagement Agreement specifies another arrangement.

General

These Terms, together with the Engagement Agreement and the policies linked in the Site footer, form the entire agreement on their subject matter. If a provision is held unenforceable, the remainder stays in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our written consent; we may assign them in connection with a business transfer. Notices may be sent to the contact details below or to the email address you gave us.

Changes to these Terms

We may update these Terms from time to time. The effective date above shows the current version. Changes do not alter the terms of an Engagement Agreement already signed unless both parties agree in writing.

Contact

Questions about these Terms:

Weblume Labs LLC
710 E Main St, Lexington, KY 40502, United States
network@weblumelabsllc.com · +1 (224) 974-3213