Terms of business.

Kay Konsulting Limited (“we”), company number 17445525, registered in England and Wales, with its registered office at 66 Paul Street, London EC2A 4NA. Email hello@kaykonsulting.com. “You” means the person or business buying the service.

These terms apply to everything bought through this site: the fixed scope services on the services and pricing pages, the automated services, retainers, and the discovery deposit. An engagement we quote separately in writing is governed by that written scope together with these terms; if the two conflict, the written scope wins.

An order is placed when you pay through Stripe, and accepted when we confirm it by email. The description on the site at the time you pay is the scope of what you have bought.

Each service lists what it includes and a turnaround. Turnarounds are in working days, Monday to Friday excluding English bank holidays, and start when we have what we need to begin: the address or access, and answers to the short intake email we send after payment. If those arrive late, the date moves with them.

If we cannot do the work, because it is outside what we do, because we are not satisfied you are entitled to have the target reviewed, or because doing it would be unsafe or unlawful, we will tell you within two working days and refund you in full.

The Automated Scan, Automated Review and Automated Deep Review are produced by software with no human review. They look at your site from the outside, the way a visitor or a search engine would, and report what can be found that way. The scan is emailed to the address on the order within minutes of payment; the larger automated reviews follow within one working day.

They are a floor, not a verdict. They say nothing about your code, they cannot see anything behind a login, and they can be wrong in both directions. They are not a security audit and they are not a guarantee that anything is, or is not, secure. If an automated service cannot run because the address is unreachable, private or malformed, we will either run it by hand or refund you in full.

By giving us an address, repository or system to review, you confirm that you own it or have the owner’s authority to have it reviewed, and that any third party who hosts it permits that. You will cover any loss or claim we suffer because a target turns out to be one you were not entitled to give us.

The automated services, page reviews and teardowns are passive: ordinary requests any visitor could make, and public DNS lookups. Anything more intrusive, such as the testing in a security audit, is done only within a written scope with your written authorisation, and never against systems outside that scope.

Prices are in pounds sterling and exclude VAT. Where VAT is chargeable it is shown before you pay, or on the invoice. Payment is by card through Stripe Checkout; card details go to Stripe and never reach us. Stripe issues a receipt and a numbered invoice for every payment.

If you would rather pay by bank transfer or be invoiced on terms, ask and we will send an invoice, payable within fourteen days. We may change published prices at any time, but never for an order already placed: the price you paid is the price.

Retainers are billed monthly in advance, by card, on the day you subscribe and on the same day each month after. Hours do not roll over, and unused hours are not refunded. Response-time commitments are targets during UK working hours, not guarantees.

You can cancel at any time, by email or through the link on your Stripe invoice. Cancellation takes effect at the end of the month you have paid for, and nothing further is charged. We can end a retainer with one month’s notice, and immediately if payment fails and is not put right within seven days.

• Before work starts, you can cancel any fixed scope service for a full refund. Work starts when you answer the intake email or give us access, whichever comes first.
• After work starts, we refund the part not yet done, estimated fairly, and send you whatever findings exist at that point.
• The automated services start the moment you pay. By buying one you ask us to begin straight away, and once its report has been sent there is nothing left to cancel. If it fails to run, see section 4.
• The discovery deposit is refunded in full if, after the scoping session, either of us decides the engagement is not a fit. Otherwise it is credited against the engagement we agree.
• If you are buying as a consumer, rather than for a business, you have fourteen days from the order to cancel under the Consumer Contracts Regulations 2013. Asking us to start within those fourteen days, which buying an immediately delivered service does, means you pay for what has been done, and the right ends once the service is fully delivered. Nothing here affects your statutory rights.

Refunds go back to the card you paid with, through Stripe, within ten working days of our agreeing them.

Timely access and information, and honest answers to intake questions. Backups of anything we are asked to look at. Warning of anything that could make a review unsafe, such as a shared production system or a third party who has not agreed. Never credentials through the forms on this site: we arrange access properly once we start. What you do with the findings, and in what order, is your decision.

Reports, recordings, reproductions and any patch or code we hand over are yours to use, keep, and share with your developers, customers, auditors and regulators, without limit and without further payment. You do not get to resell them as your own work. We keep ownership of our methods, tooling, templates and know-how, and may reuse what we learn in anonymised form. We will not name you as a client, publicly or to anyone else, without your written consent.

Everything we learn about your systems and your business in the course of the work is confidential. We use it only for the work, disclose it only to the providers named in our privacy policy as far as they need it to provide their service, or where the law requires, and we never publish findings. This survives the end of the engagement. If we find a problem that affects people beyond you, for example in a widely used library, we will agree with you how it is disclosed responsibly.

If you would like a signed non-disclosure agreement before telling us anything at all, our standard mutual NDA is published. Ask, or tick the box on the contact form, and we will countersign it before work starts. Where it and these terms differ, the stricter obligation applies.

A review is a professional opinion based on what could be seen at the time, and every finding is given with its reasoning so you can check it. We cannot promise that a review finds every issue, that a system is or will remain secure, accessible or fast, or that a finding will not be overtaken by a change you or a supplier makes later. We do not promise outcomes, such as passing a third party’s audit, a regulator’s view, or an improvement in conversion, and we are not responsible for systems we did not review or changes we did not make.

Nothing in these terms limits our liability for death or personal injury caused by negligence, for fraud, or for anything else the law does not allow us to limit. Otherwise, our total liability to you in connection with a service is limited to the fees you paid for that service, and we are not liable for loss of profit, revenue, business or data, or for indirect or consequential loss. We are not liable for the effects of testing carried out within an agreed scope with reasonable care, nor for problems caused by information you gave us that was wrong or incomplete. If you are a consumer, this section does not affect your statutory rights.

How we handle personal data is set out in our privacy policy. Where the work means we process personal data held in your systems, we do so on your instructions and only as far as the work requires, and we will sign a data processing agreement if you need one.

Either of us can end an engagement if the other is in serious breach of these terms and has not put it right within fourteen days of being told. We can refuse or stop work we consider unlawful or unsafe, in which case we refund the part not done. Sections 10 to 13 continue to apply afterwards.

These terms, the description of the service on the site when you paid, and any written scope are the whole agreement between us, and we are not bound by anything not written in them. If a part of these terms is found unenforceable, the rest still applies. Neither of us may pass the agreement to someone else without the other’s consent, and nobody else can enforce it. Notices are by email to the addresses each of us has used. The version of these terms in force when you paid is the one that applies to that order.

These terms are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction. If you are a consumer living in Scotland or Northern Ireland you may also bring proceedings there.

If something has gone wrong, email hello@kaykonsulting.com. We will acknowledge it within two working days and aim to resolve it within fourteen. We would rather hear the complaint than lose the client.