Legal Terms | RD Security

1. Scope and contract documents

Our services are offered to businesses only (Unternehmer, § 14 BGB), not to consumers.
All engagements are contracted with RiveDrive UG (haftungsbeschränkt).
The agreement consists of the following documents. If they conflict, they apply in this order: the signed proposal, the written authorization, the rules of engagement, the data processing agreement, and these terms.
The client’s own general terms and conditions do not apply, even if they are referenced in an order or we do not object to them.
Individually agreed terms take precedence over these terms (§ 305b BGB).
Changes and additions to these terms must be made at least in text form. Email is sufficient.

2. Nature of the service

Our services are provided as a service contract (Dienstvertrag, § 611 BGB). We owe testing performed with professional care within the agreed scope and time. We do not owe a specific result, such as finding every vulnerability. There is no formal acceptance (Abnahme).
The services are performed by testers employed by RiveDrive. RiveDrive remains responsible to the client for their work.

3. Authorization

Testing never starts without a written authorization signed by the client’s managing director or a person with written power of attorney.
The client confirms it owns or controls every system in scope.
For systems hosted by third parties (cloud, SaaS, hosting providers), the client confirms that testing complies with those providers’ policies and obtains any consent they require.
RiveDrive may verify ownership of domains and systems before testing.
Systems outside the agreed scope are never tested. If a target turns out to belong to a third party, testing of it stops immediately.
If there is reasonable doubt about the authorization, RiveDrive may pause testing until it is resolved. A delay caused by such a pause is not a breach of duty by RiveDrive.

4. Risk acknowledgement

The client acknowledges that a penetration test uses real attack techniques against live systems. Despite all precautions, testing can cause unexpected effects such as slowdowns, errors, locked accounts or interruptions. The client accepts these risks, subject to RiveDrive’s liability under section 8.

5. Client cooperation

The client provides in good time: test accounts for each user role in scope, relevant documentation, a technical contact, and an emergency contact reachable during all testing windows.
Before testing starts, the client makes a complete backup of all systems and data in scope. During testing, it repeats backups at least every 3 working days. Backups must allow full restoration of the affected data and systems. The client confirms its backups in writing on request.
The client informs third parties affected by the testing, such as hosting or cloud providers, where required.
Delays or additional effort caused by missing cooperation are charged at the day rate stated in the proposal.

6. Indemnification

To the extent the client is responsible for the cause (§ 276 BGB), the client indemnifies RiveDrive UG, its managing director and its employees, including testers, against third-party claims, against fines where such indemnification is legally permitted, and against reasonable legal costs, arising from incorrect or incomplete authorization, errors in the scope the client provided, or the client’s breach of these terms.

7. No guarantee

A security assessment is a point-in-time review. It cannot find every vulnerability, and we do not guarantee that systems are secure after testing.
A security incident after the engagement does not by itself establish a breach of duty by RiveDrive.
Compliance readiness services do not guarantee an audit result. The certification decision rests solely with the client’s auditor.

8. Limitation of liability

RiveDrive is liable without limit for intent and gross negligence, for injury to life, body or health, for fraudulently concealed defects, for any guarantee expressly given, and under the Product Liability Act.
For slight negligence, RiveDrive is liable only for breach of essential contractual obligations. These are obligations whose fulfilment makes proper performance of the agreement possible in the first place, and on whose fulfilment the client regularly relies and may rely. In these cases, liability is limited to the typical damage foreseeable when the agreement was concluded and, where the signed proposal contains an individually negotiated maximum amount, to that amount.
In all other cases of slight negligence, RiveDrive is not liable.
The client is responsible for current backups of all systems in scope. In cases of slight negligence, liability for data loss is limited to the typical effort of restoring the data that would have been required if those backups had been made.
These limitations also apply to the personal liability of RiveDrive’s managing director and employees, including testers.
RiveDrive does not provide professional liability or cyber insurance for engagements.

9. Expiry of claims

Claims against RiveDrive become time-barred (Verjährung) 12 months after delivery of the final report, or after the end of the engagement if no report was delivered. This does not apply to cases of unlimited liability under the first point of section 8.

10. Testing rules

We never perform denial-of-service, load or stress tests, or destructive tests that delete or change production data. These are not offered.
Vulnerabilities are exploited only as far as needed to prove their real-world impact. We do not extract data beyond the minimum needed as evidence, and we never install persistent backdoors.
Testing takes place only within the agreed testing windows and only from the source IP addresses listed in the rules of engagement.
Testing stops immediately if a system becomes unstable, or at any time on the client’s request.
At the end of testing, we remove all test accounts, files and tools we created. Anything we cannot remove ourselves is listed in the report for the client to remove.
If we find evidence of an existing breach, illegal content, or a vulnerability in a third party’s product, we stop that line of testing and inform the client immediately. Any further action or disclosure is the client’s decision, unless the law requires otherwise.

Offered only after the client confirms in writing that its works council has been involved where required, and that employee data protection requirements are met.
The client approves the list of target employees in advance. Only the client’s own employees and contractors on that list are targeted, never private accounts or private devices.
For the agreed tests only, the client authorizes RiveDrive to contact its employees and contractors under a false identity, and to use the client’s name, logos and trademarks.
Calls are never recorded.

12. Data protection

RiveDrive processes personal data on the client’s behalf. A data processing agreement under Art. 28 GDPR is signed before testing starts.
Testing and test data storage take place in Germany. All testers are located in and work from Germany. Correspondence and contract administration use Google Workspace, which may process data outside the EU under the safeguards set out in the data processing agreement.
Testers are RiveDrive employees. They process personal data only on RiveDrive’s instructions (Art. 29 GDPR) and are bound to confidentiality (Art. 28(3)(b) GDPR).
Any other sub-processors are named in the data processing agreement. RiveDrive informs the client before adding or replacing one, and the client may object on reasonable data protection grounds.
Client data is stored only on encrypted devices and storage, accessible only to the testers assigned to the engagement.

13. Confidentiality and reports

All findings and client information are strictly confidential and shared only with the client’s named contacts, unless the law requires disclosure. This obligation continues for 5 years after the engagement ends.
Project communication and reports are in English or German, as agreed in the proposal. Reports are delivered through an encrypted channel.
Reports are for the client’s internal use. The client may share them with its auditors, investors or customers under confidentiality, but no third party may rely on a report or bring claims against RiveDrive based on it.
The confirmation letter contains no vulnerability details and may be shared freely. It confirms only the scope and testing period, and does not guarantee the security of the systems tested.
The client may not publish a report or name RiveDrive as its tester without our written consent. RiveDrive does not name the client publicly without the client’s written consent.
Tester identities are kept confidential, unless the law requires disclosure.

14. Retest

Each assessment package includes one retest of the findings in the final report.
The retest must be requested within 90 days of delivery of the final report. If it is not requested in time, it lapses without refund.
The retest covers only the original findings. New systems or features count as a change of scope.

15. Changes of scope

Changes to the agreed scope require a written change request accepted by both parties. Additional work is charged at the day rate stated in the proposal.

16. Data deletion

Credentials and accesses we received are removed at the end of each testing phase. A new testing phase, such as the retest, uses fresh credentials from the client.
All other client data is permanently deleted after the retest, or once the 90-day retest window has lapsed. The client receives a signed deletion certificate.
Exceptions: contracts, invoices and business correspondence, kept for the periods required by German commercial and tax law; and minimal testing logs (timestamps, source IPs, targets and actions, no client data), kept for 13 months after delivery of the final report as evidence and then deleted.

17. Prices, payment and cancellation

All prices are net, plus statutory VAT. For clients in other EU countries, the reverse charge procedure applies where its conditions are met.
Proposals are valid for 30 days.
50% of the fee is invoiced on signing. Testing starts only after this payment is received.
The remaining 50% is invoiced on delivery of the final report.
Invoices are due within 14 days.
If the client cancels or postpones testing, or fails to provide the required access or cooperation in time, the following share of the fee is due, measured from the agreed start of testing: more than 3 weeks before, only costs already incurred, up to 10%; less than 3 weeks, 10%; less than 2 weeks, 20%; less than 1 week, 30%. This amount never exceeds 30% of the fee. Work performed after testing has started is paid under section 18.
The client may prove that RiveDrive suffered no loss or a lower loss. Costs RiveDrive saved are taken into account. Amounts already paid are offset, and any excess is refunded.
On late payment, statutory default interest applies, and RiveDrive may pause work and withhold reports until the overdue amount is paid.

18. Termination

Either party may terminate the agreement for good cause (§ 626 BGB). Other mandatory statutory rights of termination, including § 627 BGB where it applies, are not affected.
Good cause for RiveDrive includes in particular: non-payment, failure to provide a valid authorization, or a request by the client to perform testing that is unlawful or outside the agreed testing rules.
On termination, work performed up to that point is paid at the day rate stated in the proposal, up to the agreed fee. Amounts already paid are offset against this. § 628 BGB otherwise applies.

19. Force majeure

Neither party is liable for delays or failures caused by events beyond its reasonable control, such as natural disasters, widespread outages of internet or cloud infrastructure, or official orders.

20. Final provisions

The client may transfer rights under the agreement to third parties only with RiveDrive’s written consent. § 354a HGB is not affected.
German law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). If the client is a merchant, a legal entity under public law or a special fund under public law, the exclusive place of jurisdiction is Berlin.
If any provision is or becomes invalid, the remaining provisions stay in effect, and statutory law applies in its place (§ 306 BGB).
German legal terms given in brackets determine the meaning of the English wording next to them.