B-52 Terms of Service

These Terms of Service ("Terms") are a binding agreement between you and Security Brigade InfoSec Private Limited ("Security Brigade", "we", "us" or "our"), a company incorporated in India (CIN U74999MH2011PTC217821, GSTIN 27AAPCS8899B1ZK) with its registered office at A 2604, Lodha Adrina, Lodha Park, Opp. Hard Rock Cafe, Pandurang Budhkar Marg, Worli, Mumbai 400013, Maharashtra, India.

B-52 is a product of Security Brigade InfoSec Private Limited. It is not a separate legal entity, and these Terms are entered into with Security Brigade.

1. Who these Terms apply to

These Terms apply when you buy or use B-52, our agentic penetration-testing product, through b52security.com, including through the online pricing wizard ("the Wizard"). "You" means the organisation placing the order. If you place an order on behalf of an organisation, you confirm that you have authority to bind it.

If you have signed a Master Services Agreement, order form, statement of work or proposal with us for B-52, that document prevails over these Terms where the two conflict. These Terms, the Refund Policy and the B-52 Data Processing Agreement ("DPA") together make up the agreement for an order ("the Agreement").

2. What you are buying

B-52 runs penetration tests against targets you own or are authorised to test, within a written scope. The Wizard lets you configure an assessment and shows its price before you pay. Your quote and order confirmation record what you bought: the target type, the delivery model, the term, the number of assessments, and the deployment option ("the Configuration").

Each assessment is delivered in the delivery model stated in your Configuration. A report from a fully autonomous assessment is produced by the platform. It does not carry an individual auditor's signature unless your Configuration says so.

2.1 Terms (purchase options)

Term	What it includes	Period
One-Time	1 assessment	Delivered once
Half-yearly	2 assessments, generally one every six months. Offered to buyers billed in India, for a web app, API or mobile app	12 months
Quarterly	4 assessments, generally one each quarter	12 months
Annual	12 monthly comprehensive assessments; each includes one post-fix re-validation round within its two included retests	12 months
Continuous	Daily automated testing within the agreed scope	12 months, agreed by proposal (section 2.3)

For an Annual programme, B-52 conducts one comprehensive assessment in each month of the programme. After you have addressed findings from that month's assessment, one re-validation round may be run against those fixes as part of the two retests included with that assessment; it is not an additional comprehensive assessment or an unlimited retesting entitlement. Assessment runs may be scheduled in advance or manually initiated within the programme term, subject to the agreed scope, availability and written authorisation.

Half-yearly, Quarterly and Annual programmes run for 12 months and are paid in advance, in full or in instalments (section 3.4). The 12 months start on the date the first assessment in the programme starts. Assessments in a programme that are not used within the 12 months lapse, subject to the Refund Policy.

2.2 Services agreed by proposal

The Wizard prices supported configurations of web applications, APIs, mobile applications, cloud accounts, external networks, internal networks and source code online. The applicable scope limits and exclusions are displayed before you proceed. Other configurations are agreed under a separate written proposal setting out scope, price and schedule. These include:

• agentic red-teaming;
• Active Directory;
• AI and LLM applications;
• thick-client applications;
• social engineering;
• Continuous testing;
• expert-verified or human-led delivery;
• dedicated or customer-hosted deployment;
• mixed-size portfolios, targets beyond the Wizard's supported limits, and arrangements to purchase services on behalf of clients; and
• other testing that requires a bespoke scope or delivery plan.

Where the Wizard routes a particular network or code configuration to a proposal because of its size, target structure or delivery requirement, that configuration is priced in the proposal. These Terms apply to proposals you accept; the accepted proposal prevails where the two conflict.

2.3 Continuous testing

Continuous is automated testing, run daily within the agreed scope for 12 months, on the terms of its proposal. It is not 365 separate reports, and it is not a report signed by an auditor for each day.

A "daily testing cycle" is one run of B-52's automated test set against the in-scope targets, started once in each 24-hour period of the term. The proposal sets out what each cycle covers. Findings from the cycles are reported through the B-52 dashboard and in the reports the proposal describes. A cycle can be paused or shortened where the target is unavailable, where you have withdrawn authorisation, or where continuing could put the target at risk. Cycles that do not run for those reasons are not a failure to deliver.

2.4 First-order credit

We may offer a promotional credit on an organisation's first order. Where we do:

• it can be used once per organisation;
• it applies to a One-Time assessment only, and never to a Quarterly, Annual or Continuous programme;
• it is taken off the price before GST, and the Wizard shows it before you pay;
• it cannot be transferred, and it cannot be exchanged or redeemed for cash.

3. Ordering, price and payment

3.1 Prices and quotes

The Wizard shows the price of each Configuration it prices online, and saves that price as a quote. A quote fixes its price for:

• 7 days, for a card or UPI payment made online;
• 30 days, for a bank transfer, an international wire, or a formal quotation.

If the quote expires before you pay, the price is recalculated and shown to you before you pay. Services agreed by proposal (section 2.2) are priced in the proposal.

3.2 Currency and tax

• If you are billed in India, the Wizard prices your selected configuration in INR using our India price list. The price breakdown shows 18% GST separately and the total payable in INR before you proceed. Your issued quote fixes the INR price for the validity period stated in section 3.1. No currency conversion or daily exchange rate is applied to an India order.
• Everyone else pays in USD. Billing outside India is an export of services and carries no Indian GST. Prices in USD exclude any tax, duty or withholding that applies in your own country, and you are responsible for it.

3.3 Payment

Payment is in advance. You can pay:

• by card or UPI, online through Razorpay;
• by bank transfer in India (NEFT, RTGS or IMPS), to an account number created for your order;
• by international wire transfer (SWIFT); or
• against a formal quotation, online or by bank transfer, once your organisation has approved it.

Payment places an order. It does not start testing. An order is confirmed when we receive its full amount: for a card or UPI payment, when Razorpay confirms it to us; for a bank transfer or wire, when the funds reach us. If you have paid and do not receive an order confirmation, contact us with your payment reference.

3.4 Online limit and instalments

A single online payment is subject to the payment limit shown in the Wizard for the order's billing currency. For INR orders, that limit is ₹5,00,000. Where an order is larger than the applicable limit:

• a Half-yearly, Quarterly or Annual programme may be paid in instalments, where the Wizard offers them. Each instalment is due before the period it pays for. We send each instalment as a payment link, and we never debit it automatically. If an instalment is not paid, the testing for its period is not scheduled;
• any other order is paid by bank transfer, by wire, or against a formal quotation.

3.5 Invoices

We raise a tax invoice for each paid order. If you are billed in India and want your GSTIN on it, give it to us before you pay.

4. Scope, authorisation and when testing starts

Testing starts only after the target, the scope and your written authorisation are confirmed with you. Until then your assessment has not started. We will contact you after payment to complete this step.

You confirm that:

• you own each target, or you are authorised to arrange security testing of it;
• where a target is hosted or operated by a third party (a cloud provider, a hosting provider, an affiliate), you hold any permission that party requires;
• the information you give us about the target and scope is accurate.

We test only within the written scope and authorisation. B-52 does not test systems outside it. Before an action that could affect production systems, move beyond the entry host, or use a live account's credentials or a real person's records, B-52 requires your separate written approval, as set out in the DPA.

We may decline or pause a target where we cannot verify that you own it or are authorised to test it, or where it falls outside the coverage classes we support for the order. In that case you are refunded under the Refund Policy.

Scope only goes up. We confirm the scope with you before testing starts.

• If the confirmed scope is larger than your Configuration, we send you a revised quote. You can approve it and pay the difference, or decline it and receive a full refund. Testing does not start until you have done one or the other.
• If the confirmed scope is smaller than your Configuration, the price stands.

5. Your responsibilities

You agree to:

• give us accurate and timely information, including target details, access, and a technical contact;
• tell the teams who run the target (security operations, IT, hosting providers) when testing will take place, so that it is not mistaken for an attack;
• revoke any credentials you issue for testing when the assessment ends;
• not use B-52, its reports or its methods for any unlawful purpose, or against any target you are not authorised to test;
• not share your account access with people outside your organisation, and not reverse-engineer, decompile or extract the source code of the platform;
• pay the fees for your order.

6. Rescheduling

You can ask to move the start date of an assessment, or the dates of assessments in a programme, by written request to us. We will agree a new date within the term where we can. Rescheduling does not extend the 12-month term and does not create a right to a refund.

7. Refunds and cancellation

Refunds are governed by the Refund Policy, which forms part of these Terms. In summary:

• before any assessment starts, you are refunded in full if you choose not to proceed, if we cannot verify ownership or authorisation of the target, if the target is outside the supported coverage classes, or if you decline a revised quote for a larger scope;
• once any assessment has started, there are no refunds, including for unused assessments in a Quarterly, Annual or Continuous programme and for instalments already paid, except where section 4.3 of the DPA gives a prorated refund;
• if Security Brigade fails to deliver the service you bought, you are refunded in full.

8. Intellectual property

Your deliverables. Reports, findings and remediation recommendations delivered to you under an order belong to you on full payment. You receive a perpetual, non-exclusive licence to use them for your internal business purposes.

Our IP. The B-52 platform, its methodologies, test sets, tooling, report templates and know-how remain the exclusive property of Security Brigade. No order transfers ownership of them to you.

Aggregated and anonymised data. We may use anonymised, aggregated and de-identified material from assessments to improve our services. No customer-identifiable information is disclosed. You can exclude your material from platform-improvement use under the DPA.

Website content. The content of b52security.com is the property of Security Brigade or its licensors and is protected by the Copyright Act, 1957 (India) and applicable international law. You may not reproduce, distribute or modify it without our written permission.

9. Confidentiality

Each party may receive confidential information of the other. "Confidential Information" includes vulnerability reports, test findings, source code, system architectures, security configurations, commercial terms, business strategies and anything marked confidential.

Each party shall hold the other's Confidential Information in strict confidence, shall not disclose it to any third party without prior written consent (except to employees and contractors who need to know and are bound by obligations no less protective), and shall not use it for any purpose other than performing or receiving the services.

This duty survives the end of the Agreement for five (5) years, or for as long as the information remains a trade secret, whichever is longer. A disclosure required by law, regulation or court order is not a breach, provided the disclosing party gives reasonable prior notice where the law permits.

10. Data protection

The DPA applies to the Personal Data we process for you. By accepting these Terms at the point of purchase, you accept the DPA. Standard Hosting applies to every order placed through the Wizard, unless we agree another Model Hosting Option with you in writing.

11. Availability, suspension and ending the Agreement

We may suspend an assessment immediately if we reasonably believe that continuing would put your production environment at risk, if authorisation is withdrawn or cannot be verified, or if you use B-52 in breach of these Terms. Either party may end the Agreement for cause on thirty (30) days' written notice if the other party materially breaches it and does not cure the breach within that period.

Where we suspend or end an order because you are in breach, section 7 and the Refund Policy apply as they stand: if an assessment has started, there is no refund. Where we suspend or end an order and the cause is our own failure to deliver, you are refunded under the Refund Policy.

12. Disclaimers and limitation of liability

To the maximum extent permitted by law:

• No guarantee of absolute security. B-52 is a professional security-testing service. It does not and cannot guarantee that every vulnerability in a system will be found, or that a system will be immune to attack after an assessment. Cybersecurity risk can be reduced, not eliminated.
• Aggregate liability cap. Our total aggregate liability for all claims arising out of or in connection with an order shall not exceed the total fees you paid for that order in the twelve (12) months before the claim.
• Exclusion of consequential damages. We are not liable for indirect, incidental, special, consequential or punitive damages, including loss of profit, loss of data, loss of business opportunity or reputational harm, even if we were advised of the possibility.
• Testing disruption. We are not liable for service disruption, performance degradation or data loss in your systems arising from testing carried out within the authorised scope and the approvals you gave, in accordance with the agreed methodology.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited, and nothing limits your right to a refund under the Refund Policy.

13. Indemnity

You shall indemnify and hold harmless Security Brigade, its directors, officers, employees and contractors against claims, damages, liabilities, costs and expenses (including reasonable legal fees) arising from: (a) your breach of these Terms; (b) your failure to hold proper authorisation for a target you asked us to test; (c) your misuse of reports or findings; or (d) any third-party claim arising from your systems, content or data.

Security Brigade shall indemnify you against claims arising from our gross negligence or wilful misconduct in delivering an assessment, or from our material breach of section 9.

14. Force majeure

Neither party is liable for a failure or delay caused by circumstances beyond its reasonable control, including natural disaster, acts of government, cyberattack on the affected party's own infrastructure, pandemic restrictions, war or civil unrest. The affected party shall tell the other promptly and take reasonable steps to limit the impact.

15. Governing law and jurisdiction

These Terms and the Agreement are governed by the laws of the Republic of India.

The parties first try to resolve a dispute by good-faith negotiation between senior representatives within thirty (30) days of written notice. Either party may go to court without waiting for that period where it needs urgent relief to protect its Confidential Information or intellectual property.

The courts of Mumbai, Maharashtra, India have exclusive jurisdiction over any dispute arising out of or in connection with these Terms or the Agreement. Disputes about the processing of Personal Data are dealt with as set out in the DPA.

16. General

• Severability. If a provision of these Terms is held invalid or unenforceable, the rest continue in full force.
• No waiver. A failure to enforce a right is not a waiver of it.
• Entire agreement. The Agreement is the whole agreement between us for the order and replaces earlier discussions about it.
• Assignment. You may not assign your rights under the Agreement without our written consent.
• Notices. We send notices to the email address on your order. You send them to the address in section 18.
• Survival. Sections 8, 9, 12, 13 and 15 survive the end of the Agreement.

17. Changes to these Terms

We may update these Terms. We post the revised Terms on this page with a new "Last updated" date. A change applies to orders placed after it is posted. An order you have already paid for stays on the Terms and Refund Policy that applied when you placed it, unless you agree otherwise.

18. Contact

Security Brigade InfoSec Private Limited

• Registered and operating office: A 2604, Lodha Adrina, Lodha Park, Opp. Hard Rock Cafe, Pandurang Budhkar Marg, Worli, Mumbai 400013, Maharashtra, India
• CIN: U74999MH2011PTC217821
• GSTIN: 27AAPCS8899B1ZK
• B-52 orders and refunds: sales@securitybrigade.com
• Privacy and data protection: privacy@securitybrigade.com

---

End of B-52 Terms of Service v1.1 · Effective 2026-11-05 · Last updated 2026-11-10