Website Security Review

Prices and terms are subject to change.

1. Default Services. Unless the parties agree otherwise in writing, the Services consist of testing of Client's public-facing websites and related public surfaces using current AI-assisted toolkits, operated and supervised by a person. The specific tools and methods may expand or change over time. By default, testing is passive and non-intrusive: it is limited to what a normal browser user or public DNS lookup could observe, plus materials Client chooses to provide.
2. Active or Targeted Testing. ATB will perform deeper, targeted, or active testing (for example authenticated testing, port scanning, fuzzing, or exploit-style checks) only if Client requests it in writing and the parties sign a written authorization and rules of engagement that name the assets, methods, time window, rate limits, and contacts. ATB will stay within those rules and will stop on Client's request.
3. Point-in-Time Review. Each review reflects only the systems, configurations, and content observed on the date or dates tested. The Services are not continuous monitoring, incident response, or ongoing protection. Changes made after the test date are not covered.
4. No Warranty. The Services, reports, and any badge are provided "as is." ATB makes no warranty or guarantee, express or implied, that any site is secure, free of defects, or free of vulnerabilities, and disclaims all implied warranties, including merchantability and fitness for a particular purpose. Tools and reviewers can miss issues. Findings are advisory only. Client alone is responsible for deciding whether and how to fix any issue and for all remediation.
5. Limitation of Liability. To the fullest extent permitted by law, ATB's total liability arising out of or related to an engagement is limited to the fees Client actually paid ATB for that engagement. For free-tier engagements (including the DigiByte builder tier), no fees are paid, so ATB's liability is $0 to the fullest extent permitted by law. In no event is ATB liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill, even if advised of their possibility. This section does not limit liability that cannot be limited under applicable law.
6. Client Authority and Verification. Before any testing, Client must confirm in writing that it owns, or is authorized by the owner to permit testing of, every asset in scope. ATB will verify control of each domain by a DNS TXT record or a file placed at a /.well-known path that ATB specifies, and will not test until verification succeeds. Client will defend, indemnify, and hold harmless ATB from claims, losses, and costs arising from any misstatement of Client's ownership or authority.
7. Third-Party Infrastructure. Client is responsible for obtaining any permission required from its hosting provider, CDN, cloud platform, or other third-party service before testing. Third-party systems are out of scope unless Client provides that provider's written permission or the provider's published terms clearly allow the testing.
8. Confidentiality and Data Handling. ATB will treat findings, reports, and data collected during an engagement as Client confidential information, use them only to perform the Services, and not publish or share them without Client's written consent, except as required by law. ATB will collect the minimum data needed, redact secrets in reports, protect stored data with reasonable security measures, keep raw tool output for up to 90 days after delivery and final reports for up to 24 months (or less on Client's written request), and then delete them.
9. AI-Assisted Tools. ATB uses automated and AI-assisted tools to run tests and draft reports. A person reviews findings and reports before delivery, but AI-assisted output can contain errors, and that review does not change Sections 3 through 5.
10. Badge. If Client opts in, ATB may issue a badge that states the site was "reviewed," never "secured," for example: "Reviewed by AroundTheBlock.Us on YYYY-MM-DD (badge expires YYYY-MM-DD)." The badge must link to ATB's verification page, which shows the review date, expiry, and a disclaimer that a review is not a guarantee of security. The badge expires 90 days after the review date unless renewed by a new review. ATB may revoke the badge at any time, including if Client misrepresents it, and Client will remove it on expiry or revocation and will not describe it as a certification or guarantee.