--- title: "Terms and Conditions (B2B) | Mr Cyber" url: https://mr-cyber.com/terms language: en description: "Mr Cyber terms and conditions for penetration tests and security assessments, for businesses only." --- # Terms and conditions Last updated: 26 October 2026 This is a translation for convenience; the German version is authoritative. ## 1\. Scope These terms apply to all services provided by Moez Bouzayani (“Mr Cyber”) to businesses within the meaning of § 14 BGB, legal entities under public law and special funds under public law. Services are not offered to consumers. Conflicting terms of the client only apply if Mr Cyber agrees to them in writing. ## 2\. Contract and scope of services Quotes are non-binding, except ScopeCheck fixed prices: they are binding for 30 days for the relevant scope. The relevant scope is the one entered in ScopeCheck or, where that scope was unclear ("Not sure" answers or scopes priced only after a call), the one agreed in the free scoping call. If the actual scope differs, you receive a new fixed price using the same formula before any work starts and may withdraw at no cost. The contract is concluded with the written engagement (text form suffices). Scope, timeframe, test type and targets are defined conclusively in the engagement (“scope”). Mr Cyber provides services; a specific result, in particular finding all vulnerabilities, is not owed. ## 3\. Authorisation and client cooperation Every test requires the client’s written authorisation defining scope, timeframe, methods and contacts. This authorisation is industry standard and protects both parties. The client confirms that it is entitled to authorise testing of the systems in scope or has obtained the consent of entitled third parties (e.g. hosting or cloud providers). It provides access, information and a reachable emergency contact in time, and ensures current backups of the systems concerned. ## 4\. Execution Tests follow the agreed rules of engagement. Critical findings are reported to the client without delay. Despite careful execution, impairments of the tested systems cannot be ruled out entirely; Mr Cyber refrains from destructive actions unless explicitly approved. ## 5\. Report and retest The report is usually delivered within 5 business days after testing ends. A retest of the findings documented in the report within 60 days of delivery is included in the price. For one-time services, the client receives on full payment a simple, perpetual right to use the report for its own purposes, including sharing it with auditors, customers and authorities. For monthly services (section 8), this right arises for each report once the invoice for that month is paid. ## 6\. Confidentiality and data Both parties treat confidential information as confidential, also after the contract ends. Project data is stored encrypted and deleted 30 days after the project closes unless statutory retention obligations apply. Where personal data is processed on the client’s behalf, the parties conclude an agreement under Art. 28 GDPR. Mr Cyber provides a non-disclosure agreement (NDA), a data processing agreement (DPA) and a testing authorisation with the written offer. ## 7\. Fees and payment The fixed prices stated in the quote apply. One-off services are invoiced after delivery of the report; the invoice is payable within 14 days without deduction. No deposits are required. Monthly services (section 8) are invoiced monthly in advance, or yearly in advance when prepaid for a year; each invoice is payable within 14 days. ## 8\. Monthly services: monthly AI-assisted pentest and continuous pentesting The monthly AI-assisted pentest and continuous pentesting run monthly with no minimum term. They can be cancelled in text form to the end of any calendar month. If the client prepays a year, Mr Cyber grants 10% off; there is no pro-rata refund on early cancellation. Continuous pentesting includes 1 manual test day per month. Unused test days can be used later within the calendar quarter; they expire without refund at the end of the calendar quarter and when the contract ends. For the AI-assisted pentest (one-time and monthly), before the first run the client confirms in text form that it is entitled to authorise testing of each target and names the targets, the permitted test times and an emergency contact. This authorisation covers all runs until the client changes or withdraws it in text form; it is the authorisation under section 3. Production systems are tested only within this authorisation. Mr Cyber stops a run at once if it affects availability or at the client’s request, and reports critical findings without delay. ## 9\. Rescheduling The client may reschedule an agreed test window free of charge up to 5 business days before it starts. If it is rescheduled later, or the test cannot be performed due to lack of cooperation, Mr Cyber may charge the effort actually incurred, at most the fee for one test day. If a test window cannot take place for reasons on Mr Cyber’s side, such as illness, a new date is agreed free of charge. ## 10\. Liability Mr Cyber is liable without limitation for intent and gross negligence, for injury to life, body or health and under the Product Liability Act. For slightly negligent breach of essential contractual obligations, liability is limited to the typical, foreseeable damage, at most the fee for the order concerned; for monthly services, the fees paid in the last twelve months. Otherwise, liability for slight negligence is excluded. ## 11\. Final provisions German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. Place of jurisdiction, where permitted, is Hamburg. Should individual provisions be invalid, the remaining provisions remain unaffected.