Terms of Service

These terms are between you and Meridian Infrastructure Ltd, trading as Zentinel, a private limited company registered in England and Wales under company number 17221205. “We” and “us” on this page mean Meridian Infrastructure Ltd.

We test only what you are entitled to authorize us to test. Before any testing begins, you confirm in writing the exact hosts, applications, and features in scope, what is explicitly out of scope, and the testing window.

By booking, you confirm that you own the target application or are authorized by someone who does to request testing of it. If that turns out not to be the case, the engagement ends immediately and no testing is performed. This is not negotiable, and no refund request will change it.

Third-party systems your application depends on are out of scope unless their owner has also authorized testing.

Each plan covers one application: its web application and the API behind it, on the hosts you authorize. A staging environment of the same product counts as the same application. A second product, a separate customer portal, or an unrelated marketing site are separate applications and require their own plan.

This is not a per-request limit you can spread across unrelated targets. If your product is larger than one application, or you want several covered together, we will quote for that rather than stretch a plan to fit.

Continuous plans cover the same single application on an ongoing basis. Changing which application a continuous plan covers is a new scope agreement, not a substitution you can make unilaterally.

• Testing is non-destructive. We do not modify, delete, or exfiltrate your data or your customers' data.
• We do not run denial-of-service or load-generating attacks.
• We stop at the boundary of the agreed scope.
• Where a finding requires evidence involving real records, we take the smallest sample that demonstrates it and redact it in the report.
• If we find something severe mid-test, you hear about it immediately rather than at the end of the engagement, and we pause testing in that area if there is any risk to your users.

Code Review and Hybrid engagements are white-box: they include read-only access to your source code. This section exists because source code is the most sensitive thing a client can hand us, and it should be unambiguous exactly what happens to it.

How access is granted. You choose the method: a read-only collaborator invite on your repository, a deploy key or machine user with read-only scope, or a temporary access token you revoke when testing ends. We never ask for write access, and we never push, merge, or modify anything in your repository.

How it is handled. Code is cloned read-only into an isolated, encrypted working environment accessible only to the engineer assigned to your engagement. It is not copied to any other system, not shared with anyone outside that engagement, and not used to train or fine-tune any model.

How long we keep it. Working copies of your source are deleted within 7 days of report delivery, and your repository access grant is removed at the same time. You can revoke access yourself at any moment, which immediately ends our ability to read the code. Reports may quote the smallest code snippet needed to demonstrate a finding, and you can ask for specific snippets to be redacted before delivery.

Ownership. Your code remains yours. Nothing here grants us any licence to your source beyond what is strictly necessary to perform the assessment you commissioned. We claim no derivative works, no redistribution rights, and no reuse rights.

If source access were ever exposed. If we became aware that source code provided for an engagement had been accessed by anyone not authorized to see it, we would tell you immediately and work with you on remediation. That is the same standard we apply to a critical finding in your application.

These meanings apply on the website, at checkout, in these terms and in any agreement with us.

• 1 application: One production domain and its associated API, one staging copy, and up to 3 user roles.
• 48-hour turnaround: The 48 hours start once scope, written authorization, target details and test access are confirmed. If access is delayed or the scope grows significantly, the clock pauses until it's resolved.
• Retest: Verification of previously reported findings after remediation: we replay the original attack path and record whether it still works.
• Release test: A targeted security test of a material release or change within the agreed application scope.
• Additional application: A production application, domain or API outside the original application definition.
• Rush: Expedited testing ahead of the normal 48-hour commitment, where Zentinel agrees to prioritize the engagement.

One-time plans. Each covers one application, as defined above, and is a full penetration test: reconnaissance, active testing, manual exploitation, finding validation, human security review, CVSS scoring, evidence, remediation guidance, an executive summary and a full technical report. We deliver it within 48 hours of confirmed scope, authorization, target information and required access.

• Launch: one retest, requested within 30 days of the report.
• Startup: one retest, requested within 60 days of the report, and compliance-ready evidence.
• SOC 2-Ready Penetration Test: per application; documented methodology, an audit-ready report and evidence package, and a retest. It is penetration-testing evidence for your audit, not a SOC 2 attestation, and we are not your SOC 2 auditor.
• Mobile app review add-on: a focused review of the app package and the API it uses, per platform. It is not a full mobile penetration test, which is quoted separately.

Continuous plans. For as long as the subscription is active:

• Continuous: one application; automated monitoring of the in-scope external targets, run daily; a human testing pass each month, scheduled with you in the portal; up to two release tests a month, requested from the portal; retesting of reported findings; the verification badge, if you choose to publish it.
• Growth: the same, across up to three applications, with two release tests per application per month (six at most) and priority scheduling.
• Additional release tests beyond the allowance are $250 each, bought from the portal. Extra applications are $600 per month each, added to your existing subscription and prorated. Unused release tests, included or bought, do not carry over to the next month.
• Enterprise: what the signed agreement says.

Monitoring is automated; testing and verification are done by people. We do not claim to manually test every deployment you make.

Founding-price engagements also include 30 days of continuous re-checks on the authorized scope, at no extra cost. Nothing renews automatically when that window ends. Founding customers who move to Continuous receive 20% off Continuous for their first 12 months; published pricing applies after that.

Rush. Expedited testing ahead of the 48-hour commitment is available at +50% where we agree to prioritize the engagement. It is confirmed in writing before you pay.

An assessment is evidence of what was found in an agreed scope during an agreed window. It is not proof that no vulnerabilities remain, and no honest security provider can offer that. It is not a compliance audit, attestation or certification. For SOC 2 and similar frameworks we provide penetration-testing evidence; your auditor evaluates it independently.

Coverage depends on the application's architecture, functionality, and the assessment timeframe. Findings describe weaknesses identified during the engagement window only.

All prices are in US dollars. One-time plans are paid up front. Enterprise, additional SOC 2-Ready applications and quoted add-ons are agreed in writing before any work or payment. Continuous billed monthly carries a three-month minimum commitment: by subscribing you agree to pay for at least three months, even if you cancel sooner. Continuous can instead be billed yearly ($8,990), and Growth monthly ($1,999) or yearly ($19,990). Recurring plans are cancelled from the billing portal, and no new testing is scheduled after cancellation.

Upgrade credit. If you bought Launch or Startup and move to Continuous within 30 days of that payment, 100% of the amount paid is credited to your Continuous subscription; any credit larger than an invoice carries onto later invoices. The credit has no cash value and is not refundable.

Who you buy from. Zentinel is the seller for every purchase, wherever you are. All payments are processed by Stripe; card details go to Stripe directly and never reach us. Your receipt and invoice come from Zentinel.

Tax. Prices are in US dollars and exclusive of tax unless stated at checkout. Where tax applies, it is calculated and shown at checkout before you pay. If you are a business, you can enter your VAT or GST number at checkout; for EU businesses with a valid VAT number, VAT is reverse-charged and you account for it.

If, after you pay, the scope turns out not to fit what the engagement covers, you are refunded in full and we say so before testing begins rather than after. If we cannot proceed because authorization cannot be established, you are refunded in full. Refunds are returned to the original payment method through Stripe.

Findings from your engagement are yours. We do not publish them, identify you as a client, or use your engagement in marketing without your written permission. Where we describe our work publicly, targets are generalised and no client is named.

We expect the same discretion in return regarding the methods and tooling shown to you during an engagement.

Customers may publish a Zentinel badge and verification page once an assessment has been delivered and they have proven control of the domain the badge is issued for. Publishing is the organization owner's choice and can be withdrawn at any time.

• Use the badge only as provided: unmodified, linked to its verification page, and only on the domain it was issued for.
• The badge states that testing took place, when, and whether it is ongoing. It does not state or imply that an application has no vulnerabilities, and must not be presented as a certification.
• Its status updates automatically: active while a Continuous or Growth plan is current and testing is recent, then assessed, lapsed or expired as the facts change.
• We may suspend a badge that is misused, displayed on a domain it was not issued for, or attached to an account in breach of these terms. A suspended badge says so publicly.
• "Zentinel" and the badge artwork remain our marks; this is a limited, revocable permission to display them for this purpose.

Our total liability arising from an engagement is limited to the fee you paid for it. We are not liable for indirect or consequential losses, including lost profits or lost business, arising from findings, the absence of findings, or remediation decisions you make in response to a report.

Remediation is your responsibility. We provide guidance; deciding what to fix, and verifying it in your own environment, remains with you.

Questions about these terms go to hello@zentinel.dev.