Legal

Terms of Engagement

Effective date: 4 October 2026

DRAFT — template only, not legal advice. These website terms are a starting point. Your actual paid engagements must run under a signed contract (MSA + scope + authorisation). Have a qualified Kenyan advocate review before use.

1. Agreement

These terms govern use of this website and describe the framework for services provided by Orvantis Security (Martin Mwathi, sole proprietor). Any engagement is additionally governed by a separate signed agreement, which prevails over these terms in the event of conflict.

2. Services

Orvantis provides offensive-security services including red team engagements, penetration testing, application security review and security advisory. The precise scope, deliverables, timing and fees of any engagement are defined in a written proposal and statement of work.

3. Authorisation is mandatory

  • Orvantis performs testing only against systems the client owns or is lawfully authorised to have tested.
  • Before any testing begins, the client must sign a scope document, Rules of Engagement, and written authorisation permitting the work.
  • The client warrants it has authority to grant that authorisation for all in-scope systems and data.

4. Client responsibilities

  • Provide accurate scope, access and a technical point of contact.
  • Maintain current backups before testing begins.
  • Obtain any third-party authorisations (e.g. from cloud or hosting providers) required for in-scope systems.

5. Fees & payment

[State fee model, invoicing schedule, payment terms, currency, late-payment terms.]

6. Confidentiality

Each party protects the other's confidential information. Findings, reports and client data remain confidential and are not disclosed or published without the client's written consent. Mutual NDA terms are set out in the engagement agreement.

7. Deliverables & intellectual property

On full payment, the client receives the engagement report and findings for its internal use. Orvantis retains ownership of its methodologies, tooling and know-how. [Confirm IP terms with counsel.]

8. Warranties & disclaimers

Security testing reduces but cannot eliminate risk, and cannot guarantee the discovery of every vulnerability. Services are provided with professional skill and care; except as expressly stated, no other warranties are given. [Counsel to finalise.]

9. Limitation of liability

[This clause must be drafted by a lawyer and is critical. Typical elements: cap on liability, exclusion of indirect/consequential loss, carve-outs required by law. Do not publish generic wording here.]

10. Term & termination

[State how engagements start, pause and terminate, and the effect of termination on fees and deliverables.]

11. Governing law

These terms and any engagement are governed by the laws of Kenya, and the courts of Kenya have jurisdiction, unless otherwise agreed in writing. [Confirm with counsel; consider dispute-resolution/arbitration.]

12. Contact

Questions about these terms: martin@orvantis.co.ke.