Consulting engagement terms

Red Pulse · Sydney, NSW · Effective 3 November 2026

These are the standard terms on which Red Pulse provides security assessment and advisory services. They apply together with a written proposal or statement of work ("Proposal") that you accept. If the Proposal and these terms conflict, the Proposal wins.

Summary in plain terms: we assess what we can see at the time, we tell you what we found and how to fix it, we keep your information confidential, and we do not guarantee that you will pass an audit or never be breached. You own the report; we own our methods.

1. Services

We will perform the services described in the Proposal with due care and skill, by appropriately qualified people, within the agreed scope and timeframe. Work outside the scope will be quoted separately.

2. Your obligations and authorisation

You will provide timely access to the systems, tenants, documents and people in scope, and nominate a contact who can make decisions. You warrant that you own or are authorised to permit assessment of every system in scope, including cloud tenancies and any third-party hosted services, and that you have obtained any consents required under your contracts with suppliers. Penetration testing is only performed against assets you have authorised in writing, within the agreed window.

3. Nature of assessments

Assessments are point-in-time and sample-based. They reflect the configuration, evidence and access available during the engagement.
Maturity ratings and control findings are our professional opinion against the published framework at the date of the report. They are not a certification, accreditation, IRAP assessment or legal determination, and a third-party assessor may reach different conclusions.
No assessment can identify every vulnerability. A finding of "met" or a high maturity level is not a guarantee against compromise.
We do not provide legal advice. Where regulatory obligations are discussed (for example under the Privacy Act, the SOCI Act or APRA standards), obtain legal advice before relying on them.

4. Fees and payment

Fees are fixed-price or time-based as stated in the Proposal, exclusive of GST unless stated otherwise. Invoices are payable within 14 days. Reasonable pre-approved expenses are passed through at cost. We may pause work if an invoice is more than 14 days overdue.

5. Confidentiality

Each party will keep the other's confidential information confidential, use it only for the engagement, and protect it with at least reasonable care. Findings, evidence and reports are your confidential information. Our methodologies, templates and tooling are ours. These obligations survive for five years after the engagement, and indefinitely for security vulnerabilities and personal information.

6. Handling of your data

We access systems read-only wherever the engagement allows and collect only the evidence needed to support findings. Evidence is stored encrypted on Australian-region infrastructure, shared only with people working on your engagement, and deleted or returned within 90 days of the final report unless you ask us to retain it or law requires otherwise. Personal information is handled under our privacy policy. If we discover an actual or suspected data breach affecting your information, we will tell you without undue delay.

7. Intellectual property

On payment, you own the deliverables prepared for you and may use them internally and share them with your auditors, customers, insurers and regulators. We retain ownership of pre-existing materials, methods, templates and know-how, and grant you a perpetual licence to use any of them embedded in the deliverables. We may describe the engagement in general, anonymised terms for our own reference purposes unless you tell us not to.

8. Independence

We do not accept commissions or referral fees from vendors whose products we may recommend. Red Pulse also develops a security monitoring platform; we will disclose when a recommendation involves it, and you are never required to use it.

9. Liability

Nothing in these terms excludes consumer guarantees or other rights that cannot be excluded by law. Subject to that, each party's total liability arising from the engagement, whether in contract, tort or otherwise, is limited to the fees paid or payable under the relevant Proposal, and neither party is liable for indirect or consequential loss, loss of profit, revenue, data or goodwill. These limits do not apply to breach of confidentiality, infringement of intellectual property, or liability that cannot lawfully be limited.

10. Insurance

Details of any professional indemnity or public liability insurance held by Red Pulse are available on request. Where an engagement requires specific cover, this will be agreed in the Proposal before work begins.

11. Term and termination

Either party may terminate an engagement on 10 business days' written notice, or immediately for a material breach that is not remedied within 10 business days of notice. On termination you pay for work performed to that date and we deliver work in progress.

12. General

We may use subcontractors bound by equivalent confidentiality obligations; we remain responsible for their work. Neither party is liable for delay caused by events outside its reasonable control. These terms are governed by the laws of New South Wales, Australia. Disputes will first be raised in good faith between senior representatives before any proceedings, other than urgent injunctive relief.