Terms and Conditions of Business 

12th October 2026 

1. Basis of contract

These terms and conditions (the “Conditions”) govern all services supplied by Securlab Ltd, a company registered in England and Wales with company number 16710989 and registered office at 13 Arm And Sword Lane, Old Hatfield, Hertfordshire, England, AL9 5EH (“Securlab”), to the client named in the applicable Proposal or Statement of Work (the “Client”).

Each engagement is defined in a Proposal and/or Statement of Work (“SOW”) issued by Securlab. The Proposal constitutes an offer to supply the Services on these Conditions and is valid for thirty (30) days from its date of issue. A binding contract (the “Contract”) comes into existence when the Client accepts the Proposal in writing or issues a purchase order against it, whichever is earlier.

The Contract comprises: (a) the SOW; (b) the Proposal; (c) these Conditions; and (d) where the Services are delivered under an Assurance Scheme, the applicable Scheme Rules. In the event of conflict, the Scheme Rules prevail in respect of Scheme deliverables, followed by the SOW, the Proposal and these Conditions in that order.

These Conditions apply to the exclusion of any terms the Client seeks to impose or incorporate, or which are implied by trade, custom, practice or course of dealing.

Marketing materials, capability statements and service descriptions are indicative only and have no contractual force.

2. Definitions

In these Conditions:

Assurance Scheme — any certification or assurance scheme under which Securlab is authorised to deliver Services, including the NCSC Cyber Resilience Testing (CRT) framework (“CRTF”), Principles Based Assurance (“PBA”), Cyber Essentials and Cyber Essentials Plus, and the IASME Defence Cyber Certification (“DCC”).

Scheme Rules — the rules, standards, methodologies, codes of conduct and reporting requirements published by the relevant Scheme Owner and applicable to the Services from time to time.

Scheme Owner — the body owning or administering an Assurance Scheme, including the National Cyber Security Centre (NCSC), IASME Consortium Ltd, or any certification or accreditation body appointed by them.

Assessment Services — Services delivered under an Assurance Scheme, including CRT engagements, PBA assessments and certification assessments.

Consulting Services — cyber security strategy, governance, risk and compliance, architecture, operational technology (OT) security and other advisory services not delivered under an Assurance Scheme.

Testing — any authorised technical security testing of systems, networks or applications forming part of the Services, including penetration testing, vulnerability assessment, wireless and social engineering testing.

Business Day — 09.00 to 17.30 on any day (other than a Saturday, Sunday or public holiday in England) when banks in London are open for business.

Deliverables — the reports and other outputs set out in the SOW.

Confidential Information — any information, in any form, which is confidential to either party and is obtained under or in connection with the Contract.

Intellectual Property Rights — all patents, rights to inventions, copyright and related rights, trade marks, business names, rights in designs, rights in computer software, database rights, rights in confidential information (including know-how) and all other intellectual property rights, registered or unregistered, anywhere in the world.

Force Majeure Event — an occurrence beyond the reasonable control of the affected party which that party could not prevent by the exercise of reasonable diligence, including acts of God, war, terrorism, civil commotion, government action, industrial action not confined to that party's own workforce, widespread power or telecommunications failure, and epidemics or pandemics.

3. The Services

Securlab shall provide the Services with reasonable skill and care, in accordance with good industry practice and, for Assessment Services, in accordance with the applicable Scheme Rules, by suitably skilled and qualified personnel.

Securlab shall use reasonable endeavours to meet any performance dates stated in the SOW, but such dates are estimates only and time is not of the essence.

Independence of assessments. The Client acknowledges that Assessment Services must be delivered impartially. Securlab's findings, test results, assurance judgements and certification recommendations will reflect the evidence obtained, and nothing in the Contract obliges Securlab to reach any particular finding or outcome. The Client shall not seek to influence, and Securlab shall not accept any instruction to alter, the substance of any finding or assurance judgement.

No guarantee of outcome. Securlab does not warrant that the Client will achieve certification, a passing result or any particular assurance outcome. Certification decisions rest with the relevant Scheme Owner or certification body, not with Securlab.

Scheme reporting. The Client acknowledges that Scheme Rules may require Securlab to share engagement information, findings or reports with the Scheme Owner, and consents to such disclosure to the extent required by the Scheme Rules.

Securlab may make changes to the Services which are necessary to comply with applicable law, Scheme Rules or safety requirements, or which do not materially affect their nature or quality, and shall notify the Client in writing of any such change.

Both parties accept that it may be necessary to alter or adapt the Services during delivery. Any change to the SOW, including additional work and any consequent change to fees or timescales, is valid only if agreed in writing by both parties.

4. Authorisation to test and legal basis

Computer Misuse Act 1990. Unauthorised access to, or modification of, computer systems is an offence under the Computer Misuse Act 1990. Before any Testing begins, Securlab will obtain written authorisation from the Client confirming the systems in scope, the permitted testing activities and the test dates. By accepting the SOW, the Client grants Securlab explicit permission to attempt to breach security controls and access the in-scope systems for the purpose of the agreed Testing, and indemnifies Securlab against any claim under the Computer Misuse Act 1990 arising from Testing performed within the agreed scope.

Third-party systems. The Client warrants that it owns the in-scope systems or has obtained all necessary authorisations from third parties (including cloud, hosting and application providers) whose systems or networks may be affected by the Testing. The Client shall indemnify Securlab against any third-party claim relating to the Testing, except where such claim arises from negligence or malicious action by Securlab or its personnel.

Scope. Testing is confined to the systems, addresses, locations and activities identified in the SOW. Securlab shall not intentionally perform denial of service testing without prior written agreement. The Client shall indemnify Securlab against losses arising from unexpected data additions or changes affecting Client processes or metrics, unless the Client identified these as a specific concern in the SOW.

Human Rights Act 1998. Securlab shall make all reasonable endeavours to respect individual privacy, collecting and retaining personal and sensitive data only as required by the agreed test objectives. Where the Client has informed its employees that they have no expectation of privacy on Client systems and that communications may be monitored, the Client shall indemnify Securlab against any claims arising.

Regulation of Investigatory Powers Act 2000 / Investigatory Powers Act 2016. Testing may identify network traffic or data indicating inappropriate or unlawful activity by Client staff. Should the Client take disciplinary or legal action as a result of such findings, the Client shall indemnify Securlab against any resulting claim under this legislation.

Communications Act 2003. Where wireless network testing is in scope, the Client hereby authorises radio frequency interception and indemnifies Securlab against any action under the Communications Act 2003 in respect of such authorised activity.

Malicious Communications Act 1988. Where social engineering is in scope, communications sent as part of the engagement may be perceived by recipients as falling within the Malicious Communications Act 1988. The Client shall indemnify Securlab against any action by the Client or its staff under that Act in respect of authorised social engineering activity.

Security classifications. Where a security classification or security aspects letter applies to an engagement (including MOD-related work), both parties shall comply with the relevant handling procedures, which shall form part of the Contract.

5. Client obligations

The Client shall:

ensure the Proposal and SOW are complete and accurate, and that the Services selected are appropriate to its needs;

co-operate with Securlab in all matters relating to the Services and respond promptly to requests for information and decisions;

provide Securlab's personnel with such access to premises, systems, documentation, facilities and personnel as is reasonably required, and maintain a safe working environment compliant with applicable health and safety law;

provide accurate and complete prerequisites (including scoping information, credentials, network access and points of contact) by the dates set out in the SOW and in any event no later than five (5) Business Days before scheduled delivery;

obtain and maintain all licences, permissions and consents required for the Services before delivery begins;

maintain adequate backups of its systems and data before any Testing begins; and

keep any Securlab materials and equipment at its premises in safe custody and use them only in accordance with Securlab's instructions.

Client Default. If Securlab's performance is prevented or delayed by the Client's act, omission or failure to perform an obligation (a “Client Default”), then on written notice allowing the Client reasonable opportunity to remedy: (a) Securlab may suspend the Services until the Client Default is remedied and is relieved from its obligations to the extent prevented; (b) Securlab is not liable for costs or losses the Client sustains arising from that suspension or delay; and (c) the Client shall reimburse Securlab on written demand for costs or losses sustained by Securlab arising directly from the Client Default, up to the value of the affected Services.

6. Fees, expenses and payment

Fees are as set out in the Proposal. Where no fixed fee is quoted, Services are charged on a time and materials basis at Securlab's standard daily rates, calculated by reference to a normal Business Day.

By prior written agreement, work outside Business Day hours attracts a fifty per cent (50%) uplift and work on non-Business Days a one hundred per cent (100%) uplift on the standard daily rate.

Unless the SOW provides otherwise, Securlab may charge reasonable expenses (travel, accommodation, subsistence, third-party services and materials) supported by receipts. Where an expenses cap has been agreed, Securlab will seek written approval before exceeding it.

Unless the SOW provides otherwise, Securlab invoices monthly in arrears for Consulting and Assessment Services, and annually in advance for any recurring or subscription services.

Invoices are payable within thirty (30) days of the invoice date, in full and in cleared funds in Pounds Sterling. Time for payment is of the essence. All amounts are exclusive of VAT.

Postponement and cancellation. Where the Client cancels or postpones scheduled delivery for reasons outside Securlab's control: less than five (5) Business Days' notice — 100% of the fee for the affected work; between five (5) and ten (10) Business Days' notice — 50% of the fee for the affected work.

If the Client fails to provide required prerequisites within five (5) Business Days of the scheduled start date, or Securlab is unable to proceed with commenced work due to the Client's failure to specify activities within the timeframe in the project schedule, Securlab may (having notified the Client in writing) charge for the affected days at 100% of the agreed daily rate, itemised on the next invoice. Securlab will make reasonable efforts to reallocate resources to minimise such charges.

Overdue amounts bear interest at three per cent (3%) per annum above the Bank of England base rate, accruing daily from the due date until payment.

The Client shall pay all amounts without deduction, set-off or counterclaim except as required by law.

Securlab may increase fees before delivery, with notice and written justification, to reflect cost increases beyond its control, Client-requested changes to the Services, or delays caused by the Client's instructions or inaccurate information.

7. Confidentiality and data protection

Each party shall keep confidential all Confidential Information of the other, use it only for the purposes of the Contract, and not disclose it to any third party without the other's prior written consent, except: (a) to personnel, advisers and subcontractors who need it and are bound by equivalent obligations; (b) as required by law, regulation or court order; or (c) to a Scheme Owner to the extent required by the Scheme Rules.

Test results, findings and Deliverables are the Client's Confidential Information; Securlab's methodologies, tools and pricing are Securlab's Confidential Information. Where reports or technical data of a sensitive nature are exchanged, each party shall exercise proper custody and control and shall return or destroy such material in accordance with the other's written instructions.

Where a Scheme or service definition mandates retention periods (for example, Cyber Essentials or CRTF evidence requirements), Securlab shall retain information for the mandated period; otherwise retention follows Securlab's Data Retention Policy, available on request.

Each party shall comply with UK GDPR and the Data Protection Act 2018. Where Securlab processes personal data on the Client's behalf, it does so as processor on the Client's documented instructions, and shall: implement appropriate technical and organisational measures; ensure personnel are bound by confidentiality; assist the Client with data subject requests and security obligations; notify the Client without undue delay of any personal data breach; and, at the Client's direction on termination, delete or return the Client's personal data.

Personal data discovered during Testing will be treated in confidence and destroyed once the commercial need for retention has ended (ordinarily on delivery of the report), unless year-on-year comparison has been agreed, in which case data is retained securely for the agreed period.

Securlab stores engagement data on [cloud provider(s)] within the UK [and EEA]. The Client consents to this storage for the purposes of the Services. Securlab shall not transfer the Client's personal data outside the UK without appropriate safeguards.

Nothing in the Contract obliges the Client to disclose information where disclosure would breach data protection law. Where the Client is a public authority, the Freedom of Information Act 2000 takes precedence over the confidentiality provisions to the extent it requires disclosure.

This clause 7 survives termination of the Contract.

8. Intellectual property

All Intellectual Property Rights in Securlab's methodologies, tools, templates, know-how and pre-existing materials remain Securlab's property.

Copyright in the Deliverables (including reports) vests in Securlab. On payment in full of the applicable fees, Securlab grants the Client a non-exclusive, non-transferable, royalty-free licence to use and copy the Deliverables for its own internal business purposes, including disclosure to its professional advisers, insurers, regulators and, where the SOW so provides, its customers or a Scheme Owner. The Client shall not otherwise sell, distribute, publish or sub-license the Deliverables without Securlab's prior written consent.

Where bespoke software development is expressly included in the SOW, Intellectual Property Rights in that bespoke development transfer to the Client on payment in full, and Securlab shall co-operate with any steps needed to give effect to that transfer. This does not apply to Securlab's pre-existing materials or generic tooling.

Securlab shall not reproduce, modify or distribute the Client's data or materials except as needed to deliver the Services, with the Client's prior written consent, or as required by law or a Scheme Owner.

Securlab may retain and use general knowledge, skills and experience acquired in delivering the Services, provided it does not use or disclose the Client's Confidential Information.

9. Warranties, liability and insurance

No guarantee of security. Securlab does not warrant that the Services will identify all vulnerabilities, weaknesses or security issues, or that implementation of its recommendations will prevent any security incident. Testing reflects the state of the in-scope systems at the time of testing only.

Inherent risk of testing. The Client acknowledges that Testing may impact, disrupt or damage systems and data. Securlab shall exercise reasonable care to minimise such impact and shall not be liable for consequences of Testing performed within the agreed scope, except where caused by negligence or malicious action by Securlab or its personnel.

Securlab indemnity. Securlab shall indemnify the Client against losses, damages, costs and expenses awarded against or incurred by the Client arising from Securlab's breach of clause 7 (confidentiality and data protection). This indemnity survives termination.

Unlimited liabilities. Nothing in these Conditions limits or excludes either party's liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; breach of the terms implied by section 2 of the Supply of Goods and Services Act 1982; or any other liability that cannot lawfully be limited or excluded.

Excluded losses. Subject to clause 9.4, neither party is liable for loss of profit, revenue, business, anticipated savings or goodwill, or for any indirect, special or consequential loss, arising under or in connection with the Contract.

Cap. Subject to clauses 9.4 and 9.5, Securlab's total aggregate liability arising under or in connection with the Contract, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed the total fees paid or payable by the Client under the affected SOW in the twelve (12) months preceding the event giving rise to the claim.

Except as set out in these Conditions, all warranties, conditions and other terms implied by statute or common law are excluded to the fullest extent permitted by law.

Insurance. Securlab shall maintain professional indemnity insurance of not less than £1,000,000 million, cyber liability insurance of not less than £25,000.00 million and public liability insurance of not less than £2,000,000.00 million for the duration of each engagement, and shall provide evidence of cover on reasonable request.

This clause 9 survives termination of the Contract.

10. Term, termination and suspension

The Contract continues until the Services are completed or it is terminated in accordance with this clause.

Either party may terminate the Contract on written notice if the other commits a material breach and, where the breach is remediable, fails to remedy it within fourteen (14) days of written notice requiring it to do so.

Either party may terminate immediately on written notice if the other becomes insolvent, enters administration or liquidation, makes any arrangement with its creditors, or ceases (or threatens to cease) to carry on business. On Securlab's insolvency the Client owes no compensation for the terminated portion but shall pay in full for Services performed but unpaid.

The Client may cancel a SOW and claim reimbursement of actual losses where Securlab fails to deliver in accordance with the SOW, fails to rectify defective work within an agreed timescale, or performs demonstrably below normal industry standards for the type of Service. Securlab will investigate alleged defects on request and, where an item does not meet agreed acceptance criteria, repair or replace it within a reasonable time at no additional charge; where an investigated item proves not to be defective, the Client shall pay Securlab's reasonable investigation costs.

Either party may suspend the Services where circumstances beyond its control prevent or hinder performance, until such circumstances cease. If a Force Majeure Event prevents performance for more than fourteen (14) days, either party may terminate the Contract immediately on written notice.

If the Client causes delays which are not reasonably deemed unforeseen, Securlab may pause the affected work and reschedule it to accommodate other pre-booked client commitments.

On termination: (a) the Client shall pay for all Services performed and expenses incurred up to the date of termination; (b) each party shall return or destroy the other's Confidential Information as directed; and (c) accrued rights, and clauses intended to survive, are unaffected.

Termination does not affect Securlab's obligations to a Scheme Owner in respect of work already performed under an Assurance Scheme.

11. General

Subcontracting and assignment. Neither party shall assign, transfer, novate, charge or subcontract any of its rights or obligations under the Contract without the other's prior written consent (not to be unreasonably withheld). Each party remains responsible for the acts and omissions of its subcontractors. Any subcontractor delivering Assessment Services must hold the qualifications required by the applicable Scheme Rules.

Non-solicitation. Neither party shall, during an engagement and for six (6) months after its completion, directly solicit for employment or engagement any employee of the other who was materially involved in the engagement, except through a response to a general recruitment advertisement. The remedy for breach is a fee equal to 25% of the individual's first-year remuneration.

Anti-bribery and sanctions. Each party shall comply with the Bribery Act 2010, applicable anti-money laundering legislation and applicable trade sanctions.

Notices. Notices must be in writing and delivered by hand, pre-paid post to the registered office, or email to the addresses stated in the SOW, and are deemed received on delivery (or, for email, at the time of transmission on a Business Day).

Waiver. No concession or indulgence by either party constitutes a waiver of its rights unless expressly authorised in writing.

Severance. If any provision is found invalid or unenforceable, it shall be modified to the minimum extent necessary or, if that is not possible, deleted, and the remainder of the Contract is unaffected.

Entire agreement. The Contract constitutes the entire agreement between the parties and supersedes all previous agreements and understandings relating to its subject matter. Each party acknowledges it has not relied on any statement, promise or representation not set out in the Contract.

Third-party rights. No person other than the parties has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of the Contract.

Governing law and jurisdiction. The Contract, and any dispute or claim arising out of or in connection with it (including non-contractual disputes), is governed by the law of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

12. Contact Us

For queries about these Terms:

Email: info@securlab.io

Website: https://securlab.io