Terms & Conditions - Secureleap

Old versions are available here

Version of December, 23rd 2025

Secureleap Lda (hereinafter referred to as "Secureleap" or "We" / "Us") is a provider of Virtual Chief Information Security Officer (VCISO) services and cybersecurity solutions designed to improve the security posture of organizations (hereinafter referred to as the "Services"). The business is operated through its published website, available at secureleap.tech (hereinafter referred to as the "Website").

These terms and conditions (hereinafter the "Terms and Conditions") apply to any entity or person acting on behalf of an entity that has procured the Services as defined herein, either online, through the Website, by exchanging e-mails with Secureleap or on paper (hereinafter the "Client" or "You"). They govern access and use by the Client of the Services and any other services provided through the Website and by Secureleap.

The Client has confirmed its interest in using the Services and, to this end, has agreed to a Statement of Work (SOW) proposed by Secureleap under the terms of a quotation issued by Secureleap or any equivalent document which is accepted by the Client and deemed to be a valid Purchase Order.

Prior to any use of the Services provided by Secureleap, the Client acknowledges and accepts the present Terms and Conditions in full and without reservation. Before agreeing to the present Terms and Conditions, the Client declares to have access to all the necessary information and technical features of the Services, and also to have been provided with all the details requested by the Client concerning its mode of operation and features, and its adequacy to the Client's needs.

1. DEFINITIONS

"Client" refers to the legal entity and professional client of Secureleap, identified as such and operating within the scope of its professional activity, which has procured or seeks to procure the Services.

"Statement of Work" or "SOW" refers to the formal project document issued by Secureleap, executed by both Parties for a specific commitment. The SOW shall detail, at a minimum: (i) the scope of the Services to be provided; (ii) the specific deliverables; (iii) the project schedule, including important milestones; (iv) the fixed or estimated Project Fees and payment schedule; and (v) any other project-specific terms. These Terms and Conditions apply to all SOWs, forming, in each case, a single and separated contract.

"Agreement" is composed, in decreasing order of precedence, of the executed Statement of Work (SOW), the present Terms and Conditions, and any appendices. The Agreement prevails over any statement by Secureleap concerning any sales materials (brochures, website, etc.) in the event of a conflict of interpretation.

"Service(s)" refer(s) to the cybersecurity and VCISO service(s) purchased from Secureleap by the Client, which concern(s) or is(/are) linked to the relationship between Secureleap and the Client, and more generally to the Agreement. The scope and extent of the Services procured by the Client are set out in the Statement of Work (SOW).

"User(s)" shall mean, in the singular or plural, the natural person employed by the Client and expressly authorized in this capacity by the Client to access and use the Services pursuant to the present Agreement and for professional purposes only, provided that such person has reached the legal age of majority in his/her jurisdiction of domicile. The Client shall keep an up-to-date name list of Users and provide it to Secureleap upon first request. By default, and unless otherwise agreed between Secureleap and the Client, the User must be a legal representative, an authorized representative, or a designated representative acting at the Client's express and written request.

2. PURPOSE OF THE AGREEMENT

The purpose of this Agreement is to govern the provision and use of the Services to the Client and its Users for their own business needs and on a non-exclusive basis, as agreed and detailed under the Statement of Work (SOW).

3. AGREEMENT PURCHASE OPTIONS

3.1. The access to the Services is limited to corporations, public or private institutions that are duly registered or incorporated in an official register, and which operate within the scope of their professional activity.

3.2. Private customers are not entitled to purchase the Services.

3.3. At the time of engagement or upon request, the Client must provide Secureleap with all the information or official documents required to justify its status as a registered professional (company name, company number, Commercial Registration number, VAT number, Commercial Registry extract, or an equivalent document in the event that the Client is located outside Portuguese territory).

3.4. The Client undertakes to communicate all the information deemed necessary at the time of engagement, certifies the accuracy of the data on the day of entry, and must keep it up to date.

3.4.1. Failure by the Client to do so constitutes a material breach of the Agreement, in which case, Secureleap reserves the right to temporarily suspend access to all or part of the Services or to terminate this Agreement for cause without prior notice, notwithstanding the provisions hereof regulating the terms and conditions of termination.

3.5. By applying for purchase to the Services and by accepting the terms of the Agreement, the User certifies that (i) it has the legal capacity to enter into an Agreement under the laws in force in its jurisdiction of registration or incorporation, (ii) it has reached the legal age of majority under the laws in force in its jurisdiction of incorporation, (iii) it is entitled to all the rights, authorizations or powers of attorney necessary to bind the legal entity which executed the Agreement (the Client), (iv) it shall not access the Services by means of any automated process or devious means, (v) it shall not use the Services for illegal or unauthorized purposes, infringing Secureleap's requirements or any applicable law or regulation.

4. TERM

4.1. The Contract shall come into force on the commencement date specified in the SOW.

4.2. Regardless of the conditions set forth in the Agreement ("Project Term") regarding its duration, it shall remain in effect until: (i) Secureleap has effectively completed and delivered the Services described in the SOW; or (ii) for subscription-based Services, the end of the subscription term specified in the SOW; unless there has been early termination pursuant to Section 16.

4.3. This Agreement does not automatically renew. Any subsequent services or new projects will require the execution of a new and separate SOW.

5. IMPLEMENTATION OF THE SERVICES

5.1. In order to access and use the Services, the Client must possess the technical prerequisites procured by Secureleap.

5.2. It is the Client's sole responsibility to acquire and maintain at its own expense and under its sole responsibility all necessary technical resources, in particular the internet access (hardware, software, networks, etc.) or network, and the required skills to access the Services, as well as to complete all operations authorized in this respect.

5.3. The Client is responsible for the acquisition and maintenance of all equipment necessary to access the Services and agrees that such equipment may affect the quality of access to the Services in whole or in part.

5.4. Secureleap cannot be held liable in any way, nor can it provide any remedy or claim in the event of damage or loss of any nature whatsoever resulting directly or indirectly from Client's failure to comply with the aforementioned obligations.

5.5. Prior to the use of the Services, and where applicable to the nature of the Services being provided, a kick-off or onboarding phase shall be carried out. This phase may consist of discovery questions related to the Client's security environment and needs, platform configuration, or account provisioning, as appropriate to help Secureleap understand the Client's specific requirements prior to the delivery of the Services.

5.5.1. The Client thus undertakes to ensure that this phase runs smoothly, by implementing all diligence to collaborate with Secureleap and by providing all necessary documents or relevant information or data, by appointing a dedicated decision-maker in its representation, and by conducting all actions requested by Secureleap in both oral and written form.

5.5.2. The Client acknowledges and accepts that failure to communicate such information, data or documents, to name a contact person and, more generally, late or unresponsive cooperation on the part of the Client, shall constitute a breach of the Client's obligation to cooperate.

5.6. Where applicable, the kick-off or onboarding phase is followed by a service delivery phase, which may include: (i) implementation of cybersecurity services according to the Client's specific needs; (ii) provisioning of platform access or third-party licenses; or (iii) commencement of ongoing advisory services, based on the information communicated to Secureleap during the kick-off or onboarding phase.

5.6.1. The scope and extent of this stage is detailed in the Statement of Work (SOW) and implies the active collaboration of the Client under the same conditions as specified in clause 5.5.1 above.

5.6.2. Both Parties agree with the fact that Secureleap does not provide any additional development services, nor services for integrating new functionalities or altering existing functionalities beyond those agreed to within the scope of this Agreement.

5.6.3. Subject to their feasibility and the agreement of Secureleap, such services require the acceptance of an estimate signed by the Client's legal representative and the execution of a new Statement of Work (SOW), as referred to in the second part of clause 4.3.

6. MODALITIES OF ACCESS TO THE SERVICES

6.1. In order to access the Services, the Client agrees to provide a valid and active e-mail address along with any information requested by Secureleap by means of a form or any written document.

6.2. Where the Services include access to a platform or portal, the Client is invited to create a password for secure access.

6.3. Where the Client is provided login credentials for any platform or portal, the Client is solely responsible for the confidentiality and security of such login details and password and undertakes not to disclose them to any third party and to treat them as strictly confidential.

6.4. Where the Services include platform or portal access, it is the Client's responsibility to manage its access codes and to ensure that only authorized Users access and use the Services in compliance with the Agreement.

6.5. Where the Client is provided login credentials, the Client undertakes to inform Secureleap immediately by any means and to notify Secureleap in writing as soon as it becomes aware of any risk of abuse or unauthorized use of its login and password.

6.6. Where applicable, Secureleap can under no circumstances be held liable for any losses or damages of any kind resulting from the Client's failure to meet the obligations set forth in Sections 6.3 through 6.5.

6.7. Where the Services involve ongoing platform access or multiple authorized Users, the Client agrees to disclose the identity and precise number of Users to Secureleap in writing, and to inform Secureleap without delay of any changes during the term of the Agreement.

6.8. By accessing the Services made available by Secureleap, the Client accepts the present Terms and Conditions, if such access occurs prior to the signature of the SOW.

7. INVOICING – PAYMENT

7.1. The fees for the Services ("Project Fees") and the corresponding payment schedule shall be explicitly defined in the applicable Statement of Work (SOW).

7.2. Unless otherwise specified in the SOW, Project Fees shall be invoiced as follows: (i) for project-based Services: fifty percent (50%) upon execution of the SOW, and fifty percent (50%) upon delivery of the final project deliverable; (ii) for subscription or retainer-based Services: as specified in the SOW, or if not specified, monthly in advance.

7.3. Unless an alternative method is specified in the SOW, payment of invoices shall be made by the Client via one of the following modalities: (i) bank transfer to the account detailed on the invoice, or (ii) an online payment link provided by Secureleap.

7.4. For online payments, Secureleap utilizes a third-party payment solution.

7.4.1. The payment methods accepted are: VISA, MASTERCARD, and AMERICAN EXPRESS.

7.5. The Client agrees to provide up-to-date, complete, and accurate payment details for the processing of any transaction.

7.6. All prices are quoted in the currency specified in the SOW and are exclusive of any applicable taxes or charges, which will be added to the invoice.

7.7. The Client is responsible for any bank charges or fees related to international payments.

7.7.1. Any customs duties, import taxes, or similar levies are the sole responsibility of the Client.

7.8. The Client expressly accepts that invoices may be issued in electronic form.

7.9. Each invoice is sent to the Client by e-mail to the e-mail address indicated in the Statement of Work (SOW), or in writing prior to payment.

7.10. The Client must imperatively provide the invoice on a durable medium before any dispute can be lodged against it, subject to the additional prerequisite that such a dispute be notified to Secureleap within thirty (30) days of the invoice date; if no dispute arises by the end of this period, it implies definitive and unreserved acceptance by the Client. This invoice acceptance is without prejudice to other claims under Section 17.9, provided such claims are raised within the applicable timeframe therein.

7.11. The Project Fees specified in an executed SOW are fixed for the duration of that project or subscription term. For Services involving third-party platform licenses, fees may be subject to adjustment upon renewal to reflect changes in third-party vendor pricing, with reasonable advance notice to the Client.

7.11.1. Any changes to the scope of work that may affect the Project Fees must be mutually agreed upon in writing via a formal change order or an amended SOW.

7.12. In case of late payment and without prejudice to Secureleap's other remedies, Secureleap reserves the right to charge interest on all sums due until full payment is made.

7.12.1. Interest will be capitalized at a rate equal to the higher of the following two rates: (i) three (3) times the legal interest rate in Portugal; or (ii) the rate of the European Central Bank plus ten (10) points.

7.12.2. Secureleap is entitled to obtain from the Client a fixed sum of Euros 40 (or any other amount fixed by applicable regulations), by way of compensation for collection costs.

7.12.3. Secureleap also reserves the right to invoice any bank charges arising from a payment refusal.

7.13. In the event of non-payment, Secureleap may suspend access to the Services, or terminate this Agreement as provided herein.

7.14. In the event the Client terminates the Agreement for convenience (i.e., for any reason other than a material, uncured breach by Secureleap) prior to the completion of the project, the Client shall be liable for payment for all work performed up to the date of termination at Secureleap's standard rates, plus a cancellation fee equal to twenty percent (20%) of the total remaining Project Fees.

7.14.1. This represents liquidated damages, not a penalty, to compensate for the resources Secureleap has allocated and the opportunity cost incurred.

8. OBLIGATIONS OF THE CLIENT

8.1. The Client undertakes to use and guarantees the use made of the Services by its Users in accordance with the Agreement, all documentation and standards, legal and regulatory provisions in force, any code of conduct or Secureleap documentation.

8.2. The Client shall ensure that any use made of the Services by the Client or its Users is accurate, stable and not likely to disrupt operations of the Services.

8.3. The Client also declares that its hardware is compatible with the implementation and use of the Services.

8.4. In all circumstances, the Client is solely responsible for the equipment used, its information system, access to the Services and any data, files or other documents used by the Client in relation to the Services, and undertakes to take all appropriate measures to protect any data or software used by the Client in relation to the Services against infection by viruses, logic bombs, Trojan horses or any other harmful or destructive software, or unauthorized use of the Client's information system by third parties.

8.5. It is up to the Client to take all necessary measures to safeguard and check the quality of its data, and where appropriate, to subscribe to an insurance policy covering the possible consequences of this type of risk.

8.6. Secureleap cannot be held responsible for damage resulting from the loss, alteration or damage to the Client's data, in the event that the Client has not kept a backup copy.

8.6.1. The Client shall refrain from downloading, transmitting, or facilitating the transmission of any virus, logic bomb, Trojan Horse, or other destructive or harmful program to Secureleap's systems or, where applicable, to any platform or service provided under this Agreement.

8.6.2. The Client undertakes not to interfere with, hinder, or disrupt the delivery of the Services, including any platforms, systems, or testing activities conducted by Secureleap, whether directly, indirectly, or through the use of automated tools.

8.7. The Client agrees not to reproduce, duplicate, copy, sell, exchange, resell, grant access to, transfer, modify, or create derivative works of any part of the Services, any platforms provided, or the deliverables (including reports, assessments, and documentation) for commercial purposes beyond the Client's internal business use, without Secureleap's prior written consent.

8.8. The Client is liable for all use made of the Services.

8.9. The Client assumes sole responsibility for direct or indirect, material or immaterial damages and prejudices caused by themselves or their Users or staff to Secureleap and/or to any third party whatsoever, and undertakes to indemnify Secureleap against any claims, demands and/or condemnation to damages which might be brought against Secureleap, or any threat of sanction and/or punishment Secureleap might incur, including all reasonably incurred attorney's fees that Secureleap may be liable to pay, insofar as the cause, basis or origin of such claims is deemed to involve any use of the Services that does not comply with the aforementioned provisions and/or any content conveyed, hosted, routed or inserted that is inconsistent with the terms of this Agreement.

8.10. Failure by the Client to comply with the obligations set forth in this Agreement, or infringement of any legal or regulatory obligation may result in Secureleap suspending access to the Services, or terminating this Agreement in accordance with these Terms and Conditions.

9. SUPPORT AND UPDATES

9.1. Remedial Support, which aims at correcting material dysfunctions of the Services that prevent the Client from using the core functionalities, shall be provided as follows: (i) for Services delivered directly by Secureleap, remedial support is the responsibility of Secureleap; (ii) for third-party platform licenses resold by Secureleap, technical support and remediation are provided by the third-party vendor in accordance with their terms of service. For one-time project-based Services such as penetration testing or assessments, "remedial support" refers to clarification of deliverables or correction of material errors in reports, subject to a reasonable period following delivery as specified in the SOW.

9.1.1. For Services delivered directly by Secureleap, Secureleap will make commercially reasonable efforts to correct material dysfunctions in a timely manner. For third-party platforms, Secureleap will use reasonable efforts to facilitate the Client's access to the vendor's support resources.

9.1.2. The features of the Services are likely to be upgraded from time to time. For Services delivered directly by Secureleap, upgrades will be in line with Secureleap's development roadmap. For third-party platforms, upgrades are determined solely by the third-party vendor.

9.2. Secureleap reserves the right to add or remove functionalities or features to Services delivered directly by Secureleap, or to suspend or discontinue them in whole or in part. For third-party platforms, functionality changes are determined by the third-party vendor, and Secureleap shall not be liable for any such changes.

9.2.1. Any such changes will not affect the scope or fees for projects already underway and governed by a fully executed SOW.

9.2.2. For services not governed by an active SOW, Secureleap reserves the right to modify its general service offerings and pricing at any time.

9.3. Secureleap reserves the right to discontinue availability to Users of Services delivered directly by Secureleap in order to carry out updates, maintenance and/or improvement work. For third-party platforms, scheduled maintenance and downtime are controlled by the third-party vendor, and Secureleap shall have no liability for such interruptions. This Section 9.3 applies to ongoing or subscription-based Services and does not apply to one-time project-based Services such as penetration testing or assessments.

9.3.1. For Services delivered directly by Secureleap, and save for emergencies, Secureleap undertakes to notify the Client of any planned downtime by e-mail. For third-party platforms, the Client should refer to the vendor's communication channels for maintenance notifications.

9.3.2. The Client expressly accepts that all new functionalities, tools and features will automatically be subject to the terms of the Agreement, without this list being restrictive.

9.4. Secureleap does not guarantee that updates to Services delivered directly by Secureleap will meet the Client's specific needs. For third-party platforms, Secureleap makes no representations regarding the suitability, timing, or content of vendor updates.

9.5. For Services delivered directly by Secureleap, Secureleap will endeavor to maintain the Services in good working order but is not obligated to implement updates or improvements that are not necessary to restore functionality, nor to fix minor issues that do not materially impact the Client's ability to use core functionalities. For third-party platforms, maintenance and updates are the sole responsibility of the third-party vendor.

9.6. The Client undertakes to equip its information system with workstations, terminals or any other devices compatible with the Services, and to provide a technical environment that includes a reliable Internet connection compatible with the technical requirements necessary for operating the Services.

9.7. Unless otherwise specified in the Statement of Work (SOW) or expressly agreed in writing, all Services will be provided during standard business hours (Monday to Friday, 9:00 AM to 6:00 PM WET/WEST, excluding Portuguese public holidays).

9.8. Although Secureleap may, at its sole discretion, provide support outside of standard business hours including weekends and holidays in urgent situations, such support is not guaranteed and should not be expected as part of the standard Service offering.

9.8.1. Any support provided outside standard business hours is done on a best-effort basis and does not create an ongoing obligation for Secureleap to provide such extended support.

9.9. For Clients requiring guaranteed support outside standard business hours, dedicated arrangements must be explicitly agreed upon in writing and may be subject to additional fees as specified in Statement of Work (SOW).

9.10. In cases of severe security incidents or emergencies that may significantly impact the Client's business operations, Secureleap will make commercially reasonable efforts to respond in a timely manner, subject to resource availability, but does not guarantee immediate response outside of standard business hours unless explicitly agreed otherwise in writing.

10. RESPONSIBILITY AND WARRANTIES

10.1. You agree to use the Services on an "AS IS" basis, with no implied or express warranties of any kind about its quality, performance or results.

10.2. The Client confirms that: (i) for Services delivered directly by Secureleap, the Services have been reviewed during the kick-off or onboarding phase and are suitable for the Client's needs; (ii) for third-party platforms, the Client has independently evaluated the platform's suitability and accepts it on an "as available" basis from the third-party vendor.

10.3. The Client acknowledges that the Services may involve third-party applications, platforms, or services in two ways: (a) third-party compliance platforms (such as Secureframe, Vanta, or Drata) that Secureleap resells to the Client; and (b) other third-party tools or services that the Client independently chooses to integrate with the Services.

10.3.1. For third-party platforms resold by Secureleap, use is governed by the applicable third-party vendor's terms of service and privacy policy, and Secureleap's liability is limited to license procurement as specified in the Service-Specific Terms. For third-party integrations initiated by the Client, such integration is made at the Client's sole discretion and risk. In either case, Secureleap shall not be held liable for damages, service interruptions, data loss, or any other issues arising from third-party applications or platforms.

10.4. Secureleap is not liable for any direct or indirect damage incurred by the client or a third party as a result of the use of the services or any subsequent media, including loss of data or resulting from their partial or total unavailability.

10.5. Secureleap cannot be held responsible for the unavailability of the Services arising from the breakdown of electronic communications carriers or hosting providers, or from a lack of network coverage or insufficient network capacity on the part of the Client.

10.6. Secureleap declines all responsibility for any damage incurred by the Client as a result of using the Services in conjunction with any software or hardware operated by the Client or any user, for any technical issue on the part of the Client, for any technical issue relating to the services provided by any third party, or for any internal issue related to the Client.

10.7. The Client is fully responsible for taking out the necessary maintenance policies to cover its equipment, as well as for implementing the necessary update and backup policies for its information systems, and for establishing all work continuity and recovery procedures and plans. The responsibility of Secureleap is therefore explicitly excluded for any damage resulting from third party hardware or software forming part of the Client's information system and/or that of its Users.

10.8. Secureleap is not responsible for the lack of accuracy, truthfulness, or comprehensiveness of the results or data stemming from the use of the Services. For third-party platforms, data accuracy and integrity are the sole responsibility of the third-party vendor and the Client.

10.9. Secureleap is bound by a best-efforts obligation in the performance of its obligations, including those relating to support and consultancy and to the deadlines for execution, completion, availability or any other time frames agreed upon in the Statement of Work (SOW), which are provided to the Client for information purposes only.

10.10. Secureleap may not be held responsible for any delay in the performance of the Agreement resulting from these indicative deadlines, nor for any functional defects in the Services.

10.11. Secureleap does not guarantee that the Services will function at all times, nor that they are exempt from any error. For third-party platforms, uptime and availability are determined by the third-party vendor's service level commitments, if any. Secureleap does not guarantee that any Service will prevent all cyber attacks, but rather that it will improve the Client's security posture.

10.12. Unless there has been gross negligence proven and documented in the performance of its obligations, Secureleap's liability is limited expressly as indicated below, to the exclusion of all other damages of any nature including, in particular, loss of profits, loss of revenue, loss of business, loss of clientele, loss of business opportunity, or other similar losses, breach of privacy, loss of personal data and, also, any kind of indirect, incidental or consequential damages as well loss of information, and damages caused to third parties.

10.13. Secureleap is not liable for any temporary disruption of the Services, in particular where such disruption results from the deployment and implementation of maintenance, service or backup work, updates and extensions, including in cases where the Client observes a degradation, failure or temporary quality disruption.

10.14. Secureleap shall not be held liable for any loss of time or inconvenience caused by the performance of its duties under the present Agreement or resulting from the failure of the whole or any part of the Services.

10.15. At all events, if the liability of Secureleap is proven for compensable damage, its total liability to the Client for any and all claims arising from or related to a specific Statement of Work (SOW) shall not exceed the total Project Fees paid or payable by the Client to Secureleap under that SOW.

11. INTELLECTUAL PROPERTY

11.1. Secureleap retains all intellectual property rights in the Services it develops and delivers directly, including but not limited to source code, functionalities, software, media, documentation, content, visuals, and registered trademarks. For third-party platforms resold by Secureleap, all intellectual property rights remain with the respective third-party vendors.

11.1.1. Secureleap may freely use any ideas, suggestions, feedback, or recommendations regarding the Products or Services that have been provided by the Client ("Feedback"), without incurring any obligation to pay royalties or any other form of compensation to the Client.

11.2. The Client acknowledges that this Agreement does not entitle them to any title or right of ownership of whatsoever nature with regard to the Services and its constituents or components, nor of any other kind.

11.3. For Services delivered directly by Secureleap, Secureleap grants the Client a limited, non-exclusive, non-transferable right to use the Services for professional purposes during the term specified in the SOW. For third-party platforms, the license to use the platform is granted by the third-party vendor in accordance with their terms of service; Secureleap's role is limited to facilitating the Client's access to such license.

11.4. The Client must comply with and ensure compliance with all notices relating to Secureleap's property rights and, where applicable, third-party vendors' property rights on the components of the Services on all media.

11.5. The Client is not authorized to copy, modify, disassemble, alter, or otherwise adapt, in particular by translation, any part of the Services delivered by Secureleap or any third-party platforms accessed through Secureleap.

11.6. This Agreement does not empower the Client to sell, rent, license, lease or distribute the Services by any means whatsoever, including on a temporary basis.

11.7. The Client expressly undertakes not to copy, reproduce, republish, download, display, translate, distribute, sell, or operate the Services, trademarks, and other intellectual property rights held by Secureleap or by third-party vendors whose platforms are accessed through Secureleap.

11.8. The Client shall refrain from implementing or allowing the deployment of a deconstruction or reverse development process that would result in accessing any code, modifying it or reusing part of this code by whatever means or in whatever form, or from inserting any intrusive or malicious code.

11.9. The Client undertakes not to implement any procedure aimed at accessing the Services by any devious or unauthorized means, or to impede such an occurrence by abstaining from doing so.

11.10. Secureleap reserves the right to terminate, suspend or block the Client's access to the Services in the event of a failure to comply with any of the articles herein. The Client undertakes to ensure that all staff comply with these obligations.

11.11. The Client claims to be the owner of all legal rights pertaining to all the elements, contents, data and documentation which they provide and may be produced within the framework of this Agreement and guarantees that the latter are in conformity with the current laws and regulations, and that they are not being disputed or claimed by a third party for any purpose whatsoever, such as, in particular, patents and copyrights.

11.12. The Client must indemnify Secureleap on demand for all damages, costs, expenses including legal defense costs (fees and expenses), for which Secureleap may choose the counsel, fines or indemnity of any nature that Secureleap may suffer as a result of a claim by a third party, including all qualified administrative authorities, due to a breach by the Client of their obligations under the provisions of this section.

11.13. In addition, any data or other elements produced or generated based on the Client's indications remain the property of the Client, who is entirely responsible for them, and Secureleap has no obligation to monitor and verify the content provided or sent through the Services.

11.14. The Client expressly agrees to indemnify and hold harmless Secureleap against all loss suffered by Secureleap or any third party as a result of the infringement of a third party's intellectual property rights, violation of applicable law, or of any conflicting provision herein. 

11.15. CLIENT LICENSE GRANT TO SECURELEAP

Under the terms of this Agreement, the Client grants Secureleap a limited, non-exclusive license to use the data and other elements provided by the Client solely for the following purposes: 

(i) performing the Services under this Agreement; 

(ii) generating aggregated, anonymized statistics and benchmarks that do not identify the Client; and 

(iii) improving Secureleap's service offerings. 

This license does not transfer ownership of Client data and remains subject to the confidentiality obligations set forth in Section 13 and the data protection requirements of Section 12.

12. PERSONAL DATA

12.1. Each of the Parties shall comply with all applicable data protection laws.

12.2. Secureleap undertakes to comply with the provisions of EU Regulation No. 2016/679 on the protection of individuals with regard to the processing of personal data known as the "GDPR", as well as Portugal's Law on the protection of personal data, and more generally all current statutory regulations on the protection of personal data.

12.3. Secureleap will use the information and personal data provided by the Client in accordance with the terms of the Data Processing Agreement reached between the parties in the case of Secureleap acting as a subcontractor, and in accordance with the terms of Secureleap's Confidentiality Policy in all other cases, available at https://secureleap.tech/privacy

13. CONFIDENTIALITY

13.1. Each party commits not to disclose the other party's confidential information to any third party without the prior written consent of the other Party for the term of the Agreement and for a five (5) year period following the expiration or termination of the Agreement under any circumstances whatsoever.

13.2. The Parties represent and warrant that their staff and any subcontractors involved in the performance of the Agreement will comply with this obligation.

13.3. The term "Confidential Information" refers to any non-public information disclosed by one Party to the other, whether orally, in writing, or by any other means, including but not limited to: (i) business plans, strategies, pricing, and financial data; (ii) technical data, software, source code, know-how, and trade secrets; (iii) client and supplier lists and related information; (iv) proprietary methodologies, processes, and tools; (v) any information expressly marked or identified as "Confidential"; and (vi) any information that a reasonable person would understand to be confidential given its nature or the circumstances of disclosure.

13.3.1. Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the receiving Party; (b) was lawfully in the receiving Party's possession prior to disclosure without restriction; (c) is independently developed by the receiving Party without use of or reference to the disclosing Party's Confidential Information; or (d) is lawfully obtained from a third party without breach of any confidentiality obligation.

‍

14. TRADE REFERENCES

14.1. By accepting these Terms and Conditions, the Client hereby grants free, express, informed, and unequivocal authorization for the company to use its name, corporate name, or trade name, as applicable, for institutional, advertising, and marketing purposes, including but not limited to promotional materials, commercial presentations, websites, social media, portfolios, commercial proposals, advertising campaigns, and other disclosure channels, whether in physical or digital format.

14.2. This authorization is granted free of charge and for an indefinite term, and may be revoked at any time upon formal written request, without prejudice to materials already produced and/or disclosed prior to the date of revocation.

14.3. Secureleap undertakes to use the Client’s name in an ethical and professional manner, consistent with its reputation, and shall not associate it with unlawful, offensive, or harmful content that may damage its image.

14.4. This authorization does not imply the assignment of any other image, trademark, or intellectual property rights, being strictly limited to the use of the name for the purposes described herein.

15. AGREEMENT ON EVIDENCE

15.1. The use of the Services by the Client is deemed to be evidence of use and compliance with the documentation and the Agreement and this clause is deemed to be an agreement of proof within the meaning of article 368º of the Portuguese Civil Code.

15.2. If any dispute arises concerning the use of the Services, the parties expressly agree that all technical information concerning the Client, in particular recordings and statistics, will be retained and filed by Secureleap for evidentiary purposes.

16. EXPIRY OF THE AGREEMENT - REVERSIBILITY

16.1. This Agreement is in force until the date specified herein, unless otherwise specified in the Statement of Work (SOW).

16.2. Secureleap may modify this agreement by posting revised terms online at https://secureleap.tech/terms-of-service, without additional notice to the Client. The revised terms will be effective on the date of posting and shall apply only to Statements of Work executed after that date. SOWs executed prior to the posting date shall remain governed by the version of the Terms and Conditions in effect at the time of their execution.

16.3. Unless otherwise provided in Section 16.1 , each Party may terminate this Agreement thirty (30) days after formal notice sent by registered letter with acknowledgement of receipt to the other Party in case of breach by said Party of a provision herein, describing precisely the grievance(s) and the provision of the Agreement concerned, whereby if such termination occurs prior to project completion, the termination fees specified in Section 7.14 shall apply.

16.4. As an exception to the notice period set forth in Section 16.3, Secureleap reserves the right to suspend or terminate this Agreement without prior notice if one of the following three events occurs:

(1) if the Client fails to comply with any of its material obligations under this Agreement,

(2) if Secureleap is informed that the Services are being used for unlawful purposes, contrary to public order or morality, or

(3) if the Client is in one of the following situations: receivership or liquidation, change of ownership or principal shareholder, merger resulting in a change of control.

‍

16.5. In the event of non-payment of an overdue invoice from Secureleap and fifteen (15) days after sending a written notice of any kind (regular mail, registered letter with electronic acknowledgement of receipt) without effect, Secureleap will be able to suspend access to all or part of the Services without further notice, at its discretion, or to terminate immediately the Agreement ipso jure.

16.6. For avoidance of doubt, this specific procedure for non-payment supersedes the dispute resolution process described in Section 18 of this Agreement, which does not apply to non-payment cases.

16.7. In the event of termination of the Agreement, the Client undertakes to return to Secureleap without delay all elements in their possession which belong to Secureleap, and not to retain any copy of such items, in whole or in part, failing which they will be liable to legal action.

16.8. In the event of early termination of the Agreement for any reason, the Client must pay all undisputed outstanding invoices.

16.9. If termination is initiated by the Client for convenience, the cancellation fees specified in Section 7.14 shall become immediately due and payable.

16.10. Following the end of the Agreement and upon request in writing from the Client, Secureleap shall, within a maximum period of thirty working days following the expiration of the Agreement for any reason whatsoever, either return all of the Client's data in their possession as a result of the enforcement of the Agreement in a standard format, or destroy them and attest to the Client that they have been destroyed, according to the Client's explicit instructions in its written request.

16.10.1. Such return or destruction shall remain subject to and within the limits of the statutory and regulatory conservation obligations imposed on Secureleap. In the absence of specific instructions from the Client, Secureleap shall return the data in a standard format.

16.11. The Client agrees to cooperate actively with Secureleap in order to assist in the recovery of data and information.

16.12. Any additional or extended reversibility operation beyond that described above shall be subject to prior quotation at Secureleap's rates in effect on the date of the request.

17. MISCELLANEOUS

17.1. The Agreement comprises all of the contracts entered into between the Parties and replaces any other agreements or arrangements whatsoever, whether written or verbal, relating to the purpose of the Agreement, which may have been entered into between the Parties prior to the date thereof. By executing a Statement of Work, the Client fully agrees to be bound by its provisions.

17.2. The party liable for an obligation arising from this Agreement shall not be in breach of such obligation if non-performance results from a case of force majeure.

17.2.1. By express agreement, cases of force majeure include natural disasters, general or partial strikes or lockouts, epidemics, shortages or disruptions of ordinary means of transport, shortages of raw materials or components, fire, storms, earthquakes, flooding, water damage or other damage which affects the performance of the Agreement, Government or legal restrictions, and more generally, any situation beyond the control of the party affected such as to prevent the party from performing its obligation under the conditions provided for, within the meaning of Portuguese case law.

17.3. If such a situation of force majeure is of a temporary nature, the execution will be suspended for as long as the performance of the obligation concerned is delayed, in which case the delay shall be tolerated.

17.4. If the situation of force majeure or the delay continues beyond a period of ninety (90) days, either party may terminate it at its discretion, with no obligation to indemnify or compensate the other party.

17.5. Any delay resulting in whole or in part from (a)- the total or partial interruption of telecommunications networks, as well as (b)- the failure or fault of Secureleap contractors such as suppliers or subcontractors shall be excused, as the Client acknowledges and accepts without recourse against Secureleap, and without this list being limitative.

17.6. All documentation provided by the Client to Secureleap, such as, in particular, expressions of needs, studies, specifications, are devoid of any contractual character, even if Secureleap has responded to same, and do not fall within the scope of the Agreement, the aim of which is to deliver the Services under the conditions mentioned above, to be evaluated by the Client so as to ensure that they comply with their needs.

17.7. Unless Secureleap grants prior written consent, the Client may not assign all or part of this Agreement or otherwise make the Services available to any other party, even on a temporary basis, and regardless of the type of operation performed. In case of corporate reorganization, merger, or acquisition of the Client, Secureleap shall not unreasonably withhold such consent.

17.8. All or part of the work which is the subject of this Agreement may be subcontracted by Secureleap provided that: (i) Secureleap remains in charge of the proper execution of the Agreement with respect to the Client; (ii) the named subcontractor is aware of and accepts the obligations incumbent upon Secureleap hereunder; and (iii) such subcontracting does not materially affect the quality of Services or the security of Client data.

17.8.1. A complete list of Secureleap's subcontractors is available upon written request to info@secureleap.tech.

17.9. All claims and/or disputes by the Client against Secureleap must be lodged in writing no later than 12 (twelve) months from the date of their occurrence, subject to forfeiture.

17.10. The written claim and/or dispute must in particular include a breakdown of the services, the amounts, etc. under dispute along with the underlying causes for the complaint.

17.11. Should one or more clauses of the Agreement be regarded as void or declared as such by applicable laws or regulations or following a legal decision that has become permanent, such clause(s) will be removed without rendering the remainder of the Agreement invalid, while all its other clauses shall remain fully applicable.

17.11.1. The Parties shall seek to replace the invalid provisions with effective provisions that come as close as possible to the underlying purpose of the invalid clause.

17.12. Failure of either Party to enforce any provision of this Agreement or to accept any breach thereof, whether permanent or temporary, shall not be construed as a waiver of any such provision nor prevent such party from enforcing any of its rights.

18. DISPUTE SETTLEMENT PROCESS

18.1. The Agreement shall be governed by the laws of Portugal.

18.2. If any dispute arises out of the interpretation and/or execution of the Agreement, excluding cases of non-payment (which shall be handled in accordance with Section 16.5 ), entitling the parties to bring the matter directly before the Court of competent jurisdiction, each party agrees to attempt to settle the dispute amicably within a period of one (1) month, with the more diligent party describing the grievance or grievances and the relevant contractual provisions deemed to have been breached and summoning the other by registered letter with acknowledgement of receipt to attend a meeting to be held at Secureleap's head office or by videoconference, no later than five working days after the event.

18.3. Failure to reach an amicable settlement will result in the dispute being subject to the exclusive jurisdiction of the Lisbon Courts, notwithstanding any third-party claims or multiple defendants, even for emergency or protective measures.

19. ACCEPTANCE OF ELECTRONIC SIGNATURE

19.1. The Parties mutually and unequivocally acknowledge and accept the validity and effectiveness of the electronic signatures applied to this Agreement and any documents arising from it (including Statements of Work – SOWs).

19.2. The validity of such electronic signatures is conditional upon demonstrating, at the time of their application, the authority and legal capacity of the signatory to bind the respective Party to the Agreement.

19.3. The electronic signature thus applied shall be considered equivalent, for all legal purposes, to a handwritten signature.

‍

Service-Specific Terms

These Service-Specific Terms are to be read in conjunction with the main Terms and Conditions and form an integral part of the Agreement between Secureleap and the Client.

1. COMPLIANCE PLATFORM

1.1. The Compliance Platform is Secureleap's SaaS compliance management solution that seamlessly integrates with organizations of any size, providing the Client access to a comprehensive suite of compliance tools.

1.2. These tools collectively enable the Client to maintain regulatory adherence, automate compliance workflows, and protect against compliance risks.

1.3. The Compliance Platform grants the Client's Users a License to access a complete 360° view of the Client's compliance posture at any time, facilitating continuous monitoring, documentation, and reporting of compliance activities across multiple frameworks and standards.

1.4. Where Secureleap resells third-party compliance platform licenses (including but not limited to Secureframe, Vanta, or Drata), the Client acknowledges that (a) use is subject to the applicable third-party provider's terms of service and privacy policy; (b) Secureleap acts solely as a reseller and makes no warranties regarding third-party platforms; and (c) Secureleap's liability is limited to license procurement; technical support and platform performance are governed by the third-party provider's terms.

‍

2. CONSULTANCY SERVICES

2.1. Secureleap will remotely provide the Client advice and support covering information security topics, including, without limitation, frameworks such as ISO 27001, SOC2, NIST, CIS, ISO22301 and General Data Protection Regulation (GDPR).

2.2. Where specified, Secureleap will assist the Client to work toward improvement of its business performance in terms of operations, management, structure and/or strategy regarding cybersecurity and/or GDPR compliance.

3. ISO 27001 SERVICES

3.1. ISO 27001 Gap Analysis

3.1.1. Secureleap will provide an experienced ISO 27001 consultant to undertake a Gap Analysis against, as appropriate, the version of the ISO 27001 standard requested by the Client in accordance with the agreed scope.

3.1.2. The output of the gap analysis will be a report detailing the current level of compliance to each of the requirements of ISO 27001 with recommendations on what needs to be done to achieve compliance.

3.1.3. During the Gap Analysis, which will be conducted via a series of online interviews with key stakeholders, the Client will be required to provide documents, e.g., policies and procedures that are currently in place for assessment.

3.2. ISO 27001 Implementation

3.2.1. Secureleap will provide an experienced ISO 27001 implementer to deliver an ISO 27001 implementation project to enable the Client's readiness for certification by an external accredited certification body.

3.2.2. The implementation service, which will be delivered remotely, will include training of all staff on the Information Security Management System the consultant is implementing and preparation of all required documentation.

3.2.3. The Client will be required to play an active part in the implementation through interviews and workshops.

3.3. ISO 27001 Internal Audit

3.3.1. Secureleap will provide an experienced ISO 27001 auditor to conduct an internal audit against the agreed requirements and scope of the Information Security Management System.

3.3.2. The output of the internal audit will be a report, written in accordance with the requirements of the ISO 27001 standard that will outline any non-conformities and opportunities for improvement.

3.3.3. During the audit, which will be conducted remotely, the Client will need to provide access to key staff, documentation and evidence to support the audit.

4. PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS) CONSULTANCY

4.1. Secureleap will provide an experienced information security consultant to provide a range of PCI DSS consultancy services to ensure the Client has implemented all the necessary policies, procedures and technical controls to achieve PCI DSS certification.

4.2. Where available, the Client will be required to provide an asset inventory for systems in scope for PCI along with a network diagram and data flow diagram along with any other relevant supporting policies, procedures and documentation.

5. SERVICE ORGANISATION CONTROL (SOC) 2

Secureleap will provide an experienced information security consultant to provide a range of SOC2 consultancy services to assist the Client in the implementation of all necessary policies, procedures and technical controls in preparation for an audit by a Certified Public Accountant (CPA).

6. TRAINING

6.1. Secureleap will provide a range of standard training courses covering cybersecurity awareness.

6.2. These can be delivered through the Compliance Platform with a range of videos and associated exams which, along with built-in reporting, allows the Client to track that staff have watched the videos and completed their exams.

6.3. Other delivery methods include virtual training using video conferencing tools.

7. PENETRATION TESTING

7.1. Secureleap will perform penetration testing that evaluates the Client's systems to validate and exploit known vulnerabilities by assessing critical external and/or internal assets and/or APIs and/or web applications and/or mobile applications and/or cloud infrastructure and/or wireless infrastructure using experienced penetration testers to determine if the Client's organisation is susceptible to attacks.

7.2. This test will commence on the provisional or definitive date and time listed in the Statement of Work (SOW) or subsequently expressly agreed in writing by the parties.

7.3. Secureleap will provide a report in downloadable versions within 5 working days of completion of a test.

7.4. Client Obligations

The Client, under the terms of this Agreement, undertakes to:

• Notify Secureleap in writing of any necessary further scope details at least five working days prior to the start of the Penetration Tests for efficient scheduling of necessary resources and time.
• Where the Client fails to submit the necessary scope details, Secureleap shall reschedule the Penetration Test and the Client shall be liable for any charges.
• The Client and Secureleap will agree dates promptly after the Commencement Date or as set forth in the Statement of Work (SOW) for Secureleap to deliver the Services within 12 months of the execution of the Agreement and, where the Client fails to agree dates for the Services through no fault of Secureleap, the Client will forfeit their right to the Services for the relevant 12-month period and, for the avoidance of doubt, no refund or waiver of Fees or related costs, all owed upon execution of the Agreement, will be issued by Secureleap.
• The Client acknowledges that the Service will be provided remotely. The Client acknowledges that a Penetration Test is a snapshot in time and that it is limited to the actions set out on the Statement of Work (SOW), (which actions may be agreed in an incorporated scope Annex document).
• The Client shall comply with any rules imposed by any third party whose content or services are accessed via the Services.
• The Client shall inform Secureleap forthwith if any of the Services are subject to interference or malfunction.
• The Client, prior to Penetration Tests, must proactively and appropriately backup all critical data from its Systems that will form part of the Penetration Tests.

7.5. Authorization and Liability for Penetration Testing

By requesting Penetration Testing services, the Client:

• Authorizes Secureleap to attempt to penetrate and test the Client's systems as specified in the scope;
• Confirms it has full legal authority to permit such testing on all systems in scope, including necessary consents from any third parties whose systems may be affected;
• Acknowledges and accepts that penetration testing may cause temporary service disruptions or performance degradation;
• Agrees that Secureleap shall not be liable for temporary disruptions, discovery of pre-existing vulnerabilities, or business interruption resulting from properly conducted testing activities;
• Agrees to defend, indemnify and hold harmless Secureleap from any claims, damages, or liabilities arising from authorized testing activities, including third-party claims alleging unauthorized access or system interference;
• Will promptly notify Secureleap if any critical systems become unavailable during testing or if any third party raises concerns about the testing activities.
• Secureleap may pause or terminate testing if continuing would cause significant harm to systems or if legal concerns arise.

7.6. Post-Engagement Account Cleanup

Upon completion of the Penetration Test, the Client shall promptly (and in any event within five (5) working days) remove, disable, or delete all test accounts, temporary credentials, API keys, and elevated access permissions created or provided for the purpose of the engagement. Secureleap shall delete any credentials provided by the Client upon completion of the engagement. The Client acknowledges that Secureleap bears no liability for security incidents arising from the Client's failure to perform such cleanup.

‍

8. VIRTUAL CHIEF INFORMATION SECURITY OFFICER (VCISO)

8.1. Secureleap will provide a remote managed service that includes an experienced Information Security Consultant to build and implement information security strategy for the Client.

8.2. The service may require an initial health check to establish the current security posture of the Client's organisation and enable Secureleap's Consultant to build a strategy. This Service can also provide support to manage existing security frameworks such as SOC2 and ISO 27001.

8.3. Secureleap Obligations

• Secureleap will provide regular updates to the Client where reasonably requested;
• Secureleap will provide regular (at least monthly, at Secureleap's discretion) updates on the progress of the implementation of the agreed security strategy;
• Secureleap will only amend any agreed strategy with the written agreement of the Client; and
• Secureleap will work with third party suppliers of the Client where reasonably requested (e.g., outsourced IT providers).

8.4. Client Obligations

The Client will notify Secureleap's designated VCISO of changes to the Client's business including, interpreted broadly:

• Structural/organisation changes e.g., acquisitions, sales;
• Critical role and responsibility changes;
• Key Client supplier changes that may impact on information security;
• New Client supplier onboarding that may impact information security;
• New software/solutions/hardware/cloud services that are planned; and
• Key personnel changes.

8.4.1. The Client will notify the VCISO of any security incidents or data breaches of which it becomes aware. The Client will notify the VCISO of any Client regulatory, legislative and/or contractual requirements. The Client will, when raising a request for assistance from its VCISO, ensure that info@secureleap.tech is copied on all messages.

8.5. VCISO Engagement Terms

8.5.1. The VCISO Services are provided on a fixed-term project basis, as a "VCISO Engagement."

8.5.2. The specific duration, objectives, deliverables, and total fee for the engagement will be detailed in the SOW.

8.5.3. Termination of VCISO Engagement

For VCISO Services provided on a monthly retainer basis, either Party may terminate the engagement by providing thirty (30) days' written notice in accordance with Section 16.3 of the main Terms and Conditions. Upon such termination:

(a) If terminated by the Client for convenience after providing the full thirty (30) days' written notice, the Client shall pay for all Services rendered through the end of the notice period. If the SOW specifies a minimum committed term and termination occurs before that term expires, the cancellation fees specified in Section 7.14 shall apply only to the remaining committed term.

(b) If no minimum committed term is specified in the SOW, the Client shall pay for all Services rendered through the end of the thirty (30) day notice period, with no additional cancellation fee.

(c) Any unused prepaid hours shall be forfeited unless otherwise agreed in the SOW.

9. EXTERNAL AUDIT

9.1. Scope and Purpose

9.1.1. Secureleap will, upon the Client's request and as specified in the Statement of Work (SOW), coordinate external audit services to assess the Client's compliance with relevant industry standards, regulations, or frameworks.

9.1.2. External audits may be performed for certification purposes or to provide independent validation of compliance status.

9.2. Audit Coordination

9.2.1. Secureleap will assist the Client in engaging with qualified, independent, and accredited third-party auditors appropriate to the relevant standard or regulation.

9.2.2. These auditors will be selected based on their credentials, industry recognition, and expertise in the specific standards being audited.

9.3. Pre-Audit Assessment

9.3.1. Prior to an external audit, Secureleap may conduct a pre-audit assessment to evaluate the Client's readiness and identify any areas requiring remediation before the formal audit process, in order to maximize the likelihood of a successful audit outcome.

9.4. Audit Support

During the external audit process, Secureleap will:

• Act as a liaison between the Client and the external auditors
• Assist in preparing and organizing documentation required by auditors
• Provide guidance on addressing auditor questions and requests
• Support the Client during audit interviews and assessments
• Help interpret audit findings and recommendations

9.5. Post-Audit Remediation

Following the external audit, Secureleap may assist the Client in:

• Analyzing audit findings and non-conformities
• Developing remediation plans to address identified issues
• Implementing necessary corrective actions
• Coordinating follow-up assessments or audits as required

9.6. Client Obligations

In relation to external audit services, the Client shall:

• Provide timely access to all information, systems, facilities, and personnel necessary for the audit
• Assign appropriate internal resources to support the audit process
• Promptly address and implement required remediation activities
• Maintain accurate and complete records of all audit-related activities
• Cooperate fully with both Secureleap and the external auditors throughout the process

9.7. Cancellation of Scheduled External Audits

9.7.1. External Audit services involve the coordination and booking of accredited third-party auditors.

9.7.2. If the Client terminates or requests to reschedule an External Audit after it has been formally scheduled with the third-party auditor, the Client shall be responsible for any and all cancellation or rescheduling fees imposed by the auditor, in addition to an administrative fee payable to Secureleap equal to fifteen percent (15%) of the total audit fee specified in the SOW.

9.8. Limitations

9.8.1. While Secureleap will use commercially reasonable efforts to provide expertise, guidance, and support throughout the audit process to maximize the potential for a successful outcome, we do not guarantee successful certification or audit results.

9.8.2. The ultimate outcome depends on the Client's actual compliance status and the independent judgment of the external auditors.

‍