Terms of Service

Scope and agreement

These terms govern the hosting, design and development, cybersecurity, and training services provided by Silentweb of Kingston, Ontario, Canada. Engaging any of these services means you accept them.

Where a written engagement letter, statement of work, or quotation covers the same subject as these terms, that document takes precedence for the engagement it describes. These terms fill the gaps and continue to apply to everything the engagement letter does not address.

We contract with organisations and with individuals acting in a commercial capacity. If you are signing on behalf of an organisation, you confirm you are authorised to do so.

Fees, invoicing, and taxes

All fees are stated and payable in Canadian dollars. Applicable federal and provincial taxes are added to invoices. We accept payment by electronic transfer, cheque, or card through a payment processor.

Invoices are due on the terms stated on the invoice. Work on active projects stops where an invoice goes unpaid past its due date, and resumes once the account is current — a stoppage of this kind may push out agreed dates, and we will not be held to a deadline missed for this reason.

Hosting accounts

Hosting is billed monthly or annually in advance. Accounts unpaid thirty days past due may be suspended; accounts suspended for sixty days may be deleted along with their data.

You are responsible for the content you publish, for the applications you install, and for keeping those applications and their dependencies updated. We may patch or disable an application without notice where leaving it running would endanger the server or other accounts, and we will tell you when we have done so.

Plan limits on disk space, transfer, domains, and databases are published on our hosting page. Sustained use beyond your plan may require an upgrade. We do not oversell storage or bandwidth.

Acceptable use

Hosting accounts must not be used to send spam or unsolicited bulk email; to publish unlawful material; to mine cryptocurrency; to operate open proxies, VPN exit nodes, or Tor relays; to host adult content; or to store or distribute malware, phishing kits, or any other attack infrastructure.

Accounts must not consume resources in a way that degrades service for others on the same server. Where this happens we will contact you first unless the situation requires immediate action.

We may suspend an account without prior notice where it has been compromised, is actively sending unsolicited mail, hosts unlawful material, or endangers other accounts. We will tell you why, in writing, and give you a route to put it right where one exists. We reserve the right to refuse or discontinue service, and where we do we will state our reason in writing.

Availability and maintenance

We target high availability but do not offer a contractual uptime guarantee, and no service credits arise from downtime. We would rather be honest about that than publish a number we cannot enforce alone.

Scheduled maintenance is announced in advance on our News page and, when urgent, on Mastodon. We schedule disruptive work outside Eastern Time business hours wherever we have the choice.

Backups are taken as part of the hosting service and are a courtesy of operating the platform, not a substitute for your own. Keeping an independent copy of anything you cannot afford to lose remains your responsibility.

Cancellation and notice

You may cancel hosting at any time. Service continues to the end of the paid term and prepaid fees are not refunded. Ongoing hosting and retainer relationships may be ended by either party on sixty days’ written notice.

Retrieve your data before the closure date. Backups are retained for thirty days after an account closes so that a closure made in error can be reversed, and are then deleted permanently. After that point we cannot recover your data by any means.

Development engagements

Development work is quoted at a fixed scope and fixed price on the basis of an agreed statement of work. A deposit is required before work begins — typically twenty-five percent, varying with the size of the engagement — and is applied against the final invoice.

Changes to agreed scope are quoted and priced separately. We will not absorb scope growth silently, and we will not proceed with additional work until you have approved its cost.

Projects depend on you supplying content, assets, credentials, and approvals by the dates set out in the statement of work. Where material is outstanding beyond thirty days, we may pause the project and place it back in our schedule when you are ready, or re-quote the remaining work if our costs have changed in the interim.

Ownership of work

On final payment, you own the custom work produced for you — the designs, templates, content, configuration, and application code written specifically for your project — and you may modify, host, or hand it to another developer freely. We claim no continuing control over it.

Our own internal libraries, tooling, build scripts, and general-purpose components predating or developed independently of your project remain ours. Where any of these are embedded in your deliverable, you receive a perpetual, irrevocable, royalty-free licence to use, modify, and distribute them as part of that deliverable. This is what allows us to build quickly without charging you to reinvent the same pieces.

Third-party open-source components remain under their own licences, which we will identify on request.

Publicity

We will not name you as a client, show your website, or describe our work for you in any public material without your written permission. Permission given for one purpose is not permission for all purposes, and you may withdraw it at any time.

Security engagements

All security testing is performed under a written engagement that defines scope, timing, and authorisation before any work begins. We do not test systems you do not own or control.

You warrant that you own the systems in scope, or hold the authority to permit testing of them. Where a system in scope is hosted, operated, or maintained by a third party, you are responsible for obtaining that party’s written authorisation and providing it to us before testing begins. We will stop work if authorisation cannot be evidenced.

You are responsible for taking a verified backup of any system in scope before testing starts. Security testing carries an irreducible risk of disruption: services can become unresponsive, data can be altered, and systems can require a restart. We work carefully and stay inside agreed scope and timing, but we are not liable for incidental disruption, downtime, or data loss arising from authorised testing.

A test describes what we found, in the scope we were given, at the time we looked. It is not a guarantee of security and not a warranty that every vulnerability has been identified. No testing engagement can prove the absence of flaws.

Our reports are confidential to you and must not be represented to any third party — a customer, insurer, regulator, or auditor — as a certification, accreditation, or evidence of compliance with any standard or framework. We do not certify, and a report that says otherwise is being misused.

Training

Training fees, dates, and cancellation terms are set out in each engagement. Recorded materials and courseware are licensed for internal use by the purchasing organisation and may not be redistributed, resold, or used to train others outside it.

Where a phishing or social engineering campaign forms part of an engagement, it runs under the authorisation and reporting terms agreed in writing beforehand, on the basis set out in our Privacy Policy.

Work for not-for-profits and charities

We provide security consulting and, at our discretion, training to not-for-profit organisations and registered charities at no charge. It is a gift of our time, offered because organisations holding sensitive data on the smallest budgets are the ones that most need the help.

These terms apply in full to that work, with one difference: because no fee is paid, our liability for unpaid work is limited to nil. Unpaid engagements are scheduled around paid commitments and may be paused, rescheduled, or withdrawn where our capacity requires it. We will always tell you rather than go quiet.

Warranties and disclaimers

We provide our services with the reasonable skill and care of a competent practitioner in our field. That is a real commitment and we stand behind it.

Beyond it, services are provided as they are. We do not warrant uninterrupted or error-free operation, that any system will be free of vulnerabilities, or that our work will prevent a security incident. No advice or report from us is a guarantee of any outcome.

Limitation of liability

Neither party is liable for indirect, incidental, consequential, special, or punitive damages, or for lost profits, lost revenue, lost business, or lost or corrupted data, however arising.

Our total aggregate liability arising out of or relating to our services is limited to the fees you paid us in the twelve months preceding the event giving rise to the claim. For work provided at no charge, that figure is nil.

Nothing in these terms limits liability for fraud, fraudulent misrepresentation, wilful misconduct, or anything else that cannot be limited under Ontario or Canadian law.

Your responsibilities

You are responsible for the lawfulness of the content you publish and the data you ask us to handle; for holding the rights to any material you supply; for keeping your own credentials secure; for maintaining independent backups of anything critical; and for the decisions you make in response to our advice. We can tell you what we would do. We cannot make the choice for you.

Confidentiality

Each party will protect the other’s confidential information, use it only for the purposes of the engagement, and disclose it no further than necessary to perform the work. Our obligations regarding your data are set out in more detail in our Privacy Policy, which forms part of these terms.

These obligations survive the end of the engagement and continue for as long as the information remains confidential.

Subcontractors

Work is performed by us. Where a specialist is genuinely needed we will tell you before engaging anyone, that person will be bound to the same confidentiality obligations, and we remain fully responsible to you for their work.

Suspension and termination for cause

Either party may terminate an engagement for material breach where the breach remains uncured thirty days after written notice. We may terminate immediately, without notice, where continuing would require us to act unlawfully or unethically, or where we are asked to test or access a system we have reason to believe you are not authorised to permit access to.

On termination you pay for work performed to that date, and we deliver what has been paid for.

Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, including network or upstream provider failure, data centre outage, power loss, natural disaster, labour disruption, or government action. We will keep you informed and resume as soon as we are able.

Disputes

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable there.

If a dispute arises, we will first try to resolve it directly. Failing that, both parties agree to attempt mediation in good faith before starting proceedings. Where mediation does not resolve matters, the courts of Ontario have jurisdiction. Nothing here prevents either party seeking urgent injunctive relief where genuinely necessary.

Changes to these terms

We may update these terms. Material changes affecting ongoing services are announced on our News page at least thirty days before they take effect, and continued use of the service after that date constitutes acceptance. Changes never apply retroactively to work already performed or to a signed engagement in progress.

Miscellaneous

If any provision of these terms is found unenforceable, the rest continue in force and the unenforceable provision is read down to the minimum extent necessary. A failure to enforce a term is not a waiver of it. Neither party may assign these terms without the other’s written consent, except in connection with the transfer of substantially all of its business.

Questions about these terms may be sent to support@silentweb.ca.