GUARANTEE
Our guarantee
A mark is worth exactly as much as the commitment behind it. That is why our guarantee is written down, with clear limits, and why we publish every time we pay it.
Money back
If, within the 6 months the certificate is valid, a Critical or High security flaw is found that existed in the version we audited and that our audit should have caught, we refund 100% of the cost of the audit and repeat it free of charge.
A bounty if we miss one
For Gold-certified applications we pay €1,000 per confirmed Critical flaw to any security researcher who finds one we did not. We pay the bounty, not the client. Testing happens only in a test environment and only with the client’s written consent, under responsible-disclosure rules.
Breach cover
Insurance covering part of the cost of a breach caused by a flaw we missed. In preparation with an insurer.
What it covers and what it does not
Covered
- Critical or High flaws in the version we certified
- Flaws within our published criteria
- Findings confirmed by an independent reviewer
Not covered
- Changes made after the audit
- Findings we reported to you and you chose not to fix
- New library vulnerabilities disclosed after the audit
- Third-party services outside the audit scope
- Social engineering, physical access, denial-of-service attacks
- Cases where continuous checking was switched off, or remediation deadlines were not met
The limits
- Maximum amount: the cost of the audit that was paid.
- Lost profit, indirect damage and third-party claims are not covered.
- The guarantee applies to the client who ordered the audit.
- Every claim is reviewed by an auditor who took no part in the original audit, with a written answer within 10 working days.
Transparency
We publish in the registry every case where we paid out, together with what we missed and what we changed in our method so that it does not happen again. A guarantee that has never been paid proves nothing.
The full terms of the guarantee form part of the audit contract. This is a summary.