Last updated 2026 · English version governs

1. Services

waitdead.ai provides independent AI security review and assessment services on a scoped, per-engagement basis. Each engagement is defined in writing before work begins, including the systems in scope, the attack surface to be reviewed, the frameworks referenced, the deliverables, the timeline, and the fees. Our services include the Hermes Dogfood Reference Review, the Agentic & MCP Security Review, the AI Security Questionnaire & Evidence Pack, Continuous Adversarial Assurance retainers, and add-on readiness assessments described on our services page.

A review is an assessment, not a product we install or operate on your behalf. Work outside the agreed written scope is not part of the engagement unless separately agreed in writing.

2. No certification, no guarantee

We are not an accredited certification body. We issue no certificate and no attestation. The EU AI Act conformity decision, and any framework conformity decision, is the client's. Our findings are evidence into a human decision — never the final safety authority.

A security review reduces risk; it cannot eliminate it. We provide evidence and assessment, not assurances. We do not guarantee that any system is secure, free of vulnerabilities, "unhackable," or "compliant." No deliverable we produce should be read as a promise of security, a warranty of fitness, or a representation that a system meets any regulatory standard. A clean finding reflects what our method observed within the agreed scope and timeframe — not a guarantee about the system as a whole or about future states of the system.

3. Client responsibilities

By engaging us, you represent and warrant that:

• You own, or have full authorization to permit security testing of, every system, endpoint, server, and account included in the agreed scope. We test only systems you own or control and have authorized us to review in writing.
• You will not include in scope any third-party system you are not authorized to permit testing of. You are responsible for obtaining any consents required from third parties whose systems or data may be affected.
• You will provide accurate scope information and reasonable access needed to perform the review.
• The scope, including any constraints, windows, or exclusions, is agreed in writing before testing begins. Changes to scope require written agreement.

You agree to indemnify us against claims arising from your failure to hold the authorizations described above.

4. Intellectual property

Upon full payment for an engagement, we grant you a perpetual, worldwide, non-exclusive license to use the deliverables — including the report, findings, reproduction artifacts, and remediation guidance — within your organization for your internal security, remediation, and stakeholder-evidence purposes.

We retain ownership of our review harness, methodology, the Hermes agent, our internal tooling, and any general know-how, techniques, and non-client-specific improvements developed before or during the engagement. Nothing in these terms transfers ownership of those underlying methods. You may share a deliverable with your assessors, regulators, customers, or counsel as needed; you may not resell it as a standalone product or represent it as your own assessment work.

5. Limitation of liability

To the maximum extent permitted by applicable law, neither party is liable to the other for indirect, incidental, special, consequential, or punitive damages, or for lost profits, lost revenue, or loss of data, arising out of or related to an engagement, even if advised of the possibility of such damages.

Our total aggregate liability arising out of or related to an engagement is capped at [to be supplied: liability cap — e.g. fees paid for the engagement giving rise to the claim]. Nothing in these terms limits liability that cannot be limited under applicable law.

Because a review is an assessment within a defined scope and timeframe, we are not liable for vulnerabilities, incidents, or losses arising from systems, components, configurations, or time periods outside the agreed scope, or from changes made to a system after the review.

6. Confidentiality

Each party will protect the other's confidential information with reasonable care and use it only to perform or receive the services. We treat your systems, scope details, and findings as confidential. We will not disclose engagement-specific information, client identity, or findings publicly without your prior written consent. Confidentiality obligations survive the end of an engagement.

We may describe our methodology and publish general, anonymized research that does not identify you or expose your confidential information.

7. Governing law & jurisdiction

These terms are governed by, and disputes are subject to the courts of, [to be set on incorporation]. The governing law and jurisdiction will be finalized when our legal entity registration is complete; until then this section is a placeholder and not a representation of a chosen forum.

8. Changes

We may update these terms from time to time. The version in effect for an engagement is the version referenced in, or attached to, the signed engagement agreement for that work. Material changes do not retroactively alter a signed engagement. The current version is published on this page with its "last updated" date.

9. Contact

Questions about these terms, or about a proposed engagement, should be raised through our intake channel, which creates a tracked ticket: crm.waitdead.com/intake. A dedicated inbound security mailbox is in progress and will land with our mail server. We do not operate a phone line. See also our Privacy Policy.

Legal entity registration is in progress. Registered-entity details — company name, number, and address — will be added here on incorporation.