Terms of Service

RootRecon (“RootRecon”, “we”, “us”, or “our”) provides cybersecurity and information-security services to businesses, organizations, and other authorized customers.

Our services may include:

• Web application penetration testing
• API security testing
• Mobile application security testing
• Network and infrastructure penetration testing
• Vulnerability assessments
• Cloud security assessments
• Security configuration reviews
• Security architecture assessments
• Source-code security reviews
• Security consulting
• Security research
• Security advisory services
• Other cybersecurity services agreed between RootRecon and a client.

By accessing the RootRecon website, submitting an enquiry, requesting services, entering into an agreement with RootRecon, or otherwise using RootRecon services, you acknowledge that you have read, understood, and agreed to these Terms.

If you are using RootRecon on behalf of a company, organization, or other legal entity, you represent that you have the authority to bind that entity to these Terms. In that case, “you” and “your” refer to both you and the relevant entity.

You may use the RootRecon website for lawful purposes only.

You agree not to:

• Use the website for unlawful purposes
• Attempt to gain unauthorized access to RootRecon systems
• Interfere with website availability or functionality
• Introduce malware or malicious code
• Conduct unauthorized security testing against RootRecon
• Attempt to bypass authentication or access controls
• Scrape or collect information through abusive automated methods
• Impersonate RootRecon or another person
• Misrepresent your identity or authority
• Abuse website forms or communication channels
• Upload unlawful or malicious material
• Otherwise interfere with the operation or security of the website

RootRecon reserves the right to restrict or terminate access where misuse is suspected.

RootRecon provides cybersecurity services only under an agreed scope and authorization.

A cybersecurity engagement may include testing of applications, APIs, networks, infrastructure, cloud environments, devices, domains, or other technology assets specifically identified by the client and accepted by RootRecon.

The exact services, scope, deliverables, timelines, fees, and testing conditions will normally be defined in an applicable Master Services Agreement (MSA), Statement of Work (SOW), Order Form, Rules of Engagement (RoE), or other written agreement.

RootRecon performs security testing only when it has appropriate authorization.

Before testing begins, the client must have the legal right and authority to authorize RootRecon to test the relevant systems.

The client is responsible for obtaining all necessary permissions from system owners, application owners, infrastructure owners, cloud providers where required, hosting providers where required, network owners, third-party service providers, and other relevant parties.

Providing RootRecon with a target, domain, IP address, application, API, credential, or other technical information does not automatically establish authorization beyond the agreed engagement.

Security testing will be limited to the systems, applications, domains, IP addresses, APIs, environments, accounts, and other assets expressly included in the applicable engagement.

RootRecon will not intentionally test assets outside the agreed scope.

If RootRecon identifies an asset that appears to be outside the approved scope, RootRecon may stop testing that asset and request clarification or written authorization before continuing.

Where applicable, cybersecurity assessments will be conducted according to agreed Rules of Engagement.

The Rules of Engagement may specify testing dates and times, authorized targets, testing techniques, prohibited techniques, source and destination IP addresses, testing accounts, emergency contacts, communication procedures, rate or traffic limitations, production-system restrictions, data-handling requirements, incident-response procedures, and other operational requirements.

Where Rules of Engagement conflict with general website terms, the engagement-specific Rules of Engagement will govern the relevant testing activity.

The client is responsible for providing accurate information, providing appropriate authorization, identifying in-scope systems, identifying systems that must not be tested, providing necessary test accounts or credentials, providing required technical information, obtaining third-party permissions where necessary, maintaining appropriate backups, identifying business-critical systems, maintaining appropriate emergency contacts, informing RootRecon of known operational restrictions, and cooperating reasonably during the engagement.

The client remains responsible for the operation, availability, security, and backup of its systems unless otherwise expressly agreed in writing.

Where RootRecon requires credentials for testing, the client should provide dedicated test accounts wherever reasonably possible.

Clients should not provide unnecessary administrative credentials or production credentials unless they are expressly required and appropriate for the agreed engagement.

Credentials supplied to RootRecon will be handled according to the applicable engagement requirements and security procedures.

Security testing may involve techniques that could affect system behavior.

Depending on the scope and methodology, testing may potentially cause increased system load, service interruptions, application errors, temporary account lockouts, logging or alert generation, unexpected application behavior, or other operational effects.

RootRecon will conduct testing using reasonable professional practices and according to the agreed scope and Rules of Engagement.

However, RootRecon cannot guarantee that testing will never cause an unexpected effect on a system.

Clients should maintain appropriate backups, monitoring, recovery procedures, and emergency contacts before testing begins.

Testing production environments carries additional operational risk.

The client must clearly identify production systems and communicate any restrictions concerning production testing.

Where possible, RootRecon may recommend testing in a non-production or staging environment.

If the client expressly authorizes production testing, the client acknowledges the associated operational risks.

RootRecon will not intentionally test third-party infrastructure unless the relevant third-party system is expressly included in the scope and appropriate authorization has been obtained.

Clients are responsible for obtaining permissions from third parties where necessary.

RootRecon is not responsible for consequences arising from a client's failure to obtain required third-party authorization.

During a cybersecurity engagement, RootRecon may receive or access information belonging to the client.

Such information may include application data, source code, API data, network information, logs, credentials, configuration information, vulnerability evidence, screenshots, security reports, system information, and other confidential technical information.

RootRecon will use such information primarily for the purpose of performing the agreed services and will handle it according to the applicable contractual and confidentiality requirements.

RootRecon may encounter personal information while performing cybersecurity services.

Clients should avoid providing unnecessary personal information where test data, synthetic data, masked data, or other alternatives can reasonably be used.

Where personal information is processed during an engagement, RootRecon will handle it according to applicable law, its Privacy Policy, and applicable contractual obligations.

Each party may receive confidential information belonging to the other party.

Confidential information may include business information, technical information, security information, source code, credentials, vulnerability information, security reports, commercial information, product information, customer information, and other non-public information.

Each party agrees to protect confidential information using reasonable measures and not disclose it except as permitted by applicable agreement or law.

Where a separate Non-Disclosure Agreement (NDA) is executed, the NDA may contain additional confidentiality requirements.

Security vulnerabilities, exploit information, security weaknesses, credentials, security configurations, and related findings identified during an engagement are confidential unless otherwise agreed in writing.

RootRecon will not intentionally publicly disclose client-specific vulnerabilities or confidential security findings without appropriate authorization, except where disclosure is required by applicable law.

Following an engagement, RootRecon may provide a security assessment report or other agreed deliverables.

Reports may include executive summaries, technical findings, vulnerability descriptions, risk ratings, evidence, screenshots, reproduction steps, recommendations, remediation guidance, and other agreed information.

Reports are intended for the client and authorized recipients.

Clients are responsible for controlling access to their reports and security findings.

Security testing provides an assessment of security conditions observed during the agreed testing period and within the agreed scope.

A security assessment cannot guarantee that all vulnerabilities will be identified, all vulnerabilities will remain undiscovered after testing, a system is completely secure, future vulnerabilities will not occur, third-party systems are secure, or security risks have been permanently eliminated.

Security findings may change as systems, configurations, dependencies, threats, and technologies change.

RootRecon does not represent that completion of an assessment constitutes certification that a system is secure.

RootRecon may provide recommendations to help clients address identified vulnerabilities.

Unless expressly agreed otherwise, RootRecon is not responsible for implementing the client's remediation activities.

Clients remain responsible for determining whether to remediate a finding, how to remediate it, when remediation should occur, and whether changes introduced during remediation are appropriate.

Where RootRecon provides remediation validation or retesting, such services may be subject to a separate scope or agreement.

Unless otherwise agreed in writing, RootRecon retains ownership of its pre-existing intellectual property, methodologies, tools, scripts, frameworks, templates, techniques, know-how, processes, documentation, and other proprietary materials.

Client-owned information, systems, source code, data, and other materials supplied by the client remain the property of the client or their respective owners.

Ownership and permitted use of specific deliverables may be further defined in the applicable MSA or SOW.

RootRecon may use proprietary or third-party tools, scripts, frameworks, methodologies, and other technologies when performing services.

Unless expressly agreed in writing, providing a report or service does not transfer ownership of RootRecon's underlying tools, methodologies, source code, or intellectual property to the client.

Clients may not reverse engineer, reproduce, resell, or commercially exploit RootRecon proprietary tools or methodologies without written authorization.

Fees for RootRecon services will be specified in the applicable quotation, proposal, order form, SOW, or other commercial agreement.

Unless otherwise agreed in writing:

• Fees are payable according to the agreed payment schedule
• Applicable taxes are additional where required
• Approved expenses may be chargeable
• Late payments may be subject to applicable contractual remedies
• Additional work outside the agreed scope may require additional fees

The applicable commercial agreement will control where payment terms differ from these general Terms.

Requests that materially change the agreed scope may require a written change request or revised SOW.

Examples may include additional applications, domains, IP ranges, APIs, testing methods, environments, assessment days, or reporting requirements.

RootRecon may decline additional work until the revised scope and applicable commercial terms are agreed.

RootRecon may use third-party services or infrastructure to support its business operations or delivery of services.

Such services may include hosting, communication, collaboration, security, analytics, document management, cloud infrastructure, or other business services.

RootRecon will seek to use appropriate providers and reasonable safeguards.

Third-party services may be subject to their own terms and policies.

Information published on the RootRecon website is provided for general informational purposes.

Website content may include service descriptions, security information, articles, research, guides, announcements, marketing materials, and other content.

RootRecon may update, modify, or remove website content at any time.

Website content should not be interpreted as a guarantee of a particular security outcome.

RootRecon may publish cybersecurity research, vulnerability information, educational material, technical articles, demonstrations, or security advisories.

Such material is provided for lawful and responsible security purposes.

Users must not use RootRecon content to conduct unauthorized access, exploitation, disruption, or other unlawful activity.

Nothing on the RootRecon website constitutes authorization to test or attack a third-party system.

Nothing in these Terms grants any person permission to conduct security testing against RootRecon, its clients, partners, infrastructure, systems, employees, applications, or third-party systems.

Any security testing of RootRecon systems requires explicit written authorization from RootRecon.

Unauthorized testing may be treated as a security incident and may be reported to appropriate authorities where necessary.

To the maximum extent permitted by applicable law, the RootRecon website and general website content are provided on an “as is” and “as available” basis.

RootRecon does not guarantee that the website will always be available, uninterrupted, error-free, current, that all defects will be corrected, or that the website will be completely free from security vulnerabilities.

Specific cybersecurity services will be governed by the applicable contractual terms.

To the maximum extent permitted by applicable law, RootRecon will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages arising from use of the website or services, including loss of profits, revenue, business opportunities, data, goodwill, or anticipated savings.

Nothing in these Terms is intended to exclude or limit liability that cannot legally be excluded or limited under applicable law.

Where an MSA or other written agreement establishes a specific limitation of liability, that agreement will govern the relevant client engagement.

To the extent permitted by applicable law, the client may be responsible for claims, losses, damages, or expenses arising from unauthorized security-testing instructions, lack of authority to test a system, client-provided materials that infringe third-party rights, client violations of applicable law, client misuse of RootRecon reports or services, or client actions outside the agreed scope.

Specific indemnification obligations may be established in the applicable MSA or other written agreement.

RootRecon may suspend or terminate access to its website or services where reasonably necessary, including where these Terms are violated, unauthorized activity is suspected, security risks are identified, payment obligations are materially breached, required authorization is withdrawn, continued activity creates unacceptable operational risk, or required by law.

Termination of website access does not necessarily terminate contractual obligations that survive termination.

Upon termination of a service engagement, the parties will handle outstanding deliverables, payments, confidential information, client data, and other project materials according to the applicable agreement.

Confidentiality, intellectual-property, liability, dispute-resolution, and other provisions intended to survive termination will continue to apply where legally appropriate.

RootRecon's processing of personal information is described in itsPrivacy Policy.

RootRecon may use cookies and similar technologies on its website.

The use of cookies is described in the RootReconCookie Policy.

You agree to use the RootRecon website and services in compliance with all applicable laws and regulations.

You must not use RootRecon services to facilitate unauthorized access, fraud, theft, data destruction, malware distribution, unauthorized surveillance, abuse of computer systems, credential theft, denial-of-service activity, privacy violations, or other unlawful activity.

These Terms shall be governed by and interpreted in accordance with the laws applicable to RootRecon.

Subject to applicable law, disputes arising from these Terms shall be subject to the jurisdiction of the courts specified below.

Governing Law: Laws of India

Jurisdiction: [City/State, India]

Specific client agreements may contain different governing-law and jurisdiction provisions.

The parties will attempt to resolve disputes through good-faith discussions before commencing formal proceedings, where appropriate.

For client engagements, the applicable MSA or other written agreement may establish additional dispute-resolution procedures, including mediation or arbitration.

Nothing in this section prevents either party from seeking urgent legal or equitable relief where necessary.

RootRecon will not be responsible for delays or failures caused by circumstances beyond its reasonable control, including natural disasters, war, terrorism, government actions, internet or telecommunications failures, cloud-service outages, widespread cybersecurity incidents, power failures, labor disruptions, or other events beyond reasonable control.

The affected party will take reasonable steps to mitigate the impact of such circumstances.

RootRecon may update these Terms from time to time.

Changes may be made to reflect new services, website changes, business changes, legal or regulatory developments, security requirements, or changes to operational practices.

The updated version will be published on the RootRecon website with a revised “Last Updated” date.

Your continued use of the website after an updated version becomes effective constitutes acceptance of the revised Terms to the extent permitted by applicable law.

For existing client engagements, the applicable signed agreement will continue to govern unless the parties agree otherwise.

If any provision of these Terms is determined to be invalid, unlawful, or unenforceable, that provision will be interpreted or modified to the minimum extent necessary to make it enforceable where legally possible.

The remaining provisions will continue in full force and effect.

A failure by RootRecon to enforce any provision of these Terms does not constitute a waiver of its right to enforce that provision in the future.

Any waiver must be made in accordance with applicable law and, where appropriate, in writing.

These Terms constitute the general terms governing use of the RootRecon website.

For a specific cybersecurity engagement, the applicable MSA, SOW, order form, Rules of Engagement, NDA, or other signed agreement may contain additional or different terms.

Where there is a conflict between these website Terms and a specific signed client agreement, the signed client agreement will govern the relevant engagement to the extent of the conflict.

Neither party may assign its rights or obligations under an applicable agreement except as permitted by that agreement or applicable law.

RootRecon may assign these Terms as part of a merger, acquisition, restructuring, sale of substantially all relevant assets, or similar corporate transaction, subject to applicable legal requirements.

For questions regarding these Terms or RootRecon's services, please contact:

Email: [privacy@rootrecon.com]

General Email: [support@rootrecon.com]

Telephone: +91 9344611338

Registered Office: RootRecon Private Limited

6/55 Suncity Nagar, Keelamelkudi Road,

Manamadurai, Tamil Nadu - 630606

Website: https://rootrecon.com

By accessing or using the RootRecon website, you acknowledge that you have read and understood these Terms of Service.

By engaging RootRecon for cybersecurity services, you further acknowledge that the applicable engagement may be subject to additional contractual documentation, including an MSA, SOW, NDA, and Rules of Engagement.

These documents are intended to establish a clear framework for lawful, authorized, professional, and responsible use of RootRecon's website and cybersecurity services.