Aegis — Terms of Service

Provider: Backbone Business Solutions Inc., trading as Backbone Solutions ("Backbone", "we", "us") Service: Aegis automated security testing platform ("Aegis", "the Service") Effective date: 16 August 2026 · Version: 1.0

1. Agreement

By creating an account, you agree to these Terms, the Acceptable Use Policy and the Rules of Engagement, which together form the agreement between you and Backbone. If you are agreeing on behalf of an organisation, you confirm you are authorised to bind it.

2. What the Service is

Aegis performs automated security testing against targets you nominate and prove you control. It produces reports describing what its automated checks observed.

Aegis is not a manual penetration test performed by human security consultants. It does not replicate the creativity, intuition or context-specific reasoning of a skilled human tester.

3. Your authorisation and ownership of targets — the central obligation

You may only submit a target that you own or are expressly authorised in writing to test.

Before any test runs you must: 1. prove control of the target domain via the DNS verification we issue; 2. accept the Rules of Engagement for the tier you have selected; 3. confirm you have complied with your hosting, cloud and CDN providers' policies.

Testing computer systems without authorisation is a criminal offence in most jurisdictions (in Canada, s.342.1 of the Criminal Code; comparable provisions exist elsewhere, e.g. the US Computer Fraud and Abuse Act and the UK Computer Misuse Act). You are solely responsible for ensuring you hold the necessary authority. You indemnify Backbone against any claim arising from your submission of a target you were not authorised to test.

DNS verification proves control of a domain. It does not prove you are authorised by every party with an interest in the underlying systems (for example a hosting provider, a landlord of shared infrastructure, or a client whose data you process). That remains yours to establish.

4. Accounts

You are responsible for your credentials and for all activity under your account. Notify us promptly of any suspected compromise. We may suspend an account we reasonably believe is being used in breach of this agreement or unlawfully.

5. Service tiers and inherent risk

Tier Nature Constraint
Baseline Unauthenticated, non-destructive, low rate Permitted against production
Authenticated Signs in with credentials you supply; non-destructive Permitted against production
Aggressive assurance — deep suite Authenticated deep injection and access-control testing; non-destructive Permitted against production; approval-gated
Aggressive assurance — state-changing Business-logic and multi-tenant tests that write data, run self-serve with your written in-app approval Non-production targets only

Security testing sends real network traffic to real systems. Even non-destructive testing may surface latent faults, trigger rate limiting, generate alerts, fill logs or cause unexpected application behaviour. Aggressive testing modifies data by design.

You are responsible for: maintaining backups; having a rollback plan; selecting an appropriate testing window; nominating a contact reachable during testing; and ensuring the target is appropriate for the tier selected. An emergency stop control is provided and it is your responsibility to use it if you observe adverse effects.

6. Your responsibilities

The Service is self-serve and Customer-initiated. You acknowledge that its effective and lawful use depends on you, and you agree that you are solely responsible, at your own cost, for each of the following, both before and throughout any testing:

  1. Authorisation and ownership of targets. Ensuring you own, or hold full legal authority and all necessary permissions, authorisations and consents (including from any hosting or cloud provider or other third party) to authorise security testing of every target, system, network, application, IP address, domain and asset you bring within scope. You represent and warrant that you hold, and will hold throughout, all such rights.
  2. Accurate scope. Providing complete, accurate scope information and correctly identifying which targets are production and which are staging or test systems.
  3. Technical contact. Designating a qualified contact authorised to receive findings, approve testing windows and respond to urgent issues during testing.
  4. Backups. Creating and verifying complete, restorable backups of all data, systems, applications, configurations and databases that could be affected by testing, before any test is initiated, and maintaining your own ability to restore your environment to a secure, operational state.
  5. Environment readiness. For active, authenticated, aggressive or state-changing testing, taking fragile or business-critical systems out of production, using a non-production environment where appropriate, and avoiding release events and blackout windows.
  6. Maintaining your own security. Independently establishing and maintaining your own security controls — patching, monitoring, logging, alerting, firewalls, authentication, encryption, access control and anti-malware — and not relying on the Service as your sole or primary security measure.
  7. Credentials. Keeping your account credentials, API keys and any credentials you supply for authenticated testing secure and confidential, and remaining responsible for all activity under your account.
  8. Remediation. Reviewing findings and remediating vulnerabilities yourself; the Service identifies weaknesses but does not fix them, and remediation and re-test decisions are yours.
  9. Restoration. Restoring your systems and data to a secure, operational configuration after testing.
  10. Compliance with law. Using the Service in compliance with all applicable laws and never against any system you are not authorised to test.

Responsibility for the security of your systems, data, servers, applications, backups and infrastructure rests with you at all times. The Service is an assessment service only; Backbone is not, and does not act as, a guarantor or insurer of your security.

7. Security testing — your authorisation, risks and waiver

You authorise and instruct Backbone to access and test the targets you configure, including, where you so configure or request, by active, authenticated or aggressive testing. You acknowledge that legitimate security testing simulates a real-world attack and may, as an inherent characteristic: (a) increase load and degrade the performance or availability of targets; (b) trigger security alerts, rate limiting, account lockouts or automated defences; (c) create, modify, delete or corrupt data or leave test artifacts; and (d) cause temporary or, in rare cases, prolonged disruption, instability or outages.

You accept these risks as a condition of using the Service, confirm you have taken the precautions in section 6 (including current backups and, for aggressive testing, non-production environments), and, to the maximum extent permitted by law, release Backbone from, and will hold Backbone harmless against, any loss, damage, disruption or data change resulting from testing performed in accordance with the scope and authorisation you provided. An emergency stop control is provided and it is your responsibility to use it if you observe adverse effects.

8. Fees

Fees are as published at sign-up. Subscriptions renew automatically for successive periods until cancelled. Aegis is a digital service and all fees are non-refundable: we do not refund partial or unused periods, except where a refund is required by law or granted at our discretion. Taxes are additional where applicable. We may change pricing on 30 days' notice, effective at your next renewal.

9. Your data and our confidentiality

You retain ownership of your data, findings and reports. We store them encrypted, scoped to your workspace, and redact evidence server-side before storage. We will not disclose your findings to third parties except as required by law or as you direct. How we handle personal data is described in our Privacy Policy; a Data Processing Agreement is available on request.

While your account is active, scan reports and findings are retained for up to 18 months so you have a running security history for auditors; you may export or delete your data at any time. On termination we delete or return your data within 30 days, save for backups purged on their ordinary cycle and records we must retain by law.

We may use aggregated, anonymised statistics that do not identify you or your systems to improve the Service.

10. Reports are not certifications

Reports support a defensible security process and may be shared with your auditors and customers under confidentiality. They are not a certification against SOC 2, ISO 27001, PCI DSS or any other standard, and are not legal advice. Whether a report satisfies a particular obligation is a matter for your auditor or regulator.

11. No warranty and no guarantee of security

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, TO THE MAXIMUM EXTENT PERMITTED BY LAW.

We expressly do not warrant that the Service will identify all vulnerabilities. No automated testing can prove the absence of vulnerabilities. A report containing no findings means the checks performed did not detect an issue — it does not mean your systems are secure. You must not represent to any third party that Aegis certifies your security.

The Service is a point-in-time assessment performed using standard, recognised penetration-testing methodology. We do not guarantee that your systems are secure or that you will not suffer a security breach, intrusion, malware, ransomware, unauthorised access, data loss or other attack. Security cannot be absolutely assured: a sufficiently determined or well-resourced attacker may succeed regardless of the testing performed or the precautions you take, and new vulnerabilities can arise at any time after an assessment. Backbone is not responsible or liable for any security breach, incident, unauthorised access, or loss affecting your systems, applications or data, including any that occurs after an assessment, is not detected by an assessment, or arises from issues outside the agreed scope. Securing your systems, applying remediations and maintaining your own controls remain your responsibility.

12. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, BACKBONE IS NOT LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, NOR FOR LOSS OF PROFITS, REVENUE, DATA, GOODWILL, BUSINESS INTERRUPTION OR SYSTEM DOWNTIME, HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY.

BACKBONE'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT IS LIMITED TO THE FEES YOU PAID FOR THE SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

Disclaimer of liability for breaches and incidents. To the maximum extent permitted by law, Backbone is not responsible or liable for any security breach, intrusion, unauthorised access, ransomware or malware infection, data loss, data corruption, service disruption, downtime or damage to your systems, data or environment, including where such event: (a) affects a system Backbone did or did not test; (b) results from a vulnerability the Service did not identify, or identified but you did not remediate; (c) occurs during, after or notwithstanding the Service; or (d) arises from your own controls, configurations, patching, monitoring, or the acts or omissions of you, your users or third parties.

13. Exclusions required by law

Nothing in this agreement excludes or limits liability that cannot be excluded or limited under applicable law, including liability for fraud or fraudulent misrepresentation, gross negligence or wilful misconduct, or death or personal injury caused by negligence. Any statutory rights, conditions, warranties or remedies that cannot lawfully be excluded — including under the Business Practices and Consumer Protection Act (British Columbia) where you are a "consumer", and under the Sale of Goods Act (British Columbia) to the extent applicable — apply despite anything to the contrary, and where they cannot be excluded, Backbone's liability is limited to the maximum extent permitted by law. If any limitation in this agreement is held unenforceable, the remaining limitations continue to apply.

14. Indemnity

You will indemnify and hold harmless Backbone against claims, losses and reasonable legal costs arising from: (a) testing a target you were not authorised to test; (b) your breach of this agreement, the Acceptable Use Policy or your responsibilities under section 6; (c) your failure to comply with a provider policy or applicable law; or (d) your use or distribution of a report.

15. Suspension and termination

You may cancel at any time, effective at the end of the current period. We may suspend immediately where we reasonably believe unauthorised testing is occurring, where the Service is being used unlawfully, or where testing threatens the stability of third-party infrastructure. We may terminate for material breach not cured within 14 days.

16. Changes

We may amend these Terms on 30 days' notice for material changes. Continued use after the effective date constitutes acceptance.

17. Governing law

Governed by the laws of British Columbia, Canada, with exclusive jurisdiction in the courts of British Columbia.

18. Contact

aegis.support@backbonesolutions.ca · Backbone Business Solutions Inc., incorporated in British Columbia, Canada (incorporation number BC1601923).