Terms for audits and buyer’s tests.

1. Scope

The scope of an engagement is the written quote: the scenario in one paragraph, the product and the account I will use, the dates, the price, and what is out of scope. Work outside the quote is a new quote, agreed in writing before it starts.

2. Price and payment

The price is fixed and stated in the quote. Half is due before the start date and half on delivery of the findings report. There is no hourly billing and nothing is added during the engagement without a new written agreement.

If you cancel before the start date, the first half is refunded in full. If you cancel after the start date, the first half is kept and nothing further is due.

3. What you provide

• Access to the product: a public trial, a sandbox, or an invite, as agreed in the quote.
• The scenario, agreed in the quote, and answers to clarifying questions within a reasonable time.
• No real customer data and no production credentials. Where you provide a sandbox, it contains only test data you are entitled to share.

4. What I deliver

A written findings report in the format of the sample report: the scenario result, each finding with a severity, reproduction steps, timestamps and screenshots, the data-handling and pricing facts observed, and questions for your team. For a pre-launch audit, one retest round of fixed items inside the window stated in the quote, delivered as an updated report.

5. What the report is, and is not

The report records what the product did, under the account and configuration described, at the times stated. It is hands-on product testing from a customer’s seat. It is not a penetration test, a source code review, a certification, a warranty that the product is free of defects, or a legal opinion on your policies or your obligations. Where a policy and the product disagree, the report says so and leaves the legal reading to your counsel.

Decisions you take on the basis of the report are yours. My liability for an engagement is limited to the fees you paid for it.

6. Confidentiality

• The report, the evidence and everything you give me for the engagement are confidential to you. I do not publish them, share them with third parties, or use them for rankings, placement or editorial coverage on opensourcesai.com or anywhere else.
• With your written OK, and only then, one anonymized line may appear on the track record page: the kind of product, the kind of finding, what happened next. No product name, no vendor name, nothing that identifies either.
• Before I accept a buyer’s test on a product whose maker has paid me for an audit, I tell the buyer that such work exists, without disclosing its contents. The buyer can then choose someone else.
• If you need your own NDA on top of this, send it with the request.

7. Independence

I take no commission, referral fee or other payment from vendors in connection with a buyer’s test, and no payment from a vendor changes what a report says.

8. Retention

I keep the report and its evidence for twelve months after delivery so a retest has something to compare against, then delete them unless you ask me to keep them longer. The privacy page covers the rest.

9. This website

The pages on this site describe the service and show one sample report with identifying details removed. They are provided as they are, for information, and no engagement exists until a written quote is accepted and the first payment is made.