Leadership Second Opinion Terms.

1. What you ask us to do

You ask Cyber Way US LLC (“Cyber Way”) to look at your organization from the outside: the domain of the work email and the website you give us on the request form, and any other domain of yours we agree on with you (the “Domains”). Cyber Way may:

• review information anyone on the internet can already see about the Domains, including their public DNS and email security records, certificates, public websites, publicly reachable services, and public search and code repositories;
• make ordinary connections to the Domains’ public websites and services, as any visitor would, to check how they are configured;
• check breach intelligence sources for work accounts on the Domains that appear in known breaches, and list them in your results.

2. What we never do

• We never try to log in to any system or account, with any password.
• We never collect, view or keep passwords, password hashes or government ID numbers. If a source returns them, we discard them without review.
• We never look at anyone’s personal email accounts, only accounts on the Domains. For each account we find, the results show only the account itself: never its password, where it leaked, or when.
• We never exploit a weakness, run intrusive or high-volume scans, attempt denial of service, or try to get into any system.
• We never contact your staff or anyone else about the Second Opinion without your permission.
• We never look at anything outside the Domains.

3. What you confirm

• You may ask for the Second Opinion on behalf of your organization.
• Your organization owns or controls the Domains.
• Any internal approval your organization requires, such as from ethics, procurement or legal, has been given.
• You will tell us at once if any Domain should be left out.

Before we share results, we may confirm your role and that your organization controls the Domains. If we can’t, we don’t share them.

4. What you get

A first meeting with our senior team, a self-assessment built for your organization, a written report, and a follow-up conversation. The report is yours to keep and to use inside your organization, whether you work with us or not. Our methods, tools and materials stay ours. Decisions about your security stay yours.

5. Confidentiality and who sees the results

The results, and anything you share with us during the Second Opinion, including your self-assessment answers, go only to you and the people you choose. Cyber Way keeps them, and the fact that you asked for the Second Opinion, confidential, except where the law requires otherwise.

6. Personal information

The only personal information involved is the work email addresses on the Domains that appear in known breaches, which we list in your results, and the details of the people you work with on the Second Opinion. We process it as your service provider, only to deliver the Second Opinion to your organization. We:

• don’t sell or share it, or use it for advertising;
• don’t keep, use or disclose it for any other purpose, or outside our relationship with you;
• don’t combine it with personal information we get from anyone else, except as the law allows;
• protect it as California privacy law requires, and tell you if we can no longer meet these terms;
• hold anyone who helps us, such as a breach intelligence source, to the same terms.

You may take reasonable steps to make sure we use it this way, and to stop any use that isn’t. Our Privacy Notice explains the rest.

7. How long we keep the results

We keep the results for the Second Opinion and its follow-up, and delete them within ninety days after the follow-up, or sooner if you ask. We keep the record that you accepted these terms for up to three years. If you become a client, your agreement with us governs from then on.

8. What the Second Opinion is, and isn’t

The Second Opinion has no charge and commits you to nothing. It is an outside view at a point in time. It is not a penetration test, an audit or a certification, and it won’t find every risk. We may decline a request, or stop a Second Opinion, at any time. It is provided as it is, and to the extent the law allows, Cyber Way’s total liability arising from it is limited to one hundred US dollars. This doesn’t limit liability for fraud, willful misconduct, gross negligence or a violation of law.

9. Changing your mind

You can withdraw at any time by writing to us, and we stop at once.

10. Governing law

These terms are governed by the laws of the State of California, together with our Terms of Use and Privacy Notice. Any dispute about them goes to the state or federal courts in Sacramento County, California.

If you ask on behalf of a government body and the law prevents it from agreeing to any of these terms, such as governing law or limits on liability, that term doesn’t apply to it, to that extent. The rest still applies.

11. Contact

Cyber Way US LLC, a California limited liability company. info@cyberwayus.com.