Pentrox B.V.
Terms and Conditions
These general terms and conditions apply to every assessment performed by Pentrox B.V. for a client, unless a signed statement of work (opdrachtbevestiging) explicitly states otherwise. Where a statement of work conflicts with these general terms, the statement of work prevails for that assessment. Pentrox B.V. publishes these terms so that prospective clients, procurement officers, and legal counsel can review them before scoping begins.
This page covers the contractual relationship between Pentrox B.V. and its clients. For data protection, see the Privacy Statement. For supplier due diligence, see the Trust and Procurement page. For vulnerability reports against Pentrox systems, see the Responsible Disclosure page.
Definitions
The following definitions apply throughout these general terms and conditions and in every statement of work that references them, unless the statement of work assigns a different meaning to a specific term.
| Assessment | A security assessment, penetration test, red team exercise, compliance assessment, phishing simulation, mystery guest assessment, source code review, hardware security test, cloud security review, or any other offensive security service performed by Pentrox under a signed statement of work. |
|---|---|
| Client | The legal entity or natural person that signs the statement of work or that is identified as the contracting party in the statement of work. |
| Pentrox | Pentrox B.V., a private limited company (besloten vennootschap) incorporated under the laws of the Netherlands, registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 42105876, with its registered office at Keizersgracht 241, 1016 EA Amsterdam, Netherlands. |
| Statement of work (opdrachtbevestiging) | The written document signed by both Pentrox and the client that defines the scope, objectives, timeline, pricing, and specific conditions for a single assessment. The statement of work references these general terms and conditions. |
| Portal | The Pentrox Portal at portal.pentrox.nl, the secure client platform through which findings, reports, retest results, and project communication are delivered. |
| Report | The written deliverable produced by Pentrox at the conclusion of an assessment, containing an executive summary, a vulnerability overview, detailed findings with evidence and remediation guidance, a technical conclusion, and the assessment strategy and scope description. Reports are delivered in English by default. |
| Finding | A single vulnerability, misconfiguration, or security weakness identified during an assessment and documented in the report with a severity rating, evidence, and remediation guidance. |
| Retest | A follow-up assessment cycle in which Pentrox verifies whether the client has successfully remediated one or more findings from the original assessment. |
| Deliverables | The report, the retest report (where applicable), Portal access, and any other artefact explicitly listed in the statement of work. |
| Authorisation letter | The written document signed by the client that authorises Pentrox to perform offensive security testing against the systems, networks, and applications listed in the statement of work, within the agreed scope and timeframe. |
| Business day | A day on which banks in the Netherlands are open for general business, excluding Saturdays, Sundays, and Dutch public holidays. |
Scope of services
Pentrox performs offensive security assessments for clients. The services include penetration testing, red teaming, scenario-based assessments, compliance assessments, phishing simulations, mystery guest assessments, source code reviews, hardware security testing, cloud security reviews, and Pentest as a Service (PTaaS) subscriptions. Each assessment is governed by a signed statement of work that references these general terms and conditions.
The following five commercial principles apply to every assessment unless the statement of work states otherwise:
- Remote-first execution; on-site work can be arranged when required.
- Regular progress updates; critical or blocking findings communicated immediately.
- Final report delivered within five (5) business days after completion of testing.
- Payment term: fourteen (14) days. Prices exclude VAT (VAT added to invoices).
- Preferably non-production testing. Non-destructive approach.
Nothing published on the Pentrox website constitutes a binding offer. An assessment contract is formed only when both Pentrox and the client have signed a statement of work.
Statement of work and acceptance
Each assessment is governed by a signed statement of work (opdrachtbevestiging) that defines the scope, objectives, timeline, pricing, testing approach, communication arrangements, and any conditions specific to that assessment. The statement of work references these general terms and conditions.
Where a statement of work conflicts with these general terms and conditions, the statement of work prevails for that assessment. Where the statement of work is silent on a subject covered by these general terms, these general terms apply.
The assessment begins after the following conditions are met: (a) the statement of work is signed by both Pentrox and the client; (b) the authorisation letter is signed by the client; (c) any access, credentials, or technical prerequisites listed in the statement of work have been provided; and (d) a Data Processing Agreement has been executed where the assessment involves the processing of personal data.
Pentrox retains the right to decline a statement of work where the scope, purpose, or conditions of the proposed assessment cannot be reconciled with the Pentrox code of ethics published on the Trust and Procurement page.
Execution model
The assessment is performed remotely whenever feasible. If activities must take place at the client location, travel and accommodation expenses are charged. Travel time is billed at fifty percent (50%) of the standard hourly rate.
Preferably non-production testing. Non-destructive approach. Testing is performed in a non-production environment where one is available and suitable for the assessment objectives. Where testing must be performed in a production environment, the statement of work describes the additional precautions and the agreed test window. All testing is non-destructive. Pentrox does not deploy ransomware, wipers, destructive payloads, or any code that damages data or causes service loss outside an agreed test window.
Every assessment is led or supervised by a senior ethical hacker. Reports undergo internal quality review before delivery to the client. The assessment methodology is confirmed in the statement of work and is aligned with recognised standards, including OWASP Top 10, PTES, NIST SP 800-115, and MITRE ATT&CK where applicable.
Project communication is available in English and Dutch. Reports are delivered in English by default. A Dutch executive summary can be requested during scoping at no additional cost.
Communication and escalation
Regular progress updates; critical or blocking findings communicated immediately. Pentrox provides progress updates at the frequency agreed in the statement of work. As a minimum, the client receives an update at the start of testing, at the midpoint of the testing window, and at the conclusion of testing.
Critical or blocking findings are escalated immediately through the communication channel agreed at kickoff. The escalation channel, the named contacts on both sides, and the out-of-hours contact path are recorded in the kickoff document and updated if personnel change. Pentrox does not hold critical findings back for the final report.
When an assessment uncovers a pre-existing compromise, an active attacker, or a finding that poses immediate and significant risk to the client or to a third party, the issue is escalated immediately. Continuation of testing is paused until the client instructs otherwise.
Direct access to the tester is standard. There are no account managers between the client and the ethical hacker performing the assessment.
Deliverables and timeline
Final report delivered within five (5) business days after completion of testing. The report contains an executive summary, a vulnerability overview, detailed findings with evidence and remediation guidance, a technical conclusion, and the assessment strategy and scope description. The report is structured for both technical teams and executive leadership.
Four report types are supported through the Portal: the initial report, the management report, the retest report, and the retest management report. The statement of work specifies which report types are included in the assessment.
Findings are published in the Portal as they are identified and reviewed. The client does not need to wait for the final report to begin reviewing individual findings. Each finding includes a severity rating, the affected component, evidence, and remediation guidance.
Portal access is included with every assessment. Client administrators can manage their own team members and assign them to specific projects. All Portal users are protected by mandatory two-factor authentication and role-based access control. Reports and findings remain accessible in the Portal for the lifetime of the client account.
A findings meeting can be scheduled after the report is delivered. The meeting is used to align on risks, priorities, and the remediation approach. The statement of work specifies whether a findings meeting is included.
Payment terms
Pentrox applies a payment term of fourteen (14) days. After this period, the invoice is considered in default and statutory commercial interest (wettelijke handelsrente) as well as extrajudicial collection costs become due. Prices are stated in Euro and exclude VAT. VAT is added to invoices at the rate applicable at the date of invoicing.
Invoices are issued by Pentrox B.V. from the registered office address. The payment schedule is stated in the statement of work. Where the statement of work specifies milestone-based invoicing, each milestone invoice is payable within the same fourteen (14) calendar day period.
Where a payment is not received within the fourteen (14) calendar day period, Pentrox sends a written reminder. If payment is not received within fourteen (14) calendar days after the reminder, statutory commercial interest (wettelijke handelsrente) is charged from the original due date in accordance with Article 6:119a of the Dutch Civil Code. Reasonable extrajudicial collection costs are charged to the client in accordance with the Besluit vergoeding voor buitengerechtelijke incassokosten.
Pentrox reserves the right to suspend delivery of the report, Portal access, or any other deliverable until outstanding invoices are paid. Suspension does not release the client from the obligation to pay.
Confidentiality
Pentrox and the client each treat the other party confidential information as confidential for the duration of the assessment and indefinitely after its conclusion. Pentrox does not reveal sensitive information belonging to a client at any time. There is no expiry date on this obligation.
Confidential information includes, without limitation: the report, findings, evidence, scope documents, test credentials, pricing, the statement of work, and any technical or business information exchanged during the assessment that is identified as confidential or that a reasonable person would regard as confidential given the nature of the information and the circumstances of disclosure.
Pentrox does not disclose the identity of its clients in any marketing material, case study, website content, or public communication. Client references are provided only with the written consent of the client. This commitment is consistent with the Pentrox policy described on the Trust and Procurement page.
Confidentiality obligations do not apply to information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was already known to the receiving party before disclosure, as demonstrated by written records; (c) is independently developed by the receiving party without reference to the disclosing party confidential information; or (d) is disclosed pursuant to a lawful order of a Dutch court or a competent regulatory authority, provided the receiving party gives the disclosing party reasonable notice of the order where legally permitted.
A mutual non-disclosure agreement is available on request during scoping. The Pentrox template is not published for public download.
Data processing
For assessment data that contains personal data of client employees or end users, Pentrox B.V. acts as a data processor on behalf of the client, who is the data controller. The processor relationship is documented in the Data Processing Agreement executed at the start of each assessment. The full description of the processor posture is published on the Trust and Procurement page at /en/trust under Section 7.
A Pentrox standard Data Processing Agreement is available on request during scoping. Client-template Data Processing Agreements are reviewed on request. The Pentrox template is not published for public download.
Assessment data is stored and delivered through the Portal. Portal infrastructure is hosted in a datacenter in the European Union on a dedicated virtual private server. Assessment data is stored only within the European Economic Area (EEA) and assessment work is not offshored. Cloudflare, Inc. (United States), which operates the network in front of the Portal, is the only third-country sub-processor; Portal traffic passes through it encrypted in transit and is not stored there, under the EU-U.S. Data Privacy Framework.
Assessment data remains available to the client in the Portal indefinitely. Pentrox does not automatically delete client data. Clients can access their data at any time. On explicit written request from the client, Pentrox removes the data within a reasonable period and confirms removal in writing.
The Pentrox Privacy Statement at /en/privacy describes how personal data collected through the Pentrox website and the Portal is processed, retained, and protected. The Privacy Statement applies alongside these terms and the Data Processing Agreement.
Intellectual property
Upon delivery of the report, the client receives an irrevocable, non-exclusive, perpetual licence to use, copy, and distribute the report internally and to share the report with its auditors, regulators, insurers, suppliers, and clients. Payment is expected within the period stated in Section 7 but does not gate access to the delivered report. The client may not publish the report or any part of the report publicly without the prior written consent of Pentrox.
Pentrox retains all intellectual property rights in its assessment methodology, tooling, templates, processes, and any proprietary code or scripts used during the assessment. Nothing in these terms or in a statement of work transfers methodology intellectual property to the client.
Pentrox does not claim any intellectual property rights over the client systems, source code, architecture, or business data accessed during the assessment. Access to client systems is limited to the scope and duration defined in the statement of work and the authorisation letter.
All content on the Pentrox website, including text, images, and design, is the property of Pentrox B.V. and is protected by copyright. Reproduction without prior written consent is prohibited.
Limitation of liability
The total aggregate liability of Pentrox for any and all claims arising from or in connection with a single assessment is limited to the lower of: (a) the total fee paid or payable by the client for that assessment under the statement of work; or (b) the amount actually paid out under the Pentrox professional indemnity insurance policy in respect of that claim. This cap applies regardless of the legal basis of the claim, whether in contract, tort, or otherwise.
Pentrox is not liable for indirect, incidental, special, or consequential damages, including but not limited to: loss of profit, loss of revenue, loss of data, loss of business opportunity, business interruption, reputational damage, or any claim by a third party against the client, even if Pentrox has been advised of the possibility of such damages.
The limitations in this section do not apply to: (a) liability for intentional misconduct (opzet) or gross negligence (grove nalatigheid) on the part of Pentrox; (b) liability that cannot be excluded or limited under mandatory Dutch law; or (c) obligations under the Data Processing Agreement relating to the protection of personal data.
Pentrox is not liable for damages caused by: (a) the client failure to provide accurate scope information, credentials, or access as required by the statement of work; (b) delays caused by the client in providing prerequisites listed in the statement of work; (c) actions of third parties outside the control of Pentrox; or (d) the client decision not to implement remediation recommendations provided in the report.
Any claim for damages lapses if the client has not reported the damage to Pentrox in writing, with reasons, within thirty (30) calendar days after the client discovered or reasonably should have discovered it. In any event, any legal action against Pentrox lapses no later than twelve (12) months after delivery of the relevant assessment, unless mandatory Dutch law prevents this.
Insurance
Pentrox B.V. maintains professional indemnity and public liability insurance appropriate to the delivery of offensive security assessments. Cover is placed with a Dutch or EU-based carrier and is renewed annually.
Certificates of insurance are provided to prospective clients during scoping, after a mutual non-disclosure agreement is in place. Higher project-specific liability caps are negotiable during scoping for assessments that justify them, as described on the Trust and Procurement page.
| Carrier | Available on request - email info@pentrox.nl |
|---|---|
| Professional indemnity limit | Available on request - email info@pentrox.nl |
| Standard contractual liability cap | Available on request - email info@pentrox.nl |
Cancellation and rescheduling
Cancellation or postponement without charges is only possible if Pentrox is notified in writing at least ten (10) business days prior to the start of the assessment.
If cancellation or postponement occurs within ten (10) business days before the start date, the client is invoiced fifty percent (50%) of the assessment cost, and a new date is scheduled under the same conditions.
An overview of the required preparatory information is attached to the statement of work. All necessary materials for the assessment (such as source code, documentation, IDE access, and accounts) must be provided to Pentrox at least three (3) business days before the planned start date. If the assessment cannot commence due to missing information, this time is invoiced.
The client is responsible for ensuring that all required systems, components, and resources are available and accessible for the full duration of the assessment.
Pentrox adheres to the agreed budget and only exceeds it with the explicit written approval of the client.
Pentrox may reschedule an assessment in the event of force majeure, illness of key personnel assigned to the assessment, or a scheduling conflict that arises after the statement of work is signed. Pentrox notifies the client immediately and proposes a new start date within a reasonable period.
Retest policy
Retesting of remediated findings is included as standard with every assessment. There are no additional charges for verifying that fixes have been implemented correctly. The retest scope covers the findings documented in the original report.
The retest process is managed through the Portal. The client flags which findings have been remediated and submits a retest request. Pentrox schedules the retest, assigns a retest tester and reviewer, and notifies the client of the retest dates. Results are reviewed internally and published to the client through the Portal.
Multiple retest cycles are supported. If findings remain open after the first retest, the client can request additional retest cycles through the Portal. The process repeats until all findings are addressed or until the client and Pentrox agree that no further retesting is required.
The default retest window is ninety (90) calendar days after delivery of the report. The client can request the included retest at any point within this window. The statement of work may specify a different retest window. Retest requests submitted after the retest window closes are treated as a new assessment and quoted separately.
Client obligations
The client provides the following before the assessment begins: (a) a signed authorisation letter authorising Pentrox to perform testing against the systems listed in the statement of work; (b) access to the systems, networks, and applications listed in the statement of work, including test accounts at the required privilege levels; (c) a designated contact person who is available to answer scoping and technical questions during the assessment; and (d) any technical prerequisites, documentation, or credentials listed in the statement of work.
The client ensures that it has the legal authority to authorise offensive security testing against the systems in scope. Where systems in scope are operated by a third party or hosted on third-party infrastructure, the client obtains the necessary permissions from the third party before the assessment begins and provides evidence of those permissions to Pentrox.
The client designates at least one contact person who is available during the testing window to respond to escalation communications within a reasonable time. The contact person has the authority to instruct Pentrox to pause, resume, or stop testing if circumstances require it.
Where the client fails to provide the access, credentials, or prerequisites listed in the statement of work, and this failure delays or prevents the assessment, Pentrox notifies the client in writing. If the prerequisites are not provided within five (5) business days of notification, Pentrox may treat the delay as a client-initiated rescheduling under the terms of Section 13.
The client is responsible for the remediation of findings. Pentrox provides remediation guidance and recommendations in the report. The decision to implement, partially implement, defer, or accept a finding rests with the client. Pentrox is not responsible for damages arising from the client decision not to remediate a finding.
Responsible disclosure
Pentrox operates a responsible disclosure process for security researchers who identify vulnerabilities in Pentrox systems. The process, scope, rules, and safe-harbour commitment are published on the Responsible Disclosure page at /en/responsible-disclosure. This process is separate from the client obligation to provide access and authorisation for a contracted assessment.
Governing law and disputes
These general terms and conditions, every statement of work that references them, and any dispute arising from or in connection with an assessment are governed by the laws of the Netherlands.
Any dispute arising from these terms, a statement of work, or an assessment is subject to the exclusive jurisdiction of the competent Dutch courts, unless mandatory law prescribes a different forum.
The parties first attempt to resolve any dispute through good-faith consultation. Where consultation does not resolve the dispute within thirty (30) calendar days of one party notifying the other in writing, either party may submit the dispute to the competent Dutch court.
Force majeure
Neither Pentrox nor the client is liable for a failure to perform obligations under these terms or under a statement of work where the failure is caused by a force majeure event, meaning an event beyond the reasonable control of the affected party that could not have been prevented by reasonable precautions. Force majeure events include, without limitation: natural disasters, epidemics, government orders, internet outages affecting multiple providers, cyberattacks against the affected party infrastructure, and power outages lasting more than twenty-four (24) hours.
The affected party notifies the other party in writing within five (5) business days of becoming aware of the force majeure event. The notification describes the event, its expected duration, and the obligations affected. The affected party takes all reasonable steps to mitigate the impact of the event.
Where a force majeure event continues for more than thirty (30) calendar days, either party may terminate the affected statement of work by written notice. Work performed up to the date of termination is invoiced at the rates stated in the statement of work. No cancellation fee applies.
Amendments
Pentrox may update these general terms and conditions from time to time. The updated version is published on this page with a revised "last updated" date. Material changes are identified in a short summary on this page.
Existing statements of work are governed by the version of these general terms and conditions that was in effect at the date the statement of work was signed. A new version of these terms does not retroactively alter the conditions of an assessment already contracted.
Prospective clients are encouraged to review this page before signing a statement of work. Where a prospective client has questions about a specific clause, those questions should be raised during scoping.
Contact
Questions about these terms and conditions should be sent to info@pentrox.nl. The contact form at /en/contact is the preferred route for a first exchange.
| General contact | info@pentrox.nl |
|---|---|
| Website | www.pentrox.nl |
| Portal | portal.pentrox.nl |
These general terms and conditions are maintained by Pentrox B.V. Where these terms and a signed statement of work cover the same subject, the statement of work prevails for that assessment.