Terms of Service

Effective date: 29 October 2026

These Terms govern agreed security assessment services provided by Aliaksandr Tarantsei, operating as AppPerimeter (“we”, “us” or “Provider”), to the client identified in the engagement documentation (“you” or “Client”).

1. Provider and business clients

Aliaksandr Tarantsei, sole trader (JDG), trading as AppPerimeter
ul. Zwierzyniecka 24 lok. 501, 31-105 Kraków, Poland
NIP: 6793321936
REGON: 540842130
Email: [email protected]
Website: https://appperimeter.com

Our services are intended for business customers, including application developers, companies and agencies. A representative accepting an engagement must have authority to bind the Client. Nothing in these Terms excludes mandatory rights available to an individual business customer or any other protected person under applicable law.

2. How an engagement is agreed

Website descriptions and prices invite you to request an engagement. Sending an enquiry does not purchase a service, reserve a start date or authorize testing.

Before contracting, we provide these Terms and a written quotation or Statement of Work (“SOW”) identifying the parties, package, authorized assets, deliverables, exclusions, timetable, payment requirements and any agreed variations. A contract is formed when both parties expressly accept the written engagement, including by email or signature. Payment alone is not authorization to begin testing.

Testing starts only after the required payment, access, written authorization and Rules of Engagement are in place. “Written” includes an email from an authorized contact, unless a particular document or applicable law requires another form.

Mandatory law takes priority. A signed negotiated agreement and express SOW variations take priority over these Terms. The DPA governs personal data processing and the Rules of Engagement govern testing permissions and operational safety. Any inconsistency affecting authorization or data protection must be resolved before the affected work proceeds.

3. Packages and fees

Standard package prices are fixed for the following scope and are stated in US dollars (USD). Applicable VAT or other taxes are identified separately in the quotation before acceptance. If a proposed application does not fit a standard package, we will explain this and quote a different scope before you commit. No additional fees or scope changes apply without written agreement.

Shopify App Security Readiness — $900

One Shopify app, one agreed environment, one backend/API, up to 20 agreed endpoints and two test stores.

The review covers agreed authentication and session flows, selected store-isolation checks, webhooks and app proxies where applicable, scopes, exposed secrets, TLS, public ports and key storefront components. Dependency scanning is included where source access is provided within the agreed scope.

Deliverables: a PDF report describing methodology, scope, limitations, findings and remediation priorities; a 30-minute walkthrough; and one round of report questions within 10 business days after delivery.

This is a focused readiness review. A full VAPT, incident report, code fixes and retesting are not included.

Shopify Incident VAPT — $3,500

One Shopify app, one agreed backend/API, up to 30 agreed endpoints, two test stores and up to three agreed roles.

Manual and automated testing covers the incident-related path and agreed authentication, authorization, tenant isolation, business logic, integrations and application-owned external services. Source review and cloud configuration checks apply only where access and scope are expressly agreed.

Deliverables: a technical VAPT report signed by the independent assessor, an executive summary, assistance preparing an incident report draft from Client-provided evidence, a plan for organizing submission materials, and one retest of confirmed findings within the original scope, with a retest addendum.

The included retest must take place within 30 calendar days after delivery of the initial report unless a different window is agreed in writing. You should request it with sufficient notice and provide usable access and deployed fixes. If our availability prevents a timely retest after a timely request and access, we will extend the window without an additional fee. Other extensions and additional rounds require written agreement.

Code remediation, forensic investigation, data recovery, legal advice and determining the historical extent of a breach are not included. You verify and approve the incident report and submit it to Shopify unless a separate arrangement is agreed.

Retest & Shopify evidence pack — $800

One retest round covering up to 10 specifically identified findings in one application, based on an adequate original report and reproduction details.

Deliverables: a signed PDF retest addendum recording resolved, unresolved or inconclusive findings and limitations, and a concise evidence summary for Client use in Shopify correspondence.

This does not include a new VAPT or a fresh full-application assessment. Where another assessor issued the original report, we attest only to our own retest work. The original report and comparability of test conditions must be reviewed during scoping.

The Incident VAPT package already includes its stated retest. We do not charge the separate $800 fee for that included round.

4. Testing authorization and safety

Before testing, you must identify the permitted assets, environments, IP addresses or hostnames, accounts, roles, test windows, allowed techniques, rate limits and emergency contacts. You must hold or obtain the rights and permissions needed to authorize the assessment, including relevant merchant, infrastructure owner and third-party permissions.

Ownership of an application does not itself authorize testing Shopify's infrastructure or other third parties. Third-party platforms, unrelated stores and assets outside the written scope are excluded without the relevant owner's express authorization.

By default, testing excludes denial-of-service, destructive actions, deletion or alteration of live business data, real payments, bulk messaging, social engineering and persistence. Any permitted exception must be lawful, precisely scoped and expressly authorized in writing; we may decline techniques we consider unsafe.

Staging, dedicated test stores and synthetic data are preferred. Production testing requires express agreement about its risks and limits. You are responsible for appropriate backups, recovery readiness, monitoring and availability of an emergency contact. We remain responsible for exercising professional care and observing the agreed limits.

Either party may request an immediate pause for safety, suspected lack of authorization or unexpected impact. We will promptly communicate material findings or incidents requiring urgent attention through the agreed secure channel. A pause does not permit us to expand the scope.

5. Client cooperation and scheduling

You provide accurate scope information, usable access, relevant incident records and a contact authorized to make decisions. You are responsible for your remediation decisions, deployment of fixes, legal reporting duties and submission deadlines.

Dates are confirmed in the SOW after scoping and access planning. Missing access, unavailable systems or changes may require a revised schedule. We will explain the impact and seek agreement on material changes; extra charges are not automatic. We do not guarantee delivery within a particular Shopify response period unless expressly agreed.

6. Methodology, independence and limits

We perform the agreed work with reasonable professional skill and care, using manual testing and selected authorized tools. Methods and tools depend on scope, permissions and licensing. A tool listed on the website is not a promise that it will be used in every engagement.

Assessments are time-bound and limited to the tested version, environment, access and scope. They cannot identify every vulnerability or prove that a system is secure. A lack of findings is not a certification. Reports describe material limitations and untested areas.

For an engagement sold as independent VAPT, the assessor must be independent of the development and remediation work being assessed. We disclose relevant conflicts before accepting that engagement.

An incident report draft reflects the evidence available. Where impact or root cause is uncertain, the draft will identify that uncertainty. A VAPT does not by itself establish whether historical data access or exfiltration occurred.

7. Payment

The agreed fee is paid in two instalments: 30% in advance, after acceptance of the scope and before work starts, and 70% within seven calendar days after delivery of the principal report, unless the accepted SOW expressly specifies different milestones or payment dates. For Incident VAPT, the principal report is the initial VAPT report and accompanying deliverables due at that stage; the included retest follows under its agreed window and carries no additional fee. For the standalone retest package, the principal report is its retest addendum and evidence summary. Payment does not waive remedies for a missing or defective deliverable.

For the standard package fee, before any applicable taxes or agreed extras:

These are one-off engagements with no automatic renewal or recurring subscription. The advance is credited towards the total fee. It is subject to the cancellation and refund rules below and is not described as statutory earnest money (zadatek).

You bear transfer charges imposed by your bank; charges imposed by our payment arrangement are disclosed before acceptance. We do not store full payment-card details. A different currency or exchange-rate arrangement must be agreed in advance.

If payment is overdue, we may defer the start or, after written notice and a reasonable opportunity to pay, suspend further work. We will communicate the schedule impact and preserve the agreed included retest where the delay is attributable to us.

8. Cancellation, missed deadlines and refunds

Cancellation within 48 hours

You may cancel by emailing [email protected] within 48 consecutive hours after we receive your advance payment. We confirm its receipt and the end of this cancellation window by email. A cancellation notice received within the window qualifies for a full refund of amounts paid, including the 30% advance. This contractual refund applies even if you requested an early start and some work has begun. It does not shorten any longer mandatory withdrawal period.

Cancellation after 48 hours

If you cancel for convenience after that window, we generally retain the 30% advance as the agreed cancellation charge for the reserved capacity and engagement preparation. This charge is credited against the amount due for work already performed; it is not added on top of that work without credit.

If the reasonable value of work already performed and expressly approved nonrecoverable third-party costs exceeds 30% of the agreed fee, you pay the difference, calculated using agreed milestones or rates. Without separately agreed rates, the calculation reflects the reasonable proportion of the fixed scope completed. The total cannot exceed the accepted fee without an approved scope change. We provide an itemized account and refund any prepaid balance above the amount properly due. The unperformed 70% balance is not automatically payable merely because you cancel.

Advance retention does not apply to termination caused by our material breach, the missed-deadline remedies below, a valid statutory withdrawal, termination for important reasons where mandatory law prevents the charge, or any other case where the charge cannot lawfully be imposed. Mandatory rights, including any right to challenge or reduce a cancellation charge, are preserved.

If we miss an agreed deadline

The SOW identifies delivery dates and any deadline expressly agreed as essential. If we miss a delivery deadline for a reason attributable to us, you may notify us in writing and give us five business days to deliver the overdue work, unless a different reasonable extension is mutually agreed. A business day is Monday to Friday, excluding public holidays in Poland. You do not have to accept a unilateral extension.

If we do not deliver within that additional period, you may terminate the affected part and receive a refund for the unperformed work and any delivered work rendered unusable for the agreed purpose by that delay. The refund includes the corresponding advance payment; the later-cancellation charge does not apply.

If the original deadline was expressly agreed as essential and our delay defeats the agreed purpose, you may terminate the affected engagement immediately without a cure period. If the delay makes the whole engagement unusable for that purpose, we refund all amounts paid. Where you retain useful, independently usable completed work, only its reasonable agreed value is retained and the remainder is refunded. Other mandatory remedies remain available.

These Provider-delay rules do not apply to the extent a delay results from missing Client access or authorization, Client changes, an agreed safety pause not caused by our breach, or events beyond our reasonable control. We must explain the cause and its schedule impact promptly; we cannot keep the advance indefinitely without performing. For a prolonged external interruption, either party may terminate the unperformed part, with a refund of payments allocated to that part and no convenience-cancellation charge. A new completion date requires agreement.

A failure by Shopify to accept a report, close a ticket or meet its own response timetable is not itself a missed delivery deadline by us. This does not excuse failure to deliver our agreed scope on time.

Suspension and other termination

We may suspend unsafe or unauthorized testing immediately. For other material breaches, we give written notice and a reasonable opportunity to remedy them before termination where practicable. If authorization cannot be established, testing does not proceed. Any financial settlement must reflect the reason for termination, work properly performed and mandatory law; an inability to proceed is not automatically a right for us to keep all payments.

If we cancel or cannot complete the service for reasons attributable to us, we refund the unperformed portion and any completed portion unusable for its agreed purpose, provide available completed deliverables and preserve your applicable remedies. If nothing usable has been delivered, all amounts paid are refunded.

Refund method and timing

Refunds are made within 14 calendar days after a valid cancellation or termination notice, normally to the original payment method unless another method is agreed without additional charge. We provide any itemized settlement promptly. A dispute about one portion does not delay repayment of the undisputed refund. Shorter mandatory deadlines take priority.

9. Delivery and complaints

We deliver reports through the agreed channel. Contact [email protected] to report a missing deliverable, factual error or failure to meet the agreed scope, identifying the engagement and the issue. You do not need to provide confidential evidence by ordinary email; we will arrange a suitable method.

We aim to respond substantively within 14 calendar days and comply with any shorter mandatory deadline. We will correct verified errors or complete missing agreed work within a reasonable period at no additional charge. Other contractual and statutory remedies remain available. Silence or payment does not waive a complaint or automatically confirm that a deliverable is free of defects.

10. Confidentiality and report use

Both parties protect nonpublic information received through the engagement, including source code, credentials, vulnerability details, logs, reports, business information and incident records. Disclosure is limited to people and providers who need access for the engagement and are bound by appropriate confidentiality obligations.

This obligation does not cover information lawfully public without breach, already lawfully known, independently developed or lawfully received without confidentiality restrictions. Legally required disclosure is permitted, with notice where lawful and disclosure limited to what is required.

You may disclose complete reports to Shopify, relevant merchants, your remediation team, professional advisers, insurers and competent authorities for legitimate business or legal purposes, using appropriate confidentiality safeguards. We do not publish findings, identify you in marketing or use your name or logo without separate permission. We do not independently submit reports to Shopify unless authorized or legally required.

Confidentiality continues for five years after the engagement ends, and for trade secrets, credentials, personal data and nonpublic exploitable vulnerability information for as long as their nature or applicable law requires protection. Data retention and deletion obligations still apply; confidentiality is not permission to retain information indefinitely.

11. Personal data and subcontractors

The website Privacy Policy describes processing for our own website and business administration. Client-controlled personal data is processed only under the applicable DPA and documented instructions. Where an Article 28 agreement is required, it must be in place before that processing begins.

Qualified subcontractors may assist subject to confidentiality, relevant independence requirements and any client approval or subprocessor authorization required by the contract or DPA. We remain responsible for their performance of our contractual obligations. Client data is not freely reusable for other purposes.

12. Intellectual property

You retain rights in your application, source code and supplied material. We retain rights in our pre-existing methods, templates, tools and general know-how. Third-party software remains subject to its own licenses.

Once the agreed fees are paid, you receive a perpetual, worldwide, nonexclusive right to use, copy and share the engagement deliverables for your business, remediation, compliance and permitted submission purposes. This does not transfer ownership of our underlying tools or permit misleading alteration, resale as your own assessment service or claims that we tested a different system or scope.

Payment disputes do not prevent use of urgent findings to mitigate a security risk or comply with a legal obligation.

13. Liability

We are responsible for performing the agreed work with professional care. Except where prohibited by law or excluded from the limitation below, each party's aggregate liability arising out of an engagement is limited to twice the total fee paid or payable for that engagement. For ordinary business claims subject to this cap, neither party is liable for lost profits, lost opportunities or indirect or consequential loss, to the extent such exclusions are lawful.

The cap and exclusions do not apply to intentional misconduct, gross negligence, breach of confidentiality or applicable data protection obligations, fraud, death or personal injury, or liability that cannot lawfully be limited. The cap does not reduce fees properly due or refunds required under these Terms. It does not restrict a data subject's statutory rights or a regulator's powers.

Client operational responsibilities do not excuse our breach of the agreed testing boundaries or required standard of care. Nothing here guarantees that limitations will apply in every jurisdiction.

14. Relationship with Shopify

Shopify is a trademark of Shopify Inc. AppPerimeter is independent and is not affiliated with, endorsed by or sponsored by Shopify Inc.

Our services do not provide Shopify certification, official approval or a guarantee that Shopify will accept a report, close an incident, reinstate an app or approve an App Store submission. Shopify controls its own decisions and requirements.

15. Applicable law and disputes

The engagement is governed by Polish law, subject to mandatory rules that cannot lawfully be excluded. The parties will first try to resolve disputes through their authorized contacts; this does not prevent urgent relief or suspend statutory deadlines.

For business disputes where a jurisdiction agreement is lawful, the competent courts in Kraków, Poland have jurisdiction. This provision does not restrict mandatory venue rights or protections available to an individual business customer or other protected person.

16. Mandatory rights of protected individual business customers

Where Polish or other mandatory law gives an individual business customer consumer-type rights for a particular engagement, those rights apply despite the business purpose of the service or any contrary provision above. In particular, a qualifying distance contract may carry a 14-day withdrawal right.

Before entering such an engagement, we provide the applicable statutory information and withdrawal documents separately. Starting work during a withdrawal period requires the legally necessary express request and notices. Loss of a withdrawal right after full performance applies only when all statutory conditions have been met. Merely accepting these Terms or describing the service as customized does not automatically remove that right.

17. Changes and general provisions

The version supplied and accepted for an engagement remains applicable to it. Updating the website does not amend an existing contract; changes to that engagement require written agreement.

If a provision is unenforceable, the remaining provisions continue to apply to the extent legally possible. Neither party's delay in enforcing a right automatically waives it. Provisions intended to survive completion, including confidentiality, permitted report use, payment and dispute provisions, continue for their applicable duration.

Notices and questions: [email protected].