Professional B2B terms for 5Z Consulting / 5Z Product Security.
Scope and contracting
These terms concern CRA readiness assessments, CRA Portfolio Diagnostics, product-security consulting, PSIRT-as-a-Service, vulnerability-management support, SBOM services, incident-response support, secure-development advisory, managed Product Security Operations and related technical/compliance advisory. Services begin only under an agreed written engagement. 5Z Product Security is a division of 5Z Consulting. The contracting provider and applicable governing law and dispute-resolution arrangements are identified in the signed engagement agreement. For questions about these terms or an engagement, contact legal@5zconsulting.com.
Statements of work
Each statement of work defines scope, deliverables, assumptions, customer responsibilities, access, service hours, escalation routes, reporting responsibilities, fees and timelines. The signed engagement agreement takes precedence over these website terms in a conflict. Changes require written agreement. A website enquiry does not create an engagement or an emergency-response commitment.
Conformity and regulatory role
5Z Product Security provides advisory, implementation and managed product-security services. 5Z is not a notified body or certification body and does not award CE marking. Where independent conformity assessment, testing or certification is legally required, it must be carried out by an appropriately authorised third party. Advice does not guarantee compliance or a particular assessment outcome.
Customer responsibilities
The customer supplies accurate, complete and timely information and authorises all access and activities. Findings depend on the supplied information and agreed scope; an assessment may not identify every vulnerability. The manufacturer remains responsible for final product, release, remediation, reporting and legal decisions. Specialist legal advice should be obtained when required.
Tools, dependencies and regulatory change
Services may rely on third-party tools, databases, components and providers. Their availability and findings may change or be incomplete. Third-party vulnerabilities can arise after an assessment. Regulatory guidance and standards may change; work reflects the agreed scope and information available at the time. Ongoing monitoring or updates apply only where contracted.
Confidentiality
Both parties must protect non-public information, limit access to those who need it and use it only for the engagement. Appropriate third-party controls and any required customer approvals apply. Exceptions include information lawfully public, independently developed, lawfully received or required to be disclosed by law. An NDA and engagement-specific handling requirements may supplement these terms. Confidential client information is not used to train public AI models.
Intellectual property
Customers retain their pre-existing information and intellectual property. 5Z retains its pre-existing methods, templates, tools and know-how. Ownership and permitted use of engagement deliverables are defined in the signed agreement. Third-party and open-source materials remain subject to their applicable licences. No repository access transfers ownership.
Fees and payment
Fees, taxes, invoicing milestones, payment deadlines and approved expenses are set out in the engagement agreement. No subscription or recurring fee is created by using this website. Disputed invoices should be raised promptly; treatment of late payment or suspension is governed by the signed agreement and applicable law.
Liability
The signed agreement defines the allocation of risk, applicable liability limits and any exclusions appropriate to the engagement. Services cannot guarantee that a product will be free of vulnerabilities or incidents. Nothing in these terms excludes or restricts liability that cannot lawfully be excluded or restricted.
Termination and handover
Termination rights, notice, cure periods and any suspension rights are defined in the engagement agreement. On termination, accrued payment obligations remain due as agreed. The parties coordinate return or deletion of confidential information, removal of access and any agreed handover, subject to lawful retention. Confidentiality and applicable intellectual-property provisions survive termination.
Website use and updates
Website content is general information, not a product-specific compliance determination or legal opinion. Do not misuse the site or submit credentials, source code or vulnerability details through enquiry forms. Changes to website terms do not amend a signed engagement unless agreed. For questions about these terms, contact legal@5zconsulting.com.