Hardtstein Business Security Review
Effective date: October 9, 2026
1. Provider and Scope
1.1. These Terms and Conditions ("Terms") govern the purchase and delivery of the Business Security Review ("Service") provided by Hardtstein UG (haftungsbeschränkt), Hilpertstraße 31, 64295 Darmstadt, Germany, registered with the Local Court of Darmstadt under HRB 107549 ("Hardtstein", "we", "us").
1.2. The Service is offered exclusively to entrepreneurs and business customers acting in the course of their commercial or independent professional activities within the meaning of Section 14 of the German Civil Code (BGB). It is not intended for consumers within the meaning of Section 13 BGB.
1.3. By placing an order, the customer confirms that they are acting for business or professional purposes and are authorized to purchase the Service on behalf of the relevant business, where applicable.
1.4. Any individual agreement expressly confirmed by both parties takes precedence over these Terms.
2. Service Description
2.1. The Business Security Review is a focused, remote assessment of selected security-relevant settings, accounts and access arrangements used in the customer's business.
2.2. The fixed-price Service includes:
- A review of up to five mutually agreed business accounts or account environments.
- An assessment of selected authentication and account recovery settings.
- A review of relevant user permissions and access arrangements.
- Identification of security weaknesses reasonably identifiable within the agreed scope.
- A written summary of findings and prioritized recommendations.
- One remote consultation of up to 30 minutes to discuss the findings and practical next steps.
2.3. The exact accounts and review priorities are determined jointly during onboarding. An account or account environment means one clearly defined service, platform or administrative account selected for review. Complex systems, extensive subaccounts, separate organizational environments or multiple installations may require separate agreements.
2.4. The Service is limited to the agreed scope and the information and access made available by the customer. Hardtstein determines the appropriate assessment methods using reasonable professional judgment.
2.5. The Service is advisory and assessment-focused. Hardtstein provides professional recommendations based on the findings available at the time of the review. The customer remains responsible for deciding whether and how to implement recommendations.
3. Services Not Included
3.1. Unless expressly agreed in writing, the following are not part of the fixed-price Service:
- Comprehensive penetration testing, vulnerability scanning or red-team exercises.
- Testing of infrastructure, applications, networks, databases or source code beyond the expressly agreed account-level review.
- Continuous monitoring, recurring assessments or incident response.
- Forensic investigations, malware removal or recovery following a security incident.
- Implementation of technical changes, configuration work, migrations or extensive remediation.
- Development of security policies, comprehensive compliance audits or formal security certifications.
- Examination of more than five agreed account environments.
- Unlimited follow-up consultations, ongoing support or repeated reviews.
- Guarantees of regulatory compliance, protection against cyberattacks or elimination of all security vulnerabilities.
3.2. Simple corrective measures may be explained during the consultation. Their technical implementation is not included unless Hardtstein expressly agrees to perform a specific measure.
3.3. Any additional services require a separate agreement regarding scope and remuneration. Hardtstein is not obliged to perform work beyond the agreed Service.
4. Ordering and Contract Formation
4.1. The presentation of the Service on the website constitutes an invitation to place an order and is not, by itself, a binding offer.
4.2. The customer submits an order through the payment process provided by Stripe and confirms acceptance of these Terms before proceeding to payment.
4.3. The contract is formed when Hardtstein accepts the customer's order, for example by sending an order confirmation or commencing the agreed onboarding process. An automated payment receipt alone does not necessarily constitute acceptance of the order.
4.4. Hardtstein may decline an order for objectively justified reasons, including lack of business-customer status, insufficient authorization, legal or security concerns, or a requested scope materially exceeding the advertised Service.
4.5. Where an order is not accepted and payment has already been collected, the payment will be refunded without undue delay using the original payment method where reasonably possible.
5. Fees and Payment
5.1. The price of the Business Security Review is EUR 500 excluding applicable value-added tax (VAT).
5.2. Applicable VAT and the final payable amount are disclosed during checkout before payment.
5.3. Payment is due when the order is placed and is processed through Stripe.
5.4. The fixed price applies exclusively to the Service described in Section 2. Additional services are invoiced only where separately agreed.
5.5. The customer is responsible for providing accurate billing and business information.
6. Scheduling and Delivery
6.1. Following acceptance of the order, Hardtstein will contact the customer using the email address supplied at checkout and provide information for scheduling the initial consultation.
6.2. Review activities and consultations take place remotely unless otherwise agreed.
6.3. The parties will agree on an appropriate delivery schedule, taking into account the availability of necessary information, access and personnel.
6.4. Any estimated completion date is non-binding unless expressly agreed as a binding deadline.
6.5. Delays caused by missing information, unavailable systems, insufficient access or delayed customer responses may result in corresponding adjustments to the delivery schedule.
6.6. The Service concludes with delivery of the written findings and the agreed consultation. Further investigation or follow-up support requires a separate agreement.
7. Customer Responsibilities
7.1. The customer shall provide the information reasonably necessary to perform the agreed Service and identify the accounts and systems to be reviewed.
7.2. The customer warrants that they own, administer or are otherwise duly authorized to request the assessment of all systems and accounts included in the agreed scope.
7.3. The customer shall obtain any required third-party permissions before granting access or authorizing assessment activities.
7.4. The customer remains responsible for account administration, backups, data integrity, system availability, compliance obligations and implementation of security measures.
7.5. The customer shall not provide passwords, secret keys or other sensitive access credentials through ordinary, unencrypted email. Where access is necessary, the parties shall agree on an appropriately secure access method.
7.6. The customer shall inform Hardtstein of relevant access restrictions, internal security policies and operational constraints before assessment activities begin.
7.7. Hardtstein is not required to perform activities that may be unlawful, unauthorized or disproportionate to the agreed scope.
8. Assessment Methods and Security Limitations
8.1. The Service is a targeted review and does not constitute a complete examination of the customer's IT environment.
8.2. Hardtstein may conduct the assessment through configuration reviews, interviews, documentation checks, account-setting inspections and other proportionate, non-destructive methods.
8.3. Intrusive security tests, exploitation attempts, social engineering, denial-of-service testing and other potentially disruptive activities are excluded unless separately and expressly authorized.
8.4. Hardtstein does not guarantee that all vulnerabilities, configuration errors, security incidents or potential attack paths will be identified.
8.5. Security findings reflect the information, settings and conditions available at the time of assessment. Changes made after the review may affect the continued relevance of recommendations.
8.6. No particular security outcome, certification or prevention of future incidents is guaranteed.
9. Findings and Recommendations
9.1. Hardtstein will provide a written summary outlining identified concerns and recommended improvements within the agreed scope.
9.2. Findings may be prioritized based on professional judgment regarding their apparent security relevance and practical remediation considerations.
9.3. Recommendations are intended to support the customer's security decisions. They do not replace the customer's own risk management or the services of specialist legal, regulatory or technical advisers where needed.
9.4. Where an issue requires further investigation beyond the agreed scope, Hardtstein may recommend a separate assessment without being obliged to undertake that work under the fixed-price Service.
9.5. The customer may use the deliverables internally for their own business purposes. Redistribution, resale or publication of the deliverables requires Hardtstein's prior consent, except where disclosure is legally required or reasonably necessary to the customer's professional advisers, insurers or relevant service providers under appropriate confidentiality obligations.
10. Confidentiality and Data Protection
10.1. Each party shall treat non-public business, technical and security information obtained from the other party as confidential and shall use it only for the performance or administration of the contractual relationship.
10.2. Confidentiality does not apply to information that is publicly available without breach of an obligation, was lawfully known beforehand, was independently developed or must be disclosed under applicable law.
10.3. Hardtstein shall limit access to customer information to personnel or authorized service providers who reasonably need such access for the agreed Service.
10.4. The parties shall comply with applicable data-protection law, including the General Data Protection Regulation (GDPR).
10.5. Where the nature of the engagement requires Hardtstein to process personal data on behalf of the customer as a processor, the parties shall enter into an appropriate data processing agreement under Article 28 GDPR before the relevant processing begins.
10.6. The processing of personal data in connection with website use, payment and customer communication is further described in Hardtstein's Privacy Policy.
10.7. The customer shall avoid sharing personal data, credentials or other sensitive materials that are unnecessary for the agreed assessment.
11. Cancellation and Rescheduling
11.1. Either party may request a change to a scheduled consultation by notifying the other party in text form, including email.
11.2. Customers should request rescheduling at least 24 hours before the scheduled consultation where reasonably possible.
11.3. Hardtstein will reasonably accommodate requests for rescheduling, subject to availability.
11.4. If the customer fails to attend a scheduled consultation, Hardtstein will offer one reasonable opportunity to reschedule. Further appointments may require a separate agreement.
11.5. If the customer cancels before Hardtstein has begun performing the Service, any payment received will be refunded.
11.6. If the customer cancels after work has begun, Hardtstein may retain reasonable remuneration for services already performed, subject to applicable law. Any unearned advance payment will be refunded.
11.7. If Hardtstein is unable to provide the agreed Service for reasons within its responsibility, the customer may request an appropriate alternative appointment or reimbursement of the amount attributable to the unperformed Service. Statutory rights remain unaffected.
11.8. Statutory rights relating to termination for good cause remain unaffected.
12. Liability
12.1. Hardtstein is liable without limitation for intent and gross negligence, for injury to life, body or health arising from a negligent breach of duty, and in all other cases where liability cannot legally be excluded or limited.
12.2. In cases of slight negligence, Hardtstein is liable for breaches of material contractual obligations whose fulfillment is essential to the proper performance of the contract and on whose fulfillment the customer may regularly rely. In such cases, liability is limited to foreseeable damage typical for this type of contract.
12.3. Subject to Sections 12.1 and 12.2, liability for slight negligence in connection with non-material contractual obligations is excluded.
12.4. The limitations above also apply to the personal liability of Hardtstein's legal representatives, employees and agents to the extent legally permissible.
12.5. The customer acknowledges that no security review can provide absolute protection against cyberattacks or guarantee the identification of every vulnerability. This acknowledgment does not restrict any mandatory statutory liability.
13. Intellectual Property and Use of Deliverables
13.1. Unless otherwise agreed, Hardtstein retains ownership of its pre-existing methods, templates, assessment approaches, tools and general professional knowledge.
13.2. Upon payment of the agreed fee, the customer receives a non-exclusive, perpetual right to use the specifically delivered report and recommendations for its own internal business purposes.
13.3. The customer may implement the recommendations within its business without additional licensing fees.
13.4. Rights in third-party software, systems and materials remain with their respective owners.
14. Changes to the Service Scope
14.1. Any requested change to the agreed review scope must be mutually accepted.
14.2. Hardtstein may propose a separate service or additional fee where the customer requests work beyond the original scope.
14.3. Hardtstein may pause assessment activities where continued performance would create a material security risk, exceed the customer's authorization or conflict with applicable law. The parties will discuss a reasonable alternative; statutory rights remain unaffected.
15. Governing Law and Jurisdiction
15.1. These Terms and the contractual relationship are governed by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods, to the extent applicable.
15.2. If the customer is a merchant within the meaning of the German Commercial Code, a legal entity under public law or a special fund under public law, Darmstadt, Germany, shall be the exclusive place of jurisdiction to the extent permitted by law.
15.3. Mandatory statutory provisions remain unaffected.
16. Final Provisions
16.1. Amendments or additions to the agreed Service may be documented in text form, including email. Individual contractual agreements retain their statutory priority.
16.2. If any provision of these Terms is invalid or unenforceable, the remaining provisions remain effective to the extent legally permissible. Applicable statutory provisions govern in place of any invalid provision.
16.3. These Terms are available to customers before completing their order and may be retained for future reference.
Provider contact
Hardtstein UG (haftungsbeschränkt) Hilpertstraße 31 64295 Darmstadt Germany
Email: kontakt@hardtstein.de Phone: +49 151 41630297
Commercial Register: Local Court of Darmstadt, HRB 107549 VAT ID: DE452969180
Version: October 9, 2026