Last updated: 31 October 2026
These terms apply when you use securebydesignlabs.com and when you buy products or services from us. Please read them before you order. If you have a question about them, email support@securebydesignlabs.com.
1. About us
1.1 SecureByDesignLabs (“we”, “us”, “our”) is SecureByDesignLabs Ltd, a company registered in England and Wales under company number 17543312, whose registered office is at 66 Paul Street, London, England, EC2A 4NA.
1.2 You can contact us at support@securebydesignlabs.com or by post at 66 Paul Street, London, England, EC2A 4NA.
2. Who these terms are for
2.1 Our products and services are for businesses. By placing an order, you confirm that you are acting for a business, and that you are authorised to accept these terms for it. “You” means that business.
2.2 If you are in fact a consumer, nothing in these terms takes away the rights you have by law as a consumer.
2.3 Sections 3, 4 and 16 apply to everyone who uses the website. The rest apply when you order from us.
3. Using the website and our free tools
3.1 Our articles, datasets and free tools (such as the CRA scope checker) are general information to help you understand where you stand. They are not advice about your particular situation, and we don’t guarantee they are complete, current or free of errors. Our datasets are measured from what organisations publish themselves. If you spot an error, tell us and we will look at it.
3.2 You may read, share and link to our content. You may quote reasonable extracts if you credit SecureByDesignLabs and link to the source. You may not copy our datasets in bulk, scrape the site or our tools’ APIs, or try to get around their rate limits or security.
3.3 We may change, suspend or withdraw any part of the website or a free tool at any time. Free tools are provided as they are, without any promise of availability.
3.4 If you post a comment or review, it must be lawful, accurate if it states facts, and not abusive or promotional. We may remove any comment.
4. Engineering guidance, not legal advice
4.1 Everything we provide (our website, tools, reports and services) is engineering setup and plain-English guidance. It is not legal advice, and we are not a law firm, notified body or certification body.
4.2 You remain responsible for your products’ compliance with the EU Cyber Resilience Act and any other law. We don’t promise that using our products or services will make a product compliant, or that a regulator, notified body, customer or court will accept your documentation.
4.3 You are the manufacturer of your products. We don’t sign your EU declaration of conformity, and we don’t act as your authorised representative, importer or distributor. We don’t take on any of your duties as a manufacturer under the Cyber Resilience Act or any other product law, including reporting vulnerabilities and incidents, handling vulnerabilities, providing security updates and keeping technical documentation. Any declaration, document or decision you make with our help is yours.
5. Orders and how a contract is formed
5.1 Products bought on the website: the contract is formed when we send you an email confirming your order.
5.2 Services (such as reviews, assisted setup and done-for-you work): we will send you a written quote or order describing the scope, deliverables, price and expected timing. The contract is formed when you accept it in writing (email is fine) or pay the first invoice. A quote is valid for 30 days unless it says otherwise. If the quote and these terms conflict, the quote wins.
5.3 The contract is made up of these terms, the order confirmation or accepted quote, and anything they refer to. Nothing else applies, including any terms in your purchase order, unless we agree to it in writing.
6. Prices and payment
6.1 Prices are as shown on the website at the time you order, or as stated in your quote, in the currency shown. We are not registered for VAT, so we don’t add VAT to our prices. If we register, we will show any VAT separately before you order or in your quote.
6.2 Products bought on the website are paid for in full when you order. For services, unless your quote sets a different schedule:
- when you accept the quote, we invoice a booking deposit, which holds your start date and is credited in full against the price;
- the balance is due before the booked start date, and we start work once the price has been paid in full.
6.3 If you cancel a service before the booked start date:
- Within 14 days of making a payment for it, we refund that payment in full. Each payment, whether it is the booking deposit or the balance, has its own 14 days.
- After those 14 days, we don’t refund the payment in cash. It becomes a credit you can use for the same service with a later start date. The credit lasts 12 months from the date of your first payment for that service (usually the booking deposit), and a later payment such as the balance doesn’t restart that clock.
This doesn’t affect your right to a refund under 7.3 or 7.7. The same applies to a deposit paid to reserve a slot for later work.
6.4 If an invoice is paid late, we may charge interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998, and pause work until it is paid.
6.5 If we have shown a price by mistake, we will tell you before we accept your order, or, if we have already accepted it, give you the choice of paying the correct price or cancelling for a full refund.
6.6 If you pre-order a product, the product page states the date by which we will deliver it. If we don’t deliver by that date, we will refund what you paid in full.
6.7 If your quote offers a credit, such as the price of one service credited against a later one, quoted credits apply as stated in the quote, including any time limit the quote gives.
7. Services
7.1 We will carry out services with reasonable skill and care, and deliver what your quote describes.
7.2 You will give us the information, access and decisions we reasonably need (including the builds and access set out in 7.6 and your quote), on time, and make sure you have the right to share anything you give us. If you are late, or something you give us is wrong, we are not responsible for the resulting delay, and we may charge for extra work it causes.
7.3 Dates in a quote are estimates unless the quote says a date is fixed. Changes to scope must be agreed in writing, and may change the price or timing. If your quote gives a fixed delivery date and we miss it for a reason within our control (not a delay on your side under 7.2), you may cancel and get a full refund of that service. If your quote says that in a stated case you may choose a full refund of everything you have paid (for example, if the start date or booked month can’t be confirmed by the date the quote gives), that refund applies as the quote states, even if it falls more than 14 days after a payment.
7.4 You may also cancel a service at any time, for any reason, by telling us in writing. There is no cancellation fee and no notice period. If you cancel before the booked start date, 6.3 applies. Once work has started, we don’t refund what you have paid for that service if you cancel, except under 7.3 (a missed fixed date) or 7.7 (a result not as described that we can’t fix).
7.5 A service covers only the products, versions, materials and questions set out in your quote, as they stand when we review them. We work from what you give us and what we can see at the time. We don’t promise to find every vulnerability, gap or issue, and we are not responsible for changes made to your product after we deliver.
7.6 What we work from. A readiness review works from builds of your app that you send us yourself (Android APK or AAB, and iOS IPA), once you have authorised us in writing to analyse them. If you don’t send builds and that authorisation, the readiness review covers public information only, and says so. For an evidence review and other services, the access we need (such as code, builds and documents) is set out in your quote, and you grant it to us. In an engagement, we never download or decompile your app from an app store. We work from the builds you send us with your written permission, from the code and documents you choose to share, and from public information.
7.7 If the result isn’t as described. What we deliver will materially match what your quote describes. If it doesn’t, tell us within 14 days of delivery. We will fix it, and if we can’t within 14 days of hearing from you, we will refund what you paid for that service.
8. Intellectual property
8.1 You keep all rights in the material you give us, such as code, app builds and documents. You give us permission to use it to deliver what you have ordered, and as described in section 9.
8.2 We keep all rights in everything we owned before your order or create outside it, and in anything general we develop while working with you that isn’t specific to you. That includes our website, tools, software, methods, templates, our analysis engine, datasets and know-how (“our background materials”). Nothing in the contract transfers them to you.
8.3 Deliverables we produce specifically for you (such as a gap report) are yours to use once you have paid for them. Unless your quote says you will own them, we grant you a non-exclusive, perpetual, royalty-free licence to use, copy and adapt them within your business, including sharing them with your customers, auditors, advisers and regulators. Where a deliverable includes any of our background materials, you may use them as part of that deliverable, but not separately.
8.4 We promise that we have the right to use the tools, materials and methods we use to deliver the work. We make no other promise about intellectual property.
9. How we use data from our work with you
When we carry out an engagement for you, monitor your app, or process what you submit through our tools, we learn things that help other teams too: which issues come up, how often, and what fixed them. This section explains how we may use that, and what we will never do with it.
- What we may use. We may use information from your engagements, from monitoring your apps and from what you submit through our tools to produce statistics, benchmarks, early warnings and guidance.
- Aggregated and anonymised only. We use this information only in aggregated and anonymised form, combined with information from other sources and customers.
- Never identifying you. Nothing we publish or share from it will identify you, your organisation or any of your products. We will not publish any figure based on data from fewer than 10 customers.
- Opting out. This applies unless you opt out. You can opt out at any time by emailing support@securebydesignlabs.com, and we will stop including your data from then on.
- Deleting your raw data. “Raw data” means the material you give us (such as code, app builds and documents) and the results we produce specifically about your app, such as reports and records of our work. You can ask us to delete the raw data we hold about you by emailing support@securebydesignlabs.com, except anything we must keep by law (such as invoices).
- What deletion does not undo. Aggregated and anonymised statistics produced before your request do not identify you, so deleting your raw data does not remove them.
10. Confidentiality and data protection
10.1 Each of us will keep the other’s confidential information confidential, and use it only for the contract. This doesn’t apply to information that is public through no fault of the receiving party, that the receiving party already had or develops independently, or that must be disclosed by law. Section 9 sets out how we may use anonymised, aggregated data.
10.2 Each of us will comply with UK data protection law. Our Privacy Policy explains how we handle personal data about you and your staff. Where we process personal data on your behalf while delivering a service, we will agree a data processing agreement with you before we start, and it applies alongside these terms.
10.3 Unless you ask us to keep it for follow-on work, we delete the code, app builds and system access you gave us within 90 days after the engagement ends. We keep the reports we produced for you, and our records of the work, for 6 years, like our other business records. You can still ask us to delete your raw data sooner under section 9.
11. Our liability
11.1 Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, under product liability law to the extent it cannot be limited, or for anything else that cannot be limited or excluded by law.
11.2 Subject to 11.1, we are not liable for any loss of profit, revenue, business, contracts, goodwill or anticipated savings, for loss or corruption of data, for fines or penalties imposed on you, or for any indirect or consequential loss.
11.3 Subject to 11.1, our total liability to you under or in connection with each order, whether in contract, tort (including negligence) or otherwise, is limited to the amount you paid us under that order in the 12 months before the event giving rise to the claim.
11.4 Except as set out in these terms, all warranties and conditions implied by law are excluded to the fullest extent the law allows.
12. Ending the contract
12.1 Either of us may end the contract by written notice if the other seriously breaches it and doesn’t put it right within 14 days of being asked to, or becomes insolvent.
12.2 When the contract ends, you will pay for any products already delivered. For a service, what you have paid is refunded, credited or kept as set out in 6.3 and 7.4 (or, if you end it under 7.3 or 7.7, as set out there). Sections 4, 8, 9, 10, 11 and 16 continue to apply after it ends.
13. Events outside our control
Neither of us is responsible for a delay or failure caused by events outside our reasonable control, as long as we tell the other promptly and do what we reasonably can to limit the effect. This doesn’t apply to paying money that is due.
14. Changes to these terms
We may update these terms from time to time. The version on this page when you order applies to that order.
15. General
- Transfer. We may transfer the contract to a company we control or that takes over our business, and will tell you if we do. You need our written agreement to transfer it.
- Subcontractors. We may use subcontractors, and remain responsible for their work.
- Notices. Notices under the contract may be sent by email: to us at support@securebydesignlabs.com, and to you at the address you gave when ordering.
- Whole agreement. The contract described in 5.3 is the whole agreement between us about its subject. Neither of us has relied on any statement not set out in it, but this doesn’t limit liability for fraud.
- Third parties. Only you and we have rights under the contract. The Contracts (Rights of Third Parties) Act 1999 does not apply.
- Severance and waiver. If a court finds part of these terms unenforceable, the rest still applies. If we don’t enforce a right straight away, we can still enforce it later.
16. Governing law and disputes
16.1 If you have a complaint, please email us first. We will try to resolve it quickly and informally.
16.2 These terms, and any dispute about them or the website (including non-contractual disputes), are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.