Terms & Conditions

1 · Scope

Improbus AS ("Improbus", "we") provides cybersecurity services to organizations: Digital forensics & incident response (DFIR), advisory, consultancy, and enterprise engagements. These Terms apply to all such engagements and are read together with the per-engagement Statement of Work (SoW) and the Rates page. Where a signed SoW conflicts with these Terms, the SoW prevails for that engagement.

Services are provided to businesses and organizations only (B2B). We do not provide services to private individuals or consumers.

2 · Engagement & acceptance

A written agreement (SoW or equivalent) is required before work begins. The client must identify an ordering authority — a named representative with authority to commit the client and to instruct us. That person warrants they hold such authority; where they do not, they may be personally liable for the engagement they ordered.

Emergencies. In a declared emergency or active incident, instructing us to begin work — by phone, email, or message — constitutes acceptance of these Terms and the emergency engagement defaults on our Rates and DFIR pages, even before a formal SoW is countersigned. We may begin immediately to limit harm and preserve evidence; the written agreement is then completed as soon as practicable.

3 · Fees

Hourly rates per the Rates page. Time is recorded in 15-minute increments and billed per started hour. The initial consultation fee for new, non-urgent clients is NOK 2 500 + VAT for up to 60 minutes.

Final fee assessment. Where work is not fixed-price, the final fee may be assessed in light of the nature and complexity of the matter, the urgency and time of day (including out-of-hours and emergency work), the responsibility and risk assumed, the expertise and resources deployed, and the result achieved. Any such assessment stays within, and is reconciled against, recorded time and the agreed rates.

4 · Retainers & client account

We may require a retainer or advance payment before or during an engagement, particularly for new clients, emergency work, or matters with significant third-party costs. Retainers are held to the client's credit and drawn down against invoices as work proceeds. Funds held on the client's behalf are kept on a client account and applied only to that client's fees and disbursements; any unused balance is refunded on completion.

5 · Disbursements

External services, third-party fees, telecommunications, travel, and similar costs incurred on the client's behalf are billed at cost. Substantial disbursements may be invoiced in advance or paid directly by the client.

6 · Payment

Invoices are due 7 days from issue unless otherwise agreed. Late payments accrue statutory interest under the Norwegian Late Payment Act (forsinkelsesrenteloven), together with a statutory collection fee. Overdue matters may be referred to collections (collections@improbus.com). We may suspend work on overdue accounts after notice.

7 · Value-added tax (VAT / MVA)

Prices are stated excluding Norwegian VAT (MVA), which is added where applicable. For business clients established outside Norway, supplies may be zero-rated or exempt from Norwegian VAT, or subject to a reverse charge in the client's jurisdiction, in accordance with the applicable rules; the client is responsible for any VAT due in its own country. Valid business and VAT identification may be required to apply an exemption.

8 · Intellectual property

Work product created specifically for the client engagement (reports, analyses, and deliverables) becomes the client's property upon full payment. Improbus retains all pre-existing tools, methods, frameworks, templates, and know-how, including improvements of general application, and may reuse generic knowledge and experience gained.

9 · Confidentiality & data protection

All client information is treated as confidential. We handle sensitive material under the Traffic Light Protocol (TLP) and process personal data in accordance with our Privacy Policy and applicable data-protection law (GDPR / personopplysningsloven). Where we act as a data processor, a separate data-processing agreement governs that processing.

10 · Liability

Our liability is capped at the amount invoiced for the engagement giving rise to the claim. Indirect, consequential, and punitive damages — including lost profits, lost data, and business interruption — are excluded to the maximum extent permitted by Norwegian law. We are not liable for harm arising from incomplete or inaccurate information provided by the client, from instructions given by the client's ordering authority, or from the client's failure to act on our recommendations. Nothing in these Terms excludes liability that cannot lawfully be excluded.

11 · Governing law & venue

These Terms are governed by Norwegian law. The parties will attempt to resolve disputes amicably; failing that, Hordaland tingrett is the agreed legal venue.