These terms are the agreement between you and Topiax. They cover this website and the paid work we do for clients. Please read them together with the Refund and guarantee policy, which forms part of these terms, and the Privacy policy, which explains how we handle personal data.
1. Who we are
1.1Topiax is the trading name of Cyprian Tinashe Aarons, a sole trader based in Harare, Zimbabwe. In these terms, “Topiax”, “we” and “us” mean Cyprian Tinashe Aarons trading as Topiax. Topiax is not a company or any other separate legal entity.
1.2“You” means the person using this website. For paid work, “you” and “the client” mean the person or organisation named in the engagement confirmation or invoice.
1.3You can contact us at cyprian@topiax.xyz.
1.4In these terms:
- an engagement is one piece of paid work, such as a Scan, a Review, a Fix Validation, a Sprint, a Continuity subscription or an Integration project;
- an engagement confirmation is our written confirmation, usually by email, of the service, the price and the dates you have booked;
- the signed scope is the one-page authorisation and any engagement confirmation or written proposal that you and we agree for an engagement;
- your named contact is the person named in the signed scope as the contact for the engagement;
- work starts when we first access your systems or begin reviewing the materials you sent, after payment and access are both in. For Continuity, work for a month starts on the first day of that billing month. For an Integration discovery, work starts when the discovery week begins;
- handover of a Sprint is the day we deliver the handover document and the final changes;
- a business day is Monday to Friday, excluding public holidays in Zimbabwe; and
- in writing includes email.
1.5Section 3.1 sets out the short names we use for our services: “Scan”, “Review”, “Sprint”, “Continuity” and “Integration”.
2. What these terms cover
2.1These terms cover:
- the website at topiax.xyz;
- free tools and resources, including the 5-minute profile and downloadable guides;
- the newsletter;
- introductory calls; and
- paid services.
2.2By using the website, the free tools or the free resources, you agree to the parts of these terms that apply to them, in particular sections 11, 12, 14 and 17 to 19. If you do not agree, please do not use them.
2.3A contract for paid work is formed when you do any one of the following: sign the authorisation or an engagement confirmation, pay an invoice, or book paid work with us in writing. By doing any of these, you accept these terms for that engagement.
2.4Introductory calls are free and create no obligation on either side. Anything discussed on a call becomes part of an engagement only when it is confirmed in writing.
2.5If documents differ, this order applies: first the signed scope for the engagement, then these terms (including the Refund and guarantee policy), then the descriptions on this website.
2.6If you accept these terms for a company or other organisation, you confirm that you have authority to do so. You also confirm that you are at least 18 years old. Our paid services are designed for businesses and for people acting for a business, including founders building a product.
3. The services
3.1Each service has a fixed scope, a fixed price, a stated turnaround or term, and a written deliverable. For an Integration, the scope and the price are fixed in the written proposal. The offer pages describe what each service includes. The signed scope sets what applies to your engagement.
- AI App Scan (“Scan”), $400: external and logged-in checks of one live app, with a scored report of the top findings and how to fix them, within 3 business days.
- 48-hour Launch Readiness Review (“Review”), $1,250: an in-depth review of one app, with a written report, findings ranked by severity, a fix plan and a walkthrough call. The report is delivered within 48 hours.
- Fix Validation, $350 to re-test up to 10 findings or $750 to re-test up to 30 findings plus a quick check of new features: a re-test of fixes you made yourself, within 2 business days. It is available only within 60 days of the original Scan or Review (see section 3.2). Findings that are still open after one validation are re-checked once more at no charge.
- AI Reliability Sprint (“Sprint”), $4,500: we make the fixes and put tests and guardrails around the AI features, in about 10 business days. A Sprint requires a Topiax Launch Readiness Review from the last 60 days (see section 3.2). That Review sets the Sprint’s scope.
- Reliability Continuity (“Continuity”), $1,500 a month: a monthly review cycle for an app that keeps changing, with a 3-month minimum term.
- Custom AI Workflow Integration (“Integration”), $10,000 to $35,000, by invitation only: a custom build that starts with a paid one-week discovery ($1,500, credited to the build) and a written fixed-scope proposal.
3.2The 60 days for a Fix Validation and for a Sprint run from the day we delivered the report for the original Scan or Review. The window is met if the Fix Validation or the Sprint is booked within it, which means its invoice or deposit is paid. After that the app is likely to have changed too much, and a new Review is needed. The free re-check of findings that are still open must be requested within 30 days of the day we delivered the validation report.
3.3If the fix list from the Review is larger than the Sprint can cover, we tell you in the first two days of the Sprint and you choose: we prioritise within the Sprint, or you add a second week for $2,000.
3.4Unless the signed scope says otherwise, no service includes:
- formal penetration tests, or compliance audits or certification (such as SOC 2, ISO 27001 or HIPAA);
- testing of third-party platforms themselves;
- social engineering;
- denial-of-service testing;
- native mobile apps;
- fixing issues, except in a Sprint and within the fix hours of Continuity;
- new features, redesigns or platform migrations; and
- anything not listed in the signed scope.
3.5A change to the signed scope is valid only if we both agree it in writing. A change may alter the price and the dates.
3.6We may decline any request for work, for example where we cannot confirm who owns the system or where the work is outside what we offer.
4. Authorisation to test
4.1We do not test any live app, API or domain until the owner of that system has signed our one-page authorisation. The authorisation sets the scope, the dates, the test accounts and an emergency contact.
4.2By signing the authorisation, you confirm that you own the systems in scope or have the right to authorise testing of them, and that the information in the authorisation is accurate.
4.3Third-party services that your app relies on (for example Supabase, Stripe or OpenAI) are tested only through your own account and within those providers’ rules. You are responsible for complying with your providers’ terms for your accounts, including any notice they require before testing. We keep our testing within their published rules.
4.4For each engagement, you agree to:
- give the access listed in the signed scope (read-only by default) and keep it working for the length of the engagement;
- provide the agreed test accounts, and use test data rather than real customer data wherever you can;
- name one contact who can answer questions and make decisions, and an emergency contact who can be reached on the testing dates;
- give accurate and complete information about the app, how it was built and any problems you already know about;
- tell us about anything fragile or business-critical that we should avoid;
- keep your own current backups of your code and data before and during the engagement;
- for a Sprint or an Integration, provide someone who can review, approve and merge changes. You stay in control of what is merged and deployed; and
- remove our access and change any shared passwords or keys when the engagement ends.
4.5We test only what is in the signed scope, on the agreed dates. If you ask us to stop testing, we stop.
4.6Testing a live system carries some risk. For example, it can create test records, trigger emails or briefly slow a page. We take reasonable care to avoid disruption and we prefer a staging environment where you have one.
5. Timing and communication
5.1The turnaround for a Scan is 3 business days, for a Review 48 hours, and for a Fix Validation 2 business days. A Sprint takes about 10 business days. Timings for Continuity and Integration are set in the signed scope.
5.2The clock for a turnaround starts when payment and access are both in: we have received your payment and all the access listed in the signed scope is working. We confirm the start time to you in writing. If we agreed a later start date in writing, the clock starts on that date instead, at the time we agreed or at 09:00 Harare time (UTC+2) if we did not agree a time.
5.3The 48 hours for a Review are consecutive hours. A turnaround stated in business days is counted from the next business day after the clock starts and ends at the end of the last business day, Harare time (UTC+2). A report is delivered when we send it to your named contact.
5.4If access is missing, incomplete or withdrawn, or we are waiting for information or a decision from you, the deadline moves out by the length of that delay. If the delay means we lose the time we had set aside for you, we agree new dates with you in writing and the turnaround runs from the new start date.
5.5Dates for a Sprint and for an Integration are estimates unless the signed scope states a fixed date.
5.6We use one shared channel for each client (email or a shared Slack channel) and reply within 1 business day. If we find a critical issue part-way through a review, we tell you the same day and do not hold it for the report.
6. Fees, payment and credits
6.1All prices are in US dollars. The price for your engagement is the one in your engagement confirmation or invoice. Current list prices are on the pricing page.
6.2Payment is due as follows:
- engagements under $2,000 (a Scan, a Review, a Fix Validation and the Integration discovery): 100% upfront, by card or bank transfer;
- a Sprint: 50% to book and 50% on handover. If you add a second week, its fee is added to the handover payment;
- Continuity: monthly in advance; and
- an Integration build: on the payment schedule set in the written proposal.
6.3The first 5 founding clients pay $750 for a Review instead of $1,250, in exchange for a written testimonial and permission for an anonymised case study. Section 10.7 sets out how that works.
6.4Our prices do not include sales tax, VAT, withholding tax, duties or similar charges. If any of these apply to your payment, you are responsible for them. You also pay your own bank, transfer and card charges, so that we receive the invoiced amount.
6.5We do not start work until an upfront payment has been received. If a later payment is more than 7 days overdue, we may pause work and support until it is paid. A pause for non-payment does not extend a guarantee period or a credit window.
6.6We offer these credits:
- the $400 Scan fee is credited in full to a Review bought within 30 days;
- $500 of the Review fee is credited to a Sprint booked within 30 days;
- the first month of Continuity costs $1,000 instead of $1,500 if Continuity starts within 14 days of the Sprint handover; and
- the Integration discovery fee is credited in full to the Integration build.
6.7Each credit applies once per client. Credits do not stack: only one credit can be applied to any one invoice. Credits cannot be exchanged for cash and cannot be transferred to anyone else. A credit that is not used within its window lapses. A credit window runs from the day we delivered the earlier report or, for the Continuity credit, from the Sprint handover. The next engagement is bought or booked when its invoice or deposit is paid.
6.8The Continuity price is reviewed every 12 months and does not change between reviews. We give you at least 30 days’ written notice of any change. If you give notice to end Continuity under section 8.6 before the change takes effect, the earlier price applies until Continuity ends.
6.9You pay your own software, hosting and AI usage costs. This includes usage that our agreed testing causes in your accounts, such as AI provider usage from test prompts.
7. Refunds and guarantees
7.1The Refund and guarantee policy forms part of these terms. This section is a summary. If the summary and the policy differ, the policy applies.
7.2Before work starts, you can cancel for a full refund minus card or payment-processing fees. After work starts, refunds are given only under the guarantees below.
7.3We give three guarantees:
- On-time guarantee. If a Scan, a Review or a Fix Validation is delivered late, measured from when payment and access are both in, 25% of that fee is refunded automatically.
- Useful findings guarantee (Review only). If the Review finds nothing you consider worth fixing, you get a full refund.
- Sprint fix guarantee. Anything the Sprint changed that breaks within 30 days of handover is fixed at no charge.
7.4The policy explains who qualifies, how each guarantee is measured, how to claim and what is excluded.
8. Cancelling and rescheduling
8.1Cancelling before work starts. You can cancel by email at any time before work starts. The refund is set out in the Refund and guarantee policy.
8.2Moving a start date. You can move an agreed start date by telling us before work starts. We will offer the next available date, and the turnaround clock runs from the new date. Moving a date does not extend a credit window or the 60 days in section 3.2 unless we agree that in writing.
8.3Cancelling after work starts. You can stop an engagement at any time by email. Fees already paid are not refunded, except under the guarantees. We send you the work completed up to that point.
8.4Cancelling a Sprint part-way. If you cancel a Sprint after work starts and before handover, the deposit is not refunded. The work done is valued pro rata, on the business days worked against the planned length of the Sprint. If that value is more than the deposit, you pay the difference. You never pay more than the full fee. We hand over the work completed.
8.5Missing access. If we cannot start because the agreed access has not been provided within 30 days of payment, either of us may cancel and the refund is the same as for a cancellation before work starts. If, after work has started, access is missing or we have had no reply for 14 days, we may complete the engagement on what we were able to review and deliver a report that states what could not be checked.
8.6Continuity. Continuity has a 3-month minimum term from the first billing date. After that it runs month to month. Either of us can end it with 30 days’ written notice. Notice can be given during the minimum term, but Continuity cannot end before the minimum term is complete. Fees for the minimum term and the notice period remain payable, a month that has already been billed is not refunded, and unused fix hours do not roll over.
8.7If we cancel before work starts. We may cancel an engagement before work starts, for example because of a conflict of interest, because we cannot confirm who may authorise the testing, or because we are not available. If we do, we refund everything you paid for that engagement, with no deduction for fees.
8.8If we move a start date. If we need to move an agreed start date before work starts, we tell you as soon as we can and offer the next available date. You can accept it, or cancel for a refund of everything you paid for that engagement.
8.9If we stop after work starts. We may pause or end an engagement if a payment is more than 7 days overdue, if we reasonably believe you do not have the right to authorise the testing or the authorisation is inaccurate, if we are asked to do something unlawful, outside the signed scope or outside a provider’s rules, or if you seriously breach these terms and do not put it right within 7 days of our written notice. In those cases fees paid are not refunded and you pay for the work done to date, which for a Sprint is worked out as in section 8.4. If we end an engagement after work starts for any other reason, we refund the fees you paid for the part of the work we did not deliver.
9. Deliverables and ownership
9.1Reports are shared as a PDF and a private link.
9.2Once you have paid in full, you own the reports and other deliverables we prepared for you. In a Sprint or an Integration, you also own the code changes we delivered into your repository. In an Integration build, you own the code and the data, in your own accounts.
9.3We keep our methods, templates, tools, test libraries and general know-how, including our report format, severity scale and checklists. Where any of these form part of a deliverable, you have a non-exclusive, perpetual, worldwide licence to use them as part of that deliverable for your own business.
9.4Your code, data, prompts and other materials stay yours. You give us permission to access and use them only as needed to carry out the engagement.
9.5Open-source and other third-party components stay under their own licences.
9.6We may reuse anonymised learnings that do not identify you, your app or your users, for example to improve our checklists and test libraries. This never includes your confidential information or exploitable details.
9.7You may share a report with your team, advisers, investors and customers. You must not change a report, quote it in a way that changes its meaning, or present it as a certification or a guarantee.
10. Confidentiality and data
10.1Each of us keeps the other’s confidential information confidential and uses it only for the engagement. This does not apply to information that is already public, that the receiving side already knew or developed independently, or that must be disclosed by law. If the law requires disclosure, the side disclosing tells the other first where the law allows.
10.2We sign a mutual non-disclosure agreement on request. If we sign one, it applies alongside these terms, and it takes priority on confidentiality if the two differ.
10.3Client data stays in your systems. We work through the access you give us and do not export your databases or your users’ records. Nothing is copied into public AI tools. The only material we hold outside your systems is what the work needs: a working copy of your code where you give us one, and evidence such as screenshots and notes that a report needs to show a finding.
10.4Findings are shared only with your named contact.
10.5Case studies are published only with your written consent and are anonymised by default. Exploitable details are never published.
10.6We publish a testimonial only with your consent, in wording you have approved and with the name and attribution you have approved.
10.7Founding clients. If you take the founding price for a Review, you agree to give us a written testimonial within 30 days of receiving the report, and you give us permission to publish an anonymised case study about the Review. The testimonial should reflect your honest experience. The founding price does not depend on it being positive. We send you the case study before it is published so you can check that it does not identify you. If a Review is refunded in full under the useful findings guarantee, these obligations fall away.
10.8We keep reports, and the call recordings, notes and evidence behind them, for 12 months after delivery and then delete them, unless you ask us to delete them sooner or keep them longer. Within 30 days of the end of an engagement we delete any logins, keys and working copies of your code that we still hold.
10.9Walkthrough and handover calls are recorded so that you have a copy. Tell us before a call if you would rather it was not recorded.
10.10The Privacy policy explains how we handle personal data. If you need a data processing agreement for an engagement, tell us before work starts so that we can agree one.
10.11This section continues to apply after an engagement ends.
11. What our work is and is not
11.1We carry out paid work with reasonable skill and care.
11.2Every report is a point-in-time review of what was in scope. It is not a guarantee against future attacks, failures or data loss. Apps change, and new risks appear after a review ends.
11.3We never promise that an app is “secure”, “hack-proof” or “compliant”. A review can only report what we found with the scope, the access and the time agreed. The fact that a report does not list an issue does not mean the issue does not exist.
11.4Our services are not a formal penetration test, a compliance audit or a certification. Nothing we provide is legal, financial or compliance advice. Take advice from a qualified professional where you need it.
11.5A verdict or recommendation in a report is our professional opinion. You decide whether to launch and what to fix. Fix instructions and prompts for AI builders are suggestions. Review and test them before you apply them.
11.6The free 5-minute profile and the other tools on this website are directional only. They are not a test of your app, and they use AI-generated output that can be wrong. Articles, the newsletter, downloads and the sample report are general information. The sample report is fictional.
11.7Apart from what these terms and the signed scope state, and as far as the law allows, we give no other warranties or promises about the services, the website or the free tools.
12. Limits on our liability
12.1Nothing in these terms limits or excludes liability that cannot lawfully be limited or excluded. That includes liability for fraud, for deliberate wrongdoing, and for death or personal injury caused by negligence.
12.2Subject to section 12.1, our total liability for all claims connected with an engagement is limited to the fees you paid for that engagement. For Continuity, the limit is the fees you paid for Continuity in the 3 months before the event that gave rise to the claim.
12.3Subject to section 12.1, we are not liable for indirect or consequential loss, or for lost profits, lost revenue, lost business or goodwill, or lost or corrupted data.
12.4The website, the free tools, the free resources, the newsletter and introductory calls are free and are provided as they are. Subject to section 12.1 and as far as the law allows, we are not liable for loss that comes from using or relying on them.
12.5We are not responsible for the actions of attackers or other third parties, for faults in third-party platforms, or for issues that were outside the signed scope or were introduced after our work ended.
12.6These limits apply whatever the legal basis of the claim, including contract and negligence. Our fixed prices are set on the basis of these limits.
13. Your responsibilities
13.1You remain responsible for your app, your users, your data, your accounts with third-party providers, the decisions you make and the laws that apply to your business.
13.2If you ask us to test a system that you did not have the right to authorise, or the information in your authorisation is untrue, you agree to cover us for the claims, losses and costs that result, including reasonable legal fees. This includes claims made by the owner of that system or by a third-party provider.
13.3We will tell you promptly about any such claim and give you a reasonable opportunity to respond to it.
14. Using the website
14.1When you use this website, you must not:
- use it for anything unlawful or to harm anyone;
- scrape or crawl it in a way that harms the service or places an unreasonable load on it;
- try to break, overload, probe or bypass the security of the site or its tools, or submit content designed to make a tool misbehave;
- submit information about an app or a person that you have no right to share; or
- pretend to be someone else.
14.2If you think you have found a security problem on this website, please email cyprian@topiax.xyz rather than testing further.
14.3The content on this website is owned by Topiax or used with permission. You may link to it and quote short extracts with credit to Topiax. You may not copy or republish it for commercial purposes without our written consent. Free downloads are for your own use.
14.4This website links to other sites and uses embedded third-party services, such as the booking calendar and the email and newsletter providers. We do not control those services. Their own terms and privacy policies apply when you use them.
14.5You can leave the newsletter at any time with the link in any email or on the unsubscribe page.
14.6We may change, suspend or remove any part of the website or the free tools at any time. We do not promise that they will always be available or free of errors.
15. Independent contractor
15.1We work as an independent contractor. Nothing in these terms creates a partnership, an employment relationship or an agency between you and us, and neither of us can bind the other.
15.2We use subcontractors on your engagement only with your written consent. If we do, we remain responsible for their work.
15.3We may work for other clients, including clients in your industry. Our confidentiality duties to you still apply.
16. Events outside our control
16.1Neither of us is in breach of these terms for a delay or failure caused by an event outside our reasonable control. Examples are natural disasters, war, government action, serious illness, and widespread power, internet or third-party platform outages.
16.2The side affected tells the other as soon as it can, and we agree new dates. If the event lasts more than 14 days, either of us may cancel the engagement, and we refund the fees you paid for the part of the work we did not deliver.
16.3This section does not excuse payment for work already delivered. It also does not remove the on-time guarantee: if a Scan, a Review or a Fix Validation is late for a reason on our side, including an event of this kind that affects us, the 25% refund still applies.
17. Changes to these terms
17.1We may update these terms. The date at the top of this page shows when they last changed.
17.2The version in force when an engagement is confirmed applies to that engagement.
17.3For Continuity, we give you at least 30 days’ written notice of updated terms. They apply from the first billing month after that notice. If you give notice to end Continuity under section 8.6 before they take effect, the earlier terms apply until Continuity ends.
17.4For use of the website and the free tools, the version published on this page at the time applies.
18. Governing law and disputes
18.1If you have a complaint or a dispute, please email cyprian@topiax.xyz first and describe the problem. Each of us will try in good faith to resolve it within 30 days before starting court proceedings. This does not stop either of us from asking a court for an urgent order to protect confidential information or intellectual property.
18.2These terms, and any dispute or claim connected with them or with our services, are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-law rules.
18.3The state and federal courts located in Delaware have exclusive jurisdiction over any such dispute or claim, and each of us agrees to the jurisdiction of those courts.
18.4Nothing in these terms removes any mandatory consumer or data-protection rights that you have under the law of the country where you live, including any right that law gives you to bring a claim in your local courts.
19. General
19.1Entire agreement. The signed scope, these terms, the Refund and guarantee policy and any non-disclosure agreement we sign are the whole agreement between us for an engagement. They replace earlier discussions and proposals about it.
19.2Severability. If a court finds part of these terms invalid or unenforceable, the rest continues to apply.
19.3No waiver. If either of us does not enforce a right straight away, that right is not given up.
19.4Assignment. You may not transfer your rights or duties under these terms without our written consent. We may transfer ours to a company that takes over the Topiax business, and we will tell you if we do.
19.5Notices. Notices under these terms are sent by email: to us at cyprian@topiax.xyz, and to you at the email address of your named contact. A notice is treated as received on the next business day after it is sent.
19.6Signatures. The authorisation and any other document may be signed electronically.
19.7Third parties. Only you and we have rights under these terms.
19.8Terms that continue. Sections 9 to 13, 18 and 19 continue to apply after an engagement ends, as does any duty to pay fees already due.
Related documents: Refund and guarantee policy and Privacy policy.