1. About this notice
This notice applies to services and research conducted under the names Caesar Data, Inc. and Caesar Data Inc (NUF) (“Caesar Data”, “we”, “us” or “our”).
We provide security scanning and reporting services for businesses, focusing on publicly accessible digital assets, including websites, APIs and other agreed internet-facing systems. We also undertake independent security research, including research conducted under bug bounty and vulnerability disclosure programmes.
This notice explains the scope and limitations of those activities. It does not override express contractual commitments or rights and obligations that apply by law.
2. Scope of our scanning services
Our assessments examine the assets and interfaces included in the relevant assessment scope, using the access, information and testing methods available for that assessment.
An external scan does not necessarily examine underlying source code, internal networks, authenticated functionality, private infrastructure, business processes or systems that are inaccessible from the public internet. Those activities are included only where expressly agreed.
A report is limited to the assets, methods and conditions assessed. It should not be interpreted as a complete audit of an organisation, its suppliers or its security controls.
3. Use and limitations of artificial intelligence
We use artificial intelligence and automated analysis to assist with identifying, analysing, prioritising or explaining potential security issues.
AI-assisted outputs may be inaccurate, incomplete or inconsistent. They may produce false positives, where an issue is reported that does not exist, or false negatives, where an existing issue is not detected. Descriptions, technical explanations, severity ratings and remediation suggestions may also contain errors.
An output’s level of detail or apparent confidence does not establish its accuracy. Findings should be evaluated against supporting evidence and the circumstances of the affected system.
Human review is included to the extent specified in the applicable service description or agreement. The use of AI does not reduce any contractual or legal standard of care that applies to our services.
4. Timing, coverage and asset attribution
Reports reflect the conditions observed during the assessment period. Websites, APIs, infrastructure, configurations and threats can change, and previously identified issues may be resolved, altered or replaced by new issues.
Coverage may be affected by factors such as access restrictions, unavailable endpoints, rate limits, defensive controls, third-party infrastructure and incomplete information.
Public technical information may not conclusively establish an asset’s ownership or operational responsibility. Shared infrastructure, hosting arrangements and third-party services can create uncertainty about which organisation controls a particular asset or component. Any such association should be checked before action is taken.
Occasional or repeated scans do not constitute continuous monitoring, ongoing incident detection or a commitment to update earlier reports unless expressly agreed.
5. Meaning of findings and security ratings
A reported issue may indicate a potential vulnerability or exposure requiring further investigation. Unless expressly confirmed in the report, it does not establish that the issue has been exploited, that data has been accessed, or that a security incident has occurred.
Severity ratings and priorities reflect the information and assessment methods available to us. Actual risk may differ according to business context, compensating controls, data sensitivity, exploitability and other circumstances.
The absence of a finding does not establish that an asset is secure or that no compromise has occurred. Addressing every reported issue does not establish that all security risks have been eliminated.
6. No guarantee of security or compliance
Our services support security risk management but cannot guarantee the detection or prevention of every vulnerability, attack, breach, service interruption or loss.
A scan or report does not, by itself, establish compliance with any law, regulation, contractual requirement, security framework or certification scheme.
Unless expressly included in the engagement, our services do not constitute a formal compliance audit, certification, legal opinion, incident investigation or comprehensive penetration test. References to standards or frameworks do not imply approval, accreditation or endorsement.
7. Reviewing and acting on reports
Findings and recommendations should be reviewed by appropriately qualified personnel with knowledge of the affected systems and business operations.
Before implementing a recommendation, you should validate the relevant finding, assess dependencies and potential operational effects, and follow appropriate testing, backup and change-control procedures. Suggested code, commands or configuration changes should be checked before use in production.
Unless the applicable agreement assigns these responsibilities to us, you remain responsible for remediation decisions and the operation of your systems. This does not transfer or exclude responsibilities that remain ours under contract or law.
8. Customer-requested assessments and authorisation
For an assessment you commission, you must have authority to permit the agreed testing of the relevant assets and must provide accurate information about the authorised scope.
Your authority over a website, domain, application or account may not extend to underlying cloud infrastructure, shared hosting, supplier systems or other third-party services. Any necessary third-party permissions must be obtained before testing that requires them.
Customer-requested testing must remain within the agreed scope and applicable permissions. Commissioning a report does not authorise access to unrelated systems or permit activities prohibited by applicable law.
9. Independent research and responsible disclosure
We may identify and report suspected vulnerabilities through independent security research, including participation in bug bounty and vulnerability disclosure programmes.
Where research is conducted under a programme or published policy, the applicable asset scope, permitted methods, testing restrictions and reporting requirements govern our participation. Any authorisation is limited to what the relevant system owner or authorised programme actually permits.
Public accessibility alone does not establish permission for security testing. Responsible disclosure does not itself grant permission or retrospectively authorise testing. This notice does not grant us or anyone else authorisation to access or test a third party’s systems.
When reporting findings from independent research, we follow applicable bug bounty or vulnerability disclosure requirements and use the designated reporting channel where available. Any further disclosure is subject to applicable programme terms, confidentiality obligations and law.
Receiving an unsolicited research notification or report does not, by itself, create a customer relationship, an obligation to purchase services or a payment obligation. Silence or receipt of a report does not constitute consent to further testing.
10. Operational effects and third-party dependencies
Depending on the methods used, scanning may generate requests, trigger security alerts or defensive controls, consume resources, or affect system performance and availability.
For commissioned assessments, relevant operational restrictions and known sensitivities should be communicated before testing. We remain responsible for observing the agreed testing restrictions and applicable law.
Our assessments may depend on third-party software, AI models, vulnerability information or other external services. Errors, changes, delays or outages affecting those dependencies may affect coverage or findings. Their use does not remove responsibilities that remain ours under the applicable agreement or law.
11. Reports and confidentiality
Reports may contain sensitive technical information. Recipients should restrict access appropriately and consider the security consequences of sharing detailed findings or reproduction instructions.
Where reports are shared with third parties, they should retain their assessment date, scope, qualifications and limitations. Sharing a report does not extend the assessment to additional assets or turn it into a certification or guarantee.
Nothing in this notice overrides applicable confidentiality commitments or authorises the reuse of confidential information for AI model training.
12. Contractual commitments and liability
The warranties, service commitments, remedies and any limitations of liability applicable to commissioned services are those contained in the applicable agreement and required by law.
This notice does not create a separate financial liability cap or remove an express contractual commitment. Our explanations of technical limitations do not excuse a failure to meet an applicable contractual obligation or legal standard of care.
Nothing in this notice excludes or restricts liability for fraud or fraudulent misrepresentation, death or personal injury caused by negligence, or any other liability that cannot lawfully be excluded or restricted. Rights and remedies that applicable law makes mandatory remain unaffected.
13. United States, United Kingdom and Norway
United States: Applicable federal and state rights and remedies remain unaffected. Any contractual warranty exclusion or limitation of liability applies only to the extent permitted by the law governing the relevant matter.
United Kingdom: Any applicable exclusion or limitation remains subject to statutory requirements, including relevant reasonableness and fairness requirements. Where consumer protections apply, this notice does not remove statutory rights concerning reasonable care and skill or conformity with the description of the service.
Norway: Mandatory rights under Norwegian law remain unaffected, including applicable rules concerning unreasonable contract terms. Where consumer legislation applies, including the Norwegian Digital Services Act where relevant, rights and remedies that cannot lawfully be limited remain available.
The location of our business or the choice of law in a service agreement does not, by itself, remove mandatory protections that otherwise apply. Where mandatory law conflicts with this notice, that law takes precedence.
