Terms of Engagement.

These Terms of Engagement govern the provision of digital strategy, cyber-defense, and infrastructure services (the "Services") by Fortified.Solutions ("Fortified", "we") to the contracting entity ("the Client"). They take effect on the date the Client executes a statement of work or otherwise instructs Fortified to commence.

Each engagement operates against a fixed technical baseline defined in the applicable statement of work. Any deviation from that baseline is subject to written change control. Fortified does not accept implied scope; all deliverables are those expressly enumerated.

The Client may use the Services only for lawful purposes and in accordance with all applicable regulations. The Client shall not attempt to circumvent security controls, reverse-engineer proprietary methods, or deploy Fortified deliverables outside the authorized environment without prior written consent.

Fortified reserves the right to suspend an engagement where continued operation would compromise the integrity of a shared perimeter, breach a regulatory obligation, or place personnel at risk. Suspension is a containment measure, not a termination.

Client data is processed under a zero-trust doctrine: encrypted in transit (TLS 1.3) and at rest (AES-256), segmented by identity, and retained only for the duration necessary to deliver the Services. Fortified acts as a data processor and does not sell, share, or repurpose Client data.

Processing is aligned with the GDPR and equivalent frameworks. The Client retains ownership of all data supplied. On termination, data is returned or cryptographically destroyed within thirty days, evidenced by a signed certificate of destruction.

Each party shall protect the other's confidential information with no less rigor than it applies to its own, and in no event less than reasonable care. Confidential information includes architectures, credentials, threat intelligence, and the terms of any engagement.

Confidentiality obligations survive termination indefinitely for trade secrets and for five years for all other confidential information. Disclosure compelled by law shall be limited to the minimum required and, where lawful, notified in advance.

Fortified maintains SOC 2 Type II, ISO 27001, and GDPR alignment across every deployment, backed by a tamper-evident, independently audited event ledger. Additional frameworks — FedRAMP, HIPAA, PCI-DSS — are scoped and certified per engagement during the strategic audit.

The Client is responsible for its own regulatory posture outside the boundary of the delivered Services. Fortified will supply audit artifacts and attestation letters on reasonable request.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, or consequential loss. Fortified's aggregate liability arising from an engagement is capped at the fees paid for that engagement in the twelve months preceding the event giving rise to the claim.

Nothing in these terms limits liability for gross negligence, willful misconduct, or any liability that cannot be excluded by law. Uptime, response-time, and reliability figures stated in marketing materials are validated benchmarks, not contractual guarantees unless incorporated into a statement of work.

An engagement continues for the term stated in the statement of work. Either party may terminate for material breach not cured within thirty days of written notice, or immediately where required to contain an active threat.

On termination, Fortified will conduct an orderly handover, transfer knowledge to the Client's nominated custodians, and decommission its access. Accrued fees remain payable; pre-paid fees for undelivered work are refunded pro rata.