Website terms, plus the default commercial terms for engagements. Written in plain language because terms nobody reads protect nobody.
Last updated
These terms govern your use of cymbiote.com. They also set out the default commercial terms that apply to engagements with Cymbiote Technologies where no signed master services agreement is in place.
Where a signed agreement exists, it takes precedence over anything on this page. Nothing here overrides a negotiated contract.
You may read, share and quote this site freely, with attribution. You may not:
Security researchers are welcome. Report findings to security@cymbiote.com; we will not pursue legal action against good-faith research that does not access other people's data or degrade service.
The Cymbiote name, logo and visual identity are our trademarks. Written content on this site is licensed for reading and quotation with attribution, not for wholesale republication.
You own everything we build for you, in full, from the first commit. Work is performed in your repositories under your licence. We assign all right, title and interest in deliverables to you on creation, not on final payment.
Two carve-outs, both standard: we retain ownership of pre-existing tools and libraries we bring to the engagement, licensed to you perpetually and royalty-free for use with the deliverables; and we retain the general skills and knowledge our people acquire, which cannot meaningfully be assigned.
We will not name you as a client, use your logo or describe your project publicly without your written permission.
Discovery sprints are fixed price, invoiced 50% at start and 50% on delivery. Squad and programme engagements are invoiced monthly in advance. Retainers are invoiced monthly in advance. Payment terms are 30 days net.
Rates are fixed for the duration of an engagement. We do not apply mid-contract increases.
Squad engagements are capacity-based rather than scope-based, so priority changes cost nothing and require no change order. Where scope is genuinely fixed, changes are agreed in writing with their cost and schedule impact before work begins.
Either party may terminate a squad or retainer engagement on 30 days' written notice, with no termination penalty. You pay for work performed to the end of the notice period. Handover — documentation, runbooks and a pairing period — is contractual and is delivered regardless of the reason for termination.
We treat everything we learn about your business as confidential, indefinitely, whether or not a separate NDA is in place. Our staff are bound by equivalent obligations in their employment contracts.
The usual exceptions apply: information already public, independently developed, or required to be disclosed by law. Where we can lawfully tell you before making a compelled disclosure, we will.
We warrant that work will be performed with the reasonable skill and care of a competent professional in our field, and that deliverables will materially conform to the agreed specification for 90 days after acceptance. Defects reported in that window are corrected at our cost.
This website is provided as-is. Content is offered in good faith and is not professional advice for your specific situation.
For engagements, our aggregate liability is capped at the fees paid in the twelve months preceding the claim. Neither party is liable for indirect or consequential loss, including lost profits or data. Nothing limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.
We carry professional indemnity and cyber liability insurance; certificates on request.
Where we process personal data on your behalf, we do so as a processor under a data processing agreement, which we will sign before any such processing begins.
We work against anonymised or synthetic data by default. Production data access, where genuinely required, is time-boxed, logged, approved by you per instance, and never copied to local machines.
Our handling of personal data as a controller is described in our Privacy Policy.
These terms are governed by the laws of the State of California, and the courts of San Francisco County have exclusive jurisdiction. Engagements contracted through our UK or Singapore entities are governed by the law of England and Wales, or of Singapore, respectively.
Before litigation, both parties agree to attempt resolution through a good-faith conversation between senior representatives. In nine years this has been necessary once and successful once.
Questions about these terms: legal@cymbiote.com.
Cymbiote Technologies
500 Howard Street, Suite 900
San Francisco, CA 94105
United States