General Terms and Conditions
RFI-IRFOS · Last updated: July 2026
Thirteen sections, no filler clause, nothing in here that exists only to look thorough. If a paragraph below feels short, that's because the short version was the accurate one.
1. Scope — B2B Only
These Terms apply to all services provided by RFI-IRFOS (ZVR 1015608684, Elisabethinergasse 25/10, 8020 Graz) — in particular security audits, software development, and research services.
This offer is directed exclusively at business entities within the meaning of § 1(2) of the Austrian Consumer Protection Act (KSchG). Contracts with consumers within the meaning of the KSchG are excluded. By placing an order, the client confirms that they are acting within the scope of their commercial or professional activity.
2. Service Delivery
Scope and terms are agreed in writing, per engagement, before work starts. Website descriptions and price listings on this site are indicative and do not constitute binding offers, actual scope is confirmed in writing with each client.
3. Pricing & Payment
Prices are in Euro, plus statutory VAT. Payment is made in full, upfront, before work begins — exclusively via the payment methods offered on the website (Stripe).
Service delivery begins immediately upon receipt of payment. The client expressly consents to this immediate commencement. Accordingly, no right of withdrawal exists (§ 18(1)(1) of the Austrian Distance and Off-Premises Contracts Act, FAGG). Cancellation or refund is excluded once payment has been received.
4. Confidentiality & NDA
Security audit findings are subject to strict confidentiality until coordinated disclosure (90-day embargo, ISO/IEC 29147). Regulatory authorities are notified independently of NDA status, in fulfillment of our statutory reporting obligations. Our NDA covers the client's confidential material; it does not, and cannot, cover findings we are legally obliged to report to a supervisory authority.
5. Liability
Liability is limited to intent and gross negligence. Maximum liability: the invoice value of the respective service. Consequential damages are excluded to the extent permitted by law.
6. No Warranty of Completeness (Security Research)
Security and privacy assessments reflect the state of the audited system at the time of testing, within the depth of access and duration of the engagement. RFI-IRFOS does not warrant that all vulnerabilities have been identified. Anyone who tells you a security assessment is exhaustive is selling you something, and this is us saying so about our own reports too.
7. Intellectual Property
Reports, source code, and research output remain the property of RFI-IRFOS until payment is received in full. Upon receipt of payment, the client receives the agreed usage rights.
8. Communication
All engagement-related communication is conducted in writing (email), for the audit trail this creates on both sides. We do not offer or conduct calls or in-person meetings as part of our research or disclosure process.
9. Force Majeure
Neither party is liable for delay or failure to perform caused by circumstances beyond its reasonable control, provided the affected party notifies the other without undue delay.
10. Governing Law & Jurisdiction
Austrian law applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). Place of jurisdiction: Graz, Austria.
11. Online Dispute Resolution (ODR)
EU platform for online dispute resolution: ec.europa.eu/consumers/odr.
As we contract exclusively with businesses, we are not obligated to participate in consumer arbitration proceedings.
12. Severability
Should any provision of these Terms be or become invalid, the validity of the remaining provisions shall remain unaffected.
13. Contact
14. Use of Revenue
100% of surplus revenue is reinvested into open science, public research, and infrastructure. Zero goes to shareholders — we have none. RFI-IRFOS is a regulated not-for-profit (ZVR 1015608684). Every euro above operating costs funds the next audit, the next model training run, or the next research publication. That is not a marketing line. It is a legal obligation.
