Legal
These terms apply when you use the ZebraZones website, its repository estimator, or order a security audit from Caesar Cipher Advanced Research OÜ.
ZebraZones is operated by Caesar Cipher Advanced Research OÜ, registry code 17405528, Estonian Commercial Register, VAT number EE102940741, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia.
Email: legal@zebrazones.com
The estimator is free. It reads the repository you submit, identifies the kind of application, and gives a price estimate for an audit. The estimate is automated and may be wrong; the price that applies is the one in the payment link we send you.
Only submit a repository that you own or are authorized to share with us, and that contains no personal data (see section 4).
An audit is a time-boxed, 48-hour security review of the source code in the repository you name. Our auditors focus on the highest-risk areas of the codebase and use automated and AI-assisted tools to support their work.
You receive a written report that lists each issue we find, where it is, how to reproduce it, and how to fix it. After you fix the findings, we retest them once at no extra cost if you ask within 30 days of receiving the report.
Unless we agree otherwise in writing, an audit does not include testing live systems, infrastructure, or third-party services, and it does not include changing your code.
When you submit a repository or order an audit, you confirm that:
Audits cost $99, $199 or $499 depending on the size of the codebase. All prices include VAT where it applies. The exact price is stated in the payment link. Payment is made in advance through our payment provider.
The 48 hours start once we have received payment and have access to the repository. Delays caused by missing access or information do not count toward the 48 hours.
If we find after payment that we cannot audit the repository, for example because the stack is not supported, we refund the full amount.
If you order as a consumer, meaning for purposes outside your trade, business, or profession, you may withdraw from the contract within 14 days without giving a reason by emailing legal@zebrazones.com.
If you ask us to start the audit before the 14 days end, you pay for the work done up to your withdrawal. Once the audit has been fully performed at your express request, and you have acknowledged that you lose the right of withdrawal at that point, the right of withdrawal no longer applies.
We keep your code, our findings, and the report confidential. We use your code only to produce the estimate and perform the audit, and share it only with service providers we need for that work, such as hosting and inference providers, under appropriate confidentiality obligations.
The report is yours to use as you wish. How long we keep your code and when we stop using repository access is described in our Privacy Policy.
An audit finds what a competent reviewer can find in the available time. We do not guarantee that we will find every vulnerability, or that your application is secure after the audit or after you apply our recommendations.
Our total liability for an audit is limited to the amount you paid for it. We are not liable for indirect or consequential losses, such as lost profits, lost data, or business interruption. These limits do not apply to liability for intent or gross negligence, or to any liability that cannot be limited under applicable law, including mandatory consumer rights.
These terms are governed by the laws of Estonia. Disputes are resolved by the Harju County Court in Tallinn. If you are a consumer, you keep the protection of the mandatory laws of your country of residence and may bring proceedings there.
We may update these terms. The version that applies to an audit is the one in force when you ordered it.
Last updated: September 28, 2026.