Terms of service
The complete rules of the road for working with Patchwise. Plain-English, not legalese.
Last updated: October 28, 2026
Please read carefully before purchasing
1. Agreement to terms
By accessing or using Patchwise ("we", "us", "our"), you ("you", "the customer", "the client") agree to be bound by these Terms of Service, our Privacy Policy, our Refund Policy, and our Acceptable Use Policy — all of which are incorporated by reference. If you do not agree to all of these terms, do not use our services or submit an order. These terms apply to all packages, quotes, scans, tickets, and interactions with our team. Placing an order, checking the agreement box at checkout, or allowing an engineer to begin work constitutes your explicit acceptance of every section below.
2. Scope of service
We audit, patch, and harden PHP on your server after security releases. The exact scope is defined in the package you purchase or the custom quote we agree in writing. We do not guarantee any site is "100% secure" — security is an ongoing process, not a one-time state. Our work covers the PHP runtime, associated configuration, and the specific items listed in your package or quote. Work outside that scope requires a separate agreement. We do not guarantee uptime, performance improvements, or compatibility with third-party plugins, themes, or custom code we did not write or modify.
3. Access method and credentials
We never ask for passwords by plain email or chat. You must send access securely — a password-manager share link, a temporary credential you rotate after we finish, or through the Secure access ticket category. You are responsible for revoking access after work is completed and for rotating any credentials you shared with us. We are not liable for unauthorized access, data breaches, or compromise resulting from credentials you fail to rotate, credentials you shared through insecure channels, or credentials you shared with parties outside our team.
4. Backup responsibility — critical
You acknowledge and agree that maintaining a complete, tested, and independently stored backup of your website, database, files, and server configuration is your sole and exclusive responsibility. We take a safety backup before making changes, but our backup is a temporary courtesy and is NOT a substitute for your own backup strategy. You must not rely solely on our backups before, during, or after the work is complete. You must verify that your own backups are restorable before granting us access. We are not liable for any data loss, corruption, or inability to restore if you have not maintained your own independent, tested backups. By proceeding with any service, you confirm that you have taken a full backup of your site and data before granting us access.
5. No responsibility for data loss, damage, or sensitive information
You acknowledge that server patching, PHP updates, and security hardening involve making changes to a live production environment, which carries inherent risk. While we take every reasonable precaution, we are NOT responsible or liable for any data loss, data corruption, file damage, database damage, service interruption, downtime, loss of revenue, loss of customers, loss of business opportunities, or any other damages — direct, indirect, incidental, consequential, or otherwise — that may result from our work or from any issue discovered or triggered during the patching process. You are solely responsible for ensuring that no sensitive, regulated, or irreplaceable data exists on the server without an independent backup. We are not liable for exposure, loss, or compromise of sensitive information (including but not limited to customer data, payment data, personally identifiable information, API keys, or credentials) that is stored on the server we are granted access to. By granting us access, you confirm that you have assessed the risk and accept full responsibility for any outcome related to data or sensitive information on the server.
6. External scans and consent
We run passive external scans only after the site owner or an authorized person gives written consent. We do not guess paths, scan ports, or probe for exploits without explicit authorization. By submitting a scan request, you confirm you own or are authorized to authorize scanning of the target site. Scan results are point-in-time snapshots and may not reflect the current state of the site at the time you read the report.
7. Payment terms
All prices are listed in US Dollars (USD) and are charged at the time of order confirmation unless otherwise stated in a custom quote. We currently accept PayPal and invoice-based payment. Payment must be received in full before work begins — no work will commence on an unpaid order. For enterprise and custom quotes, a 50% deposit may be required, with the balance due upon delivery. Invoices are issued through the finance system and are due within 7 days unless otherwise agreed. Late payments may pause active work until the balance is cleared. Orders placed via "pay by invoice" are held in pending status and will not be started until the invoice is paid.
8. Refund policy — non-refundable service
Due to the nature of our service — which involves immediate engineer allocation, server access, auditing, and hands-on patching — all sales are final. This service is non-refundable. No refunds are issued after an engineer has started work on your order. If we have not started work and you request a cancellation within 24 hours of payment, we will issue a full refund. No refund is available under any circumstances after work has begun, including if you are dissatisfied with the results, if the work reveals additional issues, or if you change your mind. If we fail to deliver the agreed scope through our own fault, we will work to remedy the issue or refund the undelivered portion at our sole discretion. See our full Refund Policy page for complete details. By placing an order, you explicitly acknowledge and accept that this service is non-refundable once work begins.
9. Service-level agreement (SLA)
First response time depends on your package: 48 hours for Verify & Check and Rapid Patch, 24 hours for Secure & Protect and Total Shield, and same-day start for Enterprise Response. "First response" means a named engineer acknowledges your case and confirms access is received. Delivery times listed on package pages are estimates, not guarantees, and may vary based on site complexity, access quality, and response times from your hosting provider. Care plans include priority support with a 24-hour first-response target during business days. See our SLA page for full details.
10. Acceptable use
You agree not to use our services for any unlawful purpose, including but not limited to: requesting scans of sites you do not own or are not authorized to test, using our reports to harm or exploit third parties, attempting to use our infrastructure to attack other systems, or misrepresenting our findings. Violation of these terms may result in immediate termination of service without refund. See our Acceptable Use Policy for full details.
11. Intellectual property
All reports, findings, and deliverables are provided to you for your internal use only. You may not resell, redistribute, or publicly publish our reports without written consent. We retain ownership of our methodologies, tools, and internal processes. Content on our website (articles, guides, blog posts) is licensed under a Creative Commons Attribution-NonCommercial license unless otherwise noted.
12. Confidentiality
We treat all information you share — including site URLs, credentials, scan results, and business details — as confidential. We do not share your data with third parties except as required by law or as described in our Privacy Policy. Our team members are bound by confidentiality obligations. However, we are not liable for confidentiality breaches that result from your own insecure sharing of credentials or data through channels outside our designated secure-access system.
13. Limitation of liability — comprehensive waiver
To the maximum extent permitted by law, our total liability for any and all claims arising from or related to our services is limited to the fees you paid for the specific package or service that gave rise to the claim. Under no circumstances are we liable for: (a) data loss, data corruption, or file damage of any kind; (b) loss of revenue, profits, business, customers, or business opportunities; (c) downtime, service interruption, or website unavailability; (d) loss or compromise of sensitive, personal, or regulated data stored on your server; (e) indirect, incidental, special, consequential, or punitive damages; (f) issues caused by third-party hosting providers, plugins, themes, or code we did not write or modify; (g) any damages resulting from your failure to maintain independent backups or to rotate credentials after work is completed. This limitation of liability applies regardless of whether the liability is based on contract, tort (including negligence), strict liability, or any other legal theory, and even if we have been advised of the possibility of such damages. You acknowledge that the fees charged reflect this limitation of liability and that the service would be significantly more expensive without it.
14. No warranties
Our services are provided "as is" and "as available" without warranties of any kind, whether express, implied, or statutory. We do not warrant that our services will be error-free, uninterrupted, secure, or that they will meet your specific requirements. We do not warrant that patching will resolve all security vulnerabilities or prevent all future attacks. We disclaim all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement. No advice or information provided by our team creates a warranty not expressly stated in these terms.
15. Indemnification
You agree to indemnify and hold us harmless from any claims, damages, losses, or expenses (including legal fees) arising from your use of our services, your violation of these terms, your failure to maintain backups or rotate credentials, your infringement of any third-party rights, or any claim that your use of our services caused damage to a third party.
16. Termination
We may terminate or suspend service if you breach these terms, fail to pay, or engage in conduct we believe harmful to us, our team, or other customers. Upon termination, any prepaid fees for undelivered work may be refunded at our sole discretion. You may terminate a care plan at any time with 30 days notice; prepaid monthly fees are non-refundable for the current billing period.
17. Changes to terms
We may update these terms at any time. Material changes will be notified by email to active customers at least 14 days before they take effect. Continued use of our services after changes take effect constitutes acceptance of the updated terms. The date of last update is shown at the top of this page.
18. Governing law
These terms are governed by the laws of the jurisdiction in which Patchwise is registered. Any disputes will be resolved in the courts of that jurisdiction, unless we agree in writing to alternative dispute resolution.
19. Contact
For questions about these terms, email us at the address listed on our contact page. We aim to respond within one business day.