Terms & Conditions
Version 2.1 · 9 September 2026
Read these terms before commissioning work. You will receive a personalised Service Agreement and Software Analysis Authorisation to read and accept by email reply or digital signature before payment. The public PDF is a preview, not an order or a signed authorisation.
Download the public agreement preview (PDF)
1. The provider and professional customers
SboxLock is the service name used by a self-employed individual established in Portugal. It is not a separate company. The contracting provider is identified in the personalised agreement supplied before acceptance and issues invoices and receipts in their own name through the Portuguese Tax Authority portal. Contact: contact@sboxlock.com or https://sboxlock.com/contact.html.
We accept commissions from businesses and people acting for their trade or profession, including self-employed developers. We do not offer consumer purchases through this service. A representative must have authority to commission the work for the customer. This description does not remove any mandatory rights that apply to a customer in law.
2. What the service includes
We provide authorised reverse engineering and crack-resistance audits of compiled Windows binaries. A standard audit includes the agreed analysis, a report of the weaknesses demonstrated within scope, how they were reached and their implications, and a working proof of concept for each demonstrated weakness. Another reverse engineering service must have its deliverables specified in the Order Summary.
The fee pays for the agreed work and deliverables, including where no bypass or weakness is found. We do not guarantee a successful crack, a number or severity of findings, discovery of every weakness, or software that cannot be cracked. An audit does not itself modify or harden your released software. Fixes, implementation, retesting and support are included only if expressly agreed. We use reasonable professional care and skill.
3. The agreement before payment
An enquiry is not an order, acceptance of a paid commission or permission to analyse software. After an authorised free first look, we issue a firm quote and a personalised Service Agreement and Software Analysis Authorisation. It contains these versioned terms, the provider and customer details, the exact build, scope, exclusions, deliverables, schedule, total price and payment method.
Review the completed personalised document before paying. Accept either by returning a digitally signed copy or by replying from your agreed customer email with your full name, order reference, agreement version and express acceptance of the terms and software analysis authorisation. An email reply does not require signing or editing the PDF. We verify the reply or signature and your authority, then confirm acceptance in writing. That confirmation forms the contract. Payment alone does not replace the agreement or the required authorisation. Both parties keep a copy; later website changes do not change an existing agreement.
4. Ownership and separate permissions
Before any analysis, including the free first look, we verify ownership or the owner's permission and obtain express written authorisation for identified files and permitted actions. Evidence may include verified company email or domain control, a marked build or equivalent proof. An agent must supply express written owner authorisation. Sending a file alone is not permission to analyse it.
The first-look permission is limited to the agreed scoping activities and does not authorise the full audit. The personalised agreement separately authorises the commissioned analysis, debugging, instrumentation, modification of copies and proof-of-concept development within its scope. Permission to test a binary does not extend to production systems, licensing servers, accounts or third-party infrastructure. Those require separately verified authority and written scope.
5. Materials and changes of scope
Supply the agreed unsigned Windows build and the dependencies it needs to run, without a licence key or activation, plus the linker .map for that exact build. Source code is not required for the audit; any extract offered solely to prove ownership is optional. Keep your own backups. Identify restrictions, sensitive data and any network behaviour before analysis.
We work on copies in the agreed environment. Changed builds, extra targets or additional work require written agreement on scope, price and timing. If materials are missing or authority is uncertain, we pause and explain what is needed. We do not infer permission or impose automatic additional charges.
6. Quotes and full advance payment
The initial look and quotation are free and impose no obligation to buy. Quotes are in euros and valid for 30 days unless the quote says otherwise. The agreed fee is paid in full before commissioned work begins. We do not start on a deposit or promise of later payment. Receipt of money is confirmed in our own account or wallet.
After we confirm the accepted agreement, we send the invoice and private payment instructions. We accept bank transfer or Bitcoin, Ethereum or Algorand, as agreed for the order. We do not accept cards or PayPal. For cryptocurrency, the instructions specify the asset, network, destination, amount, quote expiry and required confirmations. Do not pay using an expired quote or a different network.
7. Invoices and tax
The provider issues the appropriate invoice, receipt or invoice-receipt through the Portuguese Tax Authority portal using their personal NIF. The provider currently operates under a VAT exemption; no VAT is charged on services covered by it. The invoice states the applicable legal basis. Cross-border treatment depends on the transaction and customer, not simply whether an address is inside or outside the EU.
The Order Summary states the total payable and tax treatment before acceptance. No tax surcharge is added after acceptance. Any legally required refund follows the applicable rules; where a cryptocurrency refund is due, its amount and method are agreed in writing without reducing the customer's mandatory entitlement.
8. Delivery and completion
We provide the report and agreed proof-of-concept materials by the secure delivery method in the Order Summary. Completion requires all agreed work and deliverables to have been performed and provided. An incomplete report is not full performance. Tell us if you cannot access a delivery so we can arrange it again.
The report describes the supplied build and the conditions and period assessed. You receive the benefit of work that cannot be undone; choosing not to use a properly delivered report does not itself create a refund right. Any agreed follow-up obligations remain due after delivery.
9. Cancellation and refunds
Subject to mandatory law, we do not offer discretionary refunds for a change of mind, non-use of the report, disappointment with the findings where the work was performed as agreed, or later cracking of the software. This policy does not excuse failure to perform the contract or remove legally required remedies.
If we cannot provide the agreed service, we refund the amount for unperformed work, or a greater or full amount where legally required. If you request cancellation or withdraw authority during the job, we stop the affected work and confirm the position on completed work, remaining obligations and any refund due under the contract and applicable law. Payment method does not remove legal rights.
10. Service problems and disputes
Contact contact@sboxlock.com with your order reference and the issue if the service does not match the agreement. We investigate and provide any correction, repeat performance, price reduction, refund or other remedy required by applicable law. No findings, by itself, does not establish defective performance.
We may use accurate agreement, authorisation, performance and delivery records to respond to a dispute. These terms do not waive valid bank or payment-provider rights, and no payment method or accepted agreement guarantees that a payment can never be reversed.
11. Confidentiality and local analysis
We treat non-public binaries, materials, findings and customer identities as confidential. Only people authorised for the project may access them for the work, subject to confidentiality duties. The contracting provider remains responsible for the commissioned service. We do not publish customer or product names, reports or case studies without written permission. An NDA may be agreed before files are shared.
Your binary and code are not uploaded to cloud AI services. AI used on them runs locally on our own machines; we remain responsible for the findings. Files are transferred only through the agreed channel. Avoid sending unnecessary personal or production data. Any required data processing agreement must be in place before access.
12. Retention and deletion
We retain working copies of binaries only while needed for the agreed work and any agreed follow-up, and delete them when that purpose ends or on request. A deletion request during a job may prevent its completion; we will explain this before continuing.
Necessary invoices, accepted agreements and acceptance emails, authority checks, communications and evidence may be retained for applicable legal obligations and the establishment, exercise or defence of claims. These records are not automatically deleted with the binary. The privacy notice explains the purposes, recipients and retention criteria.
13. Use of deliverables and intellectual property
You retain rights in your software. You may use the paid-for report and proof-of-concept materials to assess and improve it, and share them with people authorised to assist you. You must not use them against software or systems you are not authorised to test. We retain our pre-existing tools, methods and general know-how, without disclosing your confidential information.
14. Responsibility and mandatory rights
We do not warrant that your software is secure, uncrackable or suitable for a particular purpose merely because it has been audited. You decide whether and how to implement changes, subject to any implementation work expressly included in the contract. This does not exclude our responsibility for performing the agreed service with reasonable care and skill.
Nothing here excludes liability or remedies that cannot lawfully be excluded. If mandatory consumer protections apply despite the intended professional scope, they prevail; a declaration of business use does not remove them.
15. Law and versions
Portuguese law governs the agreement, subject to mandatory protections and jurisdiction rules. The version incorporated into the accepted agreement applies to that commission. We may update the public terms for future jobs, but changes to an existing commission require written agreement. If an individually agreed Order Summary varies a service detail, that specific variation applies, subject to mandatory law.
See payment arrangements and our privacy notice. Questions can be sent to contact@sboxlock.com.