Terms & Conditions
for Meridian Cyber
Operative Provisions
These Terms & Conditions apply to every engagement between Meridian Cyber and a Client, and to any person who accesses or uses meridiancyber.io. By engaging Meridian Cyber, or by accessing the Site, you agree to be bound by these Terms & Conditions, together with the applicable proposal and Schedule for your engagement.
1. Definitions and Interpretation
1.1 Definitions
The following definitions apply to these Terms & Conditions and to each engagement between Meridian Cyber and a Client, unless the context requires otherwise.
Assets means the applications, cloud environments, servers, networks or other systems described in the Schedule as being in scope for an engagement.
Client means the person or entity named in the Schedule to whom Services are provided. Where an engagement is an Intermediary Engagement, the End Client is not the Client.
Commencement Date means the date on which an engagement begins, as set out in the Schedule or proposal.
Completion Date means the date on which an engagement is scheduled to conclude, as set out in the Schedule or proposal.
Confidential Information means the terms of an engagement, any Report, and any information disclosed by either party that is marked confidential or that a reasonable person would understand to be confidential, but excludes information that is or becomes public other than through a breach of these Terms & Conditions.
Deliverables means the Report, findings, recommendations or other materials Meridian Cyber agrees to provide as part of an engagement.
End Client means, in an Intermediary Engagement, the organisation that ultimately receives the benefit of the Services.
Engagement means the provision of Services by Meridian Cyber to a Client under a proposal and these Terms & Conditions.
Fees means the amounts payable by the Client for an engagement, as set out in the proposal or Schedule.
Force Majeure Event means an event beyond a party’s reasonable control, including natural disaster, war, civil unrest, industrial action, or failure of public infrastructure.
Intermediary Engagement means an engagement where Meridian Cyber is engaged by a Client on behalf of an End Client.
Meridian Cyber, we, us and our means Meridian Cyber and its related entities.
Personal Information has the meaning given in the Privacy Act.
Personnel means the employees, contractors and Subcontractors engaged by Meridian Cyber to deliver the Services.
Privacy Act means the Privacy Act 1988 (Cth).
Proposal means the document setting out the scope, Fees and other terms of a specific engagement.
Report means the written output of an engagement provided to the Client, including findings and recommendations.
Schedule means the schedule to a proposal setting out the Assets, Commencement Date, Completion Date and other engagement-specific details.
Services means the cyber security services described on the Site or in a proposal, which may include threat intelligence, governance, risk and compliance, AI security, third-party risk, automation, gaining efficiency advisory and quantum readiness advisory, and any other services agreed in a Proposal.
Site means the website located at meridiancyber.io.
Subcontractor means a third party engaged by Meridian Cyber to assist in delivering the Services.
Vulnerability means a weakness or control gap in an Asset, process or third-party arrangement, identified during an engagement, that could reasonably increase the Client’s exposure to a cyber security risk.
You and your means the Client, or any individual accessing the Site.
2. Services
(a) Meridian Cyber will provide the Services described in the applicable proposal, exercising the degree of care and skill expected of a competent cyber security provider.
(b) The scope of the Services, including the Assets to be reviewed or assessed, is set out in the Schedule. Meridian Cyber is not responsible for Assets outside that scope.
(c) Meridian Cyber may recommend changes to the scope of the Services once an engagement is underway. Any change to scope, timing or Fees must be agreed by both parties in writing before it takes effect.
(d) Meridian Cyber will provide a Report at the conclusion of an engagement, setting out its findings and recommendations, within the timeframe agreed in the proposal.
3. Location of Services
The Services are generally delivered remotely from Australia. Where an engagement requires Meridian Cyber’s Personnel to attend the Client’s premises, this will be agreed in the proposal.
4. Fees
4.1 Payment of Fees
(a) The Client will pay the Fees to Meridian Cyber in consideration for the Services described in the proposal.
(b) Where Meridian Cyber charges on an hourly basis, time spent of less than one hour is charged pro rata, rounded up to the nearest 6-minute increment.
(c) The Fees are exclusive of GST. Where GST applies to a supply made under these Terms & Conditions, Meridian Cyber will add GST to the Fees payable.
(d) Unless the proposal states otherwise, the Client will pay a deposit of 50% of the agreed Fees prior to the Commencement Date, with the balance payable within 14 days of delivery of the final Report or Deliverable.
4.2 Invoicing
(a) Meridian Cyber will issue a tax invoice for the Fees in accordance with GST law.
(b) The Client must pay all amounts on a tax invoice within 14 days of the invoice date, and prior to the Commencement Date in the case of a deposit invoice.
(c) The Client must quote the relevant reference and invoice number when making payment.
(d) Each invoice will set out Meridian Cyber’s ABN, the date the Services were provided, a description of the Services, and, where fees are charged hourly, the time recorded against each task.
4.3 Costs and Disbursements
Meridian Cyber may charge for reasonable out-of-pocket expenses actually incurred in delivering the Services, such as travel, data storage media and courier costs. Meridian Cyber will notify the Client in advance of any disbursement of a material amount, unless otherwise agreed in writing.
4.4 Failure to Pay
If the Client does not pay a tax invoice by its due date, Meridian Cyber may, at its discretion:
- charge interest on the overdue amount at a rate of 10% per year, accruing daily;
- require the Client to pay in advance for any part of the Services not yet performed; or
- suspend delivery of the Services until payment is received in full.
4.5 Project Variation
(a) Meridian Cyber estimates the time and Fees required for an engagement in good faith. The Client acknowledges that delays, complications or changes in scope that are outside Meridian Cyber’s control may affect the duration of an engagement and may increase the Fees.
(b) Circumstances that may affect Fees or timing include, without limitation, where the Client delays the agreed Commencement Date, fails to provide the access, credentials or environment needed for Meridian Cyber to begin or continue work, provides incomplete, inaccurate or misleading information relevant to the engagement, or requests an increase in scope requiring additional time, personnel or resources.
(c) Where any of the above circumstances arise, Meridian Cyber will notify the Client as soon as reasonably possible and the Client agrees to pay any resulting variation to the Fees, calculated at Meridian Cyber’s standard rates.
4.6 Cancellation and Client Delays
(a) The Client may cancel a scheduled engagement by giving at least 60 days’ written notice, in which case the Client must pay 50% of the agreed Fees, together with the cost of any Services already performed and any non-cancellable commitments reasonably incurred by Meridian Cyber.
(b) Where the Client cancels with less than 60 days’ notice and the Personnel allocated to the engagement cannot reasonably be reassigned to other work of comparable value, the Client must pay 100% of the agreed Fees, together with the cost of any Services already performed.
(c) A Client delay, or a failure to provide timely access, that prevents Meridian Cyber from delivering the Services as scheduled is treated as a cancellation for the purposes of this clause, unless the parties agree otherwise in writing.
4.7 Payment Security
Where Meridian Cyber reasonably considers it necessary, it may require the Client to pay a security deposit, or to pay some or all of the Fees in advance, before commencing or continuing an engagement. If the Client does not provide that security within a reasonable time of being asked, Meridian Cyber may decline to commence, or may suspend, the relevant Services, and this will not constitute a breach of these Terms & Conditions. Any deposit held is returned to the Client on completion of the engagement, less any amount owing to Meridian Cyber.
4.8 Lien Over Client Property and Data
Meridian Cyber may retain, by way of lien, any property, documents, reports, evidence or data belonging to the Client that are in Meridian Cyber’s possession or control, until all Fees, disbursements, interest and other amounts owing to Meridian Cyber under an engagement have been paid in full. This right survives the completion, expiry or termination of an engagement. Meridian Cyber will exercise this right reasonably and having regard to any legal hold or court order it has been notified of.
5. Personnel
(a) Meridian Cyber will select the Personnel assigned to an engagement, having regard to their skills and experience, and may replace any member of the Personnel during an engagement where reasonably necessary, without affecting the quality of the Services.
(b) Meridian Cyber’s Personnel remain employees or contractors of Meridian Cyber at all times, and nothing in these Terms & Conditions creates any employment, agency or other relationship between the Client and Meridian Cyber’s Personnel.
6. Client's Obligations
(a) During an engagement, the Client will (and, where the End Client is not the Client, will ensure the End Client will) cooperate with Meridian Cyber as reasonably requested, provide accurate, complete and timely information and documentation relevant to the engagement, provide timely approvals so as not to delay delivery of the Services, make any necessary facilities, systems or environments available to Meridian Cyber at no cost, and ensure its staff and agents cooperate with and assist Meridian Cyber’s Personnel.
(b) If the necessary access or facilities are not made available within the required timeframe, the Client will pay any additional costs Meridian Cyber reasonably incurs as a result.
6.1 Client Responsibility for Credentials
(a) The Client is solely responsible for the proper management, security and timely rotation, deactivation or deletion of any credentials it provides to Meridian Cyber for the purpose of delivering the Services, including account details, passwords and API keys.
(b) Meridian Cyber is not liable for any unauthorised access, security incident or data breach resulting from the Client’s failure to manage or revoke credentials in a timely manner.
6.2 Client Authorisation and Consent
The Client warrants, in respect of each engagement, that it owns, operates, or has been expressly authorised in writing by the owner or operator of, the Assets to be reviewed or assessed, and has full authority to grant Meridian Cyber the access needed to perform the Services; that, where the engagement is an Intermediary Engagement, the End Client has been fully informed of the nature and scope of the Services and has given prior written consent to Meridian Cyber performing them; that, where the Services may materially affect data or systems belonging to a third party that is not the Asset owner, the Client has obtained all necessary consent from that third party before the Commencement Date; and that all authorisations and consents referred to in this clause remain current as at the date Meridian Cyber begins the relevant Services.
The Client must notify Meridian Cyber in writing immediately if any authorisation or consent is withdrawn or qualified during an engagement, on receipt of which Meridian Cyber may suspend the affected Services without liability. The Client indemnifies Meridian Cyber against any claims and losses arising from a breach of the warranties in this clause, and this obligation survives termination or expiry of an engagement.
6.3 Authority Over Third-Party Material
The Client warrants that it holds, or has obtained, all authority needed from the owners of any copyright material to which it grants Meridian Cyber access for the purposes of the engagement, and must notify Meridian Cyber promptly if it becomes aware of any actual or suspected absence of that authority. The Client is responsible for any loss, cost or claim arising from a breach of this warranty.
6.4 Site Access and Work Health & Safety
Where Meridian Cyber’s Personnel attend the Client’s premises or any location other than Meridian Cyber’s own offices, the Client will ensure the premises comply with applicable work health and safety laws, obtain any permissions, approvals or inductions Meridian Cyber’s Personnel require to access the premises, and meet any related access or induction costs.
6.5 Regulatory Notices and Take-Down Directions
The Client must promptly notify Meridian Cyber of any direction, notice or order it receives from a regulator, court or other authority relating to data held, accessed or processed by Meridian Cyber in connection with an engagement, and must cooperate with Meridian Cyber to give effect to that direction in a timely manner.
7. No Partnership or Employment Relationship
(a) Nothing in these Terms & Conditions creates a partnership, joint venture, agency or employment relationship between Meridian Cyber and the Client.
(b) Neither party has authority to bind the other, except as expressly agreed in a proposal.
8. Use of Subcontractors
(a) Meridian Cyber may engage Subcontractors to assist in delivering the Services.
(b) Meridian Cyber remains responsible for the Services performed by a Subcontractor as if Meridian Cyber had performed them itself.
(c) Meridian Cyber will ensure any Subcontractor is subject to confidentiality obligations at least as protective as those in these Terms & Conditions.
9. Intermediary Engagements
9.1 Application
This clause 9 applies where an engagement is an Intermediary Engagement.
9.2 Conflicts of Interest
Meridian Cyber will not, before the earlier of the Completion Date and 12 months after the end of an engagement, knowingly offer services to the End Client that compete with the Client, unless those services were already being provided to the End Client, or the Client agrees otherwise in writing. Meridian Cyber will not engage in conduct it is aware represents a material conflict between its duties to the Client and its duties to a third party.
9.3 Instructions and Duties
(a) All instructions to Meridian Cyber must come from the Client. Meridian Cyber will not accept instructions directly from the End Client unless directed to do so by the Client, and where instructions conflict, Meridian Cyber will follow the Client’s instructions.
(b) The parties acknowledge that Meridian Cyber’s primary duty is owed to the Client, but Meridian Cyber retains an overriding duty to the End Client to comply with applicable legal, regulatory and professional obligations, notwithstanding any conflict with the Client’s interests.
(c) Where a conflict arises between Meridian Cyber’s duty to the Client and its duty to the End Client, Meridian Cyber will first seek to resolve the conflict in favour of the Client, to the extent this does not conflict with Meridian Cyber’s legal, regulatory or professional obligations to the End Client. If the conflict is not resolved within 1 business day of Meridian Cyber raising it with the Client and the End Client, Meridian Cyber will act in accordance with its overriding duty under clause 9.3(b).
(d) Nothing in this agreement relieves Meridian Cyber of any obligation to comply with applicable laws governing data protection, security or breach reporting, and compliance with those obligations does not constitute a breach of these Terms & Conditions.
10. Confidentiality & Data
10.1 Confidentiality
(a) Each party must keep the other’s Confidential Information confidential and must not use or disclose it except as required to perform its obligations under these Terms & Conditions or as required by law.
(b) Meridian Cyber will treat any Vulnerability, credential or Asset information obtained during an engagement as Confidential Information, and will store, transmit and, on completion of the engagement, dispose of that information securely.
(c) These confidentiality obligations continue after an engagement ends, and survive termination of these Terms & Conditions.
10.2 Data Retention and Storage
(a) Meridian Cyber may retain a copy of the Report and supporting working papers after an engagement concludes, for the purpose of managing its professional and legal obligations, subject to the confidentiality obligations in this clause.
(b) On written request, Meridian Cyber will securely delete specified Confidential Information within 30 days, and confirm that deletion to the Client, except where the law or a regulatory obligation requires Meridian Cyber to retain it for longer.
(c) Meridian Cyber handles Personal Information collected during an engagement in accordance with its Privacy Policy.
10.3 Use of Technology and AI-Assisted Tooling
(a) The Client acknowledges that Meridian Cyber may use approved software tooling, including AI-assisted analysis tools, to support the delivery of the Services.
(b) Where AI-assisted tooling is used, Meridian Cyber does not submit credentials, secrets or other sensitive access material to any such tool, and any output produced with its assistance is reviewed by a qualified Meridian Cyber consultant before inclusion in a Report. Meridian Cyber retains full responsibility for the Services regardless of the tooling used to support their delivery.
(c) The Client may request that an engagement be delivered without the use of AI-assisted tooling by written notice, in which case clause 4.5 may apply if this affects the Fees or timeline.
11. Warranties, Liability and Indemnities
11.1 Warranties
(a) Meridian Cyber warrants that it will perform the Services with due care and skill, consistent with generally accepted cyber security industry practice.
(b) If Meridian Cyber performs the Services, or any part of the Services, negligently or in material breach of these Terms & Conditions, then, if requested by the Client, Meridian Cyber will re-perform the relevant Services.
(c) A request under clause 11.1(b) must be made within 14 days of the relevant Services being provided.
11.2 No Warranty as to Outcomes
Cyber security advisory and assessment services cannot guarantee that an organisation is free of Vulnerabilities, or that the Client will not experience a security incident. Meridian Cyber does not warrant that the Services will identify every Vulnerability or risk present in the Client’s environment, or that any particular outcome will be achieved by the Completion Date.
11.3 Insurance
Meridian Cyber maintains insurance appropriate to its business, including professional indemnity and public liability insurance, and any workers’ compensation insurance required by law for its Personnel.
11.4 Limitation on Liability
(a) Except in the case of death or personal injury caused by Meridian Cyber’s negligence, Meridian Cyber’s liability to the Client arising out of or in connection with an engagement, whether in contract, tort, under statute or otherwise, is limited to the Fees paid or payable by the Client for that engagement.
(b) Neither party is liable to the other for indirect or consequential loss of any kind, including loss of profits, revenue, business opportunity or goodwill.
(c) Nothing in these Terms & Conditions excludes, restricts or modifies any right or remedy that cannot lawfully be excluded, restricted or modified under the Australian Consumer Law.
11.5 Indemnity
The Client indemnifies Meridian Cyber against claims and losses, including reasonable legal costs, arising from a breach of clause 6 (Client’s Obligations) or its subclauses, or from Meridian Cyber’s review or assessment of an Asset the Client did not have proper authority to have reviewed or assessed, to the extent such claims and losses are not caused by Meridian Cyber’s negligence or wilful misconduct.
11.6 Entire Agreement
These Terms & Conditions, together with the applicable proposal and Schedule, record the entire agreement between the parties for an engagement and supersede all prior discussions relating to it. Any implied condition, warranty or term is excluded to the extent permitted by law.
11.7 Survival
The obligations in this clause 11, and in clauses 6.2, 10 and 14, survive termination or expiry of an engagement.
12. Termination
(a) Either party may terminate an engagement by written notice if the other party fails to observe a term of these Terms & Conditions and fails to rectify that breach, to the satisfaction of the notifying party, within 14 days of written notice of the breach.
(b) In addition, either party may terminate an engagement on the happening of any of the following: the giving of at least 1 month’s written notice by one party to the other of its intention to terminate the engagement; the Client enters into a deed of arrangement or an order is made for it to be wound up; an administrator, receiver, receiver/manager or liquidator is appointed to the Client under the Corporations Act 2001 (Cth); the Client would be presumed to be insolvent by a court in any of the circumstances referred to in the Corporations Act 2001 (Cth); or the Client is unable to pay its debts as and when they become due.
(c) The Client may, at its discretion, pay Meridian Cyber the equivalent amount of the Fees payable during the notice period in lieu of the notice period referred to in the first bullet point of clause 12(b).
(d) On termination, the Client must pay any Fees, expenses or reimbursements payable in respect of Services provided up to and including the date of termination, within 5 days after Meridian Cyber delivers a tax invoice for those Services, and each party must return or securely destroy the other’s Confidential Information, except where a party is required by law to retain it.
13. General
13.1 Force Majeure
A Force Majeure Event does not constitute a breach of these Terms & Conditions, and the affected party’s obligations (other than an obligation to pay Fees) are suspended for the duration of that event, provided it notifies the other party promptly and uses reasonable efforts to minimise the impact. If a Force Majeure Event continues for more than 6 months, either party may terminate the affected engagement by written notice.
13.2 Amendment
These Terms & Conditions may only be amended in writing signed by an authorised representative of each party, except that Meridian Cyber may update the Terms & Conditions applicable to website use from time to time by posting the updated version on the Site.
13.3 Severance
If any provision of these Terms & Conditions is found to be unenforceable, the remaining provisions continue in full force and effect.
13.4 Waiver
A party’s failure to enforce a provision of these Terms & Conditions is not a waiver of that provision.
13.5 Assignment
Neither party may assign its rights under these Terms & Conditions without the other party’s prior written consent, except that Meridian Cyber may assign its rights to a related entity or successor in business.
13.6 Announcements and Use of Branding
Neither party may issue a public announcement referring to an engagement, or use the other party’s name, logo or trademark, without the other’s prior written consent, except that where the Client consents to being referred to as a client of Meridian Cyber, that consent may be relied on for reasonable promotional use unless withdrawn in writing.
13.7 Notices
A notice or other communication in connection with these Terms & Conditions has no legal effect unless given in writing.
13.8 Governing Law and Jurisdiction
These Terms & Conditions are governed by the laws of New South Wales, Australia, and the parties submit to the exclusive jurisdiction of its courts.
14. Non-Circumvention and Non-Solicitation
14.1 During an engagement and for 24 months afterwards, the Client must not directly engage a member of Meridian Cyber’s Personnel who was involved in delivering the Services, without Meridian Cyber’s prior written consent.
14.2 During an engagement and for 24 months afterwards, neither party may solicit for employment any employee of the other party who was directly involved in the engagement, without that party’s prior written consent.
14.3 The Client acknowledges that a breach of clause 14.1 may cause Meridian Cyber significant harm for which monetary damages alone may be an inadequate remedy, and that Meridian Cyber may seek injunctive relief, specific performance and/or liquidated damages in respect of any services provided by the relevant individual to the Client in breach of that clause.
15. Website Use and Cookies
15.1 You may browse the Site and use it to learn about Meridian Cyber’s Services, request a consultation, or apply for a role with us. You must not use the Site in a way that is unlawful, that interferes with its operation, or that attempts to gain unauthorised access to it or to any system connected to it.
15.2 All content on the Site, including text, graphics and logos, is owned by or licensed to Meridian Cyber and must not be reproduced without our written consent, other than for your own personal, non-commercial reference.
15.3 Content on the Site is provided for general information only and does not constitute cyber security, legal or other professional advice. You should not rely on it as a substitute for a specific engagement tailored to your circumstances.
15.4 The Site uses cookies and similar technologies, including cookies that support essential site functionality, cookies that help us understand how visitors use the Site so that we can improve it, and cookies that let us recognise when someone has used our contact or consultation request forms. Details of the categories of cookies we use, and how you can manage them, are set out in our Privacy Policy.
15.5 The Site may link to third-party websites. We are not responsible for the content, accuracy or privacy practices of those sites, and a link does not imply our endorsement of them.