Audit terms
Plain-language summary. These terms cover the two fixed-price audits sold on stonesteady.com. You buy an audit, I test your web app within the stated scope, and you receive a ranked findings report and a walkthrough video within the stated turnaround. The audit is a report. It does not promise that your app is secure or ready, it does not find everything, and it does not include fixing anything. If the report falls short of what these terms promise, I correct it; under these terms, at worst you get your fee back. Your rights under the Australian Consumer Law are preserved in full.
1. Acceptance
Plain-language summary. Ticking the terms box at checkout and paying means you accept these terms.
1.1 These terms (the "Terms") form a contract between Monika Andrea Almasy, trading as StoneSteady, ABN 44 137 669 949 ("StoneSteady", "I", "me"), and the person or entity that buys an audit ("you").
1.2 You accept these Terms by ticking the acceptance box at the Stripe checkout and completing payment for an audit, or by confirming acceptance in writing after receiving a link to these Terms.
1.3 If you buy on behalf of a company or other entity, you confirm you have authority to bind it, and "you" includes both you and that entity.
1.4 Work that is quoted separately (scoped audits above the caps, fix verification, monitoring, a managed test suite) is governed by its own written quote or agreement. Where a quote is silent, these Terms apply to it as far as they sensibly can.
2. What an audit is
Plain-language summary. An audit is a structured test of one web app, within a stated cap, producing a report and a video. The scope is fixed so the price can be fixed.
2.1 An Entry Audit covers one web application, up to 3 user flows named at intake, tested on desktop Chrome and on a real iPhone running Safari, with functional testing and an exploratory pass. Delivered within 5 business days of a complete intake.
2.2 A Full Audit covers one web application, up to 8 user flows named at intake, with API checks on those flows, tested on desktop Chrome, Safari and Firefox and on a real iPhone and a real Android phone, with Core Web Vitals measurement on the pages in those flows, accessibility observations, and an exploratory pass. Delivered within 10 business days of a complete intake.
2.3 A "user flow" is a task a user completes in your app from start to finish, such as creating an account, completing a purchase, or resetting a password. If the flows you name exceed the cap, or one flow is unusually large, I will tell you before starting and offer a scoped quote or a reduced list within the cap. You may cancel for a full refund at that point.
2.4 The audit tests the version of your app that is live at the address you give me on the day testing starts (the "snapshot"). Findings relate to that snapshot. Changes you or your tools make after the snapshot are outside the audit.
2.5 The audit is of the running application through its user interface and its network interface. I do not need, and by default do not review, your source code.
3. What an audit is not
Plain-language summary. The report is evidence of what I found, not a certificate that nothing else is wrong.
3.1 An audit does not promise, and I do not warrant, that your application is secure, free of defects, fit for launch, compliant with any standard, or that it will perform in any particular way after delivery. No testing method finds every issue.
3.2 An audit is not a penetration test, a security certification, or an accessibility certification. Security issues observed during ordinary testing (for example, an endpoint that responds without authentication) are reported as findings. I do not attempt to break into systems, escalate privileges, or test infrastructure.
3.3 An audit does not include fixing anything. Fix verification is a separate engagement (section 8).
3.4 The report is not legal, compliance, or security advice, and must not be used as evidence of compliance with any law or standard.
4. Your responsibilities
Plain-language summary. Give me an app you are entitled to have tested, working test accounts, and the information the intake asks for.
4.1 You confirm that you own the application, or are authorized by its owner, to have it tested as described in these Terms; that you have authority to give that consent; and that testing will not breach any agreement you have with a hosting provider or platform. You confirm this again in the intake form, naming the application address, and that confirmation is kept with the intake. You will not ask me to test systems you do not control.
4.2 You will provide the application address and the flows to test through the intake form, working test accounts by email or a one-time link (never through the form), and any information reasonably needed to complete the named flows. Test accounts should be created for the audit and disabled afterwards, and should not contain real customer data.
4.3 The turnaround clock in section 5 starts on the first business day on which I have everything section 4.2 requires and can log in. If access breaks during the audit, the clock pauses until it is restored.
4.4 You are responsible for backups. Ordinary testing can create test records and trigger emails or notifications in your systems. Some checks, such as repeated requests to see how your app handles them, generate load; if you have a staging copy, name it in the intake, or tell me a low-traffic window to use.
5. Delivery and turnaround
Plain-language summary. Business days are Brisbane business days. Delivery is by email. If I am going to be late, you hear before the deadline and can cancel for a full refund.
5.1 Business days are Monday to Friday, excluding Queensland public holidays, in Brisbane, Australia (UTC+10).
5.2 The report and walkthrough video are delivered by email, or by a link sent by email, on or before the last day of the turnaround period.
5.3 If I expect to miss the turnaround, I will tell you before the deadline with a new date. If the new date is not acceptable to you, you may cancel for a full refund and no report is delivered.
6. Corrections warranty (warranty against defects)
Plain-language summary. For 30 days after delivery, if the report misses part of the agreed scope or a finding lacks its required evidence, I correct and reissue it free. This is a warranty against defects under the Australian Consumer Law, so the required notice appears below.
6.1 What is covered. For 30 days from the date of delivery, if the report (a) does not cover a flow named at intake and within the cap, or (b) contains a finding that lacks the evidence required by these Terms, I will correct the report and reissue it at no cost.
6.2 What is not covered. Changes to your application after the snapshot; issues outside the named flows; issues in third-party services your application depends on; a difference of opinion about a severity rating that is explained in the report; and any request to find issues that were not present at the snapshot.
6.3 How to claim. Email hello@stonesteady.com within the 30-day period, quoting the audit date and describing the shortfall. I acknowledge within 2 business days and reissue the corrected report within 5 business days of acknowledgement, or refund the fee in full if a correction is not possible.
6.4 Costs. Making a claim costs you nothing. I bear the cost of correcting and reissuing. There is nothing to return.
6.5 Who gives this warranty. Monika Andrea Almasy, trading as StoneSteady, ABN 44 137 669 949, PO Box 233, Runaway Bay QLD 4216, Australia, hello@stonesteady.com, +61 420 755 938.
6.6 Australian Consumer Law notice.
Our services come with guarantees that cannot be excluded under the Australian Consumer Law. For major failures with the service, you are entitled: to cancel your service contract with us; and to a refund for the unused portion, or to compensation for its reduced value. You are also entitled to be compensated for any other reasonably foreseeable loss or damage. If the failure does not amount to a major failure you are entitled to have problems with the service rectified in a reasonable time and, if this is not done, to cancel your contract and obtain a refund for the unused portion of the contract.
6.7 The benefits under this warranty are in addition to other rights and remedies you have under law in relation to the services to which the warranty relates.
7. Fees, payment, and refunds
Plain-language summary. You pay in US dollars through Stripe before the work starts. Until testing starts you can cancel for a full refund. The other refund cases are listed here.
7.1 Fees are stated in US dollars on stonesteady.com at the time of purchase and are paid in full through Stripe before work starts. I am not registered for GST and no GST is added. Any currency conversion or card fees charged by your bank are yours.
7.2 The founding price for the Full Audit, where shown, applies until November 8, 2026 or until five Full Audits have been sold at that price, whichever is first, and cannot be applied after purchase to an audit bought at another price.
7.3 Refunds are made to the original payment method. Refund cases: cancellation by email at any time before testing starts (full refund); cancellation under 2.3 or 5.3 (full refund); a correction that is not possible under 6.3 (full refund); and any refund required by law.
7.4 If you cancel after testing has started for a reason not covered above, I may retain a proportion of the fee reflecting the work completed, and will tell you the proportion before processing.
8. Other services
Plain-language summary. Fix verification, monitoring and the managed test suite are quoted separately.
8.1 Fix verification (fix instructions per finding, re-testing until each is verified closed), monitoring, and the managed test suite are separate services quoted after the audit. Prices shown on stonesteady.com for these services are indicative until quoted.
8.2 By default I do not change your code. Any hands-on change is offered by me, case by case, in writing, and only for small, low-risk changes.
9. Fixing
Plain-language summary. I find and rank. Fixing is never part of the audit.
9.1 The audit finds and ranks problems. Fixing them is not part of the audit at any tier. See section 8 for the separate fix-verification service.
10. Confidentiality and data
Plain-language summary. What I learn about your app stays between us. Logins are deleted at delivery. I may quote anonymized totals.
10.1 I treat your application, test accounts, findings, and report as confidential and do not disclose them to anyone except as needed to deliver the service (see the privacy policy for the tools involved) or as required by law.
10.2 Test logins you give me are deleted when the report is delivered. I keep the report and related correspondence as business records for at least 5 years, as Australian tax law requires.
10.3 I may use anonymized, aggregated information from audits (for example, the average number of findings per audit, or the proportion of audits with a Critical finding) in my marketing, provided nothing identifies you, your business, or your product.
10.4 If you would like a named case study or testimonial, that is agreed separately in writing and never assumed.
11. Intellectual property
Plain-language summary. The report and video are yours to use. My methods stay mine. Your app stays yours.
11.1 The report and video are yours to use within your business and to share with the people fixing your application. My testing methods, checklists, scripts and templates remain mine.
11.2 You retain all rights in your application.
12. Limitation of liability
Plain-language summary. My liability is capped at the fee you paid for the audit. I am not liable for indirect losses. Nothing here limits your non-excludable consumer rights.
12.1 To the maximum extent permitted by law, my total liability to you arising out of or in connection with an audit, whether in contract, tort (including negligence), under statute, or otherwise, is capped at the fee you paid for that audit.
12.2 To the maximum extent permitted by law, I am not liable for loss of profit, revenue, business, data, or opportunity, for losses arising from changes to your application or from third-party services, or for any indirect or consequential loss.
12.3 Australian Consumer Law preserved. Nothing in these Terms excludes, restricts, or modifies any guarantee, right, or remedy under the Competition and Consumer Act 2010 (Cth), including the Australian Consumer Law, that cannot lawfully be excluded. Where a consumer guarantee applies and the services are not of a kind ordinarily acquired for personal, domestic, or household use, my liability for a failure to comply with that guarantee is limited, to the extent permitted and at my option, to supplying the services again or paying the cost of having them supplied again.
12.4 Nothing in this section limits liability for fraud, wilful misconduct, or anything that cannot lawfully be limited.
12.5 You will indemnify me against claims by third parties arising from your breach of section 4.1 (authorization to test).
13. Disputes
Plain-language summary. We talk first. Then mediation in Queensland. Court is the last resort.
13.1 If a dispute arises, the party raising it gives written notice describing the issue and the outcome sought, and the parties discuss it in good faith within 14 days.
13.2 If unresolved within 30 days of the notice, either party may refer the dispute to mediation administered by the Resolution Institute (or another agreed mediator), held in Brisbane or online, with the mediator's fees shared equally.
13.3 If unresolved within 60 days of the referral, either party may commence proceedings in a court of competent jurisdiction in Queensland, Australia. Nothing prevents either party from seeking urgent relief from a court at any time.
14. General
14.1 Governing law. These Terms are governed by the laws of Queensland, Australia, and each party submits to the jurisdiction of its courts, subject to section 13.
14.2 Consumers outside Australia. If you buy from outside Australia, mandatory consumer protections of your own country may also apply, and nothing in these Terms reduces them.
14.3 Entire agreement. These Terms, the intake form, and the privacy policy are the whole agreement for an audit. A written quote prevails over these Terms to the extent of any inconsistency.
14.4 Severability. If any part of these Terms is unenforceable, the rest continues to apply.
14.5 Changes. I may update these Terms. The version in force when you paid applies to your audit. Each version carries its number and effective date at the top.
14.6 Notices. Notices may be sent by email to hello@stonesteady.com or to the address you used at checkout, and are taken to be received on the next business day.
14.7 Contact. Monika Andrea Almasy, trading as StoneSteady, ABN 44 137 669 949, PO Box 233, Runaway Bay QLD 4216, Australia, hello@stonesteady.com, +61 420 755 938.