Terms of service

Last updated 22 September 2026

These terms apply to the review services offered on this site and ordered through it or by email. They are written for businesses; this is not a consumer service. Where we sign a separate contract or statement of work with you, that document wins over this page.

1. Who you are dealing with

HYCAD SOFTWARE SRL, Calea Turzii 241/E, Cluj-Napoca, Romania, CIF 42122453, registered as J12/149/2020, reachable at office@hycad.eu. "We" and "us" mean that company; "you" means the business ordering the work.

2. What the services are

• Cost and Risk Map. Three working days. A written report on where the money goes in the code, what the same product should cost to run, what breaks first as traffic grows, and one verdict in writing, followed by a 60 minute call to walk you through it.
• Production Readiness Sprint. Ten working days. Everything in the Map, and then we make the changes we agreed on day one: the deploy, a tested rollback, a restored backup, logging and one real alert, a runbook and a go or no go verdict.
• Retainer. A monthly arrangement, up to eight hours a month, a weekly call, review of changes before they ship, and the Map re-run each quarter.

3. What the review is not

It is a code and cost review. It is not a penetration test, not a security audit, not a certification, and it grants no accreditation. We are not certified or accredited by any standards body and we do not claim to be. Findings are graded against our own severity rubric, which is ours and not an industry standard.

The review works from your source code rather than from your production systems, so every figure in the report is an estimate priced off the code and your provider's published rates, not a reading from your bill. It is a point in time review of the code we were given. No review of any length can establish that no other problem exists, and nothing in the report is a warranty that your system is secure, compliant or fault free. The decisions stay yours.

4. Access, and what you confirm

We work from read only access to source code, with no production data. We do not ask for production credentials and you should not give them to us. Before anything is opened we sign an NDA.

By giving us access you confirm that you are entitled to share that code with us, that doing so breaks no licence or agreement you are bound by, and that the repository contains no personal data of other people beyond what is unavoidable in a codebase. If personal data turns out to be in there, tell us and we will agree in writing how to handle it.

Our copy of your code is deleted within fourteen days of delivering the report, and we confirm the deletion in writing.

5. How we use AI, and what a human does

We use language models to read the whole repository and map what calls what. That is how three days can cover a codebase that would otherwise take weeks to read. Every number and every finding that reaches the report is checked by one of us before it is written down. A model's output on its own never becomes a finding.

6. Prices and payment

Prices are those published on this site at the time you book: the Cost and Risk Map at €1,000 for reviews booked before 31 October 2026 and €1,200 after that, the Production Readiness Sprint at €7,500, and the Retainer at €1,500 per month with no minimum term. Each price buys a fixed block of our time rather than an open scope. Prices exclude VAT where it applies.

Unless we agree otherwise in writing, we invoice on delivery and payment is due within fourteen days of the invoice. Work that has not started can be rescheduled or cancelled at no cost.

7. The guarantees, in full

Cost and Risk Map. If the report contains nothing worth acting on, you pay nothing and the report is still yours to keep and to use. Above that threshold our fee is the same whatever we find: it does not rise with the number of findings and it does not rise with the severity we assign them. We invoice when the report is delivered either way, so you read it before you pay. If you book a Sprint within thirty days of the report, the whole Map fee comes off the Sprint.

Production Readiness Sprint. We agree the list of changes in writing on day one. If we deliver less than that list, we invoice less, in proportion to what was delivered. The list may be changed during the sprint at your request; any addition is quoted in writing before we start on it and invoiced in addition to the agreed price. For thirty days after delivery, if we broke something that worked before we touched it, we fix it at no charge.

Retainer. There is no minimum term. Either side can end the arrangement with thirty days notice, and any month already paid for is worked in full.

8. What you get, and what stays ours

The report and anything we write specifically for you is yours once it is paid for, or, in the case of the Map guarantee, even if it is not. You may share it inside your company, with your investors and with your advisers. Our methods, templates, rubric and general know-how stay ours, and nothing in the report stops us doing similar work for anyone else.

9. Confidentiality

What we see in your code and hear in your calls stays between us, for as long as it is not public through no fault of ours. We name no client publicly without written permission, and any example published from our own work is labelled as such.

10. Liability

For each piece of work, our total liability is limited to the fees you paid us for that piece of work. We are not liable for indirect or consequential loss, lost profit, lost data or lost business opportunity. Nothing here limits liability that cannot be limited under Romanian law, including liability for fraud, for wilful misconduct or for death or personal injury.

The report is advice. Acting on it, or not, remains your decision and your responsibility, and you stay responsible for your own backups, security, compliance and deployments.

11. Law and disputes

Romanian law applies. If we cannot settle something between us, the competent courts of Cluj-Napoca, Romania, decide it. Since this is a business to business service, the consumer protection rules for individuals do not apply, and comparative advertising is governed by Directive 2006/114/EC.

12. Changes

We can change these terms for future orders; the version that applies to your work is the one published when you booked, and the date at the top says which that is. Personal data is covered by the privacy notice, cookies by the cookie policy.