Terms of Service

These Terms are governed by Australian law. The following legislation is relevant to your use of Sky Nexus services.

• Competition and Consumer Act 2010 (Cth) — Australian Consumer Law (ACL) consumer guarantees and unfair contract terms provisions (ss 23–28)
• Electronic Transactions Act 1999 (Cth) — legal validity of electronic contracts and signatures
• Privacy Act 1988 (Cth) — data handling obligations (see Privacy Policy)
• Cybercrime Act 2001 (Cth) / Criminal Code Act 1995 (Cth) — prohibited computer-related conduct
• Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act) — obligations for clients operating critical infrastructure assets
• Spam Act 2003 (Cth) — electronic messaging consent
• Copyright Act 1968 (Cth) — intellectual property ownership
• Corporations Act 2001 (Cth) — business conduct obligations

Where you are a consumer under the ACL, statutory guarantees apply to our services and cannot be excluded. Nothing in these Terms limits, excludes, or modifies any right or guarantee you have under the ACL to the extent that such limitation would be unlawful.

• Services will be provided with due care and skill
• Services will be fit for any disclosed purpose
• Services will be delivered within a reasonable time where no time is fixed
• Where we fail to meet an ACL guarantee, you may be entitled to a remedy (re-supply or refund) depending on whether the failure is minor or major

Sky Nexus does not rely on terms that would be unfair within the meaning of Schedule 2, Part 2-3 of the ACL. If any term in an individual service agreement is found to be unfair, it is void to the extent of the unfairness; the remainder of the agreement continues in force.

Sky Nexus provides cybersecurity, cloud, ICT, and digital transformation services. Specific deliverables, scope, timelines, and fees are set out in individual statements of work or master service agreements.

• Managed Security Services — 24/7 SOC monitoring, SIEM, threat detection and response
• Penetration testing and red team operations — conducted under written authorisation only, within agreed scope (Cybercrime Act 2001 compliance)
• Cloud architecture, migration, and security — AWS, Azure, GCP
• Governance, risk, and compliance consulting — Essential Eight, IRAP, DISP, ISO 27001, SOCI
• Incident response, digital forensics — aligned to ISO/IEC 27035:2023
• ICT infrastructure, managed support, and digital transformation

All offensive security activities (penetration tests, red team exercises, vulnerability assessments) are conducted only under a written Authorisation to Test document signed by an authorised representative of the client organisation. Unauthorised access to computer systems is a criminal offence under the Cybercrime Act 2001 (Cth) and the Criminal Code Act 1995 (Cth). Sky Nexus will not conduct any testing without valid written authorisation, and clients must ensure they have authority over all systems included in the scope.

Under the Copyright Act 1968 (Cth), all methodologies, frameworks, tools, software, templates, and pre-existing materials developed by Sky Nexus remain our property. Deliverables created specifically for a client engagement vest in the client upon full payment, unless the Statement of Work specifies otherwise.

• Background IP (pre-existing tools, frameworks) — remains Sky Nexus property; client receives a licence to use in deliverables
• Foreground IP (bespoke deliverables) — assigned to client on full payment
• Open-source components — governed by their respective licences; we disclose all OSS used
• Client data and materials — remain the client's property at all times

Both parties agree to maintain the confidentiality of each other's confidential information indefinitely, and to use it only for the purpose of the engagement. This obligation survives termination.

Subject to the ACL and to the extent permitted by law, Sky Nexus's liability for any claim is limited to the fees paid for the specific service giving rise to the claim in the 12 months preceding the event.

• We are not liable for indirect, incidental, consequential, or punitive losses
• We are not liable for losses arising from client failure to maintain backups or implement recommended controls
• We are not liable for the acts or omissions of third-party software, cloud providers, or infrastructure vendors
• Nothing in these Terms limits liability for death or personal injury caused by negligence, or for fraud

These Terms are governed by the laws of Victoria, Australia. Disputes will first be addressed through good-faith negotiation. If unresolved after 30 days, disputes are referred to mediation in Melbourne before either party commences litigation. Courts of Victoria, Australia have exclusive jurisdiction.