Terms & Conditions of Trade

Advance Payment: All services require full payment upfront before any work begins on the respective case and/or CRN.

Refund Policy: Should CSSI not be able to recover any data, refundable amounts will be refunded within 7 days of the case being deemed unrecoverable. Non-refundable fees, if any, will not be included in the refund.

Non-Refundable Fees: Certain services may carry non-refundable fees. This will be clearly communicated at the time of a firm, official quote, stated on the quote against the respective CRN / Quote number.

Partial Recoveries: In some cases (head crash events, platter damage, user deletion, overwriting, ransomware decryption, certain SSD chip recoveries) only partial recovery is possible. Our engineers exhaust all reasonable attempts. If the client accepts and takes possession of partial data, no further refund is processed. If the client declines and does not take possession, a refund is processed.

Management Discretion: At management's discretion, CSSI may review a case on risk. Once feasibility is confirmed, a CRN is issued locking in the fixed quote. Further work involving other technical teams (including global offices/affiliations) may incur additional fees or an hourly rate on top of the quoted price.

Risk-Based Services: Services are performed on a 'risk' basis unless stated otherwise — there is no guaranteed outcome given the unpredictable nature of data recovery, ransomware decryption and forensic work. Once a CRN is issued, the quoted price is fixed based on CSSI's assessed confidence in performing the recovery.

Client's Responsibility: The client acknowledges that tampering, modification, or damage to the original data or device by the client or third parties after the data loss event (DLE) — including third-party recovery attempts that alter data structures, ECC, parity or hidden sector data prior to CSSI receiving the device — may result in unsuccessful recovery. CSSI is not liable for such tampering. In decryption cases, further access after encryption can trigger additional code modification or permanent data destruction, for which CSSI cannot be held liable; a new CRN or workload quote will be raised for any such additional case.

Service Scope: CSSI provides specialised decryption services for data affected by ransomware or similar encryption threats.

No Guarantee: Given the complexity and evolution of ransomware, CSSI cannot guarantee successful decryption in every case. Feasibility is assessed case by case.

Refunds: If no data can be decrypted, and the client has not accepted or taken possession of a partial recovery, a refund can be requested.

Decryption Attempt: Where assessment indicates a viable path, a quote is compiled under our general payment terms. Until procedures are complete there is no guarantee of success — the work is complex and carried out in our lab and data centres.

Client Responsibility: The client must not attempt any decryption or modification of the encrypted data without CSSI's guidance, as this may cause permanent data loss or increased complexity.

Confidentiality: All interactions and findings related to ransomware threats are treated with the utmost confidentiality, in line with our data protection policies.

Legal Compliance: CSSI will not engage in illegal or unethical activity, including negotiating or paying ransoms. Our focus is technical decryption and recovery.

Service Limitations: CSSI is not responsible for data that cannot be decrypted due to external factors such as ransomware evolution, or where the key cannot be obtained through technical means.

Guarantee: CSSI's performance guarantee is based on the condition of the original media at time of receipt, and is void if the original data or device is tampered with or modified after our initial assessment.

No Data Modification: CSSI will not alter data headers or original content without prior written client consent, except where necessary to perform the agreed service.

Data Recovery Outcomes: While CSSI applies best practices and industry-leading tools, successful recovery or decryption cannot always be guaranteed. Where recovery is unsuccessful and no tampering occurred (Clause 3), a refund is processed per Clause 2.

CRN: Once a risk-reviewed case is confirmed recoverable, a unique Customer Reference Number (CRN) is assigned in our CRM system. This is the identifier for all subsequent communication and the fixed quote.

Confidentiality: All client data is treated with the highest level of confidentiality. CSSI adheres to all relevant data protection laws and regulations.

Data Retention: Unless otherwise agreed, data is returned to the client on completion, and CSSI securely deletes any residual data from its systems 30 days after the case is concluded, per the archival policy stated on the CRN quote.

Ownership: The client retains ownership of all data provided to CSSI for service. CSSI claims no rights to client data.

Mediation: Any dispute arising from these terms will first be addressed through mediation before legal proceedings are considered.