Compliance & Professional Services Disclaimer

Draft notice. This document is a first-pass draft prepared for attorney review. Do not treat this version as final or as legal advice.

Read this first. Vigilent Technologies LLC is a cybersecurity assessment and advisory company. We are not a licensed accounting or auditing firm, a Qualified Security Assessor (QSA), a PCI Approved Scanning Vendor (ASV), an ISO 27001 certification body, or a law firm. Our Audit Tool, chatbot, and any output produced by them are informational and educational tools to help you understand your security posture and prepare for real, certified audits performed by properly licensed third parties.

1. What the Audit Tool is

The Vigilent Audit Tool is a browser-based static-analysis utility operated internally by Vigilent staff as part of a Code Assessment engagement — it is not offered as a public, self-service product. It performs pattern-matching against source files provided for a scoped engagement, mapping detected patterns to control clauses from published frameworks including ISO 27001:2022, NIST SP 800-53, TISAX, SOC 2, PCI DSS v4.0.1, OWASP ASVS and Top 10, CIS Controls v8.1, UL 2900, and MITRE ATT&CK.

2. What the Audit Tool is not

The Audit Tool does	The Audit Tool does not
Perform static pattern-based analysis of source code you upload.	Perform live penetration testing, dynamic analysis (DAST), or active exploitation of any system.
Map findings to published framework control clauses.	Constitute a certified audit, an attestation of compliance, or a Report on Compliance (ROC).
Produce a draft Statement of Applicability as an input for an auditor.	Produce a finalized Statement of Applicability. A real SoA requires a certified lead auditor's judgment on scope, applicability, justification, and evidence for every control.
Suggest security weaknesses that a pattern match indicates may exist.	Confirm exploitability, prove impact, or replace the judgment of a qualified security engineer.
Provide educational content about frameworks through the chatbot and news pages.	Provide legal, regulatory, tax, or accounting advice.

3. Vigilent's professional status

Vigilent is not an ISO 27001 certification body, and no output from the Audit Tool can grant ISO 27001 (or any other) certification. Certification can be granted only by an accredited certification body following a formal audit by qualified auditors.
Vigilent is not a Qualified Security Assessor (QSA) or PCI Approved Scanning Vendor (ASV) unless expressly stated in a signed statement of work. Payment Card Industry compliance work that requires a QSA or ASV must be performed by one.
Vigilent's staff are not licensed attorneys and do not practice law. Nothing produced by our Services is legal advice.
Vigilent's cybersecurity assessments and advisory engagements are performed under a written statement of work that defines the scope, deliverables, and any professional certifications applicable to that engagement.

4. About "penetration testing"

Real penetration testing involves actively attacking a running system under agreed rules of engagement with the system's owner. It is a professional service, typically performed under a scoping agreement, non-disclosure agreement, and safe-harbor authorization. The Vigilent Audit Tool does not perform live penetration testing. Its "Security Test Checklist" is a static-analysis checklist mapped to pentest categories — a preparation aid, not a substitute. If you need a live penetration test, schedule a consultation to scope one.

5. About Statement of Applicability output

The Audit Tool's draft SoA feature is a starting point. It pre-populates an ISO 27001 Annex A control table so that your certified ISO 27001 lead auditor has less blank-page work to do. Every entry requires review, adjustment, justification, and evidence linkage by that auditor before it becomes a finalized SoA acceptable for certification audit purposes.

6. About compliance percentages and scores

Any percentage, score, or maturity rating produced by the Audit Tool measures the coverage of pattern-matchable indicators. It does not measure your organization's actual compliance with any framework. Real compliance is determined by evidence review, control-effectiveness testing, and — for certification — a licensed auditor.

7. Your responsibilities

By using the Services, you understand and agree that:

You will not represent output from the Audit Tool as a certified audit, penetration test, or attestation of compliance.
You will engage properly licensed professionals (auditors, attorneys, QSAs, etc.) for any certification, legal, or regulated compliance purpose.
You will verify all findings independently before acting on them, and will not rely solely on Audit Tool output for security-critical decisions.
You are responsible for confirming you have the rights necessary for Vigilent to scan any source code you provide as part of an engagement.

8. No professional-client relationship formed by using these tools

Your use of the Audit Tool, chatbot, or Site does not create any professional, consulting, advisory, or attorney-client relationship between you and Vigilent. Such a relationship is formed only under a signed written engagement.

9. Relationship to the Terms of Service

This disclaimer is incorporated into and forms part of the Terms of Service. In the event of any conflict between this disclaimer and the Terms of Service, this disclaimer controls with respect to scope-of-service and professional-limits matters.

10. Contact

Questions about the scope of our Services, or about scoping a certified audit or professional engagement:

Vigilent Technologies LLC
519 SW 4th Street, STE 105, PMB 1034
Moore, OK 73160
Email: mroberson@vigilenttechnologies.com
Phone: (800) 716-0084

This disclaimer is a first-pass draft prepared for attorney review and is not legal advice.