Effective November 12, 2026 · Version 2026-11-12
1. Scope of services
MOAT Cybersecurity (“MOAT”) provides independent document evaluation, commercial contract analysis, invoice reconciliation, and passive public domain assessment. MOAT does not sell or manage IT services, hardware, or software, accept vendor commissions or referral payments, or replace the client’s existing provider. MOAT does not perform penetration testing, incident response, or system administration.
2. Documents and evidence only
Reviews rely on client-authorized contracts, proposals, invoices, vendor exports, test records, and passive public DNS records. MOAT never requests passwords or administrative credentials, logs into client production systems, or executes scripts on client devices. Findings apply only to the stated scope, evidence, and review date. Missing evidence is identified as unverified; it is not treated as proof of failure or misconduct.
3. Engagement, fees, and payment
The Free Missing-Evidence Check is an initial review of one proposal or invoice. The Proposal & Contract Verdict costs $1,750; the Provider Response Recheck costs $450; the Ongoing Accountability Plan costs $650 monthly or $1,750 billed quarterly. Fees are in US dollars. Paid work begins only after MOAT confirms sufficient documentation, the parties approve a written scope, and payment clears. Intake alone does not authorize payment or recurring billing.
4. Written scope and turnaround
The engagement identifies the organization, documents, decision, deliverables, limits, and any applicable tax, cancellation, refund, or subscription renewal terms before payment. Ongoing screening covers unscheduled quotes under $15,000 within the agreed volume and scope; it is not unlimited consulting. The free check takes 24 business hours after complete documents are confirmed. Verdict Reviews take 3 business days and Rechecks take 2 business days after complete documentation and cleared payment. Weekends and US federal holidays are excluded. MOAT confirms the delivery date and communicates changes caused by missing evidence or scope dependencies.
5. Client responsibilities
The client must have authority to share the documents and provide accurate, relevant information. Redact unnecessary personal information, client matter details, account numbers, and privileged advice. Do not submit passwords, private keys, patient records, or regulated personal records through this intake. The client retains responsibility for provider relationships, business decisions, and authorizing implementation.
6. Mutual confidentiality and AI
Each party will keep the other’s non-public business information confidential, use it only for the engagement, and disclose it only to personnel and service providers with a legitimate need and appropriate confidentiality obligations, or as legally required. This does not cover information that is public without a breach, independently developed, or lawfully obtained elsewhere. MOAT does not sell client information, share it with IT vendors for marketing, or use client documents to train AI models. The intake does not send documents to AI services. Any AI-assisted analysis requires an approved business service with contractual no-training controls and suitable confidentiality protections. A prompt alone does not establish those protections.
7. Qualified review and limits
MOAT combines founder-led commercial and operational analysis with a credentialed CISSP reviewer’s evaluation of security findings on paid reviews. Sign-off relates only to the stated documentary scope. Contract questions and redlines are business discussion points, not legal advice. Consult counsel about legal obligations, enforceability, privilege, and proposed legal language.
8. No security or compliance guarantee
A review does not warrant that systems are secure, free of vulnerabilities, compliant with all laws or standards, eligible for insurance, or protected from cyber incidents. MOAT does not guarantee savings, coverage, premium reductions, or attorney-client privilege. Passive DNS information and configuration records are limited evidence of specific facts, not certification of overall security.
9. Limitation of liability
To the maximum extent permitted by applicable law, MOAT and its officers, personnel, and independent reviewers will not be liable for indirect, incidental, special, consequential, or punitive damages, including lost profits, revenues, data, use, or goodwill arising from the services, the client’s provider relationship, cybersecurity incidents, or implementation of recommendations. MOAT’s aggregate liability for claims arising out of or relating to the services will not exceed the total fees actually paid by the client to MOAT in the three months preceding the claim. These limits apply only to the extent the law permits and do not exclude liabilities that cannot lawfully be limited.
10. Written engagement and contact
A written engagement may add service-specific terms. Modifications must be agreed by the parties. Contact hello@moatcybersecurity.com or 914-288-6068 with questions.
See the Privacy Policy for data handling.