Terms of Service
Last updated: September 26, 2026
The Russian version is the legally binding original. Read the Russian version
These Terms govern the provision of penetration testing (pentest) and information security audit services by ТОО «AB.AI TECH» (brand KEMEL.TECH, hereinafter the "Contractor"). By submitting a request on kemel-tech.kz, you agree to these Terms.
1.Scope of services
The Contractor provides the following services:
- →KEMEL PROBE — penetration testing (pentest): external perimeter, web applications, API and mobile applications (from 48 hours to 10 business days depending on scope).
- →KEMEL BREACH — Red Team: reproducing an attack and demonstrating its consequences within agreed boundaries (2–4 weeks).
- →KEMEL GUARD — ongoing support acting as the Customer's information security department (monthly contract).
The work is performed by the Contractor's specialists using professional tools; every finding is verified manually.
2.Payment model
The Customer pays only for vulnerabilities that are actually found and confirmed, at a fixed rate depending on the CVSS severity level. There is no prepayment. Duplicates of the same vulnerability are not charged. If no vulnerabilities are found, the Customer receives a "clean perimeter" PDF report free of charge.
- →CRITICAL (CVSS 9.0–10.0): 300,000 – 600,000 ₸;
- →HIGH (CVSS 7.0–8.9): 120,000 – 200,000 ₸;
- →MEDIUM (CVSS 4.0–6.9): 50,000 – 100,000 ₸;
- →LOW (CVSS 0.1–3.9): 15,000 – 40,000 ₸.
This payment model applies to the KEMEL PROBE service. The price of KEMEL BREACH starts from 1,200,000 ₸; the final amount depends on the scope of work and is fixed in the contract. The price of KEMEL GUARD is set by the contract based on the agreed scope of work.
2.1.Special terms for Red Team (KEMEL BREACH)
Scenarios that affect the operation of the Customer's systems (data modification, denial of service, etc.) are carried out only with the Customer's separate written consent, at an agreed time or on a test copy of the systems, and with an agreed recovery plan in place. The list of systems, timelines and permitted impact are fixed in the contract before work begins.
3.Authorization and scope of work
The Contractor does not start testing without written permission from the resource owner. Before work begins, the parties sign:
- →a testing agreement with a clearly defined scope;
- →Authorization Letter (written permission from the resource owner);
- →Scope Sheet — a list of domains, IP addresses and APIs;
- →NDA — a mutual, perpetual non-disclosure agreement.
All work is performed strictly within the agreed scope. Going beyond it is ruled out: unauthorized access is a violation of Art. 205 of the Criminal Code of the Republic of Kazakhstan.
4.Confidentiality
The fact of the request, the scope of work and audit results are confidential and protected by an NDA. Information is not disclosed to third parties under any circumstances, except where expressly required by the legislation of the Republic of Kazakhstan.
5.Reporting and retest
Upon completion of the work, the Customer always receives a PDF report — whether or not vulnerabilities were found. After the vulnerabilities are fixed, a free retest of the fixes is provided within the same scope.
6.Legal framework
The services are provided in accordance with:
- →Law of the Republic of Kazakhstan of 21.05.2013 No. 94-V "On Personal Data and Their Protection";
- →Rules for implementing personal data protection measures (Order No. 179/НҚ, as amended);
- →Criminal Code of the Republic of Kazakhstan, Art. 205 "Unlawful access to information" (work strictly within the scope);
- →OWASP WSTG, PTES — testing methodology;
- →СТ РК ISO/IEC 27001-2023 — information security management systems.
7.Limitation of liability
The Contractor performs testing with reasonable professional care; however, a pentest by its nature cannot guarantee the discovery of absolutely all vulnerabilities. The Contractor is not liable for the consequences of exploitation of vulnerabilities that existed before the work began, nor for failures caused by actions of the Customer or third parties outside the agreed scope. The extent of the parties' liability is determined by the concluded contract.
8.Contractor details
- →ТОО «AB.AI TECH» (brand KEMEL.TECH)
- →BIN: 210640016050
- →Address: 050045, Republic of Kazakhstan, Almaty, Bostandyk district, Yermensay microdistrict, Bulakty St., 1
- →Represented by Director Diyas Askarovich Burabay
- →Email: security@kemel-tech.kz