Credential Handover Disclaimer

Last updated: 10 April 2025 · Questions: support@neelnetworks.com · Governing law: Mumbai, India

This disclaimer applies whenever we provide login credentials to a client — CMS administrator access, hosting control panel, FTP or SFTP, database access, or any other access to the back end of a website.

The principle behind it is a simple one: whoever holds the access carries the responsibility. Once credentials are in your hands, changes made with them are yours, and putting right any resulting damage becomes chargeable work rather than maintenance.

We will always help. We would only ask you to understand that, in these circumstances, we help as paid work rather than as free cover. By requesting credentials from us, whether verbally or by email, you accept these terms.

This disclaimer supplements our Terms of Service and Annual Maintenance Plan Terms. Where they differ on a matter of credential handover, this page takes precedence.

“Credentials” and “access” here mean any of the following, whether provided by us or already held by you:

Access to any of these, in whole or in part, brings the responsibilities described below into effect.

Everything here follows from one principle: whoever controls the access controls the responsibility.

Where you hold the access

• You or your team hold and use the logins
• You are responsible for every change made with them
• We are not liable for resulting damage
• Fixes and recovery are quoted and billed separately
• Maintenance cover may be suspended for the affected areas

Where we hold the access

• We are the only party with back-end access
• We handle updates, fixes and technical upkeep
• Anything caused by our own code or configuration is put right at no cost
• Maintenance cover applies in full
• Monitoring and scheduled maintenance apply
• Third-party costs are approved by you before they are incurred

Many clients sit somewhere in between, holding their own logins while also engaging us for ongoing support. In that case we remain responsible for anything caused directly by our own work, and matters arising from your access remain yours.

Where you request and receive credentials from us, for any reason, the following applies from that moment:

• You accept full responsibility for all actions taken with those credentials, whether by you, your employees, your IT team or anyone else you share them with.
• We are not responsible for errors, broken features, downtime, data loss, slower performance or security incidents caused by changes made through your access.
• We are not responsible for the consequences of plugin installations, theme changes, code edits, database changes or server configuration changes made by you or on your behalf.
• We are not responsible for changes made by a developer, freelancer or agency you engage, even where we originally built the website.
• Investigation, repair, restoration and recovery arising from such changes are treated as new, chargeable work, quoted at our standard rates and requiring your written approval before we begin.
• Where credentials are held by you and a fault appears, we cannot assume the cause lies with us. The investigation needed to establish the cause is itself chargeable.

None of this means we will not help you. It means we will help as paid work. If something breaks, please call us; we will put it right quickly.

If you hold an Annual Maintenance Plan, the following actions — by you, your team or any third party with access — suspend our cover for the affected parts of the website:

• Installing or activating plugins or themes without telling us, particularly those that conflict with existing functionality, alter the database structure or modify core files
• Editing PHP files, theme files, functions.php or any custom code, through the CMS editor, FTP or any other means
• Changing the database directly through phpMyAdmin or a similar tool
• Changing hosting settings, the PHP version, server configuration or .htaccess without consulting us
• Upgrading CMS core, themes or plugins manually without coordination, especially major version upgrades that can break compatibility
• Giving another agency, freelancer or developer back-end access without informing us, since their changes fall outside our oversight
• Changing DNS settings, nameservers or email configuration without consulting us, as these can take a website offline and disrupt email in ways that are slow and costly to diagnose
• Deleting files, posts, products or database tables that were not clearly intended for deletion

Before making any change yourself, please do ask us. A short email takes a moment and can prevent days of recovery work. We are always happy to advise, or simply to do it for you safely.

Where you give access to a freelancer, another agency or a developer engaged after delivery:

• You become the responsible party for every change they make. The fact that we originally built the website does not transfer that responsibility back to us.
• We cannot be held responsible for broken functionality, data loss, design changes, performance problems or vulnerabilities introduced by another developer.
• Maintenance cover is suspended for all areas the third party has touched, until our team has carried out a formal handover and review. That review is chargeable.
• If their work needs to be undone or corrected, we will assess the website and quote for the remediation. It is not covered by any plan.

We would strongly encourage you to tell us before giving anyone access. We can advise on which roles and permissions to grant so that risk is kept low, and we are glad to coordinate with your chosen developer. If you need work that falls outside our current scope, please ask; we may well be able to do it ourselves.

What we would ask you to do

• Change every password immediately after receiving it from us. Please do not keep the credentials we issue as your permanent passwords.
• Use strong, unique passwords for each access point, and do not reuse them across services.
• Turn on two-factor authentication wherever it is available — CMS, hosting, registrar and email.
• Limit access to those who genuinely need it. Use restricted roles such as Editor or Author for team members who do not need full administrator rights.
• Do not share credentials over insecure channels such as SMS or plain email. A password manager with secure sharing is far safer.
• Revoke access promptly when someone no longer needs it.
• Keep an eye on your website for unusual activity, unexpected administrator accounts or unfamiliar file changes.

What we cannot be responsible for

• Weak or reused passwords chosen by you or your team
• Credentials shared with people who should not have them
• Two-factor authentication left switched off where it was available
• Plugins or themes installed by you that carry known vulnerabilities
• Credentials compromised on your own devices or email accounts
• Server-level vulnerabilities on hosting managed by you or a third party
• Delay in applying security updates after we have flagged them

If you suspect your website has been compromised, please contact us immediately at support@neelnetworks.com or on +91 91366 94505. We will assess the situation and provide an emergency response quotation within hours.

Website software — CMS core, plugins, themes and the PHP version — needs regular updating to stay secure and compatible. Where you manage your own access:

• Keeping everything up to date is your responsibility if you also manage your own hosting and back end.
• Updates can break things, particularly major version upgrades. We would strongly recommend testing on a staging environment before applying anything to a live website.
• Where an update applied by you or a third party breaks the website, restoring it is chargeable work rather than plan cover.
• We will tell you when a critical update is available. If you would like us to apply updates safely, we will quote for it as a separate task.
• Automatic updates are not advisable on a live website without a staging environment and a rollback plan. Where auto-updates are enabled without our knowledge, we cannot take responsibility for the outcome.

One particular caution: please never change the PHP version through your hosting panel without first confirming compatibility with your CMS, theme and every active plugin. A PHP mismatch is among the most common causes of a completely broken website, and among the easiest to avoid.

Backups are the single most valuable safety net you have.

• If you manage your own hosting, setting up, testing and maintaining regular backups of files and database is your responsibility.
• If we manage your hosting, scheduled backups form part of your plan. Even so, we would encourage you to keep an independent copy in a separate location.
• Please take a complete manual backup — files and database — before making any change, applying any update, or giving anyone access.
• Restoring a backup under client-managed access is a chargeable service. We will always act quickly, but it is not free work.
• We are not liable for data loss arising from missing, failed or corrupted backups caused by your hosting environment or actions.

As a routine, we would suggest a backup before every update, before granting anyone access, and once a week in any case. Five minutes can save several days.

Where we are the only party with back-end access, and credentials have not been taken or shared independently, we accept the following as part of your plan:

• We carry out all plugin, theme and CMS core updates on a safe, tested schedule
• We monitor uptime and respond to critical failures within your plan's response times
• Anything caused by our own configuration, code or update is fixed at no additional cost
• We maintain backups as agreed and can restore quickly if needed
• We notify you of vulnerabilities, incompatible plugins or hosting matters needing your attention
• Third-party costs such as premium plugin renewals, SSL and hosting upgrades are put to you for written approval before anything is incurred

In our experience the cleanest arrangement is one where we hold the technical access and you are free to concentrate on your business rather than on servers. That is how our maintenance plans are designed to work, and it is the model under which we can offer the strongest commitments.

So that there is no confusion when something goes wrong:

We are always transparent about billing before starting. You will never receive an unexpected invoice from us; chargeable work always needs your written approval first.

We are not liable for loss, damage, data corruption, business interruption, loss of revenue, reputational harm or any other loss arising from:

• Changes made to the website by you, your employees, your team or any third party you have given access to
• Security breaches, malware, hacking or data theft resulting from exposed credentials, weak passwords or access granted by you
• Downtime or data loss caused by actions taken through credentials you hold
• Plugin, theme or core updates applied by you or a third party without our oversight
• Failures of third-party services, platforms, hosting providers or APIs, whoever manages the hosting
• Automatic updates enabled without our knowledge
• Any consequential, indirect or punitive damages arising from the above

Where we are found liable for something arising from our own work, our total liability is limited to the amount paid for the particular service or project in the 6 months before the claim.

Nothing here excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded under Indian law.

This disclaimer is governed by the laws of India, and any dispute relating to it, to the handover of credentials, or to client-managed access is subject to the exclusive jurisdiction of the courts of Mumbai, Maharashtra. Both parties agree to attempt a resolution through good-faith discussion before beginning formal proceedings.

By requesting credentials from us, you confirm that you understand and accept the following:

• You are responsible for everything done with credentials in your possession
• Damage caused by your changes, or by a third party you authorise, is not covered by your plan
• Recovery and repair of such issues is always chargeable
• We will always help, as paid work rather than free maintenance
• You will tell us before giving any third party access to your website
• You will change every password immediately after receiving it from us

For any question about this disclaimer, or for help with an issue arising from client-managed access, please write to support@neelnetworks.com or call +91 91366 94505, Monday to Friday, 10:00 am to 7:00 pm IST.