Terms of Service

1. The service

A hosted platform for application security testing: agentic pentests of web applications and hosts you own, code scanning (SAST, SCA, IaC and secret scanning) of repositories you connect, AI verdicts, AI code review and AI-proposed fixes, and the reports that come from them. What each plan includes is listed on the pricing page.

2. Testing only what you are authorised to test

You may pentest only hosts you own or are explicitly authorised in writing to test, and you warrant that every host you add meets that condition for as long as it is tested.

Before any pentest the platform requires proof that you control the host (a DNS record or a file on the site), valid for 90 days. The proof is a safeguard, not a transfer of responsibility: you remain responsible for having the right to test. We may refuse, stop or suspend testing of any host we believe you are not authorised to test.

3. Pentests can change data

A pentest sends real attack traffic. It can create, change or delete data, trigger alerts and use resources on the target. Test a staging copy where you can, keep current backups, and tell anyone who runs or monitors the target before you start. Rules that limit testing of production reduce, but do not remove, this risk.

4. Acceptable use

You may not use the service to test systems you are not authorised to test, to get round the ownership proof or any plan limit, to attack us or other customers, to create organisations in bulk to multiply free allowances, or for anything unlawful.

5. Plans, prices and payment

Code scanning on the Free plan costs nothing and needs no card. Paid plans and pentest purchases are sold through Polar (polar.sh), which acts as our merchant of record: Polar is the seller of record, takes the payment, issues the invoice and handles sales tax and VAT. Prices are in US dollars, plus tax where it applies.

Subscriptions renew each month or year until cancelled. You can cancel at any time from Manage billing in the app; the plan stays until the end of the period already paid and then returns to Free. Launch prices are held for subscribers for 12 months from their first payment.

6. Pentest credits and refunds

A Pentest Pass is a credit for one pentest. An Audit Pentest is two credits, the pentest and its re-test, and adds a person validating every finding before the report is released, a signed attestation letter, and a re-test within 30 days of the report. Credits are valid for 12 months. A credit is used only after the month's pentest allowance on your plan, and is used when the pentest starts.

If a pentest is stopped on our side (it was skipped, failed because of our configuration, or found no worker to run it), the credit is returned automatically. A pentest that ran against the target is not refundable, whatever it found. Everything else about money back is in the Refund Policy (/refund), which is part of these terms; a refunded purchase removes its unused credits.

7. Your data

You own your code, targets, findings and reports. We process them only to provide the service, as described in the Privacy Policy. You can export them at any time, and closing your organisation deletes them 30 days later.

8. Results

Testing finds some vulnerabilities, not all of them. A clean result is not a guarantee that a system is secure, and the service does not make you compliant with any standard; it maps evidence to standards and says what it does not show.

9. Availability, suspension and ending

We aim to keep the service available but offer no uptime commitment unless agreed in writing. We may suspend an organisation for breach of these terms, unpaid amounts or abuse, and a Free organisation that has not completed a scan within 30 days of sign-up is warned and then suspended. You may close your organisation at any time.

10. Liability

To the extent the law allows, the service is provided as is, neither party is liable for indirect or consequential loss, and our total liability is limited to the amounts you paid for the service in the 12 months before the claim. Nothing limits liability that cannot be limited by law.

11. Changes

We may change these terms. Material changes are announced by email at least 30 days before they take effect, and continuing to use the service after that accepts them.

12. Governing law and disputes

These terms are governed by the laws of the State of Delaware, United States, excluding the UN Convention on Contracts for the International Sale of Goods. Before starting a claim, either side first tries for at least 30 days to settle it in good faith by writing to the other.

Disputes that are not settled go to binding arbitration administered by the American Arbitration Association, seated in Wilmington, Delaware, in English, on an individual basis: no class or representative actions. Either side may still ask the state or federal courts in Wilmington, Delaware for an injunction or to protect intellectual property.

Customers in the UAE keep their rights under UAE Federal Law No. 15 of 2020 (Consumer Protection). Consumers in the EU, the UK and elsewhere keep the protection of their home country's mandatory law and may bring claims in the courts where they live.

13. Contact

Legal notices: [email protected]. Support: [email protected]. Sales and annual contracts: [email protected]. Suspected unauthorised access: [email protected].