Terms and Conditions

These Terms and Conditions ("Terms") govern access to and use of the Vulnix agentic penetration-testing platform, including the Vulnix website, dashboard, APIs, and any related services (collectively, the "Platform"), provided by Vulnix ("Vulnix," "we," "us," or "our").

By creating an account, connecting a domain or repository, or otherwise accessing the Platform, you agree to be bound by these Terms on behalf of yourself and, if applicable, the organization you represent ("Customer," "you"). If you do not agree, do not use the Platform.

• "Account" means a Vulnix organization or user account created to access the Platform.
• "Customer Data" means any data, domains, source code, repositories, credentials, or other content that Customer submits to or connects with the Platform for the purpose of running a pentest, PR review, or related scan.
• "Findings" means the vulnerabilities, exploit proofs, reports, and remediation guidance generated by the Platform as a result of testing Customer Data.
• "Documentation"means Vulnix's published user documentation for the Platform, as updated from time to time.
• "Intellectual Property Rights" means all patent, copyright, trademark, trade secret, and other intellectual property rights recognized in any jurisdiction.

The Platform runs agentic security testing — including Blackbox Pentesting (live targets: web applications, APIs, and verified domains), Whitebox Pentesting (connected source-code repositories), PR Review, and Validate-Fix re-testing — against the targets and repositories Customer explicitly scopes and verifies ownership of.

Subject to Customer's compliance with these Terms and payment of applicable fees, Vulnix grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Platform during the subscription term, solely for Customer's own internal business purposes.

You must be at least 18 years old and have the authority to bind your organization to register for an Account. You are responsible for the accuracy of the information provided during registration and for all activity that occurs under your Account.

Customer represents and warrants that it owns, or has obtained all necessary authorization to test, every domain, repository, application, and system it scopes into the Platform. Vulnix requires domain ownership verification before any live (Blackbox) testing begins, and repository access is granted exclusively through Customer's own GitHub App installation for Whitebox testing and PR Review.

Customer is solely responsible for ensuring it has the legal right to authorize security testing against any target it submits, including any third-party infrastructure, and for any consequences of testing systems it was not authorized to test.

Customer will not, and will not permit any third party to: (a) reverse engineer, decompile, or disassemble the Platform; (b) modify, translate, or create derivative works of the Platform; (c) sell, resell, license, sublicense, distribute, rent, or lease the Platform, or use it in any timesharing or service bureau arrangement; (d) remove or obscure any proprietary notices; (e) publicly disclose Findings or benchmark results without Vulnix's prior written consent; or (f) interfere with or disrupt the integrity or performance of the Platform.

Vulnix implements commercially reasonable technical, administrative, and organizational measures designed to protect the confidentiality, integrity, and availability of Customer Data. Findings and exploit proofs generated by the Platform are stored using access-controlled infrastructure and are visible only to Customer's own organization members.

Customer is responsible for maintaining the confidentiality of its Account credentials, API keys, and any GitHub App installation tokens, and for promptly notifying Vulnix of any suspected unauthorized access. No method of transmission or storage over the internet is completely secure, and Vulnix cannot guarantee absolute security.

Fees for paid subscription plans are set out in an applicable order form, invoice, or in-product checkout, are billed monthly in advance, and are non-refundable except as required by law. Late payments may accrue interest at 1.5% per month or the maximum rate permitted by law, whichever is lower. Any good-faith billing dispute must be raised in writing within 30 days of the applicable invoice.

These Terms remain in effect for as long as Customer maintains an Account. Paid subscriptions renew automatically for successive terms unless cancelled in accordance with the applicable order form.

Either party may terminate for the other party's uncured material breach following 30 days' written notice. Upon termination, Customer's access to the Platform ceases immediately, and Vulnix may delete Customer Data and Findings after a reasonable retention period, except as required to comply with law.

Vulnix warrants that the Platform will substantially conform to the Documentation when used as intended. EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE PLATFORM IS PROVIDED "AS IS," AND VULNIX DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. VULNIX DOES NOT WARRANT THAT THE PLATFORM WILL IDENTIFY EVERY VULNERABILITY PRESENT IN A TESTED SYSTEM.

Vulnix will defend Customer against third-party claims alleging that the Platform infringes that third party's intellectual property rights, and will indemnify Customer against damages finally awarded, subject to prompt notice and Vulnix's control of the defense. This obligation does not apply to claims arising from Customer's modification of the Platform, use in combination with unauthorized third-party products, or use in violation of these Terms.

Each party will protect the other party's confidential information with the same degree of care it uses for its own similar information, and no less than reasonable care, and will not disclose it except to employees, contractors, and advisors bound by confidentiality obligations. This section survives for three years after termination, except for trade secrets, which remain protected for as long as they qualify as trade secrets under applicable law. This obligation does not extend to information that is or becomes publicly available through no fault of the receiving party.

Customer retains all rights to Customer Data and Findings. Customer is solely responsible for the accuracy and legality of Customer Data submitted to the Platform. Vulnix may use de-identified, aggregated data derived from Platform usage to maintain, improve, and develop the Platform, including its underlying agentic testing engine, provided such data does not identify Customer or reveal Customer's specific vulnerabilities.

EXCEPT FOR BREACHES OF THE CONFIDENTIALITY SECTION OR EITHER PARTY'S INDEMNIFICATION OBLIGATIONS, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, AND EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO VULNIX IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

These Terms are governed by the laws of [Governing Jurisdiction — to be finalized with counsel], without regard to its conflict-of-laws principles. Each party waives any right to a jury trial in any action arising out of these Terms.

Customer will not use or export the Platform in violation of applicable export control and sanctions laws, and represents that it is not located in, or ordinarily resident in, any country subject to a comprehensive embargo, and is not on any restricted party list.

Vulnix may update these Terms from time to time; material changes will be notified via the Platform or email, and continued use after the effective date constitutes acceptance. These Terms constitute the entire agreement between the parties regarding the Platform and supersede any prior agreements on the subject matter. If any provision is held unenforceable, the remaining provisions remain in full force and effect.

Questions about these Terms can be sent to hello@vulnix.dev.