Terms of Service

1. Introduction and acceptance

By creating an account, accessing, or using the Intrudify platform, including all related services, tools, reports, and features (collectively, the "Service"), you acknowledge that you have read, understood, and agree to be bound by these Terms, the Acceptable Use Policy, and the Privacy Policy, all of which are incorporated herein by reference.

IF YOU DO NOT AGREE TO THESE TERMS, DO NOT CREATE AN ACCOUNT OR USE THE SERVICE.

You represent and warrant that you are authorized to bind the entity on whose behalf you are accepting these Terms. If you are accepting these Terms on behalf of an entity, all references to "you" or "Customer" herein shall refer to such entity.

2. Eligibility and account registration

2.1 Eligibility

The Service is available only to legal entities and individuals acting in a professional or business capacity. The Service is not intended for personal or consumer use. By using the Service, you represent and warrant that:

• You are at least 18 years of age;
• You are acting on behalf of a legally registered business entity;
• You have the authority to bind such entity to these Terms; and
• Your use of the Service does not violate any applicable law or regulation.

2.2 Account registration

To access the Service, you must create an account by providing:

• Your full legal business name and company registration number;
• A valid business email address (freemail providers such as Gmail, Yahoo, Outlook, and ProtonMail are not accepted);
• Your business address;
• The full name and role of the account administrator; and
• Valid payment information (credit card or other accepted payment method).

You must verify your business email address through the confirmation process provided by Intrudify before your account is activated. You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

2.3 Account accuracy

You agree that all information provided during registration and throughout your use of the Service is accurate, current, and complete. You agree to promptly update your account information if any changes occur. Intrudify reserves the right to suspend or terminate any account that contains materially inaccurate, fraudulent, or incomplete information.

3. Description of service

Intrudify provides an AI-powered automated penetration testing platform for web applications and related digital assets. The Service includes, but is not limited to:

• Automated penetration testing of web applications, APIs, and related endpoints;
• Generation of compliance-grade security assessment reports;
• AI-powered remediation guidance for identified vulnerabilities;
• An Intrudify Security Score measuring the security posture of tested applications; and
• Continuous security monitoring through subscription plans.

The specific features, scope, and capabilities available to you depend on the service tier and plan you have purchased.

4. Authorization warranty and attestation

THIS SECTION CONTAINS CRITICAL OBLIGATIONS. PLEASE READ IT CAREFULLY.

4.1 Authorization warranty

You represent, warrant, and covenant that for every domain, URL, application, API endpoint, or digital asset (collectively, "Target") that you submit for scanning through the Service, you either own the Target or possess valid written authorization from the legal owner of the Target to conduct automated penetration testing on such Target.

Specifically, you warrant that for each Target submitted, at least one of the following conditions is true:

• Ownership: You are the legal owner of the Target and have full authority to authorize security testing on it; or
• Third-Party Authorization: You possess valid, written authorization from the legal owner of the Target, signed by a person with actual authority to grant such permission, which explicitly authorizes automated penetration testing of the Target within the scope and timeframe of the testing conducted through Intrudify.

4.2 Per-target attestation

Each time you add a new Target to the platform for scanning, you will be required to confirm, through the platform's attestation mechanism, that you have the legal right to authorize penetration testing on that Target. This attestation is logged by Intrudify with a timestamp, your account details, and your IP address, and constitutes a binding representation under these Terms.

You are solely and fully responsible for ensuring that you hold valid authorization for every Target you submit. Intrudify relies on your attestation and is not obligated to independently verify your authorization. Your attestation does not transfer or reduce your liability in any way.

4.3 Obligation to retain and produce authorization documentation

Where you are scanning a Target that you do not own, you must obtain and retain written authorization from the Target owner for the duration of the testing and for a minimum period of thirty-six (36) months following the last scan of that Target. Intrudify provides a Scan Authorization Template for this purpose, available within the platform, which you may use or adapt.

Intrudify reserves the right to request proof of authorization for any Target at any time. You must produce such documentation within five (5) business days of Intrudify's request. Failure to produce valid authorization documentation upon request constitutes a material breach of these Terms and may result in the consequences set forth in Section 4.5.

4.4 Ongoing authorization obligation

The authorization warranty in Section 4.1 is a continuing obligation. You must ensure that valid authorization remains in effect for the entire duration of any scan and, for subscription customers, for the entire period during which continuous testing is active. If authorization is revoked or expires for any Target, you must immediately cease all testing of the affected Target and notify Intrudify.

4.5 Consequences of unauthorized scanning

If Intrudify determines, in its reasonable judgment, that you have initiated or attempted to initiate a scan on a Target for which you lack proper authorization, or if you fail to produce valid authorization documentation upon request:

• Intrudify may immediately suspend or terminate your account without prior notice;
• All fees paid are non-refundable;
• Intrudify reserves the right to report the incident to relevant law enforcement authorities;
• Intrudify will cooperate fully with any law enforcement investigation, including providing all account data, scan logs, attestation records, payment records, and IP addresses; and
• You will be subject to the full indemnification obligations set forth in Section 10.

5. Permitted and prohibited uses

Your use of the Service is subject to the Acceptable Use Policy ("AUP"), which is incorporated into these Terms by reference. In the event of a conflict between the AUP and these Terms, the more restrictive provision shall apply.

Without limiting the AUP, you agree that you shall not:

• Use the Service to scan, test, or interact with any Target for which you lack proper authorization as defined in Section 4;
• Use the Service for any purpose that violates applicable laws, including but not limited to computer fraud and abuse laws, data protection regulations, or the EU Convention on Cybercrime;
• Use scan results, reports, or findings for extortion, blackmail, unauthorized disclosure, competitive intelligence, or any purpose other than improving the security posture of the Target;
• Attempt to reverse engineer, decompile, disassemble, or otherwise derive the source code, algorithms, or underlying technology of the Service;
• Share, transfer, or sublicense your account credentials to any third party;
• Interfere with, disrupt, or attempt to gain unauthorized access to the Service, its infrastructure, or other users' accounts;
• Use the Service to build a competing product or service; or
• Circumvent, disable, or otherwise interfere with any security, verification, or access-control features of the Service.

6. Fees and payment

6.1 Pricing

The fees for the Service are as published on the Intrudify website or as agreed in a separate order form. All fees are stated in Dollars ($) unless otherwise specified. Intrudify reserves the right to modify its pricing at any time, provided that any price changes will not affect active subscription periods already paid for.

6.2 Payment terms

All fees are due and payable at the time of purchase for one-time pentests, or at the beginning of each billing cycle for subscription plans. Payment must be made via the payment methods accepted by Intrudify. All fees are non-refundable except as expressly stated in these Terms.

6.3 Taxes

All fees are exclusive of applicable taxes, including but not limited to value-added tax (VAT), sales tax, or similar levies. You are responsible for all such taxes applicable to your purchase, except for taxes based on Intrudify's net income.

6.4 Late payment

If any payment is not received by Intrudify within ten (10) days of the due date, Intrudify may, without limiting its other rights and remedies: (a) charge interest on the overdue amount at the rate of 1.5% per month or the maximum rate permitted by applicable law, whichever is lower; (b) suspend your access to the Service until all outstanding amounts are paid in full; and (c) pursue collection of all amounts owed, including reasonable attorneys' fees and costs.

7. Intellectual property

7.1 Intrudify's intellectual property

The Service, including all software, algorithms, AI models, user interfaces, documentation, reports templates, methodologies, and all related intellectual property rights, are and shall remain the exclusive property of Intrudify or its licensors. Nothing in these Terms grants you any right, title, or interest in the Service except for the limited license to use the Service as expressly set forth herein.

7.2 License to use the service

Subject to your compliance with these Terms and payment of all applicable fees, Intrudify grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service during the applicable subscription period, solely for your internal business purposes and in accordance with these Terms and the Documentation.

7.3 Customer data

You retain all right, title, and interest in and to the data, information, and materials you provide to the Service ("Customer Data"). You grant Intrudify a limited, non-exclusive license to process Customer Data solely as necessary to provide the Service. Intrudify will not use Customer Data for any other purpose without your prior written consent.

7.4 Scan results and reports

The scan results and reports generated by the Service for your Targets are provided to you for your internal use. Intrudify retains ownership of the report templates, methodologies, and scoring algorithms. You may share reports with third parties (such as auditors, regulators, or clients) as reasonably necessary for compliance and security purposes, provided that such reports retain the Intrudify watermark and branding.

7.5 Feedback

If you provide Intrudify with any suggestions, comments, improvements, or other feedback regarding the Service ("Feedback"), you hereby grant Intrudify a perpetual, irrevocable, worldwide, royalty-free license to use, modify, and incorporate such Feedback into the Service without any obligation to you.

8. Data protection and privacy

8.1 Privacy Policy

Intrudify's collection, use, and processing of personal data in connection with the Service is governed by the Privacy Policy. The Privacy Policy is incorporated into these Terms by reference.

8.2 Data Processing Agreement

To the extent that Intrudify processes personal data on your behalf in connection with the Service (including personal data that may be encountered during the scanning of your Targets), the Data Processing Agreement ("DPA") shall apply and is incorporated into these Terms by reference.

8.3 Data encountered during scans

You acknowledge that during the course of penetration testing, the Service may encounter personal data, credentials, session tokens, or other sensitive information present on or transmitted by the Target application. Intrudify processes such data solely for the purpose of performing the security assessment and generating the pentest report. Intrudify does not retain such data beyond what is necessary for report generation and delivery, subject to the retention periods specified in the DPA.

8.4 Your obligations as data controller

Where the Target application contains personal data for which you are the data controller (as defined under GDPR), you are responsible for ensuring that you have a valid legal basis to engage Intrudify as a data processor to access and process such data in the course of the security assessment. You represent and warrant that any necessary data protection impact assessments have been conducted and that all required consents or legal bases are in place.

9. Confidentiality

9.1 Definition

"Confidential Information" means any non-public information disclosed by one party to the other in connection with these Terms, whether orally, in writing, or electronically, that is designated as confidential or that, given the nature of the information or the circumstances of disclosure, should reasonably be understood to be confidential. Confidential Information includes, without limitation, scan results, pentest reports, vulnerability findings, business plans, pricing, customer lists, and technical information.

9.2 Obligations

Each party agrees to: (a) hold the other party's Confidential Information in strict confidence; (b) not disclose such Confidential Information to any third party except as permitted herein; and (c) use such Confidential Information only for the purposes of exercising its rights or performing its obligations under these Terms. Each party may disclose Confidential Information to its employees, contractors, and advisors who have a need to know and who are bound by confidentiality obligations at least as protective as those set forth herein.

9.3 Exceptions

Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was rightfully in the receiving party's possession prior to disclosure; (c) is rightfully received from a third party without restriction; or (d) is independently developed by the receiving party without use of or reference to the disclosing party's Confidential Information.

9.4 Required disclosures

Either party may disclose Confidential Information to the extent required by applicable law, regulation, or court order, provided that the disclosing party gives the other party prompt written notice (to the extent legally permitted) and cooperates in seeking a protective order or other appropriate remedy.

10. Indemnification

THIS SECTION CONTAINS IMPORTANT OBLIGATIONS REGARDING LEGAL LIABILITY AND COSTS. PLEASE READ IT CAREFULLY.

10.1 Customer indemnification

You shall indemnify, defend, and hold harmless Intrudify, its founders, officers, directors, employees, agents, and affiliates (collectively, the "Intrudify Parties") from and against any and all claims, demands, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and legal costs) (collectively, "Losses") arising out of or relating to:

• Your use of the Service on any Target for which you lacked proper authorization as required by Section 4;
• Any breach of the authorization warranty set forth in Section 4.1;
• Any fraudulent, misleading, or inaccurate attestation made in connection with the Target authorization process under Section 4.2, including false confirmation that valid authorization has been obtained;
• Any violation of applicable law by you or your authorized users in connection with the use of the Service, including but not limited to computer fraud and abuse laws, data protection regulations, or criminal statutes;
• Any third-party claim resulting from your use of scan results, reports, or findings in a manner not permitted by these Terms;
• Any breach of the Acceptable Use Policy; and
• Any claim by a third party that the Customer Data or your use of the Service infringes or misappropriates such third party's intellectual property or other rights.

10.2 Indemnification procedure

The indemnified party shall: (a) provide prompt written notice of any claim for which indemnification is sought; (b) grant the indemnifying party sole control of the defense and settlement of such claim (provided that the indemnifying party may not settle any claim that imposes any obligation on the indemnified party or includes any admission of liability without the indemnified party's prior written consent); and (c) provide reasonable cooperation in the defense of such claim at the indemnifying party's expense.

10.3 Intrudify indemnification

Intrudify shall indemnify, defend, and hold harmless Customer from and against any Losses arising out of a third-party claim alleging that the Service, when used in accordance with these Terms, infringes or misappropriates such third party's intellectual property rights. This indemnification obligation does not apply to claims arising from: (a) modifications to the Service not made by Intrudify; (b) use of the Service in combination with products or services not provided by Intrudify; (c) Customer Data; or (d) use of the Service in violation of these Terms.

10.4 Survival

The indemnification obligations set forth in this Section 10 shall survive the termination or expiration of these Terms for a period of thirty-six (36) months following the date of the last scan conducted by the Customer through the Service.

11. Limitation of liability

11.1 Exclusion of consequential damages

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF PROFITS, GOODWILL, DATA, BUSINESS OPPORTUNITY, OR ANTICIPATED SAVINGS, REGARDLESS OF WHETHER SUCH DAMAGES WERE FORESEEABLE AND WHETHER EITHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

11.2 Cap on liability

EXCEPT FOR (A) CUSTOMER'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 10.1, (B) CUSTOMER'S BREACH OF SECTION 4 (AUTHORIZATION WARRANTY), AND (C) EITHER PARTY'S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS UNDER SECTION 9, THE TOTAL AGGREGATE LIABILITY OF EITHER PARTY UNDER OR IN CONNECTION WITH THESE TERMS SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO INTRUDIFY IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

12. Warranty disclaimer

EXCEPT AS EXPRESSLY SET FORTH IN THESE TERMS, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, OR THAT THE SERVICE WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE.

Intrudify does not warrant that the Service will detect all vulnerabilities in a Target, that the Service will be free of false positives or false negatives, or that the scan results will be suitable for any particular compliance, certification, or regulatory purpose. The Service is a tool designed to assist in identifying potential security issues and does not replace a comprehensive security program.

13. Term and termination

13.1 Term

These Terms become effective when you first create an account or use the Service and remain in effect until terminated by either party in accordance with this section.

13.2 Termination by Customer

You may terminate your account at any time by providing written notice to Intrudify. For subscription customers, termination will take effect at the end of the current billing period. No refunds will be issued for partial billing periods.

13.3 Termination by Intrudify

Intrudify may terminate or suspend your account: (a) immediately and without prior notice if you breach Section 4 (Authorization Warranty), Section 5 (Permitted and Prohibited Uses), or the Acceptable Use Policy; (b) upon thirty (30) days' written notice if you breach any other provision of these Terms and fail to cure such breach within the notice period; or (c) immediately if you become subject to bankruptcy, insolvency, or similar proceedings.

13.4 Effect of termination

Upon termination: (a) your license to use the Service immediately terminates; (b) you must cease all use of the Service; (c) Intrudify will retain your account data, scan logs, and uploaded authorization documents for the period required by applicable law and as necessary to enforce these Terms; and (d) all fees owed by you to Intrudify become immediately due and payable. Sections 4, 7, 8, 9, 10, 11, 12, 14, and 15 shall survive termination.

14. Right to report and law enforcement cooperation

Intrudify reserves the right to report suspected unauthorized use of the Service to relevant law enforcement authorities in any applicable jurisdiction. In the event of any investigation by law enforcement or regulatory authorities relating to the use of the Service, Intrudify will cooperate fully with such authorities, including by providing all relevant account data, scan logs, attestation records, payment records, IP addresses, and any other information in Intrudify's possession. You acknowledge and agree that Intrudify's cooperation with law enforcement under this section does not constitute a breach of any confidentiality obligation owed to you.

15. Governing law and dispute resolution

15.1 Governing law

These Terms shall be governed by and construed in accordance with the laws of Romania, without regard to its conflict of law principles.

15.2 Jurisdiction

Any dispute arising out of or in connection with these Terms shall be submitted to the exclusive jurisdiction of the competent courts of Bucharest, Romania.

15.3 Amicable resolution

Before initiating any formal legal proceedings, the parties agree to attempt in good faith to resolve any dispute through direct negotiation for a period of thirty (30) days following written notice of the dispute.

16. General provisions

16.1 Entire agreement

These Terms, together with the Acceptable Use Policy, Privacy Policy, Data Processing Agreement, and any applicable order forms, constitute the entire agreement between you and Intrudify with respect to the subject matter hereof and supersede all prior or contemporaneous agreements, understandings, and communications.

16.2 Amendments

Intrudify reserves the right to modify these Terms at any time. Material changes will be communicated to you via email to the address associated with your account at least thirty (30) days before the changes take effect. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the modified Terms.

16.3 Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the remaining provisions shall continue in full force and effect.

16.4 Assignment

You may not assign or transfer these Terms or any of your rights or obligations hereunder without Intrudify's prior written consent. Intrudify may assign these Terms in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets.

16.5 No waiver

The failure of either party to enforce any provision of these Terms shall not constitute a waiver of such provision or the right to enforce it at a later time.

16.6 Force majeure

Neither party shall be liable for any failure or delay in performing its obligations under these Terms where such failure or delay results from circumstances beyond the party's reasonable control, including but not limited to natural disasters, pandemics, war, terrorism, riots, government actions, power failures, internet failures, or cyberattacks.

16.7 Notices

All notices under these Terms shall be in writing and shall be sent to the email address associated with your Intrudify account (for notices to Customer) or to [email protected] (for notices to Intrudify). Notices are deemed received upon confirmed delivery.

16.8 Independent contractors

The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, franchise, or employment relationship between the parties.

16.9 Language

These Terms are drafted in English. In the event of any discrepancy between the English version and any translation, the English version shall prevail.

BY CREATING AN ACCOUNT OR USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THESE TERMS OF SERVICE.