Terms of Service

These Terms of Service ("Terms") govern your access to and use of Necio, an AI security testing and behavioral compliance platform ("Service") operated by Prompt SecOps, LLC ("Prompt SecOps", "we", "us", or "our"). By creating an account or using the Service, you agree to these Terms. If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

These Terms incorporate by reference our Privacy Policy, Acceptable Use Policy, the Security Testing Authorization set out in Section 3, the Export Control Compliance requirements set out in Section 13, and any other policy or notice presented during registration or use of the Service. The Security Testing Authorization and Export Control Compliance acknowledgments you accept during registration, and the testing authorization you confirm before a scan, restate obligations in those Sections; they are not separate documents.

Role of the Service: You Operate the Testing

Necio is a testing tool. Prompt SecOps does not authorize, select, direct, or perform testing against any system. You decide which targets to configure, which credentials and files to supply, which templates and campaigns to run, and when and how often they run. When you launch or schedule a scan, the Service carries out that instruction: it transmits prompts, including prompts the Service generates for you, to the targets you selected, and records and grades what comes back. You are the operator of the testing activity, just as a penetration tester, not the maker of the tools on the tester's laptop, is the one who conducts an engagement.

As between you and Prompt SecOps, any harm to a third party arising from testing you configure, launch, or schedule, including harm alleged by a system owner, model provider, platform, or individual, is your legal responsibility and is subject to your defense and indemnity obligations in Section 11. To the extent applicable law treats Prompt SecOps as a provider of an interactive computer service, Prompt SecOps does not create or develop the targets you configure, the content those targets return, or the content you submit.

No duty to monitor or warn. Nothing in these Terms or our policies creates a duty on Prompt SecOps to monitor, pre-screen, or review scan content, targets, schedules, or outcomes; to verify that your testing is authorized; or to warn or notify any third party. The safeguards, reviews, investigations, and enforcement actions described in these Terms, including Section 12, are discretionary. Taking one on one occasion does not oblige us to take it on another, and none of them creates a duty to you or to any third party. We cooperate with lawful investigations and legal process as described in our Privacy Policy; that cooperation does not make Prompt SecOps a participant in your testing or responsible for it.

AI Can Make Mistakes — Human Verification Required

Necio is built on artificial intelligence, and artificial intelligence makes mistakes. Prompts, grades, scores, verifications, summaries, and reports produced by the Service may be inaccurate, incomplete, out of date, or fabricated, including when more than one model agrees. A reported finding may be a false positive, and the absence of a finding is not evidence that a system is secure.

You are responsible for having a qualified human review and independently verify every result before you rely on it, act on it, share it, or present it to anyone else — including for remediation, disclosure, procurement, audit, or compliance decisions. Necio is intended to support professional judgment, not to replace it.

To the maximum extent permitted by applicable law, Prompt SecOps is not responsible or liable for any decision you make, action you take, or loss you suffer in reliance on Service output. Sections 8, 9, and 10 govern.

Sensitive Evidence & Grading

The Service masks detected sensitive values in evidence presented through the app, reports, exports, notifications, and telemetry. You authorize this processing to reduce further exposure while retaining useful context and detection information. Original evidence is still processed by authorized testing and grading workflows as described in our Privacy Policy; masking does not alter grading inputs or scores.

Evidence masking may remove details from exported material, and browser artifacts may use sanitized text reconstructions in place of source-page images. Unverified historical images may be unavailable. Detection is automated and is not a guarantee of anonymization or complete discovery of personal information or secrets. You remain responsible for reviewing findings and taking appropriate action on exposed credentials or personal data.

1. Description of Service

Necio provides automated vulnerability scanning, behavioral integrity monitoring, and compliance reporting for large language model (LLM) applications and AI systems. The Service sends security testing prompts, including adversarial prompts and any files you attach to them, to AI systems you configure, analyzes responses, and produces security reports aligned with frameworks such as OWASP Top 10 for LLM Applications.

Target types. A target may be an API endpoint you hold a key for; a browser-based chat interface, which the Service reaches by driving an automated browser session against a URL you supply and, where required, signing in with credentials you supply; or a bot reached through a messaging channel such as Discord, Slack, Telegram, or Microsoft Teams, where the Service may create a temporary channel and invite the bot in order to run the test. Browser-driven and channel-based testing are beta features.

How test prompts are generated. The Service generates adversarial test prompts and Maestro campaign turns using AI models we select, including open-weight models. This is deliberate: real attackers use openly available models, and a model with fewer built-in refusals produces payloads that resemble what an adversary would actually send. Generating realistic attack payloads is the function the Service performs. Accordingly, prompts generated by the Service may be blunt, manipulative, deceptive, or offensive by design, and may contain content a consumer-facing assistant would decline to produce. They are testing artifacts, intended solely to be sent to systems you are authorized to test. We select these models for testing fidelity in authorized, professional security work. Generated prompts are made available only to your account and are transmitted only to the targets you configure; the Service does not supply them to anyone else, and you decide where they go by choosing the target and launching the run. See Section 8.

Web search and cited sources. Certain features of the Service, including prompt generation and response verification, may use web search through third-party search providers to ground output in current threat research. Search results originate from third parties and are used as reference material only.

For web searches, the third-party search provider retrieves the pages. The Service receives text excerpts and web addresses. It does not fetch, download, or execute content from cited sites. Citations identify the source of retrieved text. They do not indicate that we reviewed, endorsed, or checked the safety of a site. We do not control or inspect those sites. Search results can be in any language and may be inaccurate, misleading, machine-translated, republished, or hostile. You are responsible for deciding whether to open a cited link, and you do so at your own risk.

2. Eligibility & Account Registration

You must be at least 18 years old and capable of forming a binding contract to use the Service. The Service is a professional tool intended for security, engineering, risk, and compliance work performed for yourself or for an organization. It is not designed or offered as a consumer product and is not intended for personal, family, or household use. You agree to provide accurate account information and to keep it current. You are responsible for all activity under your account. Notify us immediately at [email protected] if you suspect unauthorized access.

If you register or sign in using a third-party identity provider (such as Google), you authorize us to receive your name, email address, and verified-email status from that provider, and you are responsible for maintaining the security of your account with that provider. Your use of the identity provider is governed by its own terms and privacy policy.

You are responsible for protecting every credential you submit, including API keys, browser sign-in credentials, bot tokens, and channel identifiers. Use credentials with permissions appropriate to the authorized test. You represent that you are entitled to use each credential. Do not submit another person's credentials. We strongly recommend a dedicated test account instead of a personal or production account. Rotate credentials according to your organization's policy and immediately after actual or suspected exposure. To replace a saved schedule credential, open the Schedule page through Edit schedule; future runs will use the replacement credential.

3. Authorized Use: Security Testing

Necio is a professional security testing tool. You may only use it to test AI systems and LLM endpoints that you own or for which you have explicit written authorization from the system owner.

By using the Service you represent and warrant that:

• You have legal authority to test every AI system, endpoint, chat interface, or bot you configure in Necio
• Your use complies with all applicable laws, regulations, and the terms of service of any third-party provider or platform you target
• You will not use the Service to harass, harm, or disrupt systems you do not own or have permission to test
• For a browser-based target, you are authorized to access and to automate that interface, and you authorize the Service's automated session to accept cookie, consent, and terms-of-use dialogs on that site on your behalf in order to reach the chat
• For a channel-based target, you are authorized to create channels in, invite bots to, and send messages through the workspace, server, or account you configure, and to test the bot you name
• You hold the rights necessary to attach each file you upload and to transmit it to the target
• Your authorization covers the particular targets, test activities, automation, and testing period you select; you must obtain, maintain, and provide the evidence required below and stop testing when permission expires or is withdrawn

Holding an account is not authorization to attack it. Being a legitimate user of a third-party chat service, workspace, or bot does not by itself give you the right to run adversarial testing against it or to automate it. Several providers prohibit both in their terms. Authorization to test must come from the party that owns the system.

Before any testing, you must obtain and maintain evidence of ownership or explicit written authorization from the legal owner, together with a documented testing scope. Evidence must identify the owner, the person granting permission and their authority, the tester, the specific targets, permitted activities and automation, limits, and testing period. Depending on your relationship to the target, this must include proof of ownership or a signed permission letter, contract, or scope-of-work document expressly authorizing the testing. Administrative access, credentials, or job responsibilities alone are not proof of authorization. Keep that evidence current for recurring scans and provide it to us on request; we may require it before a scan is permitted to begin or resume. Do not start or continue testing if evidence is missing, permission has expired or been withdrawn, or the activity exceeds the documented scope.

The Service records your authorization attestation at registration, each time you start a scan, and when you create a schedule. It does not collect or review your authorization evidence before each scan. Keeping that evidence is your obligation, and our not requesting it is not a determination that your testing is authorized.

High-risk targets. You must not use Necio to scan, probe, or otherwise test government systems, critical infrastructure, systems operated by financial institutions, medical or healthcare systems, regulated AI systems, or systems subject to export controls. These target restrictions apply even if you own the system or have permission to test it. You must not test any target where the activity, transfer of technology or data, destination, end user, or end use would violate applicable export controls or sanctions. If you cannot determine whether a target falls within a restricted category, do not test it and contact us before proceeding.

Prompt SecOps is not liable for any unauthorized or illegal testing you conduct using the Service. Unauthorized testing of third-party systems may violate the Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, or equivalent laws in your jurisdiction.

4. Prohibited Uses

Abusive use, including malicious intent, attempts, preparation, and assistance as defined in our Acceptable Use Policy, is prohibited even if no attack succeeds or harm occurs. A claim of research, experimentation, or ignorance of target ownership does not remove your authorization obligations.

You agree not to:

• Use the Service to attack, disrupt, or degrade systems you do not have authorization to test
• Use the Service's prompt generation to produce jailbreaks, attack payloads, or other adversarial content for use outside authorized testing of systems you control
• Use the Service to obtain restricted AI content for purposes other than testing your configured target, or to bypass another provider's safety controls
• Extract, stockpile, publish, or resell prompts generated by the Service as an attack toolkit or dataset
• Use browser automation or channel features to defeat a target's access controls, anti-automation measures, bot detection, CAPTCHAs, or rate limits where you are not authorized to do so
• Submit credentials belonging to another person, or credentials you are not entitled to use
• Attempt to circumvent authentication, rate limits, or security controls of the Service itself
• Scrape, resell, or redistribute Necio's proprietary prompt templates without written permission
• Reverse engineer, decompile, or extract source code from the Service
• Use the Service for any unlawful purpose or in violation of any applicable regulations
• Impersonate another user, organization, or Prompt SecOps employee
• Upload or transmit malware, viruses, or malicious code through the Service
• Submit, request, generate, test, store, distribute, or attempt to obtain child sexual abuse material (CSAM), child sexual exploitation material, sexual content involving minors, or instructions involving exploitation of minors
• Use the Service to create, facilitate, or conceal sexual exploitation, non-consensual sexual imagery, trafficking, grooming, extortion, harassment, doxxing, credential theft, phishing, malware deployment, unlawful surveillance, or other criminal activity
• Use the Service to plan, facilitate, or promote terrorism or violent extremism; to develop, acquire, or deploy chemical, biological, radiological, or nuclear weapons; or to attack, disrupt, or compromise critical infrastructure
• Use the Service in violation of export control laws, sanctions, embargoes, or restrictions on prohibited end users, jurisdictions, or end uses

You are solely responsible for all prompts, uploads, targets, outputs, and activity under your account. Prompt SecOps does not author, direct, endorse, or assume responsibility for user-generated prompts or illegal use of the Service. If you submit, request, generate, test, store, or distribute CSAM, child sexual exploitation material, sexual content involving minors, or other illegal sexual content, you may be reported to law enforcement and are solely responsible for any civil, criminal, regulatory, or other legal consequences.

5. Subscriptions, PAYGO Credits & Billing

Subscription plans are billed in advance on a monthly or annual cycle through Stripe. Prepaid PAYGO purchases are one-time payments, with automatic top-ups only when separately authorized as described below. You authorize the payments you confirm and any applicable taxes disclosed at checkout.

Prepaid pay-as-you-go (PAYGO). New accounts start on prepaid PAYGO without a credit purchase or payment method. After registration, you can set up your Use Case Applications and templates. Purchase credits before starting billable AI work, including AI prompt generation and scans. Credit purchases start at $5 through Stripe; generation and scan costs are deducted from your available balance. Additional credits are purchased in $5 increments; $5 buys $5 of usage credit. Prepaid PAYGO has no monthly base fee. Purchased credits do not expire and are applied to eligible usage on your account. Credits are usage balances, not AI tokens: the number of tokens they cover depends on the model, feature, and applicable rates. Existing legacy metered PAYGO accounts remain on their disclosed billing terms until migrated; purchasing credits does not itself cancel an existing subscription.

Minimum charges. Metered rates reflect the cost of running a request on our platform, not only the price the model provider charges us. A minimum per-token charge may therefore apply to any metered request, including requests routed to models a provider offers at no cost to us. The rate shown in the app at the time of use is the rate you are billed.

Available credit and automatic top-up. Usage is deducted from prepaid credits. Credit may be reserved for work in progress and settled against recorded usage when that work completes; unused reservations are released. Work may be blocked or interrupted when available credit is insufficient. Prepaid PAYGO does not use the legacy monthly usage spend cap. If you enable automatic top-up, you separately authorize charging your saved card for the selected amount when available credit falls below your selected threshold, subject to your monthly top-up limit. That limit includes applicable tax and pending charges and resets on the first day of each month (UTC). Saving a card alone does not enable automatic top-up. You may disable it in Billing & Plans; payments already initiated may still complete. Failed payments, required authentication, or reaching the limit can interrupt usage. We recommend enabling automatic top-up for scheduled prepaid PAYGO scans to help avoid interruptions when credits run low. It is optional; scheduled runs may proceed without it when enough credit is available.

Complimentary and promotional access. We may offer free trials, complimentary plan upgrades, credits, or other promotional access at our discretion. Promotional access is provided "as is," may be subject to additional conditions, may be modified or revoked at any time, and does not create any entitlement to continued access, features, or pricing. When promotional access ends, your account may revert to your paid plan or to restricted access until you select a plan.

Pricing and Token Costs. Necio records input and output tokens and other applicable usage, including billable prompt generation, grading, verification, and web-search activity. Charges vary by model and feature and may include a margin over provider costs. Usage already incurred may remain chargeable even if a scan is later canceled or does not produce a usable result. Each scan or Maestro campaign that reaches its target bills at least $0.02 of AI usage; automated Web Chat scans also incur a $0.50 execution fee. Usage records generated by the Service are the basis for credit deductions and legacy PAYGO charges; report a good-faith dispute within 30 days. AI providers may change their pricing or billing structures. Updated usage rates apply prospectively and are displayed in the application; a credit balance does not lock in a token price.

Refunds. Monthly and annual subscription fees, PAYGO credit purchases (including automatic top-ups), and consumed usage are non-refundable except where required by applicable law. If you believe you were charged in error, contact us within 30 days at [email protected].

Cancellation. You may cancel your subscription at any time through the account or billing settings made available in the Service, or by contacting us. Cancellation takes effect at the end of the current billing period; you retain access until then.

Third-party provider fees. Necio selects and may change providers and models based on performance, availability, and suitability for each scan task. You are solely responsible for third-party fees, quotas, rate limits, and charges from your scans. These include charges from the target provider and any messaging or chat service you test.

We may suspend or downgrade access for failed payments, chargebacks, payment fraud, or billing abuse.

We reserve the right to change pricing with at least 30 days' notice to active subscribers.

6. Intellectual Property

The Service, including its software, prompt templates, scoring algorithms, UI, and documentation, is owned by Prompt SecOps and protected by intellectual property laws. These Terms do not transfer any ownership rights to you.

Your data. You retain ownership of all data you bring to the Service, including AI system outputs captured during scans. You represent that you have all rights, permissions, and authorizations necessary to submit that data to the Service. You grant Prompt SecOps a limited license to process this data solely to provide, secure, support, and improve the Service. We do not use your scan data to train AI models or share it with third parties except as described in our Privacy Policy.

Data availability and retention. The Service automatically expires or minimizes raw scan and Maestro campaign content, private screenshot evidence, activity records, and detailed findings according to the schedule in our Privacy Policy, including while an account remains active. Files you attach to test prompts are deleted 48 hours after upload. Necio is not an archival or backup service.

30-day availability and compliance storage. Prompt SecOps does not undertake responsibility for storing, retaining, or making scan data, scan results, or web chat image artifacts available beyond 30 days after creation, except as required by applicable law or a separate written agreement. This is not a guarantee that every record will be deleted on day 30; the Privacy Policy describes the applicable data-processing retention schedule. If you need records for longer than 30 days for compliance, you must configure a SIEM connection in Settings → SIEM Integration before the applicable availability period ends. You are responsible for verifying successful delivery and configuring retention and access controls in your SIEM. SIEM delivery does not extend Necio storage and may not include every field or image artifact; separately export and preserve any required records or artifacts not delivered by the integration. Uploaded prompt attachments remain subject to their shorter 48-hour deletion period.

Feedback. If you provide feedback, suggestions, or ideas about the Service, you grant Prompt SecOps a perpetual, irrevocable, worldwide, royalty-free license to use that feedback without restriction or compensation.

The OWASP Top 10 for LLM Applications framework referenced within Necio is licensed under CC BY-SA 4.0. OWASP® is a registered trademark of the OWASP Foundation.

7. Service Availability, Maintenance, and Security Updates

We may suspend, interrupt, limit, disable, or modify access to all or part of the Service at any time, with or without prior notice, to perform maintenance, deploy security updates, remediate vulnerabilities, respond to security incidents, prevent abuse, preserve platform integrity, or comply with legal obligations.

Stopping hosted testing. You may cancel a scan, and we may stop testing for an account or pause hosted testing across the platform for security or operational reasons. These controls also apply to new attempts, retries, and scheduled testing. If the Service cannot verify the control state required for execution, it stops sending new work until that state can be verified. A stopped run may contain partial results and may require a new run to continue. Cancellation is not a recall: a request already accepted by a target or model provider may finish and incur charges, and stopping cannot retrieve content already sent to a third party.

When practical, we will use commercially reasonable efforts to notify affected users in advance or promptly after the action begins, and to provide reasonable updates through email, in-app notices, a status page, or other appropriate channels. Emergency security actions may be taken without prior notice when delay could increase risk to the Service, users, data, or third parties.

Unless separately agreed in writing, the Service does not include any uptime commitment, support service level, or guarantee of uninterrupted availability. Security and platform integrity may require immediate action, including temporary downtime.

AI Model Availability. Necio selects models for each internal task, including open-weight models for test prompts and Maestro turns. We may substitute equivalent models or providers at any time because of availability, deprecation, outages, cost, or quality. Substitutions are intended to maintain or improve service quality and functionality. We do not guarantee a particular model, model family, provider, or hosting jurisdiction. Model selection is not a subscription term.

8. AI-Generated Output; No Professional Advice

Necio uses artificial intelligence systems to generate test prompts, grade responses, verify results, and produce reports. AI-generated output may contain inaccuracies, hallucinations, false positives, false negatives, or unintended content, even when multiple models are used to verify a result. You must independently review and validate findings before relying on them or taking action, including remediation, disclosure, procurement, or compliance decisions.

Adversarial output is intentional. The Service intentionally generates attack payloads using models, including open-weight models, selected partly for their ability to produce them. Prompts may contain offensive, manipulative, deceptive, or unsafe content for testing. They are not our recommendations, views, instructions, or endorsement of that conduct. A model producing a payload does not make it lawful to send. You control where prompts go, who can see them, and how results are handled. Do not forward, publish, or reuse payloads outside authorized testing.

Browser-driven and channel-based testing. Results from browser-based or channel-based targets depend on third-party interfaces we do not control. Layout changes, sign-in walls, bot-detection or CAPTCHA challenges, rate limits, session expiry, and message-delivery failures can cause a run to stop, time out, or capture an incomplete response. The Service reports these outcomes rather than grading them as a pass or a failure, but they still affect coverage and comparability between runs. These features are beta and may change or be withdrawn.

Some features consult third-party web sources to generate or verify output. Those sources may be inaccurate, outdated, incomplete, or manipulated, and grounding output in web search does not guarantee its accuracy. Web-derived content is provided as reference material only and remains subject to your obligation to independently review and validate findings.

Scores, grades, report cards, framework mappings (such as OWASP Top 10 for LLM Applications), and other results produced by the Service are informational security-testing output only. They are not legal, regulatory, audit, or compliance advice; they are not a certification, attestation, or guarantee of compliance with any law, framework, or standard (including SOC 2, ISO 27001, GDPR, HIPAA, or the EU AI Act); and they do not establish that any system is secure or free of vulnerabilities. You assume full responsibility for any decision made or action taken in reliance on Service output.

9. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. PROMPT SECOPS DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF VULNERABILITIES. SECURITY TESTING RESULTS ARE INFORMATIONAL AND DO NOT CONSTITUTE A GUARANTEE THAT YOUR AI SYSTEMS ARE FREE FROM SECURITY FLAWS.

Beta, preview, experimental, or free features may be changed, suspended, or discontinued at any time.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, PROMPT SECOPS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING FROM YOUR USE OF OR INABILITY TO USE THE SERVICE. OUR TOTAL LIABILITY TO YOU FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, SHALL NOT EXCEED THE GREATER OF (A) THE TOTAL FEES PAID BY YOU IN THE 12 MONTHS PRECEDING THE CLAIM OR (B) USD $100.

These limitations govern claims between you and Prompt SecOps. They do not limit your responsibility to third parties for testing you configure or run, or your obligations under Section 11.

11. Indemnification and Third-Party Claims

You agree to defend, indemnify, and hold harmless Prompt SecOps, its affiliates, and their officers, directors, employees, contractors, and agents (the "Indemnified Parties") from and against all claims, demands, suits, proceedings, and causes of action, whether brought by a third party (including a system owner or operator, model provider, messaging or chat platform, or individual) or by a governmental or regulatory authority, and all resulting liabilities, damages, losses, fines, penalties, settlements, costs, and expenses (including reasonable attorneys' and experts' fees), arising out of or relating to:

• (a) your use of the Service, or any use under your account, in violation of these Terms or our policies;
• (b) any testing you configure, launch, or schedule, including any claim that you lacked authorization, exceeded the scope of your authorization, or tested a restricted target;
• (c) any claim that testing run from your account caused harm, unauthorized access, disruption, loss of data, or damage to any system, account, or person;
• (d) data, credentials, files, or other content you submit, including any claim that it infringes or misappropriates third-party rights or was submitted without necessary rights or authorizations;
• (e) your violation of the terms, developer policies, or automation rules of any provider, platform, workspace, or service you test or reach through the Service, including any claim arising from a suspension, ban, or other enforcement action it takes; or
• (f) your violation of any applicable law or third-party right.

Duty to defend. Your duty to defend arises as soon as a claim covered by this Section is asserted or threatened against an Indemnified Party, whether or not the claim has merit, and is separate from your duty to indemnify. We will notify you of a claim; a delay in notice relieves you of your obligations only to the extent it materially prejudices your defense. We may participate in the defense with counsel of our choosing at our own expense, and we may assume control of the defense at your expense if you do not defend diligently. You may not settle a claim without our prior written consent if the settlement imposes any obligation, admission, or restriction on an Indemnified Party.

Your obligations apply whether or not the claim alleges negligence by an Indemnified Party, except to the extent the losses are finally determined by a court or arbitrator to have resulted from that Indemnified Party's own gross negligence or willful misconduct. They are not limited by the amount or terms of any insurance you carry and survive termination of these Terms.

12. Preventive Enforcement and Termination

We may act proactively when specific facts or activity give us a reasonable basis to suspect abusive use, malicious intent, insufficient authorization, or a material risk to the Service or third parties. We may throttle suspicious activity, block or stop scans before they begin or complete, restrict features, deny service to high-risk users, require proof of ownership and written authorization before allowing or resuming testing, and suspend or terminate access. We may take these steps without prior notice and before completing an investigation or confirming a violation; actual harm or a completed attack is not required. We may consider attempted activity, patterns of behavior, misrepresentations, and efforts to evade safeguards when assessing intent. Lawful, authorized adversarial testing within this policy is not abusive merely because it uses attack-like prompts.

We may keep testing blocked until requested authorization evidence is provided and reviewed. Our review does not authorize a target, certify that testing is lawful, or create any duty to you or to a third party (see Role of the Service). You may request review of an enforcement decision by contacting [email protected]. Evidence and investigation records are handled under our Privacy Policy.

You may terminate your account at any time from the account settings page. We may suspend or terminate your access immediately, without prior notice, if you breach these Terms or if we determine your use poses a risk to the Service or other users. Upon termination, your right to use the Service ceases. Any provisions that by their nature should survive termination will survive, including intellectual property, warranty disclaimers, liability limitations, indemnification, dispute resolution, and payment obligations.

After termination or account deletion, we may delete scan data and account content. We may retain consent, authorization, billing, usage, and security records as described in our Privacy Policy. Export any reports you need before closing your account.

13. Export Controls & Sanctions

The Service, including its security-testing capabilities, may be subject to U.S. export control and sanctions laws, including the Export Administration Regulations (EAR) and regulations administered by the Office of Foreign Assets Control (OFAC). You represent and warrant that you are not located in, organized under the laws of, or ordinarily resident in any embargoed or comprehensively sanctioned jurisdiction; that you are not on any U.S. or other applicable restricted-party list; and that you will not use, export, re-export, or transfer the Service in violation of applicable export control or sanctions laws, or for any prohibited end use.

14. Governing Law & Disputes

These Terms are governed by the laws of the Commonwealth of Virginia, USA, without regard to conflict-of-law provisions. Any dispute arising under these Terms shall be resolved by binding arbitration under the rules of the American Arbitration Association, except that either party may seek injunctive relief in a court of competent jurisdiction or bring an individual claim in small claims court where permitted. You and Prompt SecOps each waive the right to a jury trial and the right to participate in a class-action lawsuit, class-wide arbitration, private attorney general action, or other representative proceeding.

Informal resolution first. Before initiating arbitration, you agree to first contact us at [email protected] with a written description of the dispute and give us 60 days to work with you to resolve it informally. Arbitration may be conducted remotely or in Virginia unless the parties agree otherwise.

Arbitration opt-out. You may opt out of this arbitration agreement by emailing [email protected] within 30 days of first accepting these Terms, including your name, account email, and a statement that you opt out of arbitration. Opting out does not affect any other provision of these Terms.

Changes to this arbitration agreement. If we make a material change to this Section 14, you may reject the change by emailing [email protected] within 30 days after the change takes effect, stating that you reject it. If you reject a change, the version of this Section 14 you most recently accepted before the change continues to govern disputes between you and Prompt SecOps. A change to this Section 14 never applies to a dispute that arose, or that either party had notified the other of, before the change took effect.

15. Changes to These Terms

We may update these Terms from time to time. Material changes will be communicated via email or in-app notice at least 30 days before taking effect. Continued use of the Service after the effective date constitutes acceptance of the updated Terms.

Changes apply going forward only. A dispute is governed by the version of these Terms in effect when the dispute arose, and changes to Section 14 are subject to your right to reject them described in that Section.

16. General Terms

These Terms, together with the policies incorporated by reference, are the entire agreement between you and Prompt SecOps regarding the Service. If any provision is found unenforceable, the remaining provisions remain in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our prior written consent; we may assign them in connection with a merger, acquisition, reorganization, or sale of assets. We are not responsible for delays or failures caused by events beyond our reasonable control. Notices may be provided by email, in-app notice, or posting through the Service.

No third-party beneficiaries. These Terms are for the sole benefit of you and Prompt SecOps and, for Section 11, the Indemnified Parties. They create no right, remedy, or benefit for any other person, including the owner or operator of any system you test, and no other person may enforce or rely on them.

Notice to California residents. Under California Civil Code Section 1789.3, California users are entitled to the following notice: you may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834, or by telephone at (800) 952-5210, to resolve a complaint regarding the Service or to receive further information regarding use of the Service.

17. Contact