Terms of Service

1. Agreement and acceptance

1.1 Who this agreement is between

These Terms of Service (the “Terms”) are an agreement between Vaktex, Inc., a Delaware corporation (“Vaktex”, “we”, “us” or “our”) and the person or organisation that accepts them (“you” or “Customer”).

You accept these Terms when you create an account, click to accept them, sign an Order that refers to them, or use the Services. If you do not agree, do not use the Services.

1.2 Accepting for an organisation

If you accept these Terms for a company or other organisation, you confirm that you have authority to bind it. In that case “you” means the organisation, and the individuals who use the Services under its account are its Authorized Users.

1.3 Documents that form the agreement

The agreement between you and Vaktex (the “Agreement”) consists of these Terms, any Order, the Data Processing Addendum and any other document these Terms incorporate by reference.

If documents conflict, this order of precedence applies, highest first:

Rank	Document	Applies to
1	The Standard Contractual Clauses incorporated in the Data Processing Addendum	Restricted transfers of personal data
2	A written agreement signed by you and Vaktex, only where it expressly amends the Data Processing Addendum or these Terms	The provisions it expressly amends
3	The Data Processing Addendum	The processing of personal data
4	An Order	The products, quantities, fees and term it states
5	These Terms	Everything else

Terms in a purchase order, vendor portal or similar document you issue do not apply, even if we accept or sign it, unless a signed agreement under rank 2 says otherwise.

1.4 Privacy

Our Privacy Policy explains how we handle personal data for which we are the controller, such as account and billing data. Our Cookie Policy explains the cookies and similar technologies on our websites. Neither forms part of the contract, but both describe practices that these Terms refer to.

2. Definitions

In these Terms, the following words have the meanings below. Other terms are defined where they first appear.

• “Affiliate” means an entity that controls, is controlled by, or is under common control with a party, where control means owning more than 50% of the voting interests.
• “AI Features” means any part of the Services that uses a machine-learning model to generate, analyse or transform content, including scans, Vex assessments and the Gateway.
• “Asset” means any system, application, network, host, IP address, domain, cloud account, repository, model, API, device, account or data set.
• “Asset Owner” means the person or organisation with the legal right to authorise testing of an Asset.
• “Authorization” means the written permission described in Section 5.2.
• “Authorized Assets” means Assets that are within the scope of a valid Authorization.
• “Authorized User” means an individual whom you allow to use the Services under your account, such as an employee or contractor.
• “Customer Content” means any data, code, files or other material that you or your Authorized Users submit to or generate through the Services. It includes source code, repositories, scan inputs and results, prompts and completions sent through the Gateway, sandbox files, Angrep targets, findings and evidence, and Output.
• “Documentation” means the user guides and technical documentation for the Services that we publish or provide to you.
• “Fees” means the amounts payable for the Services under an Order or the plan you select.
• “Gateway” means the Vaktex AI Gateway at gateway.vaktex.com.
• “Model Provider” means a third party that operates an AI model available through the Services, as listed on our Subprocessors page.
• “Order” means an order form, quote, checkout page or plan selection in your account that you and Vaktex agree to, and that states the Services, Fees and subscription term.
• “Output” means content that AI Features generate for you, such as findings, suggested fixes, reports and completions.
• “Preview Model” means a model marked “Preview” in the Gateway model listing and API. Preview Models are offered at a reduced rate in exchange for the use of Preview Model Content described in Section 4.3.
• “Preview Model Content” means the messages, tool definitions and generation settings of each request you send to a Preview Model by naming it, and the Output returned for that request, including the Output of any model it falls back to.
• “Security Testing” means penetration testing, vulnerability scanning, exploitation, red-teaming, adversarial testing of AI systems, and any other activity that probes the security of an Asset.
• “Services” means the products and services Vaktex provides under these Terms. They include vaktex.com and the account dashboard, vScan Studio, the vScan command-line tool and scanning services, the Gateway, sandbox compute, Vex assessments, Angrep, the cloud review used by the VAKT editor extension, and related APIs, software and Documentation.
• “Studio” means vScan Studio, the self-hosted software that we license for you to run on infrastructure you control.

The words “including” and “for example” are not limiting. Headings are for convenience only.

3. Eligibility and accounts

3.1 Business use

The Services are designed for business and professional use. You must be at least 18 years old and able to enter into a binding contract. We may ask you to confirm your age when you create an account.

If you are a consumer under the law of your country, Section 19.3 applies to you.

3.2 Account information

You must give accurate and complete information when you register and keep it up to date. You may not create an account using another person’s identity or create accounts by automated means.

3.3 Account security

You are responsible for your account credentials, licence keys and inference API keys, and for all activity under your account. Keep them confidential and do not share them outside your organisation.

Tell us at support@vaktex.com without undue delay if you suspect that your account, a licence key or an API key has been compromised. We may revoke or rotate a key we believe is compromised.

3.4 Authorized Users

You may allow Authorized Users to use the Services on your behalf. You are responsible for their compliance with these Terms, and their acts and omissions are treated as yours. You must remove access promptly for any Authorized User who should no longer have it.

4. The Services

4.1 Hosted Services

Subject to these Terms and payment of applicable Fees, you may access and use the hosted Services during your subscription term for your internal business purposes, within the limits of your plan or Order.

We may set and enforce reasonable usage limits, such as rate limits, token budgets and concurrency limits, to protect the Services. Limits that apply to your plan are shown in your account, the Documentation or your Order.

4.2 Self-hosted Studio licence

Subject to these Terms and payment of applicable Fees, Vaktex grants you a non-exclusive, non-transferable, non-sublicensable licence during your subscription term to install and run Studio on infrastructure you own or control, for your internal business purposes, up to the number of instances and seats in your Order or plan.

These rules apply to Studio:

1. Licence checks. Studio contacts Vaktex to activate a licence and sends periodic heartbeats. Activation sends the licence key, an instance identifier, a coarse non-identifying machine fingerprint and the Studio version. Heartbeats send the key identifier, instance identifier and version. Studio also reports monthly token and request counts. You must not disable, bypass or tamper with these checks, except by using air-gapped mode.
2. Air-gapped mode. Where your licence allows it, air-gapped mode disables activation and heartbeat. You remain bound by the instance and seat limits of your licence and must give us a usage report on reasonable request.
3. Your code stays with you. Studio processes your code on your infrastructure. Customer Content reaches Vaktex only if you configure Studio to use the Gateway, Vaktex sandboxes or notification email relay. In that case, the terms for those Services apply to that data.
4. Your infrastructure. You are responsible for the security, availability, backups and configuration of the environment in which you run Studio.
5. Updates. We may provide updates. We support current versions as stated in the Documentation. Older versions may stop receiving updates or lose access to hosted features.
6. End of licence. When your licence ends, you must stop using Studio and uninstall it. Studio may stop working when the licence expires.

4.3 AI Gateway

The Gateway routes prompts and completions from your applications and agents to the Model Providers you choose.

• You select the models, and so you select which Model Provider receives your data.
• We disclose each Model Provider’s data retention policy for each model in the Gateway model listing and API. Retention varies by provider, for example zero retention, or up to 30 days for abuse monitoring.
• We keep the live session’s event log only in memory or durable session storage and erase it about 5 minutes after your app disconnects, or up to about 10 minutes if a request was still running. We keep usage metadata, such as tokens, requests, spend, model, timestamps and licence identifier, for billing and operation.
• We do not store Gateway transcripts, except Preview Model Content as set out below. We will tell you before we introduce storage of transcripts for any other model.

Preview Models. Preview Models cost less because we keep what you send them for training. If you name a Preview Model in a request:

1. Only when named. The Gateway uses a Preview Model only when you name it. Automatic model selection and the fallbacks of other models never route to one.
2. What we keep. We keep a copy of all Preview Model Content. Before we store it, we replace your account identifier with a pseudonym. We store it for up to 24 months and then delete it.
3. How we use it. Vaktex and its Affiliates may use Preview Model Content to develop, train, fine-tune and evaluate AI models and to improve the Services. Section 7.2 sets out the licence you grant for this. We will not sell Preview Model Content, publish it or make it available to other customers. The Model Provider that operates a Preview Model may also use Preview Model Content to train its models, where the model listing says so.
4. Deletion. We delete stored Preview Model Content linked to your account when you delete your account, or sooner if you ask at support@vaktex.com. Deleting it does not remove what a model already trained on it has learned, and models trained before deletion are not retrained.
5. What not to send. Do not send a Preview Model credentials or secrets, special categories of personal data, personal data you have no lawful basis and notice to share for training, or content you do not have the right to licence under Section 7.2. If your organisation cannot allow training on its content, do not use Preview Models.
6. Beta. Preview Models are Beta Features under Section 4.5.

4.4 Sandboxes and assessments

Sandbox compute runs on single-tenant, ephemeral virtual machines. Each machine runs for no more than 12 hours, and its local disk is destroyed with it.

Files an assessment writes are copied to cloud storage so you can review them. We delete them within 30 days after the assessment ends, and on deletion of your account. Evidence for a confirmed Angrep finding is kept with that finding. Export anything you need to keep.

Sandboxes are for Security Testing of Authorized Assets under Section 5, and for related analysis. You must not use them for any other purpose, such as cryptocurrency mining, hosting public services, or relaying traffic for third parties.

4.5 Beta features

We may offer features labelled alpha, beta, preview, early access or similar (“Beta Features”). Beta Features are provided “as is”, may change or be withdrawn at any time, and are excluded from any service level or support commitment. Use them at your own risk and do not rely on them for production systems.

4.6 vScan cooked

vScan cooked is an optional feature. Its results are public to anyone who has the link. They are not listed or indexed by us, but they are not private. Do not use the feature if your transcripts contain sensitive material. The Privacy Policy explains how we handle the data it uses. If you use it under an organisation account, the Data Processing Addendum applies, except that the public result link is created at your own instruction.

4.7 VAKT extension cloud review

The VAKT extension for VS Code and compatible editors scores code on your machine. Its cloud review sends code to Vaktex so that Vaktex cloud models can give a second opinion on findings (“Cloud Review”). Cloud Review is on by default. The “Fully local” setting (vakt.fullyLocal) turns it off and the extension then sends nothing; the “Improved responses” setting (vakt.improvedResponses) also turns Cloud Review off.

1. What is sent. Individual functions, a code graph of the repository (functions, calls, imports, routes, data access and framework) and per-language coverage (“Cloud Review Content”).
2. Anonymisation. The extension anonymises Cloud Review Content on your machine before sending it: it removes secrets and email addresses, drops comments, replaces names, string words and path segments specific to your project with numbered placeholders, and replaces long numbers. Common programming words and the structure of the code stay. A distinctive proprietary algorithm could therefore still be recognised by someone who holds the original. Cloud Review Content is close to anonymous, not perfectly anonymous. If your organisation cannot accept this for a project, turn on Fully local.
3. Training. Vaktex and its Affiliates may use Cloud Review Content to develop, train and evaluate AI models and to improve the Services. Section 7.2 sets out the licence you grant for this. We will not sell Cloud Review Content, publish it or make it available to other customers.
4. Retention and deletion. We keep Cloud Review Content for up to 24 months and then delete it. It is stored with no user identifier, so we cannot find or delete the records that came from you on request. Deleting your account does not delete it.
5. Monthly limits. Cloud Review is free up to US$5 of cloud model use per calendar month (UTC) without signing in, and US$30 per month signed in with a verified email address. When the limit is reached, Cloud Review stops until the 1st of the next month and the extension continues to show local results. Paid Cloud Review is not available. These limits are usage limits under Section 4.1.
6. What not to send. Do not use Cloud Review on code you do not have the right to licence under Section 7.2, or on code whose structure alone must not leave your organisation. Use Fully local instead.

The Privacy Policy (section 3.12) describes Cloud Review in more detail.

4.8 Support

We provide support by email at support@vaktex.com. Any response times or service levels apply only if stated in your Order or a signed agreement.

5. Authorized Security Testing

This section governs every use of the Services to test the security of any Asset. It applies to scans, Vex assessments, Angrep, sandboxes, Studio, and to any agent or tool that uses the Gateway for offensive security work. It is a core term of the Agreement. A breach of it is a material breach.

5.1 Authorized Assets only

You may use the Services for Security Testing only against Authorized Assets. Owning an account with us, uploading an Asset, or listing it in a project does not authorise testing it.

Vaktex does not grant you permission to test any Asset, and does not review or approve your Authorization unless we expressly agree to do so in writing. You alone are responsible for deciding whether your testing is authorised and lawful.

5.2 What counts as Authorization

Before you test an Asset, you must hold permission that is:

1. Written. A signed contract, statement of work, engagement letter, bug bounty programme policy, or a written internal approval. Verbal permission is not enough.
2. From the right person. Given by the Asset Owner, or by someone with authority to act for the Asset Owner. If you test your own employer’s systems, your approval must come from someone in the organisation with authority to grant it.
3. Specific. It must identify the Assets in scope, the permitted testing window, the permitted methods, and any exclusions.
4. Accompanied by rules of engagement. It must state, or you must have separately agreed in writing, the rules for the test, including contacts for emergencies and the conditions for stopping.
5. Current. It must be in force for the whole time you test.

Where an Asset is hosted by a third party, such as a cloud provider, hosting company or SaaS provider, you must also comply with that provider’s policy on Security Testing. Permission from a tenant does not authorise testing the provider’s own infrastructure or other tenants.

5.3 Your commitments

When you use the Services for Security Testing, you represent, warrant and agree that:

1. you hold valid Authorization for each Asset you test;
2. you will keep your testing within the Assets, time window and methods your Authorization allows;
3. you will comply with all laws that apply to your testing, including the US Computer Fraud and Abuse Act, the UK Computer Misuse Act 1990 and equivalent laws in your jurisdiction and in the jurisdictions where the Assets are located;
4. you will comply with any contract, bug bounty terms or third-party rights that apply to the Assets;
5. you will configure scan targets, assessment scope and agent tools in the Services so that they match your Authorization;
6. you will monitor your testing and act promptly if it has an effect you did not intend; and
7. the individuals who run the testing are competent to do so and have been told the scope and rules of engagement.

5.4 Prohibited conduct

Even where you hold Authorization, you must not use the Services to do any of the following unless the Authorization expressly permits it and, where stated below, the Asset Owner has specifically agreed:

1. Test outside scope. Test any Asset outside your Authorization, or continue testing after the Authorization expires or is withdrawn.
2. Scan the internet. Run broad or mass scans of IP ranges, domains or services that are not individually listed as Authorized Assets.
3. Cause denial of service. Run denial-of-service, load or stress testing, or any activity intended or likely to degrade availability, unless your Authorization expressly permits it and the Asset Owner has agreed to the timing and method.
4. Target critical infrastructure or government systems. Test systems that operate critical infrastructure, such as energy, water, healthcare, transport, finance or telecommunications, or systems of any government, military or public authority, without explicit written Authorization from the operator that addresses that type of system.
5. Deploy malware beyond scope. Deploy malware, ransomware, worms, destructive payloads, persistent implants or backdoors, except for payloads your Authorization permits. You must remove any implant, account or artefact you introduce when the engagement ends.
6. Misuse credentials. Use credentials, tokens or keys other than those provided or permitted for the engagement. Do not use credentials you discover during testing except as your Authorization allows, and never against Assets outside scope. Do not run credential-stuffing or password-spraying attacks against third-party services.
7. Over-collect data. Access, copy or keep more personal data or confidential information than you need to show that a vulnerability exists. Do not alter or delete data except as your Authorization permits.
8. Use social engineering beyond scope. Run phishing, vishing or other social engineering against people, unless your Authorization expressly includes it and names the target group.
9. Hide your activity unlawfully. Evade security controls, logging or detection for any purpose other than an authorised test objective, or conceal your identity from the Asset Owner.
10. Attack Vaktex or other customers. Test, probe or attack the Services, our infrastructure, sandbox isolation, or other customers’ data, except through good-faith research reported to us under Section 5.9.

5.5 Evidence of Authorization

You must keep written evidence of each Authorization, including its scope and rules of engagement, for the duration of the engagement and for as long afterwards as you keep the related results in the Services.

If we ask, you must provide that evidence within 5 business days. We will treat it as your Confidential Information. If you do not provide evidence that satisfies us acting reasonably, we may take any action in Section 5.7.

5.6 Stopping

You must stop testing an Asset immediately, and use the Services’ controls to halt any running job, if:

1. the Asset Owner, Vaktex, or a law enforcement or regulatory authority asks you to stop;
2. your Authorization expires or is withdrawn;
3. you find that you are testing, or are about to test, an Asset outside scope; or
4. your testing causes or appears likely to cause unplanned disruption, damage or data exposure.

5.7 What Vaktex may do

If we reasonably believe that testing may be unauthorised, beyond scope, unlawful, or a risk to any person or system, we may:

1. halt any scan, assessment, sandbox or Gateway session in progress, without notice where needed to prevent harm;
2. ask you for evidence of Authorization under Section 5.5;
3. restrict, suspend or terminate your access under Section 13;
4. preserve logs, Customer Content and other records relevant to the activity;
5. notify the affected Asset Owner or hosting provider; and
6. report the activity to, and cooperate with, law enforcement or other authorities where we consider it appropriate or where the law requires.

We will act in proportion to the risk. Decisions to suspend accounts are reviewed by a person.

5.8 Incidental discoveries

If your testing reveals a vulnerability in an Asset that is not an Authorized Asset, such as third-party software or a service used by the Asset Owner, you must not exploit it further. You should report it to the affected vendor or owner through their published disclosure process, or through coordinated disclosure, and give them a reasonable time to fix it before you publish details. Do not publish working exploit details for an unfixed vulnerability in a third party’s Asset.

5.9 Reporting vulnerabilities in Vaktex

If you find a vulnerability in the Services, report it to support@vaktex.com with the subject line “Security report”. Do not access other customers’ data, degrade the Services or keep data you obtain beyond what is needed to describe the issue. We will not pursue legal action against good-faith research that follows this section.

5.10 Your responsibility

You are responsible for all Security Testing run from your account, including by your Authorized Users and by any agent you configure. Your indemnity for unauthorised testing is in Section 15.2, and it is not limited by Section 16.

6. Acceptable use

6.1 General rules

In addition to Section 5, you must not, and must not allow anyone else to:

1. use the Services in breach of any law or in a way that infringes or misappropriates anyone’s rights;
2. use the Services to develop, distribute or operate malware, botnets or tools for unlawful intrusion, other than for authorised Security Testing under Section 5;
3. use the Services to harass, defraud or harm any person;
4. submit special categories of personal data, such as health or biometric data, except where it appears incidentally in code or repositories and is handled under the Data Processing Addendum;
5. interfere with or disrupt the Services, or circumvent usage limits, licence checks, billing or security controls;
6. resell, sublicense, rent or provide the Services to third parties as a service bureau, unless your Order allows it;
7. copy, modify, decompile, disassemble or reverse engineer the Services, except to the extent the law permits it despite this restriction;
8. access the Services to build a competing product, or to copy their features, design or Output for that purpose;
9. share licence keys or API keys outside your organisation, or use one licence for more instances or seats than it covers; or
10. remove or alter any proprietary notice in the Services.

6.2 Model Provider usage policies

When you use a model through the Services, you must comply with the usage policies and terms of the Model Provider that operates it. These are published by each provider. You must not use the Gateway or any AI Feature to do something that the relevant provider’s usage policy prohibits.

If a Model Provider tells us that your use breaches its policy, or restricts our access because of your use, we may restrict your access to that provider’s models.

6.3 Investigation

We may investigate suspected breaches of this Section 6 and take the actions described in Sections 5.7 and 13.

7. Customer Content and data

7.1 You own your content

As between you and Vaktex, you own Customer Content, including Output generated for you. We claim no ownership of it.

7.2 Licence to Vaktex

You grant Vaktex and its subprocessors a worldwide, non-exclusive, royalty-free licence to host, copy, process, transmit and display Customer Content only as needed to provide, secure and support the Services for you, to prevent abuse, and to comply with law. This licence ends when the Customer Content is deleted from the Services.

For Preview Model Content, you also grant Vaktex and its Affiliates a worldwide, non-exclusive, royalty-free licence to copy, store, modify and use it to develop, train, fine-tune and evaluate AI models and to improve the Services. The licence to use stored Preview Model Content ends when it is deleted under Section 4.3.

For Cloud Review Content, you grant Vaktex and its Affiliates the same licence. It ends when the stored Cloud Review Content is deleted under Section 4.7.

Vaktex owns the models it trains, and its rights in them, and in what they learned before deletion, are perpetual and irrevocable. Section 7.1 still applies: you keep ownership of Preview Model Content and Cloud Review Content themselves.

7.3 No training, except Preview Models and Cloud Review

We do not use Customer Content to train or evaluate AI models. This applies to code, scans, findings, prompts, completions, sandbox files and transcripts, on every plan. There are two exceptions: Preview Model Content, which you choose to send by naming a Preview Model (Section 4.3), and Cloud Review Content, which the VAKT extension sends while Cloud Review is on (Section 4.7). No setting, plan or opt-in programme changes this for any other model or Service.

We use Model Providers’ business and API terms, under which API inputs and outputs are not used to train their models by default. The only exception is the Model Provider of a Preview Model, where the model listing says it trains on Preview Model Content.

Product-improvement settings in your account cover only aggregated diagnostic and usage data. They are off by default and never involve training on Customer Content.

7.4 Your responsibilities for content

You confirm that you have all rights and consents needed to submit Customer Content to the Services and to have us process it under the Agreement. For Preview Model Content, that includes the rights to grant the licence in Section 7.2, and any notices and consents needed from people whose personal data it contains. You are responsible for the accuracy, quality and legality of Customer Content.

7.5 Personal data

When we process personal data within Customer Content, we do so as your processor under the Data Processing Addendum. The Data Processing Addendum is incorporated into these Terms automatically where you process personal data subject to the data protection laws of the European Economic Area, the United Kingdom or Switzerland. Enterprise customers may request a countersigned copy at support@vaktex.com.

Where we act as controller, for example for account and billing data, the Privacy Policy applies. We also act as controller, not as your processor, when we use Preview Model Content for training under Section 4.3.

7.6 Scan caching

We cache scan inputs and outputs, including code, fixed code and model output, so that we can return repeat results. Your organisation can turn response caching off. We keep cached scan data for no longer than 90 days and delete it earlier on request or when the account or organisation is deleted.

7.7 Security

We maintain the technical and organisational measures described in the Data Processing Addendum. You are responsible for using the Services’ security features appropriately, for securing your own systems and credentials, and for backing up Customer Content you need.

8. AI Output

AI Features use machine-learning models, including third-party models listed on our Subprocessors page. You acknowledge that:

1. Output may be inaccurate, incomplete, or inconsistent between runs, and may report vulnerabilities that do not exist;
2. the Services do not find every vulnerability, and a clean result does not mean an Asset is secure;
3. suggested fixes may introduce new defects or vulnerabilities;
4. you must review Output, and test any fix, before you rely on or act on it; and
5. you are responsible for your remediation decisions and for how you use Output.

Output is not legal, regulatory, audit or compliance advice. Output generated for you may be similar to Output generated for others.

9. Fees, billing and taxes

9.1 Fees

You must pay the Fees for your plan or Order. Fees for subscriptions are billed in advance for each billing period. Usage-based Fees, such as Gateway token usage beyond your plan, are billed as stated in your plan or Order.

9.2 Payment

Payments are processed by Stripe. You authorise us, through Stripe, to charge your payment method for Fees when they are due. Invoiced Fees are due within the period stated on the invoice or Order. You must keep your billing information current.

9.3 Renewal and cancellation

Subscriptions renew automatically for successive periods of the same length unless cancelled. You may cancel at any time in your account or by emailing support@vaktex.com. Cancellation takes effect at the end of the current billing period, and you keep access until then.

9.4 Refunds

Fees are non-refundable except where these Terms or your Order say otherwise, or where the law requires a refund. These Terms give you a pro-rata refund of prepaid Fees for the unused part of your term if:

1. Vaktex terminates for convenience under Section 13.4;
2. you terminate for Vaktex’s uncured material breach under Section 13.3;
3. you terminate an affected Service after objecting to a new subprocessor under the Data Processing Addendum; or
4. you terminate after a material change to these Terms under Section 18.3.

9.5 Price changes

We may change Fees for future billing periods. We will give you at least 30 days’ notice before a price increase takes effect on a paid subscription. Prices fixed in an Order apply for the term of that Order.

9.6 Taxes

Fees exclude taxes. You must pay all sales, use, value added, goods and services and similar taxes on the Fees, other than taxes on Vaktex’s income. Where reverse charge applies, you are responsible for accounting for the tax. If you must withhold tax by law, you must increase the payment so that we receive the amount we would have received without withholding, unless the law prevents this.

9.7 Late payment

If undisputed Fees are overdue, we may suspend the Services under Section 13.1 after giving you notice and a reasonable opportunity to pay. If you dispute a charge in good faith, tell us within 30 days of the charge, and we will work with you to resolve it.

10. Confidentiality

10.1 Definition

“Confidential Information” means any non-public information that one party (the “Discloser”) discloses to the other (the “Recipient”) in connection with the Agreement that is marked confidential or that a reasonable person would understand to be confidential. Your Customer Content and Authorization evidence are your Confidential Information. Non-public parts of the Services, pricing in Orders, and our security documentation are Vaktex’s Confidential Information.

Confidential Information does not include information that the Recipient can show:

1. is or becomes public through no fault of the Recipient;
2. it knew before receiving it, without a duty of confidentiality;
3. it received from a third party without a duty of confidentiality; or
4. it developed independently without using the Discloser’s information.

Using Preview Model Content as Sections 4.3 and 7.2 allow does not breach this Section 10. In every other respect, Preview Model Content remains your Confidential Information.

10.2 Obligations

The Recipient must:

1. use Confidential Information only to perform its obligations or exercise its rights under the Agreement;
2. disclose it only to its and its Affiliates’ employees, contractors, subprocessors and advisers who need to know it and are bound by confidentiality obligations at least as protective as these; and
3. protect it with at least the care it uses for its own similar information, and no less than reasonable care.

10.3 Required disclosure

The Recipient may disclose Confidential Information where the law or a court or authority requires it. Where the law allows, the Recipient must give the Discloser prompt notice and reasonable help to seek protection, and must disclose only what is required. Section 5.7 also applies to information about unauthorised testing.

10.4 Duration

These obligations last during the Agreement and for 5 years after it ends. For trade secrets and Customer Content, they last for as long as the information remains confidential or, for Customer Content, held by the Recipient.

11. Intellectual property and feedback

11.1 Vaktex’s rights

Vaktex and its licensors own all rights in the Services, including software, models we develop, Documentation, designs and trademarks. The Agreement gives you only the rights it expressly states. All other rights are reserved.

11.2 Feedback

If you give us suggestions, ideas or other feedback about the Services (“Feedback”), you grant Vaktex a perpetual, irrevocable, worldwide, royalty-free licence to use it for any purpose without attribution or payment. Feedback does not include Customer Content, and this licence does not let us disclose your Confidential Information or identify you as its source.

11.3 Open-source components

Some parts of the Services, including Studio, contain open-source software. Open-source licences listed on our licences page govern those components, and nothing in these Terms limits your rights under them.

12. Third-party services and subprocessors

12.1 Subprocessors

We use third parties to provide the Services, including infrastructure providers, Model Providers and business tools. The current list, with each provider’s purpose, the data involved and its location, is on our Subprocessors page.

We give at least 30 days’ notice of a new subprocessor as described in the Data Processing Addendum. You can subscribe to updates by emailing support@vaktex.com with the subject line “Subprocessor updates”. We are responsible for our subprocessors’ performance of our obligations under the Agreement.

12.2 Third-party services you connect

The Services may let you connect services that we do not provide, such as code hosts, cloud accounts, ticketing systems or your own model provider keys (“Third-Party Services”). Your use of a Third-Party Service is governed by your agreement with its provider. We are not responsible for Third-Party Services, and we may stop supporting an integration if the provider changes or withdraws it.

When you connect a Third-Party Service, you authorise us to exchange data with it as needed for the integration.

13. Suspension and termination

13.1 Suspension

We may suspend all or part of your access to the Services if:

1. you breach Section 5 or Section 6;
2. your use poses a security risk to the Services, to other customers or to any third party;
3. undisputed Fees are overdue and remain unpaid after notice under Section 9.7;
4. the law, a court or an authority requires it; or
5. a Model Provider or infrastructure provider requires it because of your use.

We will give you notice before or at the time of suspension where practicable, and tell you why unless the law or a security risk prevents it. We will limit the suspension to what is needed and lift it once the cause is resolved. Decisions to suspend accounts are reviewed by a person. Fees continue to accrue during a suspension caused by your breach.

13.2 Termination by you

You may stop using the Services and delete your account at any time. Paid subscriptions end at the end of the current billing period under Section 9.3.

13.3 Termination for breach

Either party may terminate the Agreement, or an affected Order, by notice if the other party materially breaches it and does not cure the breach within 30 days after notice.

Vaktex may terminate immediately by notice if you materially breach Section 5, or if you breach Section 17.

Either party may terminate immediately by notice if the other becomes insolvent, makes an arrangement with creditors, or enters liquidation, administration or a similar process, to the extent the law allows.

13.4 Termination for convenience by Vaktex

Vaktex may terminate a paid subscription for convenience by giving you at least 30 days’ notice. In that case we will refund prepaid Fees for the unused part of your term. We may end a free plan by giving reasonable notice.

13.5 Effect of termination

When the Agreement or an Order ends:

1. your right to use the affected Services ends, and you must stop using and uninstall Studio;
2. you must pay all Fees accrued up to the end date;
3. for 30 days after the end date, you may export Customer Content using the Services’ export features or by asking us; and
4. after that export period, we delete Customer Content within 30 days. Backups are overwritten in their normal cycle within 35 days. We will confirm deletion in writing on request.

Shorter retention periods described in these Terms, the Privacy Policy or the Data Processing Addendum still apply, so some content, such as sandbox files and cached scan data, may already be deleted before the end date.

Preview Model Content is not deleted at the end of the Agreement. It is kept and deleted as Section 4.3 describes, including when you delete your account.

Cloud Review Content is not deleted at the end of the Agreement or when you delete your account. It is kept for up to 24 months and then deleted, as Section 4.7 describes.

We may keep records we must keep by law, such as billing and tax records, and records relevant to a suspected breach of Section 5 for as long as needed to address it. vScan cooked results are not removed automatically when your account is deleted. Ask us at support@vaktex.com to remove them.

If we terminate under Section 13.3 because of your breach of Section 5, we may restrict the export of Customer Content that we reasonably believe was obtained through unauthorised testing.

13.6 Survival

Sections 2, 4.3 and 7.2 (for Preview Model Content), 4.7 and 7.2 (for Cloud Review Content), 5.5, 5.10, 7.1, 8, 9 (for Fees accrued), 10, 11, 13.5, 13.6, 14.3, 15, 16, 19 and 20 survive the end of the Agreement, along with any other provision that by its nature should survive.

14. Warranties and disclaimers

14.1 Mutual warranties

Each party warrants that it has the authority to enter into the Agreement and that it will comply with the laws that apply to it in performing the Agreement.

14.2 Vaktex’s warranty

Vaktex warrants that it will provide the paid Services with reasonable skill and care. If the paid Services do not meet this warranty and you tell us within 30 days of discovering the problem, we will use reasonable efforts to correct it. If we cannot correct it within a reasonable time, either party may terminate the affected Service, and we will refund prepaid Fees for the unused part of the term. This is your sole remedy for breach of this warranty, except where the law does not allow this limitation.

This warranty does not apply to Beta Features, free plans, Output, Third-Party Services, or problems caused by your misuse, your modification of Studio, or your infrastructure.

14.3 Disclaimer

EXCEPT AS EXPRESSLY STATED IN THE AGREEMENT, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES, OUTPUT AND BETA FEATURES ARE PROVIDED “AS IS” AND “AS AVAILABLE”. VAKTEX DISCLAIMS ALL OTHER WARRANTIES AND CONDITIONS, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT AND ACCURACY. VAKTEX DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT THEY WILL FIND ALL VULNERABILITIES, OR THAT OUTPUT WILL BE ACCURATE OR COMPLETE. VAKTEX IS NOT RESPONSIBLE FOR THE CONSEQUENCES OF SECURITY TESTING YOU RUN, INCLUDING DISRUPTION TO OR DAMAGE OF ANY ASSET.

15. Indemnification

15.1 By Vaktex

Vaktex will defend you against any claim by a third party alleging that the Services, as provided by Vaktex and used in accordance with the Agreement, infringe or misappropriate that third party’s patent, copyright, trademark or trade secret (an “IP Claim”). Vaktex will pay the damages and costs finally awarded against you, or agreed in a settlement Vaktex approves, arising from the IP Claim.

If the Services are, or Vaktex believes they are likely to be, the subject of an IP Claim, Vaktex may, at its option and cost: obtain the right for you to continue using them; modify them so they do not infringe without materially reducing their functionality; or, if neither is reasonably possible, terminate the affected Service and refund prepaid Fees for the unused part of the term.

Vaktex has no obligation for an IP Claim to the extent it arises from Customer Content, Output, Beta Features, free plans, Third-Party Services, open-source components, your modification of the Services, your combination of the Services with anything not provided by Vaktex, or your use of the Services in breach of the Agreement.

15.2 By you

You will defend Vaktex, its Affiliates and their officers, directors and employees against any third-party claim, investigation or proceeding arising from:

1. Customer Content, including a claim that it infringes a third party’s rights or breaches the law;
2. Security Testing run from your account that was unauthorised, exceeded the scope of an Authorization, or otherwise breached Section 5; or
3. your use of the Services in breach of Section 6 or Section 17.

You will pay the damages, fines, penalties and costs, including reasonable legal fees, finally awarded against the indemnified parties or agreed in a settlement you approve, arising from these claims.

15.3 Procedure

The indemnified party must:

1. give the indemnifying party prompt written notice of the claim, although a delay relieves the indemnifying party of its obligations only to the extent the delay prejudices it;
2. give the indemnifying party sole control of the defence and settlement, except that the indemnifying party may not settle a claim in a way that imposes an obligation or admission on the indemnified party without its consent, which it will not unreasonably withhold; and
3. give reasonable cooperation at the indemnifying party’s cost.

The indemnified party may take part in the defence with its own counsel at its own cost.

15.4 Exclusive remedy

This Section 15 states each party’s entire liability, and the other party’s exclusive remedy, for third-party claims of the kinds it covers.

16. Limitation of liability

16.1 Excluded damages

TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND SUBJECT TO SECTION 16.3, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL OR ANTICIPATED SAVINGS, LOSS OR CORRUPTION OF DATA, COST OF SUBSTITUTE SERVICES, OR ANY INDIRECT, CONSEQUENTIAL, SPECIAL, INCIDENTAL, EXEMPLARY OR PUNITIVE DAMAGES, ARISING OUT OF OR RELATING TO THE AGREEMENT, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF IT WAS ADVISED THAT SUCH DAMAGES WERE POSSIBLE.

16.2 Liability cap

TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND SUBJECT TO SECTION 16.3, EACH PARTY’S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT WILL NOT EXCEED THE GREATER OF (A) THE FEES PAID AND PAYABLE BY YOU TO VAKTEX UNDER THE AGREEMENT IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE LIABILITY, AND (B) US$100. MULTIPLE CLAIMS DO NOT ENLARGE THIS CAP.

16.3 Exceptions

SECTIONS 16.1 AND 16.2 DO NOT LIMIT OR EXCLUDE:

1. LIABILITY FOR FRAUD OR FRAUDULENT MISREPRESENTATION;
2. LIABILITY FOR GROSS NEGLIGENCE OR WILFUL MISCONDUCT;
3. LIABILITY FOR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE;
4. YOUR OBLIGATION TO PAY FEES;
5. YOUR LIABILITY FOR BREACH OF SECTION 5, AND YOUR INDEMNITY OBLIGATIONS UNDER SECTION 15.2(2) FOR UNAUTHORISED OR OUT-OF-SCOPE SECURITY TESTING; OR
6. ANY LIABILITY THAT CANNOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW.

16.4 Basis of the bargain

The Fees reflect the allocation of risk in this Section 16, which is an essential part of the Agreement.

17. Export controls and sanctions

The Services, including Studio and security testing tools, may be subject to export control and sanctions laws, including the US Export Administration Regulations, sanctions administered by the US Treasury Department’s Office of Foreign Assets Control, and the export control and sanctions laws of the European Union and the United Kingdom.

You confirm that you and your Authorized Users are not located in, organised in or ordinarily resident in a country or region subject to comprehensive US, EU or UK sanctions, and are not named on, or owned or controlled by anyone named on, a US, EU or UK sanctions or restricted-party list.

You must not export, re-export, transfer or provide access to the Services in breach of these laws, or use them for any end use these laws prohibit. We may suspend or terminate access immediately where needed to comply with them.

18. Changes to the Services and these Terms

18.1 Changes to the Services

We may update the Services, add or remove features, and change Model Providers or models available through the Gateway. We will not make a change during a paid subscription term that materially reduces the core functionality of the Services you have paid for, unless the change is needed for security, legal compliance, or because a third-party provider withdrew a capability. Where practicable we will give you notice of such a change.

18.2 Changes to these Terms

We may update these Terms. We will post the updated Terms on this page and change the “updated” date.

For material changes, we will give paid customers at least 30 days’ notice by email to the account address or through the Services before the change takes effect. We may make changes sooner where the law requires it or to address new Services or features, in which case the change applies only to those Services or features.

18.3 Your options

If you do not agree to a material change, you may terminate the affected subscription before the change takes effect by notice to support@vaktex.com, and we will refund prepaid Fees for the unused part of the term. If you continue to use the Services after the change takes effect, the updated Terms apply.

For a fixed term in a signed Order or agreement, changes to these Terms apply from your next renewal unless you agree otherwise.

19. Governing law and disputes

19.1 Governing law

The Agreement, and any dispute or claim arising out of or relating to it, is governed by the laws of the State of Texas, United States, without regard to its conflict-of-law rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

19.2 Courts

The state and federal courts located in Bexar County, Texas have exclusive jurisdiction over any dispute arising out of or relating to the Agreement, and each party submits to their jurisdiction. Either party may seek urgent injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information, or to stop unauthorised Security Testing.

Before starting proceedings, other than for urgent relief, a party should give the other written notice of the dispute, and the parties should try in good faith to resolve it within 30 days.

19.3 Consumers in the EU, EEA, UK and Switzerland

The Services are intended for business use. If you are a consumer who lives in the European Union, the European Economic Area, the United Kingdom or Switzerland, nothing in these Terms affects the rights you have under the mandatory consumer protection laws of your country of residence. You may bring proceedings in the courts of your country of residence, and the choice of Texas law does not deprive you of the protection of those mandatory laws. Any limitation of liability in these Terms applies to you only to the extent those laws allow.

20. General

20.1 Assignment

Neither party may assign or transfer the Agreement without the other’s prior written consent, which will not be unreasonably withheld. Either party may assign the Agreement without consent to an Affiliate or to a successor in a merger, acquisition or sale of all or substantially all of its relevant business or assets, provided the assignee agrees in writing to be bound by it and is not a competitor of the other party. Any other attempted assignment is void.

20.2 Force majeure

Neither party is liable for a delay or failure to perform caused by events beyond its reasonable control, such as natural disasters, war, terrorism, civil unrest, government action, labour disputes not involving its own workforce, failure of utilities, or widespread internet or cloud provider outages. The affected party must notify the other promptly and use reasonable efforts to resume performance. This section does not excuse payment obligations. If the event continues for more than 30 days, either party may terminate the affected Service by notice, and we will refund prepaid Fees for the unused part of the term.

20.3 Notices

We may give you notice by email to the address on your account, through the Services, or, for general changes, by posting on this site. You must give us notice by email to support@vaktex.com. Legal notices, such as a notice of breach or termination, should use the subject line “Legal notice”. A copy may also be sent to Vaktex, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA. Email notice is effective when sent, unless the sender receives a delivery failure message.

20.4 Electronic communications

You agree to receive communications from us electronically. Electronic communications and electronic acceptance meet any legal requirement for a communication or agreement to be in writing.

20.5 Severability

If a court finds any provision of the Agreement invalid or unenforceable, that provision will be enforced to the maximum extent permitted and the rest of the Agreement will remain in effect.

20.6 Entire agreement

The Agreement is the entire agreement between the parties about its subject matter and supersedes all prior agreements and understandings about it. Neither party has relied on any statement not set out in the Agreement. This does not limit liability for fraud. Except as Section 18 allows, the Agreement may be amended only in writing signed by both parties.

20.7 No waiver

A failure or delay in exercising a right is not a waiver of it. A waiver is effective only if it is in writing.

20.8 Independent contractors

The parties are independent contractors. The Agreement does not create a partnership, joint venture, employment, fiduciary or agency relationship. Neither party may bind the other.

20.9 No third-party beneficiaries

The Agreement benefits only the parties, except for the indemnified parties named in Section 15.

20.10 Publicity

Neither party may use the other’s name or logo in marketing without the other’s prior written consent.

20.11 Language

These Terms are written in English. If we provide a translation, the English version controls to the extent the law allows.

21. Contact

Send questions about these Terms, security reports and legal notices to support@vaktex.com.

Vaktex, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA