Terms of Service

These terms govern access to and use of Zarb (the “Service”), operated by ZarbHQ (“we”, “us”). By using the Service you agree to them. If you are agreeing on behalf of an organization, you confirm you are authorized to bind that organization.

1. Authorization to test

The Service executes security testing activity against networked systems. You may only direct it at systems you own or for which you hold explicit, documented permission to conduct security testing.

You are solely responsible for obtaining and retaining that authorization. We do not verify it on your behalf. Directing the Service at systems you are not authorized to test is a material breach of these terms and may be unlawful in your jurisdiction.

2. Accounts and access

Accounts are provisioned by us. You are responsible for the security of your credentials and API tokens, for activity conducted under your account, and for promptly notifying us of any suspected compromise.

3. Alphas

Testing is carried out by an Alpha: a machine registered to your organization and dedicated to it. An Alpha is either one we deploy and operate on your behalf, or one you supply and register yourself.

Where you supply the Alpha, you are responsible for it, including its security, patching, network placement, and the credentials it holds. We are not responsible for its configuration or for consequences arising from it.

Where we deploy the Alpha, we are responsible for provisioning and maintaining it. You remain responsible for holding authorization to test everything you direct it at, for the scope you declare, and for any credentials you supply to it.

4. Acceptable use

You must not use the Service to:

• test systems without documented authorization
• conduct denial-of-service or availability attacks
• exfiltrate, retain, or disclose third-party personal data encountered during testing beyond what is necessary to evidence a finding
• develop, stage, or distribute malware or ransomware
• circumvent the tenancy boundaries or logging built into the Service
• resell or provide the Service to third parties without a written agreement with us

5. Content and outputs

You retain ownership of the objectives, targets, credentials, and files you supply, and of the findings and reports the Service generates for you. You grant us a limited license to process that material solely to operate and support the Service.

Outputs are generated in part by automated systems and may contain errors, omissions, or false positives. They are decision support, not a substitute for professional judgment. You are responsible for validating any finding before you act on it or communicate it onward.

6. Third-party model providers

The Service sends prompts, which may include material from your assessments, to the model providers we operate it against. We select and configure those providers as part of the Service. They are not chosen or managed by you.

We only operate against providers that contractually commit to zero data retention and to not training on submitted content. A provider unable to offer both is not eligible to process assessment traffic. We are not otherwise responsible for a provider's availability or output.

7. Availability

Unless a separate written agreement states otherwise, the Service is provided without a service-level commitment. We may modify, suspend, or discontinue any part of it, and will give reasonable notice of material changes where practical.

8. Fees

Fees, billing period, and scope of use are set out in your order or written agreement with us. Model inference costs are included in the Service and are not billed to you separately.

9. Suspension and termination

We may suspend or terminate access immediately where we reasonably believe the Service is being used without authorization, unlawfully, or in a way that risks harm to others or to the Service. You may stop using the Service at any time.

10. Disclaimer and liability

The Service is provided “as is”, without warranties of any kind to the fullest extent permitted by law. To the maximum extent permitted by law, our aggregate liability arising out of or relating to the Service is limited to the fees you paid us in the twelve months preceding the event giving rise to the claim, and we are not liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits or data.

11. Indemnity

You will indemnify us against claims, losses, and costs arising from your use of the Service in breach of these terms, including any claim that you tested a system without authorization.

12. Changes

We may update these terms. Material changes will be notified to account holders. Continued use after a change takes effect constitutes acceptance.

13. Contact

Questions about these terms: [email protected].