Terms of Service

1. Scope of Services

SableOffensive provides penetration testing and security assessment services for web applications, APIs, and cloud infrastructure. Our services include:

• --Pre-Launch Check: Automated and manual security review covering OWASP Top 10, secrets detection, and basic API testing. Report delivered within 24-48 hours.
• --Founder Shield: Comprehensive security assessment including IDOR testing, auth bypass attempts, business logic review, and a 30-minute debrief call.
• --Scale Secure: Full-scope penetration test including infrastructure review, CI/CD pipeline analysis, third-party integration audit, and ongoing support.
• --Custom Engagements: Tailored security assessments scoped to your specific requirements.

2. Authorization and Legal Testing

By engaging our services, you represent and warrant that:

• --You own or have explicit written authorization to test the target applications and infrastructure
• --You will provide a signed authorization form before testing begins
• --Testing will only be performed against the agreed-upon scope; we do not test systems outside the defined scope
• --You understand that penetration testing may cause temporary disruptions (we minimize this risk but cannot eliminate it entirely)
• --All testing is conducted ethically and in compliance with applicable computer fraud and abuse laws

3. Liability Limitations

To the maximum extent permitted by law:

• --SableOffensive is not liable for any indirect, incidental, or consequential damages arising from our testing
• --Our total liability for any claim related to our services is limited to the amount paid for that specific engagement
• --We are not responsible for vulnerabilities that emerge after the testing period or from code changes made after our assessment
• --We are not liable for any downtime or service disruption that may occur during authorized testing windows
• --Our reports represent findings at a specific point in time and do not guarantee future security

4. Payment Terms

Payment terms for our services:

• --Payment is required in full before testing begins for Pre-Launch Check and Founder Shield plans
• --For Scale Secure and custom engagements, a 50% deposit is required upfront with the balance due upon report delivery
• --All prices are listed in USD; applicable taxes may apply based on your jurisdiction
• --Invoices are sent via email; payment is accepted through our secure payment processor
• --Late payments may result in delayed report delivery or suspension of ongoing services

5. Refund Policy

We stand behind the quality of our work:

• --50% money-back guarantee: If our assessment finds zero security issues, you receive a 50% refund of the engagement fee
• --Refund requests must be made within 7 days of report delivery
• --Refunds do not apply if you provided incorrect, incomplete, or misleading information about the target scope
• --Refunds do not apply if you restricted access to parts of the application that prevented thorough testing
• --No refunds are issued for engagements that have been fully delivered as scoped

6. Service Level Agreement (SLA)

The following service levels apply to paid engagements. Timeframes are in business days (Monday to Friday) and begin once onboarding is complete: signed authorization, confirmed scope, and any access we need to start testing.

• --Report delivery: Pre-Launch Check and Founder Shield reports are delivered within 48 hours; Scale Secure and Custom Engagements within 5 business days, or the timeline agreed in your scope.
• --The delivery clock pauses whenever we are waiting on you (access, credentials, scope clarifications, or answers to our questions). Time blocked on your side does not count against these timeframes.
• --Remediation re-test: every paid scan includes one re-test at no additional charge. After you fix the reported issues we re-verify them, provided the re-test is requested within 30 days of report delivery.
• --Support response: questions about a delivered report are answered within 2 business days.
• --Platform availability: the dashboard and free tools are provided on a commercially reasonable-effort basis. We target 99% monthly availability as a goal, not a credit-backed guarantee; scheduled maintenance and occasional downtime may occur. The committed deliverables are the reports and re-tests above, so if the platform is unavailable when a delivery is due, the delivery clock pauses until service is restored.
• --Missed timeframes: if we miss a committed delivery timeframe for reasons within our control, you may request a 25% credit toward that engagement. This is in addition to the money-back guarantee in Section 5 and is your sole remedy for a missed timeframe.

7. Agent Service and Credits

The Sable dashboard, the specialist agents (pen-scout, pen-recon, pen-triage, pen-fixer, pen-compliance), and the credit system are an automated, self-service platform. These terms apply to that service and are separate from the scoped paid engagements in Section 6.

• --Agent actions are billed in credits (for example, a pen-scout turn costs 4 credits and a pen-recon turn 6). New accounts receive 150 credits at signup at no charge. Top-up prices are shown at checkout.
• --You are only charged for work that completes: if an agent turn or an automated scan fails for reasons within our control (an interrupted model provider, an unavailable scan engine, or an internal error), the credits for that action are refunded automatically.
• --Purchased credits do not expire. Promotional or granted credits may carry an expiry date, which is shown when they are issued.
• --The agent platform is provided on a commercially reasonable-effort basis and is not real-time. Scans and agent runs are queued and processed as capacity allows; we do not guarantee a completion time for automated agent work, and availability of specific agents may vary during peak demand or maintenance.
• --Automated scans run only against targets you have verified you own or are authorized to test: the ownership-verification step is required before any scan runs, and each scan executes in isolated infrastructure. The authorization warranties in Section 2 apply equally to automated scans.
• --The free header check and free-tier agent access are provided as-is, without the delivery timeframes or the missed-timeframe credit that apply to paid engagements in Section 6.

8. Confidentiality and NDA

Confidentiality is fundamental to our service:

• --All engagements are covered by a Non-Disclosure Agreement (NDA)
• --We will never sell your data, and we will never disclose your identity, application details, or vulnerability findings to third parties for their own purposes; we share data only with the trusted subprocessors needed to deliver the service, as described in our Privacy Policy
• --Our security researchers are individually bound by confidentiality obligations
• --We do not use your specific vulnerability data for marketing, case studies, or public research without explicit permission
• --Aggregated, anonymized statistics may be used to improve our methodologies

9. Data Handling and Deletion

We follow strict data handling protocols:

• --All scan data, credentials, and vulnerability findings are permanently deleted within 30 days of report delivery
• --Staging credentials and access tokens are revoked immediately after testing concludes
• --Data is stored encrypted during the engagement period
• --You may request immediate deletion of all data at any time
• --See our Privacy Policy for complete details on data handling practices

8. Intellectual Property

Upon full payment, you receive a non-exclusive license to use the security assessment report for your internal business purposes. SableOffensive retains ownership of our testing methodologies, tools, and proprietary processes. You may not redistribute, resell, or publish our reports without written consent.

9. Termination

Either party may terminate an engagement with written notice. If you terminate before testing is complete, you are responsible for payment proportional to work completed. We reserve the right to terminate an engagement if we discover illegal activity or if you violate these Terms.

10. Governing Law and Dispute Resolution

These Terms are governed by applicable international commercial law. Any disputes arising from these Terms or our services will first be addressed through good-faith negotiation. If negotiation fails, disputes will be resolved through binding arbitration in accordance with internationally recognized arbitration procedures.