Terms of Service.
What you authorize, what we promise, what we deliberately do not promise, and how either of us can end it.
Agreement and parties
These terms govern your use of the SuperPentest website and service. "We", "us" and "SuperPentest" mean the SuperPentest entity named on your order form; "you" means the organisation that accepts these terms, and anyone you let use the service under your account.
You accept these terms by signing an order form, by clicking to accept, or by using the service. If you accept on behalf of an organisation, you confirm you may bind it. Where an order form, a signed rules-of-engagement document or a negotiated agreement conflicts with these terms, that document wins for the conflict in question.
Authorized testing only
SuperPentest performs security testing that would be unlawful without authorization. Everything below is a condition of use, not a formality.
- You warrant that you own or control every target you submit, or that you hold documented authority from the party that does, and that this authority covers the testing you ask us to perform.
- Scope is agreed in writing before anything runs. The rules of engagement record the authorized assets, identities, methods, limits and an expiry. Nothing outside that document is tested.
- Ownership is verified. We confirm control of a target before the first test request. We may refuse or pause any engagement where authorization looks unclear, and we do not have to explain a refusal beyond saying so.
- Discovery is not authorization. Reconnaissance may surface assets outside your scope. Those are reported to you as leads; they are never tested without a new written scope.
- Third-party platforms have their own rules. If your application runs on infrastructure whose provider requires notice or approval before testing, obtaining it is your responsibility.
- You will keep authorization current. If your authority over a target changes or lapses, tell us immediately and we will stop.
Breach of this section lets us suspend or terminate immediately, without refund, and we will cooperate with any lawful investigation that follows.
The service
SuperPentest runs authorized security assessments against the scope you approve and returns findings with reproducible evidence. Plans, scan quotas and included features are those described on our pricing page and recorded in your order form. A plan covers one application or API in scope; additional applications, roles or a larger API surface are quoted separately in writing.
We improve the service continuously. We will not materially reduce the functionality of a plan you are paying for during your term without telling you first.
Scan quotas are per billing period and do not roll over. Where a run is blocked by something on your side — an unreachable environment, credentials that do not work, a scope not yet confirmed — the run still counts unless we agree otherwise.
Your responsibilities
- Provide accurate scope information, working test identities for the roles you want exercised, and a technical contact we can reach during a run.
- Use dedicated test accounts, and seeded test data rather than production records, wherever your environment allows.
- Keep your account credentials secure and tell us promptly about any unauthorized use.
- Take your own backups and maintain your own recovery capability. Testing a live system carries inherent risk even when it is bounded.
- Rotate any credential you shared with us once an engagement is finished.
Prohibited use
You may not use SuperPentest to test a system you are not entitled to authorize; to attack, disrupt or degrade anyone's service; to generate load or denial of service outside the explicitly authorized, bounded resilience add-on; to access, exfiltrate or retain data beyond what proving a finding requires; to circumvent our scope enforcement, rate limits or stop conditions; to resell or white-label the service without our written agreement; or to reverse engineer the engine, except where that restriction is unenforceable by law.
Fees and billing
Fees are those on your order form, in euros, exclusive of VAT and any other applicable tax, which you pay in addition. Subscriptions are billed in advance, monthly or annually, and renew automatically for the same period unless either of us gives notice before the renewal date. Annual billing includes two months free, as described on the pricing page.
No finding, no fee. This applies to a first one-off Deep test: if that first Deep engagement completes and surfaces no verified high or critical finding, you do not pay for it. "Completes" means the run reached the end of its plan inside an agreed scope with working test identities; a run that could not proceed because of a blocked environment, unusable credentials or a withdrawn scope is not a completed run. The guarantee covers the one-off Deep test fee only, is available once per customer, and does not apply to subscription plans or add-ons.
Invoices are due within 14 days unless your order form says otherwise. We may suspend the service for overdue amounts after giving you notice. Except where law requires it or the guarantee above applies, fees are non-refundable.
Intellectual property
We own the service, the engine, our methodology and everything we create that is not specific to you, including anything we learn that is generalised and does not identify you or your systems.
You own your data, your systems and your scope documents. You own the reports and evidence produced for your engagements, and you may share them with your auditors, customers and regulators without asking us. We keep a licence to host, process and display that material only as needed to provide the service to you.
We will not name you as a customer or use your logo publicly without your written permission.
Confidentiality
Each of us will protect the other's confidential information with at least reasonable care, use it only to perform this agreement, and disclose it only to people who need it and are bound to equivalent terms. Findings about your systems are your confidential information, and we treat them that way indefinitely — not for a fixed number of years. The usual exceptions apply for information that is public, independently developed, or lawfully received from a third party, and for disclosure required by law after reasonable notice to you where notice is lawful.
Data protection
Where we process personal data on your behalf we act as processor and you act as controller. Our Data Processing Agreement governs that processing and forms part of this agreement when signed. How we handle personal data as a controller is described in our Privacy Policy, including the specific handling of test credentials and evidence.
Warranties and what we do not promise
We warrant that we will provide the service with reasonable skill and care, in line with the practices described on this website, and that we will stay inside your authorized scope.
We are deliberately explicit about the limits, because a security vendor that is not is selling you a false sense of safety:
- No test finds everything. Security testing is a sampling exercise bounded by time, scope and the behaviour of your environment. A clean result is evidence about what was tested, not proof that your system is secure.
- "No finding" does not mean "secure". We say so in the product and we say so here.
- Coverage is reported honestly, including when it is degraded. If tooling was unavailable or an area could not be reached, the run says so instead of passing silently.
- Testing a live system carries risk. We bound it with rate limits, backoff and stop conditions, but we cannot guarantee that no authorized test will ever affect a production system.
- We do not guarantee an audit outcome. Our reports are built to be handed to an auditor, but your auditor decides.
Beyond the warranty in the first paragraph, and to the extent the law allows, the service is provided as is and we exclude all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement.
Limitation of liability
Neither of us is liable for indirect or consequential loss, loss of profit, revenue, goodwill, anticipated savings, or loss or corruption of data, even if the loss was foreseeable.
Each party's total liability arising out of or connected with this agreement is limited to the fees you paid in the twelve months before the event giving rise to the claim.
Nothing in this agreement limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for your obligations under Authorized testing only and Indemnity, for either party's breach of confidentiality, or for anything else that cannot be limited by law.
Indemnity
You will defend and indemnify us against claims, losses and costs arising from a target you submitted without the authority to authorize, from your breach of Prohibited use, or from your infringement of a third party's rights. We will defend and indemnify you against a third-party claim that the service itself infringes their intellectual property rights.
Term, suspension and termination
A subscription runs for the period on your order form and renews automatically unless cancelled before the renewal date. A one-off engagement ends when the report and its retest are delivered.
We may suspend the service immediately where continuing would be unlawful, where authorization for a target is in doubt, where a run threatens the stability of a system, or where invoices are overdue after notice. Either of us may terminate for material breach that is not fixed within 30 days of written notice, or immediately if the other becomes insolvent.
On termination your right to use the service stops. You can export your reports and evidence for 30 days afterwards; after that we delete or anonymise your data in line with the retention periods in our Privacy Policy. Clauses that are meant to survive — intellectual property, confidentiality, liability, indemnity and governing law — do.
Changes to these terms
We may update these terms. The date at the top changes with them. For a material change we give customers at least 30 days' notice by email before it applies, and if you do not accept it you may terminate before it takes effect and receive a pro-rata refund of fees paid for the unused period.
Governing law
This agreement is governed by the laws of the jurisdiction in which the contracting SuperPentest entity is established, and the courts of that jurisdiction have exclusive jurisdiction over any dispute. The entity and the applicable jurisdiction are named on your order form, and we will tell you both before you sign anything. Nothing here removes a consumer's or a business's mandatory local rights where the law gives them.
If any provision is held unenforceable, the rest stays in force and the provision is read down to the minimum extent needed to make it valid.
Contact
Questions about these terms: [email protected].