Terms of Service

1. Parties and acceptance

These Terms of Service ("Terms") form a contract between you (and, where you act for an organisation, that organisation) and Antanox, based in India, provider of the Orithos AI agent security testing platform ("the Service"). By accessing or using the Service you agree to these Terms, our Privacy Policy, Refund Policy, and, where applicable, our Data Processing Agreement and Master Subscription Agreement. If you do not agree, do not use the Service.

You must be at least 18 years old (or the age of majority where you live). If you accept on behalf of an organisation, you represent you have authority to bind it.

2. The service — and what it is not

Orithos probes AI agent endpoints for vulnerabilities, evaluates responses through a judge pipeline, maps findings to compliance frameworks, and produces evidence packs. Scan results are point-in-time assessments of the tested configuration — they are not a certification, audit opinion, attestation, or guarantee of security. A clean scan does not mean your agent is secure; a finding is an evaluated verdict with attached evidence and confidence, not an infallible judgment.

3. Your authorisation responsibility

You may only scan systems you own or have explicit written authorisation to test. Unauthorised security testing may constitute a criminal offence — including under India's Information Technology Act 2000, the UK Computer Misuse Act 1990, the US Computer Fraud and Abuse Act, the EU Cybercrime Directive implementations, and equivalent laws elsewhere. You assume full responsibility for confirming authorisation before every scan, including for third-party endpoints, client systems, and production environments. We may suspend scanning activity we reasonably believe is unauthorised, without liability to you.

4. Acceptable use

You agree not to:

• Probe, scan, or test any system without proper authorisation (Section 3);
• Use probe payloads, including from our public catalog, against systems you are not authorised to test;
• Use the Service for any illegal purpose or in violation of applicable cyber, data-protection, or export-control laws;
• Generate, amplify, or distribute malware, disinformation, CSAM, or other unlawful content using scan outputs;
• Resell, sublicense, or redistribute the Service or bulk scan outputs without written permission;
• Interfere with the integrity, availability, or performance of the Service (including bypassing rate limits, credential sharing at scale, or reverse-engineering access controls);
• Attempt to gain unauthorised access to the Service, other customers' data, or our infrastructure;
• Misrepresent scan results as a certification, audit, or regulatory approval.

Violation may result in immediate suspension or termination, forfeiture of unused credits without refund where the violation is wilful, and cooperation with law enforcement where required.

5. Accounts and security

You are responsible for maintaining the confidentiality of API keys and credentials and for all activity under your account. Use strong, unique credentials and rotate keys if compromise is suspected. Notify us immediately at [email protected] of any suspected unauthorised use.

6. Plans, credits, and payment

The Service is offered on Free, Starter, Team, Business, and Enterprise plans, as described on the pricing page. Scanning is metered in credits: probe scans consume credits per executed probe, adaptive scans per conversation, plus fixed rates for exports and verification. Credit packs are purchased through our payment provider (Dodo Payments); we never see or store your card details.

• Subscriptions renew automatically until cancelled; cancellation takes effect at the end of the current billing period.
• Credit packs are non-refundable once credits have been consumed — see the Refund Policy.
• We may change plan features or pricing with at least 30 days' notice; changes never retroactively alter already-purchased credits.
• Overdue invoiced amounts (Enterprise) may incur interest at the maximum lawful rate and, after notice, suspension until paid.

7. Data and privacy

Our Privacy Policy and, where you process third-party personal data through the Service, our Data Processing Agreement apply and are incorporated here. You retain all rights to your scan data and agent configurations. We access them only to provide the Service, maintain security, or as required by law. Retention follows your plan window (14 / 90 / 365 days) or Zero-Knowledge mode — see Data Retention.

8. Intellectual property

The Orithos platform — interface, API design, judge pipeline, documentation, name, logo, and brand assets — is proprietary to Antanox. Nothing here grants a license to it or to our trademarks.

Carve-out: the attack probe catalog published at github.com/Antanox/orithos-catalog is licensed MIT and may be used, modified, and redistributed under those terms. Catalog content remains subject to Section 4: MIT permission to read the payloads is not authorisation to fire them at systems you do not own.

9. Warranties and disclaimer

The Service is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that scans will detect all vulnerabilities, that findings are error-free, or that the Service will be uninterrupted. Nothing here limits rights you hold as a consumer that cannot lawfully be limited.

10. Limitation of liability

To the maximum extent permitted by law: (a) neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profits, revenue, data, or goodwill; (b) each party's aggregate liability arising from the Service is capped at the amounts you paid in the 12 months preceding the claim (or ₹10,000, whichever is greater, for Free-plan claims). Nothing limits liability for death or personal injury caused by negligence, fraud, or any matter that cannot lawfully be limited.

11. Indemnification

You will indemnify and hold harmless Antanox, its personnel, and affiliates against third-party claims arising from (i) your unauthorised testing or misuse of the Service or catalog payloads, (ii) your violation of these Terms or applicable law, or (iii) data you provide without a lawful basis. We will indemnify you against third-party IP claims alleging the Service as provided infringes their rights, provided you notify us promptly and give us control of the defense.

12. Termination

You may terminate at any time (subscriptions run to period end; see Section 6). We may suspend or terminate for material breach (including Section 4 violations), non-payment after notice, legal requirement, or service discontinuation with reasonable notice. On termination, access ends and your data is deleted within 30 days per your retention settings, except records the law requires us to keep. Sections 3, 4, 8, 9, 10, 11, and 13 survive.

13. Governing law and disputes

These Terms are governed by the laws of India, without regard to conflict-of-law rules. The parties submit to the exclusive jurisdiction of the courts at Antanox's principal place of business in India. Before litigating (except for urgent injunctive relief or IP claims), the parties will attempt good-faith negotiation for 30 days following written notice to [email protected]. Where you are a consumer, mandatory protections of your home jurisdiction continue to apply.

14. General

Entire agreement: these Terms plus the Privacy Policy, Refund Policy, DPA, and MSA (where applicable) are the complete agreement for the Service. Order of precedence on conflict: MSA, then DPA (for data matters), then these Terms. Severability: an unenforceable clause is narrowed to the minimum extent; the rest stands. Assignment: you may not assign without our consent; we may assign in a merger or asset sale. Force majeure: neither party is liable for delay caused by events beyond reasonable control. Changes: material changes notified by email or in-product at least 14 days before effect; continued use constitutes acceptance.

15. Contact

Legal questions: [email protected]. Support: [email protected].