Ghostprobe Terms of Service

1.1These terms are an agreement between Vlasiu Alexandru Robert PFA, a Romanian authorised natural person (persoană fizică autorizată) with tax identification number RO42774813, registered at Str. Bradului nr. 69, Arad 310205, Romania, trading as Ghostprobe ("Ghostprobe", "we", "us"), and the business that buys or uses our services ("you").

1.2By creating an account, buying a package or using the services, you accept these terms on behalf of your business. If you do not agree, do not use the services.

1.3These terms include Schedule 1 (Rules of engagement), our Privacy Policy at ghostprobe.io/privacy and our Data Processing Agreement at ghostprobe.io/dpa. If they conflict, the order of priority is: the Data Processing Agreement (for personal data only), then these terms, then Schedule 1, then the Privacy Policy.

1.4Under Article 1203 of the Romanian Civil Code, some clauses take effect only if you accept them expressly and in writing. You do this by ticking the separate box for them when you create your Account or buy a Package. These clauses are:

• 5.6 and 19.1: our right to refuse, suspend or stop the services
• section 7: testing limits and risks
• 9.2: renewal of the Continuous Package
• 9.4: expiry of unused Jobs
• 9.5: suspension for late payment
• section 10: no refunds
• 15.1: restrictions on your use, including no competing service
• 16.3 and section 17: limits on our liability
• section 18: your indemnity
• 19.4: our right to end the agreement on notice
• section 20: changes to these terms
• section 23: Romanian law and the courts of Arad

2.1In these terms:

Account

means your Ghostprobe account.

Dossier

means the report we deliver for a Job, including findings, evidence and suggested fixes.

Finding

means a security weakness we identify and confirm during a Job. A Critical Finding is a Finding we rate as critical severity.

Job

means one paid assessment under a Package.

Package

means the plan you buy, as described on our website at the time of purchase (for example Recon, Pentest or Continuous).

Scope

means the Targets, environments, dates and conditions you confirm for a Job.

Source Code

means any code you upload or connect for a Job.

Target

means a single web address (URL) or API endpoint you name in the Scope. Each subdomain is a separate Target.

Test Credentials

means any login details or tokens you give us for a Job.

Your Data

means all data, Source Code and Test Credentials you give us, and any of your data we access during a Job.

3.1The services are for businesses only. You confirm that you are acting for a business and not as a consumer.

3.2The person accepting these terms must be at least 18 and have authority to bind your business.

3.3You must not use the services if you, your business or any Target owner is subject to UK, EU, UN or US sanctions, or is located in a country under comprehensive sanctions.

3.4You are responsible for everything done through your Account. Keep your login details secure and tell us at once at contact@ghostprobe.io if you think your Account has been misused.

4.1Ghostprobe runs automated security tests against the Targets in your Scope using AI agents and security tools. A security engineer reviews the results, removes false positives and approves the Dossier before we release it.

4.2What each Package includes (number of Targets, Source Code testing, scheduled runs, support) is set out on our website at the time you buy. That description forms part of these terms.

4.3Our target is to deliver a Dossier within 48 hours of the later of: your Scope being confirmed, and working access to every Target (and Test Credentials, if used). This is a target, not a guarantee.

4.4On the Continuous Package, Jobs run on the schedule or deploy triggers you set, within the limits of your Package.

4.5We may change how we deliver the services (for example the tools or models we use) as long as the overall service you paid for is not materially reduced.

4.6Where your Package includes a retest, you can request it within 60 days of the first Dossier. The retest covers the live test, not Source Code review. The Dossier is delivered when the retest report is released or, if you do not request a retest within those 60 days, when that period ends.

5.1Security testing without the owner's permission can be a criminal offence, including under Article 360 of the Romanian Criminal Code, the UK Computer Misuse Act 1990 and the US Computer Fraud and Abuse Act. This section is therefore a core part of the agreement.

5.2For every Target you add, you confirm that:

• your business owns and controls the Target, or has written permission from its owner to have it tested by a third party on the terms of this agreement;
• the person confirming the Scope has authority to give that permission; and
• testing the Target does not breach any contract you have with a hosting provider, cloud provider, customer or other third party.

5.3Before a Job starts, you must prove control of each Target using one of the methods shown in your Account: a DNS TXT record, a file at /.well-known/ghostprobe-verification.txt, or an HTML meta tag. If you act for the owner (for example as an agency), the owner must complete this step or sign our letter of authorisation. We check control again before every Job and every scheduled run, and we will not test a Target until it passes.

5.4We will only test the Targets, environments and time windows in your confirmed Scope. Anything not listed is out of scope.

5.5You must tell us at once if your authority over a Target ends or changes. We will stop testing it.

5.6We may refuse to test, or stop testing, any Target at any time if we reasonably believe the testing is not authorised, could cause serious harm, or would break the law.

5.7Testing follows Schedule 1 (Rules of engagement).

6.1You must:

• give accurate Scope details and keep them up to date;
• give us working access to each Target and, if you choose, Test Credentials for test accounts only (never real customer accounts or admin accounts used for live operations);
• back up any system and data that could be affected before testing starts;
• follow your hosting and cloud providers' testing policies and get any approvals they require;
• warn anyone who needs to know (for example your hosting provider or security team) that testing will take place; and
• tell us at once at contact@ghostprobe.io if testing causes a problem, so we can pause it.

6.2We only test development and test environments, such as staging. We never test production. You confirm that every Target in your Scope is a non-production environment and that it does not connect to production databases or services. Findings reflect the environment we tested, so keep it as close to production as you can and apply fixes to production too.

6.3You are responsible for deciding whether and how to fix Findings, and for any changes you make to your systems.

7.1Within what your Package includes, we aim to find every exploitable weakness in your Scope. Testing is not cut short by a timer: it runs until our test plan for each Target is complete. Source Code review is the only part with a fixed time budget, which is set out in your Package.

7.2We confirm every Finding before we report it, exploiting it only as far as needed to prove it is real (S1.2). A security engineer then reviews it, to keep false positives out of your Dossier. Suggested fixes are guidance, so check them before you apply them.

7.3A Job tests your Targets as they are during the Job. Like any security test, it cannot prove that no other weaknesses exist. It does not cover changes made after the Job or anything outside the Scope, so keep your own security controls and monitoring in place and test again after major changes.

7.4Dossiers are built to be used as evidence in customer security reviews and audits such as SOC 2 and ISO 27001. A Dossier is not a certification of compliance, and the auditor, regulator or customer decides whether to accept it.

7.5Testing sends real attack traffic to your Targets. The safeguards in Schedule 1 keep it controlled, but it can still slow systems down, trigger alerts, lock accounts, create test records or, rarely, change or corrupt data. You accept these risks for the Targets in your Scope.

8.1We deliver each Dossier through your Account. You may share it with your auditors, customers, insurers and advisers, as long as you do not change it and still present it as our work.

8.2If we find a Critical Finding during a Job, we will aim to tell you within 24 hours, before the Dossier is ready.

8.3We treat all Findings about your systems as your Confidential Information (section 11). We will not disclose them to anyone else, except as allowed in sections 8.4 and 11.

8.4If we find a vulnerability in third-party software (for example an open-source library or a commercial product), not in your own code or configuration, we may report it privately to the vendor or maintainer so it can be fixed. We will tell you before we report it. We will not publish any details until 90 days after the vendor is told, unless the vendor agrees otherwise, and we will never name you or identify your systems.

8.5If we see signs that a Target has already been compromised by someone else, we will stop and tell you. We are not an incident response provider.

9.1Prices are shown on our website or in your order, in US dollars, and exclude VAT, sales tax and other taxes, which are added where required.

9.2Recon and Pentest Packages are paid in full before testing starts. The Continuous Package is billed monthly or annually in advance, as you choose, at the price agreed in your order.

9.3Card payments are processed by Stripe. We do not see or store your full card details.

9.4Each Job in a Package must be started within 12 months of purchase. Unused Jobs expire after that and are not refunded.

9.5Where we invoice you directly, payment is due within 30 days of the invoice date. If you pay late, we may charge the statutory penalty interest that applies between professionals under Romanian law and suspend the services until you pay.

9.6We may change our prices. Changes do not affect Jobs you have already paid for. For the Continuous Package, we will give you at least 30 days' notice and the new price applies from your next billing period.

10.1All fees are final and non-refundable once paid, including for Jobs you have not started. The only exceptions are in 10.3, 10.4 and 19.4, and in section 5.2 of the Data Processing Agreement.

10.2Before testing starts, you may move a Job to a new date or to other Targets within the same Package, as long as it starts within 12 months of purchase (section 9.4). This replaces any right to a refund.

10.3If we cannot deliver a Dossier for a Job because of a fault on our side, we will re-run the Job at no cost. If a re-run is not possible, we will refund the fee for that Job. Subject to section 17.1, this is your only remedy for a Job we fail to deliver.

10.4If we decide not to test a Target under section 5.6 for a reason other than your breach of these terms or a lack of authorisation, you may replace it with another Target. If you cannot, we will refund the unused part of the fee for that Target.

10.5The number or severity of Findings is not a reason for a refund. A Dossier with few or no Findings is a valid result of a Job.

10.6You can cancel the Continuous Package at any time, effective at the end of the current billing period. We do not refund or credit part periods, unused runs or the rest of an annual term.

10.7If you have a billing problem, contact us at contact@ghostprobe.io and give us 14 days to fix it before you dispute a payment with your bank or card issuer. If you dispute a payment that is due under these terms, we may suspend your Account until the dispute is resolved, and you must repay any dispute fees our payment provider charges us.

10.8Refunds due under this section are paid to the original payment method, in the currency you paid, within 14 days of our decision. Send refund requests to contact@ghostprobe.io.

11.1"Confidential Information" means any non-public information one party shares with the other under these terms. Your Data, Findings and Dossiers are your Confidential Information.

11.2Each party will keep the other's Confidential Information confidential and use it only to perform or receive the services. It may share it only with its staff, subcontractors and professional advisers who need to know it and are bound by confidentiality duties at least as strict as these.

11.3This section does not apply to information that is or becomes public through no fault of the receiving party, that it already knew, or that it developed independently. A party may disclose information if the law, a court or a regulator requires it, and will tell the other party first where the law allows.

11.4These duties last for the term of the agreement and 5 years after it ends. For Your Data, Findings and Dossiers, they last for as long as we hold them.

12.1You own Your Data. You give us a limited licence to use it only to provide the services to you.

12.2We will never use Your Data, Source Code, Test Credentials, Findings or Dossiers to train or improve any AI model, whether ours or a third party's.

12.3We use third-party AI model providers and hosting providers to run the services. Our AI models run on servers our AI provider shares between its customers, with each customer's data kept separate from the others'. Our AI providers may not use the data we send to train shared models, and we never authorise any training on it. Our current subprocessors are listed at ghostprobe.io/subprocessors, and we will give notice of changes as set out in the Data Processing Agreement.

12.4We protect Your Data with appropriate technical and organisational measures, including encryption in transit and at rest, and access limited to staff who need it to deliver your Job.

12.5We keep Your Data only as long as we need it. We delete Test Credentials within 7 days, Source Code within 30 days, and raw test logs within 90 days, after we deliver the Dossier for the Job they relate to (see 4.6 for when a Dossier with a retest is delivered). You should disable or rotate test accounts once the Job ends.

12.6Dossiers and Findings stay in your Account until you delete them or close your Account. We delete them within 90 days of Account closure. We keep Scope, ownership and authorisation records for 6 years after each Job, as evidence that testing was authorised, and billing records for as long as tax law requires.

12.7We store Your Data in the European Union. Some processing, including by AI providers, may take place in other countries such as the United States. Where it does, we protect it with the safeguards set out in the Data Processing Agreement.

12.8We may collect technical data about how the services are used (for example run times, error rates and number of Jobs) to operate and improve the platform. This never includes the content of Your Data, Findings or Dossiers.

13.1Where we process personal data on your behalf (for example in Test Credentials or data we see on a Target), you are the controller and we are the processor. Our Data Processing Agreement at ghostprobe.io/dpa applies and forms part of these terms.

13.2Please keep personal data out of test environments where you can, and use test accounts and test data.

13.3Our Privacy Policy explains how we use the contact and account details of your staff.

14.1We own the Ghostprobe platform, software, AI agents, methods, templates and know-how, including any improvements. Nothing in these terms transfers them to you.

14.2Once you have paid for a Job, you have a permanent, non-exclusive licence to use the Dossier for your business and to share it as set out in section 8.1.

14.3If you give us feedback or ideas, we may use them without any obligation to you.

14.4We will not use your name or logo in our marketing without your written permission.

15.1You must not:

• add a Target you are not authorised to have tested;
• use the services, Findings or Dossiers to attack, exploit or gain unauthorised access to any system;
• resell or offer the services to third parties without our written agreement;
• copy, reverse engineer or try to extract our software, models, prompts or tools, except where the law allows;
• use the services to build a competing service;
• interfere with, overload or bypass the limits of the platform; or
• upload malware or unlawful content, other than test payloads we agree in the Scope.

16.1We will provide the services with reasonable skill and care, and Findings will be reviewed by staff with suitable security testing experience.

16.2You confirm that everything you tell us in section 5 is true, that the information you give us is accurate, and that you will use the services and Dossiers lawfully.

16.3Except as set out in these terms, the services are provided "as is". To the extent the law allows, all other warranties, conditions and terms implied by law are excluded, including any about satisfactory quality or fitness for a particular purpose. We do not promise that the services will be uninterrupted or error-free.

17.1Nothing in these terms limits or excludes liability for harm caused intentionally or through gross negligence, for death or personal injury, for fraud, or for any other liability that cannot be limited or excluded by law.

17.2Subject to 17.1, we are not liable, whether in contract, tort (including negligence) or otherwise, for:

• loss of profits, revenue, business, contracts, goodwill or anticipated savings;
• loss or corruption of data;
• downtime or business interruption;
• any indirect or consequential loss; or
• any loss caused by testing carried out within your confirmed Scope and in line with Schedule 1.

17.3Subject to 17.1, our total liability arising out of or in connection with these terms is limited to the total fees you paid us in the 12 months before the event that caused the claim.

17.4The limits in this section do not apply to your obligation to pay fees or to your indemnity under section 18.

18.1You will indemnify us against all claims, losses, damages, fines, costs and expenses (including reasonable legal fees) arising from:

• testing a Target you were not authorised to have tested, or any other breach of section 5;
• your breach of section 15; or
• Your Data infringing the rights of a third party.

18.2We will tell you promptly about any claim covered by 18.1, let you control its defence (as long as you do not settle it without our consent) and give you reasonable help at your cost.

19.1We may suspend all or part of the services at once if we reasonably believe that testing is not authorised or is causing harm, that you have breached section 15, that you have not paid, or that the law requires it. Where the law allows, we will tell you why.

19.2Either party may end this agreement by written notice if the other party seriously breaches it and does not fix the breach within 14 days of being asked to, or if the other party becomes insolvent.

19.3You may close your Account at any time. The Continuous Package ends as set out in section 10.6.

19.4We may end this agreement for any reason with 30 days' notice. If we do, we will refund any unused Jobs and any prepaid Continuous fees for the period after the end date.

19.5When this agreement ends, your access ends, any unpaid fees become due, and we delete Your Data as set out in sections 12.5 and 12.6. Download any Dossiers you need before closing your Account. Sections 5, 7, 8, 11, 12, 14, 17, 18, 22 and 23 continue to apply after the agreement ends.

20.1We may update these terms. We will tell you about material changes by email or in your Account at least 30 days before they take effect.

20.2Jobs bought before a change take effect under the terms in force when you bought them. If you are on the Continuous Package and do not accept a change, you may cancel before it takes effect without any penalty.

21.1Neither party is liable for delay or failure caused by events beyond its reasonable control, such as outages at hosting or AI providers, internet failures, natural disasters, war, strikes or government action. This does not apply to your obligation to pay.

22.1Subcontractors. We may use subcontractors to provide the services. We remain responsible for their work.

22.2Transfer. You may not transfer this agreement without our written consent. We may transfer it to a company we set up or control, a group company or a buyer of our business, and will tell you if we do.

22.3Entire agreement. These terms and your order are the whole agreement between us about the services. Neither party relies on any statement not set out in them. This does not limit liability for fraud.

22.4Third parties. No one other than you and us has any right to enforce these terms.

22.5Severability. If a court finds part of these terms invalid, the rest stays in force.

22.6No waiver. If a party delays enforcing its rights, it does not give them up.

22.7Relationship. We are independent contractors. Nothing in these terms creates a partnership, joint venture or employment.

22.8Notices. We send notices to the email address on your Account. You send notices to contact@ghostprobe.io. An email notice is treated as received on the next business day after it is sent.

23.1These terms, and any dispute or claim arising out of or in connection with them (including non-contractual disputes), are governed by Romanian law.

23.2Before starting court proceedings, each party will try in good faith to settle the dispute through senior representatives for at least 30 days. This does not stop either party from seeking urgent relief.

23.3The competent courts of Arad, Romania have exclusive jurisdiction.

24.1Vlasiu Alexandru Robert PFA, trading as Ghostprobe, Str. Bradului nr. 69, Arad 310205, Romania. Email: contact@ghostprobe.io.