Terms of Service

These Terms of Service (the "Terms") are a binding agreement between you ("Customer", "you") and TigerStrike ("TigerStrike", "we", "us", "our") governing your access to and use of the TigerStrike AI-driven pentesting and VAPT services platform, including the website at tigerstrike.io, the hosted application, APIs, scanners, reports, and any related services (collectively, the "Services"). By creating an account, signing an order form, or otherwise accessing the Services, you accept these Terms. If you do not accept, do not use the Services.

1. Acceptance of Terms

By accessing or using the Services, you agree to be bound by these Terms and all applicable laws and regulations. If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have the authority to bind that entity to these Terms, in which case "you" and "Customer" refers to that entity.

We may update these Terms from time to time. Material changes will be notified via email or in-product notice at least 30 days before taking effect, except where urgent changes are required by law, security, or to prevent harm.

2. Scope of Services and Use License

Subject to your compliance with these Terms and payment of applicable fees, TigerStrike grants you a limited, non-exclusive, non-transferable, revocable right to access and use the Services for your internal business purpose of conducting authorised security testing on systems you own or are authorised to test.

• You must have documented authorisation to test every target you submit (ownership, written consent, or an existing scope agreement).
• You may not use the Services for any illegal purpose, including unauthorised access, data theft, denial-of-service against third-party systems, or any activity that violates applicable law.
• You may not attempt to reverse engineer, circumvent, or disable any security control, rate limit, or access-management feature of the Services.
• You may not redistribute, resell, white-label, sublicense, or make the Services available to third parties except under a separate written agreement with TigerStrike (for example, our MSSP / white-label programme).
• You may not use the Services to build a competing product or to extract benchmarking data for the purpose of competitive analysis.

3. Service Description

TigerStrike provides an AI-driven penetration testing and VAPT services platform. The Services include 143+ security scanners covering web applications, APIs, mobile applications, cloud workloads, and network infrastructure. Each scanner validates vulnerabilities with a working proof-of-concept where safe to do so, maps findings to compliance frameworks (SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, RBI, CERT-In among others), and produces auditor-ready report evidence.

Service availability targets, support response times, data processing arrangements, and any custom integrations are set out in the applicable order form, Service Level Agreement (SLA), and Data Processing Agreement (DPA). To the extent of any conflict, the order form prevails over these Terms.

We may modify, add, or remove features of the Services from time to time. Material degradations to a feature you depend on under an active order form will be announced in advance where feasible.

4. Account Registration and Authentication

To access most parts of the Services you must create an account. You agree to provide accurate, current, and complete information during registration and to keep it updated. You are responsible for safeguarding your credentials, including enabling multi-factor authentication where offered, and for all activity under your account.

Notify us immediately at [email protected] of any suspected unauthorised access or security incident involving your account.

5. Authorisation to Test

You represent and warrant that for every target you submit to the Services, you have the lawful authority and documented authorisation to perform security testing. This includes targets owned by third parties where you act under a contract (for example, as a Managed Security Service Provider testing on behalf of your end client).

You will indemnify, defend, and hold harmless TigerStrike against any third-party claim arising from your submission of a target you were not authorised to test, including without limitation claims by target-system owners, their customers, data subjects, or regulators.

TigerStrike may suspend scans or terminate access, with or without prior notice, where we have a reasonable basis to believe testing authority is lacking or testing is being conducted abusively.

6. Fees, Payment, and Taxes

Fees are set out in your order form or in the pricing published at tigerstrike.io/pricing. Unless otherwise stated, fees are quoted in US dollars, are billed in advance, and are non-refundable except as expressly provided in these Terms or required by law.

Overdue amounts bear interest at the lower of 1.5% per month or the maximum rate permitted by law. If any payment is overdue by more than 30 days, we may suspend the Services until payment is received.

Fees are exclusive of taxes, duties, or similar governmental assessments. You are responsible for any such taxes other than taxes on TigerStrike's net income.

7. Term, Renewal, and Termination

These Terms begin when you first access the Services and continue until terminated. Paid subscriptions have the term stated in the order form. Unless the order form states otherwise, subscriptions renew automatically for successive terms of equal length unless either party gives written notice of non-renewal at least 30 days before the end of the current term.

Either party may terminate for material breach that is not cured within 30 days of written notice. TigerStrike may suspend or terminate immediately in cases of (a) failure to pay beyond the cure period, (b) use that violates applicable law, (c) use that creates security or stability risk to the Services or other customers, or (d) failure to maintain authorisation to test submitted targets.

On termination, your right to access the Services ends. We will make your Customer Data available for export for 30 days following termination and will then delete it, except where retention is required by law or to resolve a dispute.

8. Customer Data and Intellectual Property

You retain all rights, title, and interest in and to Customer Data — the data, content, and information you submit to the Services (including scope definitions, authentication material, and scan results). You grant TigerStrike a worldwide, non-exclusive, royalty-free licence to use Customer Data solely to provide, maintain, and improve the Services for you.

We may process aggregated and de-identified data derived from use of the Services for product improvement, benchmarking, and security research, in a form that cannot reasonably identify you, your end users, or your targets.

TigerStrike retains all rights, title, and interest in and to the Services, including software, documentation, scanners, templates, and any derivative works. No implied licence is granted to Customer other than those expressly set out in these Terms.

9. Confidentiality

Each party may receive or have access to information of the other party that is marked or reasonably understood to be confidential ("Confidential Information"). TigerStrike Confidential Information includes scanner methodologies, technical architecture, and non-public pricing. Customer Confidential Information includes Customer Data, vulnerability findings, and scope details.

Each party will protect the other's Confidential Information using at least the degree of care it uses to protect its own confidential information of similar importance (and in any event no less than reasonable care), and will not disclose it to third parties except as needed to perform under these Terms, as required by law, or with the other party's consent. These confidentiality obligations survive termination for 3 years, except trade secrets which are protected indefinitely.

10. Data Processing, Security, and Privacy

Our processing of personal data is governed by the Privacy Policy and, where applicable, the Data Processing Agreement (DPA) incorporated by reference. TigerStrike maintains a security programme aligned to SOC 2 Type II and ISO 27001. Material details of the security programme are summarised in the Security Page.

You are responsible for determining whether the Services are appropriate for the categories of data you submit, for configuring role-based access control within your account, and for providing any required notices or obtaining any required consents from your end users or data subjects.

11. Warranties and Disclaimers

TigerStrike warrants that the Services will materially perform as described in the applicable documentation during the subscription term. As Customer's sole remedy for breach of this warranty, TigerStrike will use commercially reasonable efforts to correct the non-conformance; if unable to do so within 60 days of written notice, Customer may terminate the affected subscription and receive a pro-rata refund of pre-paid, unused fees.

EXCEPT AS EXPRESSLY PROVIDED, THE SERVICES ARE PROVIDED "AS IS". TIGERSTRIKE DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. TIGERSTRIKE DOES NOT WARRANT THAT THE SERVICES WILL DETECT EVERY VULNERABILITY OR THAT RESULTS WILL BE ERROR-FREE OR UNINTERRUPTED.

12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THESE TERMS, WHETHER IN CONTRACT, TORT, OR OTHERWISE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO TIGERSTRIKE IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY. THESE LIMITATIONS DO NOT APPLY TO CUSTOMER'S PAYMENT OBLIGATIONS, EITHER PARTY'S INDEMNIFICATION OBLIGATIONS, OR BREACH OF CONFIDENTIALITY.

13. Indemnification

TigerStrike will defend Customer against third-party claims alleging that Customer's authorised use of the Services infringes a third party's intellectual property right, and will pay damages finally awarded or amounts settled, provided Customer promptly notifies us, allows us to control the defence, and reasonably cooperates.

Customer will defend TigerStrike against third-party claims arising from (a) Customer Data, (b) Customer's use of the Services in breach of these Terms or applicable law, or (c) Customer's submission of targets Customer was not authorised to test, and will pay damages finally awarded or amounts settled.

14. Service-Level Commitment and Support

Service availability targets, support response times, and incident credits are set out in the Service Level Agreement attached to the order form, if any. In the absence of a signed SLA, TigerStrike will use commercially reasonable efforts to maintain availability but makes no availability commitment.

15. Export Controls and Sanctions

The Services may be subject to export control and sanctions laws, including those of the United States, the European Union, the United Kingdom, and India. You will not use, export, re-export, or transfer the Services to any person, entity, or jurisdiction prohibited under such laws, and you represent that you are not listed on any applicable sanctions or restricted-party list.

16. Governing Law and Dispute Resolution

These Terms are governed by the laws of the jurisdiction specified in the applicable order form. In the absence of an order form specification, these Terms are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws principles.

Any dispute arising out of or relating to these Terms will be resolved in the courts of the agreed jurisdiction, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

17. Miscellaneous

Assignment. You may not assign these Terms without our prior written consent, except to a successor in connection with a merger, reorganisation, or sale of substantially all assets. TigerStrike may assign these Terms without consent in connection with similar corporate events.

Entire Agreement. These Terms, together with any applicable order form, DPA, SLA, and documents expressly incorporated by reference, constitute the entire agreement between the parties and supersede any prior agreements concerning the subject matter.

Force Majeure. Neither party is liable for delay or failure to perform due to causes beyond its reasonable control, including acts of God, war, terrorism, strikes, pandemic, or utility or communications failures affecting the public internet.

Severability. If any provision is held unenforceable, the remainder will continue in effect, and the parties will substitute an enforceable provision that most closely reflects the original intent.

18. Contact Information

For questions about these Terms of Service, please contact us at [email protected]. For account-specific matters, write to your account manager or [email protected]. For reporting a vulnerability in the TigerStrike platform itself, write to [email protected].