Terms of Service

1. Service Overview

Pentforge is a credit-based, hosted platform operated by Cyber Security RO SRL, Romania, EU. These Terms govern use of the platform and any scoped security assessment performed through it on systems you own or are explicitly authorised to test.

Assessments are not point-and-shoot scans. Any assessment performed under these Terms requires:

• Written proof that you own the target system, or are authorised to test it
• A signed scope document before the assessment begins

2. Accounts and Credits

Account creation. You must provide a name and a valid business email address to register. You are responsible for keeping your password confidential, and for telling us promptly if you believe your account has been used without your permission.

Credits. Credits are a prepaid unit used to pay for platform services. Credits are tied to your account and are not transferable to another account.

The following credit terms are open. Until the owner settles them, this draft makes no promise in either direction - neither that credits expire nor that they do not, and neither that they are refundable nor that they are not:

• Expiry: TODO-owner: define the credit expiry policy — open, nothing is promised either way
• Refunds: TODO-owner: define the refund policy for unused credits and prepaid plans — open, nothing is promised either way

3. Acceptable Use

You may request an assessment only for systems you own or are explicitly authorised in writing to test. You will not:

• Scan or probe prospects, competitors or any third party who has not authorised it in writing
• Submit a target without proof of ownership or authorisation
• Use the platform for unauthorised testing or any malicious purpose
• Attempt to gain unauthorised access to the platform itself
• Share account credentials or work around access controls

The Authorised Testing Policy sets out this rule in full and forms part of these Terms.

4. Assessment Reports

Automated reports are unvalidated. Where the platform produces an automated first-pass report, it must be labelled as unvalidated. It is a preliminary view and has not been checked by a human tester.

Human validation is a separate paid step. No finding may be described as human-validated unless that step has been purchased and completed.

5. Suspension and Termination

We may suspend or terminate an account where:

• The Acceptable Use Policy is breached, including unauthorised testing or prospect scanning
• The account is used abusively or fraudulently
• Suspension is needed to protect the platform or to meet a legal obligation

TODO-owner: define the suspension policy for unauthorised testing, prospect scanning or other abuse

What happens to a suspended account's credits and data is open:

• Remaining credits: TODO-owner: decide what happens to a suspended account's remaining credits — no outcome is promised until this is settled
• Assessment data: TODO-owner: decide what assessment data is preserved after a violation, for how long, and on what legal basis
• Appeals: TODO-owner: define the suspension appeal and reinstatement process

6. Limitation of Liability

As is. If made available under these Terms, The platform and its automated assessment output are provided 'as is', without warranty of merchantability or fitness for a particular purpose.

Liability cap: TODO-owner: define the liability cap

Indemnification: TODO-owner: define the indemnification terms

Consequential damages: TODO-owner: define the exclusion of indirect, incidental and consequential damages

7. Governing Law and Jurisdiction

These Terms are governed by the laws of Romania. Disputes are subject to the competent courts of Romania. Applicable European Union law, including the GDPR, continues to apply.

8. Related Policies

• Privacy Policy
• Authorised Testing Policy

9. Contact

Questions about these Terms: TODO-owner: confirm the legal/support contact address

Company details still to be confirmed before publication - registered address: TODO-owner: confirm the registered address to publish; registration number: TODO-owner: confirm the registration/CUI number to publish; VAT identifier: TODO-owner: confirm whether a VAT identifier is displayed, and its value.