Terms of Service

1. Who we are and when these terms apply

These Terms of Service govern your use of the Versarial website and product abuse simulation and control validation services provided by Versarial AI LLC ("Versarial," "we," "us"). "Customer" or "you" means the organization entering an assessment or subscription agreement with us. A person accepting an agreement for an organization must have authority to bind it.

By using the website, you agree to the provisions applicable to website use. Assessment services require an accepted order or statement of work ("Order") identifying the service, delivery method, fees, term, authorized environment, and testing scope. Viewing the website or submitting an inquiry does not create a paid subscription or authorize a test.

An expressly negotiated Order controls conflicting commercial or scope provisions. An executed data processing agreement ("DPA") controls conflicting personal-data processing provisions. Nothing here overrides rights or obligations that applicable law does not allow the parties to waive.

2. What the service does

Assessments exercise agreed product flows, endpoints, or agents using controlled identity contexts and adversarial scenarios. Depending on the Order, deliverables may include observed outcomes, reproduction evidence, risk findings, fix verification, scheduled reruns, and release checks.

Scope may include business logic, account and identity flows, geographic restrictions, transaction controls, or manipulation of authorized test agents. We may identify behavior for which your business has not established a policy. Such behavior is presented for review, not automatically classified as prohibited or unlawful.

The marketing website currently shows illustrative results. It does not execute assessments, process payments, or provide an operational release gate. Its inquiry form sends the request to Versarial by email. Delivery through a manual assessment or platform must be established in the Order.

3. Written authorization and testing boundaries

You must own the relevant systems or obtain permission from the party entitled to authorize testing. Permission must cover each target and activity, including any required cloud, payment, communications, or other third-party provider approvals. Access credentials alone are not authorization.

Before execution, both parties must approve a written scope covering:

• Target domains, endpoints, environments, product flows, and exclusions.
• Test accounts, credentials, identity fixtures, and permitted roles.
• Allowed actions, prohibited actions, timing, request rates, concurrency, and spending or transaction limits.
• Expected controls or assumptions, success criteria, evidence collection, and handling of incidental personal data.
• Operational contacts, emergency stop instructions, monitoring, cleanup, and restoration responsibilities.

Sandbox authorization does not authorize production testing. Real transfers, withdrawals, purchases, destructive operations, load testing, and interaction with real customers or staff require separate explicit permission and safeguards. Human social engineering is excluded unless a separate engagement expressly authorizes the people, channels, methods, and consent requirements involved.

We will stay within the approved scope and stop when authorization is withdrawn, an agreed stop condition occurs, or continuing would create an unexpected material risk. Neither party may silently expand scope. You must notify us of changes affecting permissions, environment stability, or test accounts.

4. Customer responsibilities and acceptable use

You must supply accurate scope information, maintain required permissions, use appropriately limited test credentials, and arrange monitoring and recovery suitable for the environment. Both parties will use controlled fixtures and minimize access to live personal or financial data. Do not send secrets, payment credentials, or real identity documents through the website inquiry form.

You may not use the service to attack unauthorized systems, steal identities or funds, harass people, evade lawful restrictions, or exploit a finding outside an authorized engagement. Synthetic identities must be permitted test fixtures, not stolen identities. Test phone numbers, email accounts, network routes, and proxies must be lawfully controlled or licensed for the engagement.

You remain responsible for your product policies, legal obligations, remediation, and release decisions. This does not excuse us from our agreed scope, confidentiality, or data-protection obligations.

5. Findings, evidence, and limitations

A result describes the scenarios, environment, version, and conditions actually tested. A passing scenario does not establish that all paths are safe. A finding may depend on assumptions or need confirmation. AI-assisted analysis can be incomplete or incorrect, so material findings and proposed changes require qualified review.

We do not promise to discover every vulnerability or abuse pattern, prevent every financial loss, or certify compliance with any law or standard. Reports support internal reviews and auditor evidence requests; they are not legal advice, a compliance certification, or a guarantee that an auditor will accept them.

Unless separately agreed, the service is assessment and validation rather than live transaction blocking or runtime protection. Availability commitments, incident response, and remediation work apply only if included in the Order.

6. Scheduled runs and release integration

Scheduled and CI assessments require an approved scope, execution budget, target build or environment, and result policy. You determine which findings should affect a release and configure the authorized integration accordingly. An incomplete, failed, or unavailable assessment must be identified as such rather than represented as a passing assessment.

Material changes to the environment, credentials, or flow may require rescoping. Reruns and fix verification are limited to the coverage and budget in the Order; neither implies continuous coverage of every production event.

7. Orders, fees, and subscriptions

The accepted Order establishes the price, currency, taxes, included execution budget, billing schedule, and any approved additional usage. Additional charges require the agreed approval process. The free offer covers only the agreed initial sandbox assessment and does not authorize production access.

Prices are stated on the pricing page or in your Order. Annual billing is paid upfront at the agreed annual rate. It is a yearly commitment rather than a discounted monthly cancellation plan. Selecting a plan or submitting an inquiry does not itself authorize billing.

Your Order specifies subscription duration, renewal arrangements, cancellation procedures, any renewal notice or price-change process, and refund rights. Automatic renewal applies only when expressly agreed. Applicable statutory refund rights remain unaffected.

8. Ownership and permitted use

You retain ownership of data, policies, materials, and configurations you provide ("Customer Data"). We may process Customer Data only as necessary to deliver and secure the agreed service, comply with law, and fulfill documented instructions and the DPA.

You may use and share your customer-specific findings and delivered reports for internal risk management, remediation, and confidential reviews with auditors, advisers, and business partners. Protect personal data and exploit details when sharing. Public attribution to Versarial must not imply a certification or endorsement.

We retain ownership of our pre-existing software, tools, general scenario methods, templates, and branding. Your right to use these components is limited to the agreed service and delivered reports. We will not publish your name, confidential findings, or assessment traces without your written permission.

9. Confidentiality, data protection, and AI

Each party will protect the other party’s non-public business information using reasonable care, use it only for the engagement or another agreed purpose, and restrict access to people and authorized providers who need it and have confidentiality obligations. Standard exceptions apply to information already lawfully known, public without breach, independently developed, or lawfully received without restrictions.

A party compelled to disclose confidential information will provide notice where legally permitted and limit disclosure to what is required. Security findings, secrets, and customer traces are confidential even when the surrounding product is public.

Where we process personal data on your behalf, the parties must execute an appropriate DPA before testing. It must identify processing instructions, authorized providers, security measures, incident notification, assistance with rights requests, international transfers, and return or deletion arrangements.

Model training: we will not use Customer Data, confidential assessment traces, or customer-specific findings to train or fine-tune models without a separate affirmative written agreement. This restriction also applies to providers processing that data for us. Independently sourced lawful research and generic scenarios do not grant us permission to reuse your confidential information.

10. Suspension, termination, and data return

We may pause access or execution when permission is unclear, a test exceeds scope, a security concern requires intervention, or suspension is required by law. We will explain the reason and provide notice when practicable without worsening the risk.

The Order must define termination rights, notice and cure periods for material breach, treatment of prepaid fees, and the opportunity to obtain agreed deliverables. Stopping a test is separate from cancelling a subscription. After termination, both parties must revoke test access and follow agreed cleanup, data return, and deletion instructions, subject to lawful retention requirements.

Confidentiality, ownership, accrued payment obligations, and provisions intended to survive termination continue according to the applicable agreement.

11. Service standards and liability

We will perform agreed services with reasonable professional care and within the authorized scope. Results remain subject to the limitations in these Terms. Third-party platform changes, outages, and customer configurations can affect execution and results. Any service-level commitment or remedy must be expressly stated in your Order.

Except for express commitments in the applicable agreement and to the extent permitted by law, website content and illustrative materials are provided as available without a guarantee of accuracy, completeness, uninterrupted availability, or fitness for a particular purpose.

Any negotiated liability cap, exclusion of damages, or indemnity applies only as expressly set out in the accepted Order or other signed agreement. These Terms do not exclude liability that cannot lawfully be excluded. Nothing in an assessment report transfers responsibility for your product decisions or constitutes a guarantee against loss.

12. Changes and general provisions

We may update these Terms by posting a revised version and changing the last-updated date. Material changes affecting an existing engagement will be communicated through the contact channel agreed with the customer before they apply. A website update does not retroactively change an accepted Order or assessment scope.

The applicable Order may specify governing law, dispute venue, notice requirements, and any agreed dispute-resolution procedure. Mandatory rights under applicable law remain unaffected. If a provision is unenforceable, the remaining provisions continue to apply to the extent permitted by law.

Neither party’s failure to enforce a provision waives the right to enforce it later. These Terms and the applicable Order and DPA form the agreement for the services they cover. Neither party is the other party’s agent, partner, or employee.

For questions concerning an engagement or these Terms, contact your Versarial representative through the contact channel specified in your Order or existing business correspondence. See our Privacy Policy for information about personal data.