SEKURA ONLINE TERMS OF SERVICE

1. ACCEPTANCE

1.1 These Terms of Service ("Terms") form a binding agreement between Sekura Inc., a Delaware corporation ("Sekura," "we," "us"), and the individual or entity accessing the Service ("Customer," "you").

1.2 You accept these Terms by creating an account, submitting a repository to the free scan, purchasing a Scan Once scan, subscribing to a monthly plan (Scan Always, ScanPlus Always or ScanPro Always), or otherwise using the Service. If you are accepting on behalf of an organization, you represent that you have authority to bind that organization, and "you" refers to that organization.

1.3 If you do not agree, do not use the Service.

1.4 Customers requiring negotiated terms — including network penetration testing, cloud posture assessment, on-premises deployment, or a signed agreement — must contract under Sekura's Master Subscription Agreement rather than these Terms. These Terms are not negotiable.

2. THE SERVICE

2.1 The Service is Sekura's autonomous security validation platform. Under the self-serve plans, Sekura runs its automated assessment against a repository you submit and delivers a report: Free Scan (one repository, once per person, at no charge), Scan Once (a one-time scan of a repository), and the monthly plans — Scan Always (weekly), ScanPlus Always (weekly) and ScanPro Always (daily) — which scan a repository on the cadence fixed by the plan, on the weekday and hour you choose where the plan is weekly. Prices, schedules, and included capabilities are those published at sekura.ai/pricing at the time of your purchase or submission, which are incorporated into these Terms by reference.

2.2 Scope of the self-serve plans. Free Scan and Scan Always provide automated security testing of the code of a submitted repository only. Scan Once, ScanPlus Always and ScanPro Always additionally test a private copy of your application that Sekura builds and runs on its own infrastructure from that repository; the URL you give for that purpose is a reference for building the copy and Sekura sends no test traffic to it. Testing of an application running on your own host, network penetration testing, cloud security posture management and exploit-chaining against a running target are not available under these Terms and require a Master Subscription Agreement (the enterprise tiers).

2.3 Execution environment. Under the self-serve plans, the repository you submit is received and processed within Sekura's own environment — cloned into an isolated container that is scanned and then destroyed — including by a Sekura-operated AI model as described in the Privacy Policy. Sekura retains the submitted content only as long as necessary to run the scan and deliver the report. Editor (MCP) integration and customer-supplied AI model credentials are Enterprise-tier arrangements described in the applicable Master Subscription Agreement, not part of the self-serve plans.

2.4 Sekura may modify, enhance, or discontinue features. We will not materially reduce the entitlements of a paid tier during a period you have already paid for.

3. FEES AND PAYMENT

3.1 Fees are those published at sekura.ai/pricing at the time of purchase. The free first scan is provided at no charge, once per person; every scan after it is charged. Scan Once is a one-time charge per repository that does not renew. Scan Always, ScanPlus Always and ScanPro Always are recurring charges per repository per month. Where a plan includes one target application, each additional target application is charged as published at sekura.ai/pricing (one-time on Scan Once, monthly on the monthly plans).

3.2 The monthly plans are billed monthly in advance and renew automatically each month until cancelled; your payment method is collected at purchase, and you authorize us and our payment processor, Stripe, to charge it at purchase and on each renewal. Where sekura.ai/pricing publishes a free trial for a monthly plan at the time of your purchase, the first charge is made when that trial ends unless you cancel the repository before then; a trial is available only for a repository that has not previously been on one. Where no trial is published, the first charge is made at purchase. All monthly-plan repositories on an account are billed under one subscription.

3.3 You may cancel a monthly plan at any time, effective at the end of the monthly period already paid for. A submitted scan can be cancelled for five minutes after submission; cancelling a paid scan returns a credit toward a future scan, and cancelling the free first scan restores it. Except (a) as required by law and (b) under Sekura's published refund policy, fees already paid are non-refundable. Under that policy, Sekura issues a full refund, without the need to ask, when a Scan Once scan failed or never ran; when a Scan Once scan is within 7 days of payment and has not completed; or when a monthly plan's charge is within 7 days of the first invoice on that subscription — limited to one automatic refund per account in any 90-day period. A refund ends the plan it paid for.

3.4 We may change pricing on thirty (30) days' notice, effective at your next renewal. Continued use after that date constitutes acceptance.

3.5 Fees exclude taxes, which are your responsibility.

4. AUTHORIZATION TO SCAN — YOUR OBLIGATIONS

This Section is the most important term in these Terms.

4.1 You may only scan assets you own or are expressly authorized in writing to test. By submitting any repository, application, URL, endpoint, or other target to the Service, you represent and warrant that:

• you own that asset, or you hold current written authorization from its owner to conduct automated security testing;
• such testing does not violate the terms of service of any hosting provider, cloud provider, or third party whose infrastructure the asset uses;
• you have obtained any consent required from your own customers, users, or data subjects; and
• such testing is lawful in every jurisdiction where the asset is hosted or operated.

4.2 You may not submit any target that is owned or operated by a third party without authorization, is shared infrastructure you do not control, belongs to a government or critical infrastructure operator without express written permission, or is prohibited by any applicable law.

4.3 Testing is intrusive. Security assessment may cause service degradation, resource consumption, unexpected application behaviour, log volume increases, third-party security alerting, or temporary unavailability. You are solely responsible for maintaining backups and for any consequences of testing assets you have submitted.

4.4 You indemnify Sekura. You shall defend, indemnify, and hold harmless Sekura and its personnel from any third-party claim, proceeding, fine, or penalty, and all resulting damages, losses, and reasonable legal fees, arising from your breach of this Section 4 — including any assertion that a scan you initiated constituted unauthorized access or computer misuse. This obligation is not subject to the liability cap in Section 10.

4.5 We may suspend immediately. Sekura may suspend or terminate your access without notice if we reasonably believe you have breached this Section, and may report suspected unlawful activity to appropriate authorities.

5. AI PROCESSING AND MODEL CREDENTIALS

5.1 Under the self-serve plans, Sekura provides the AI models used to analyze your code — a model Sekura operates itself and, where applicable, third-party model providers — and you do not supply any model credentials.

5.2 Where an Enterprise arrangement instead requires you to supply credentials for a third-party AI or large language model service, you retain ownership of those credentials and bear all associated usage costs. Sekura uses them solely to provide the Service, applies reasonable safeguards, and will not disclose, transfer, or use them for any unrelated purpose.

5.3 You represent that any AI provider whose credentials you supply permits use for automated security testing. Sekura is not liable for provider outages, rate limits, pricing changes, model behaviour, or account suspension.

5.4 If credentials you supply become invalid or exhausted, the Service may be interrupted. This is not a breach by Sekura, and any refund is governed by the refund policy in Section 3.3.

6. ACCEPTABLE USE

You shall not:

• Reverse engineer, decompile, or attempt to derive the source code, models, or detection logic of the Service;
• Resell, sublicense, lease, or provide access to the Service to any third party;
• Circumvent any usage limit, licence control, metering, or access restriction;
• Use the Service to develop, train, benchmark, or improve a competing product;
• Publish benchmarks or comparative evaluations of the Service without our prior written consent;
• Interfere with the operation or security of the Service;
• Use the Service to conduct unlawful activity, or against any target in breach of Section 4;
• Use the Service to develop, deploy, or refine malware, ransomware, or offensive capability directed at systems you do not own.

7. YOUR DATA AND OUR IP

7.1 Your data. You retain all rights in your source code, configurations, scan results, and other data processed by the Service ("Customer Data"). You grant Sekura a limited licence to process it solely to provide the Service.

7.2 Our IP. Sekura owns the Service, including all software, AI agents, algorithms, detection methodologies, exploit validation techniques, report formats, models, and all improvements. You receive a limited, non-exclusive, non-transferable, revocable licence to use the Service for your internal business purposes during your subscription. All other rights are reserved.

7.3 Aggregated data. Sekura may generate and use aggregated, anonymized, and de-identified data derived from operation of the Service to operate, secure, benchmark, and improve the Service and to produce industry research. Such data will not identify you, will not contain your source code, credentials, or confidential information, and will not contain findings specific to your environment in identifiable form. This right survives termination.

7.4 Feedback. Any suggestions or feedback you provide may be used by Sekura without restriction or obligation.

7.5 Findings are yours. Security findings concerning your environment are your confidential information. Sekura will not disclose them to third parties except as required by law. The underlying detection logic, scoring methodology, and report templates remain Sekura's property.

8. CONFIDENTIALITY AND SECURITY

8.1 Each party will protect the other's non-public information using reasonable care and use it only as permitted by these Terms.

8.2 Sekura maintains commercially reasonable administrative, physical, and technical safeguards for Customer Data, and will notify you without undue delay of any confirmed unauthorized access to Customer Data in our control.

8.3 On termination, Sekura will delete Customer Data within thirty (30) days, except where retention is required by law or where data resides in routine encrypted backups until overwritten in the ordinary course.

9. DISCLAIMER

9.1 THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." SEKURA DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND UNINTERRUPTED OR ERROR-FREE OPERATION.

9.2 Sekura does not warrant that the Service will identify every vulnerability, weakness, misconfiguration, or risk. The Service is not a substitute for your own security program. You remain solely responsible for the security of your systems and for all remediation decisions.

9.3 No security solution can guarantee prevention or detection of all threats.

10. LIMITATION OF LIABILITY

10.1 TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, OR DATA.

10.2 SEKURA'S TOTAL AGGREGATE LIABILITY ARISING FROM OR RELATING TO THESE TERMS SHALL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS (US$100).

10.3 The limitations in this Section do not apply to your obligations under Section 3 (fees), Section 4.4 (indemnity), or Section 6 (acceptable use), or to either party's gross negligence or wilful misconduct.

11. SUSPENSION AND TERMINATION

11.1 Sekura may suspend or terminate access immediately if you breach these Terms, if your use poses a security, operational, or legal risk, or for non-payment.

11.2 You may terminate at any time by cancelling your subscription and ceasing use.

11.3 On termination, your licence ends immediately and you must cease all use of the Service. Sections 4.4, 7, 8, 9, 10, and 13 survive.

12. CHANGES TO THESE TERMS

Sekura may update these Terms. Material changes will be notified by email or in-product notice at least thirty (30) days before taking effect. Continued use after the effective date constitutes acceptance. If you do not agree, you must stop using the Service.

13. GENERAL

13.1 Governing law and venue. California law governs, without regard to conflict of laws principles. The exclusive venue is the state and federal courts of Santa Clara County, California.

13.2 Export control. You may not access the Service from, or provide access in, any country subject to comprehensive U.S. sanctions, and you represent you are not on any U.S. restricted-party list.

13.3 Entire agreement. These Terms, together with the published pricing page, constitute the entire agreement and supersede prior discussions concerning the Service.

13.4 No assignment. You may not assign these Terms without our written consent.

13.5 Severability and waiver. If any provision is unenforceable, it will be modified to the minimum extent necessary and the remainder will continue. No failure to enforce is a waiver.

13.6 Contact. Questions regarding these Terms: legal@sekura.ai