Terms of Service

1. Agreement and authority

By accessing or using DeepScan, you agree to these Terms. If you use DeepScan for an organization, you represent that you have authority to bind it, and “Customer” or “you” refers to that organization.

An order form, statement of work, data-processing agreement, or other written agreement signed by CyberImmune Inc. may supplement these Terms. If there is a conflict, the signed agreement controls for its subject matter.

2. The services

DeepScan may provide attack-surface discovery, authenticated application and API testing, adversary emulation, exploit validation, evidence capture, reporting, remediation guidance, retesting, and expert-led penetration testing. Features and delivery methods vary by plan, scope, or written engagement.

3. Accounts and access

You must provide accurate information, protect authentication credentials, maintain appropriate roles, and promptly notify us of unauthorized access. You are responsible for activity through your accounts and for ensuring users are authorized to act for your organization.

4. Authorized security testing

DeepScan may be used only for authorized security testing. Before testing begins, you must have every right, permission, consent, and written authorization required to test each domain, application, API, account, network, cloud resource, model, agent, integration, and other target placed in scope.

You must define accurate boundaries, windows, credentials, exclusions, prohibited techniques, escalation contacts, and constraints. You must not direct DeepScan toward third-party systems merely because they are reachable from an authorized target.

5. Prohibited use

You must not use DeepScan to:

• Access, test, disrupt, damage, or obtain data from a system without authorization.
• Conduct destructive testing, denial-of-service, malware deployment, social engineering, physical intrusion, persistence, or data exfiltration unless expressly authorized in a signed scope.
• Violate law, sanctions, export controls, privacy, intellectual-property rights, or facilitate unlawful surveillance or cyber abuse.
• Interfere with DeepScan, bypass safety controls, probe our infrastructure without authorization, or resell the service without a written agreement.

6. Customer responsibilities

You are responsible for the legality and accuracy of scope, maintaining authorization, coordinating with system owners and providers, backing up relevant systems, monitoring operational risk, and evaluating findings before remediation. You must pause testing or notify us if authorization changes or unexpected impact occurs.

7. Customer Data

“Customer Data” includes targets, credentials, content, instructions, and materials submitted by or for Customer, plus findings and evidence specific to Customer’s scoped environment. As between the parties, Customer retains its rights in Customer Data.

Customer grants CyberImmune Inc. a limited right to host, copy, process, transmit, and display Customer Data as necessary to provide, secure, support, and improve the services and meet legal obligations.

8. DeepScan technology and feedback

CyberImmune Inc. and its licensors retain all rights in DeepScan, including software, models, agents, workflows, interfaces, documentation, methodologies, generalized know-how, and improvements. No rights are granted except the limited right to use the service. We may use feedback without obligation, provided we do not identify you publicly without permission.

9. Confidentiality

Each party will use the other’s non-public confidential information only for the relationship, protect it with reasonable care, and disclose it only to personnel and providers who need it and are appropriately bound. These duties exclude information lawfully known without restriction, independently developed, publicly available without breach, or lawfully received from another source.

10. Fees and order terms

Paid subscriptions and services are governed by the applicable order form or statement of work. Unless it states otherwise, fees are non-cancellable and non-refundable, taxes are additional, and undisputed invoices are due as stated. We may suspend paid services for materially overdue amounts after reasonable notice.

11. Third-party services

DeepScan may interoperate with customer-selected or supporting third-party services. Their own terms apply, and CyberImmune Inc. is not responsible for services it does not control. References to third parties do not imply endorsement or formal integration.

12. Availability and changes

We may update or discontinue features and impose reasonable limits to protect security, integrity, or lawful use. We do not guarantee uninterrupted or error-free operation unless a signed agreement states a service level. Preview, beta, or evaluation features may change and are provided without production commitments.

13. Suspension and termination

We may suspend access where reasonably necessary to address suspected unauthorized testing, security risk, legal exposure, non-payment, or material breach. Either party may terminate as permitted by an order form or written agreement. Provisions that should survive—including payment, ownership, confidentiality, disclaimers, liability, and disputes—will survive.

14. Warranties and disclaimers

Each party represents it has authority to enter these Terms. CyberImmune Inc. warrants that professional services will be performed professionally and consistently with the written scope.

Except for express warranties in a signed agreement, DeepScan is provided “as is” and “as available.” To the maximum extent permitted by law, we disclaim implied warranties including merchantability, fitness for a particular purpose, non-infringement, and any warranty that testing identifies every vulnerability or prevents every incident. Security testing reduces uncertainty; it does not eliminate risk.

15. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits, revenues, goodwill, or data, arising from these Terms.

Except for amounts payable and liabilities that cannot lawfully be limited, each party’s aggregate liability will not exceed amounts Customer paid or owed for the services giving rise to the claim during the twelve months before the event. A signed agreement may establish different limits.

16. Indemnity

Customer will defend and indemnify CyberImmune Inc. against third-party claims arising from Customer’s unauthorized testing, unlawful Customer Data, prohibited use, or material breach of Customer’s representations, except to the extent caused by CyberImmune Inc. We will provide prompt notice and reasonable cooperation.

17. Ontario law and disputes

These Terms are governed by Ontario law and the federal laws of Canada applicable there, without conflict-of-law principles. The parties submit to the exclusive jurisdiction of courts in Toronto, Ontario, except that either may seek urgent injunctive relief in a court of competent jurisdiction.

18. General terms and contact

Neither party may assign these Terms without consent, except with a merger, reorganization, sale of substantially all assets, or to an affiliate that assumes the obligations. Neither party is liable for delay beyond reasonable control. If a provision is unenforceable, it will be limited and the remainder continues. Failure to enforce is not a waiver.

We may update these Terms by posting a revised version and providing additional notice where required. Questions may be sent to hello@cyberimmune.com or CyberImmune Inc., 18 King St E, Suite 1400, Toronto, Ontario, Canada.