Terms of Service

• “Agent” means any AI-driven module within the Service (e.g., Orchestrator, Recon Agent, Hunter Agent, Verifier Agent, Reporter Agent, Analyst Agent) that performs reconnaissance, analysis, exploitation, verification, or reporting functions.
• “Target” means any domain, IP range, application, API, mobile package (APK), Windows binary, source code repository, or network segment that Customer submits to the Service for assessment.
• “Scan” means an engagement in which one or more Agents perform reconnaissance, vulnerability testing, or exploitation activity against a Target.
• “Rules of Engagement” or “RoE” means the scope, constraints, and authorization terms confirmed by Customer prior to a Scan, including permitted Target ranges, testing windows, and safe-harbor limitations.
• “Findings” means vulnerabilities, proof-of-concept evidence, exploitation paths, risk scores (e.g., CVSS), and related output generated by the Service.
• “Customer Data” means Target information, source code, configuration files (including VPN configuration files), Findings, and any other data Customer submits to or generates through the Service.
• “CLI” means the SuperTools command-line client used to run code-aware, local-workspace analysis.

SuperTools provides autonomous and human-augmented penetration testing capabilities, including web/API security scanning, code-aware analysis via the CLI, mobile (APK) and Windows application analysis, internal network scanning over customer-supplied VPN tunnels, an AI Pentester Chat interface, and reporting mapped to OWASP Top 10, CWE, CVSS v3.1, and MITRE ATT&CK. The Service is intended to augment, not replace, certified human security expertise. Certain plans include human consultant review of critical findings; this does not make SuperTools a certified auditor of Customer’s overall security posture, and Customer remains responsible for its own compliance obligations.

You must be at least 18 years old and have authority to act on behalf of the organization you represent. You are responsible for maintaining the confidentiality of account credentials and for all activity occurring under your account. Notify us promptly at [security contact email] of any suspected unauthorized access.

This section is core to the Service and non-negotiable.

4.1 Ownership or Written Authorization Required.Customer represents and warrants that, before submitting any Target to the Service, Customer either (a) owns the Target, or (b) holds current, valid, written authorization from the Target’s owner permitting the specific testing activity requested, including active exploitation where applicable.

4.2 Rules of Engagement.No Scan involving active exploitation will proceed until Customer has confirmed scope and authorization through the Service’s RoE workflow. Customer is solely responsible for the accuracy and sufficiency of the scope and authorization it confirms.

4.3 No Third-Party or Unauthorized Targets. Customer will not submit any Target that Customer does not own or is not expressly authorized to test, including but not limited to competitor systems, government or critical infrastructure systems Customer does not operate, or shared/multi-tenant infrastructure where testing could affect other tenants without their consent.

4.4 Consequences of Violation. We may immediately suspend or terminate access, withhold deliverables, and/or report the activity to relevant authorities or affected third parties if we reasonably believe Customer has submitted a Target without proper authorization. Section 17 (Indemnification) applies in full to any such violation.

You will not use the Service to:

• Test, exploit, or attack any system without the authorization described in Section 4;
• Violate any applicable law, including computer misuse, data protection, or export control laws;
• Extract, exfiltrate, or use Findings to harm, defraud, or blackmail a Target owner or any third party;
• Interfere with the integrity or availability of the Service or attempt to reverse-engineer Agents, models, or Service infrastructure;
• Use the Service to develop a competing product;
• Upload malware, ransomware, or other content unrelated to legitimate security assessment of an authorized Target;
• Circumvent rate limits, safe-exploitation constraints, or the kill switch described in Section 8.

When you run the SuperTools CLI against a local project workspace, the CLI reads local source code to identify vulnerability patterns and may transmit relevant code context and Findings to our servers to correlate static analysis with live exploitation and to populate your dashboard. Do not run the CLI against source code you are not authorized to expose to a third-party analysis tool (e.g., code subject to third-party confidentiality restrictions you cannot waive).

If you upload OpenVPN (.ovpn) or WireGuard (.conf) configuration files to enable internal network scanning, you represent that you are authorized to establish that tunnel and to expose the connected internal assets to assessment. We use uploaded VPN configurations solely to establish the scanning tunnel for the engagement you initiate and handle them as Customer Data under Section 13.

We design the Service to operate within scoped, rate-limited, non-destructive testing parameters (“safe-exploitation mode”) and provide a kill switch to halt all Agent activity on demand. However, penetration testing inherently carries risk. Despite these safeguards, active testing of live systems can, in rare cases, cause service disruption, degraded performance, or unintended side effects. Customer acknowledges this risk and confirms it has appropriate change-control, backup, and rollback measures in place for any Target before authorizing a Scan.

Findings are generated by AI Agents and, where applicable, validated with proof-of-concept evidence and/or human consultant review. We do not guarantee that the Service will identify all vulnerabilities present in a Target, nor that every Finding is free of false positives or false negatives. Findings are provided for Customer’s internal security improvement purposes and do not constitute a certification, audit opinion, or compliance attestation unless expressly stated in a signed deliverable.

Access is provided via scan bundles/credits and/or subscription plans as set out in an order form or the pricing then published on our website. Purchased scan credits do not expire unless otherwise stated. Fees are non-refundable except as required by law or expressly agreed in writing. We may change pricing prospectively with notice; changes do not affect already-purchased credits.

11.1 Our IP.The Service, including all Agents, models, orchestration logic, software, and Service “look and feel,” is owned by SuperTools or its licensors. These Terms grant Customer a limited, non-exclusive, non-transferable right to access and use the Service during the subscription term for internal business purposes only.

11.2 Customer Data and Findings.As between the parties, Customer retains all right, title, and interest in Customer Data. Customer owns the Findings generated specifically from Customer’s own Targets. We may use de-identified, aggregated data (not attributable to any specific Customer or Target) to improve detection models and Service quality.

The Service may integrate with third-party tools (e.g., Jira) at Customer’s election. Use of such integrations is subject to the third party’s own terms, and we are not responsible for the third party’s handling of data once it leaves our systems via an integration Customer has enabled.

13.1 Findings and Target information are inherently sensitive. We treat Customer Data as confidential and restrict internal access to personnel and systems that need it to operate the Service.

13.2 We do not sell or share Customer Data, including scan data and Findings, with third parties for their own marketing or independent use.

13.3 See our Privacy Policy for details on data handling, retention, and security.

The Service, including all Findings, is provided “as is” and “as available.” To the maximum extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted, error-free, or will identify all vulnerabilities or prevent all security incidents affecting Customer or any Target.

To the maximum extent permitted by law: (a) neither party will be liable for indirect, incidental, consequential, special, or punitive damages, or lost profits, revenue, or data; and (b) our total aggregate liability arising out of or relating to these Terms or the Service will not exceed the fees paid by Customer to us in the twelve (12) months preceding the event giving rise to liability. These limitations do not apply to (i) either party’s indemnification obligations, (ii) Customer’s breach of Section 4 or 5, or (iii) liability that cannot be limited under applicable law.

Customer will indemnify, defend, and hold harmless SuperTools and its officers, employees, and affiliates from any claims, damages, liabilities, and costs (including reasonable legal fees) arising from: (a) Customer’s breach of Section 4 (Authorization) or Section 5 (Acceptable Use); (b) Customer Data submitted to the Service; or (c) Customer’s use of Findings in a manner that violates applicable law or third-party rights.

These Terms remain in effect while you maintain an account or active subscription. We may suspend or terminate access immediately, with or without notice, for suspected violations of Section 4 or 5, non-payment, or legal/regulatory requirement. Either party may terminate for the other’s uncured material breach after 30 days’ written notice. Sections 4, 9, 11, 13–17, and 19 survive termination.

The Service may be subject to export control, sanctions, and dual-use technology laws given its offensive-security capabilities. Customer represents it is not located in, or ordinarily resident in, a country or region subject to comprehensive trade sanctions, and is not a party prohibited from receiving security/testing tools under applicable export control laws. Customer is responsible for its own compliance with laws applicable to its use of Findings and exploitation techniques.

We may update these Terms from time to time. Material changes will be notified via the Service or by email at least 15 days before taking effect. Continued use after the effective date constitutes acceptance.

These Terms, together with any order form and the Privacy Policy, constitute the entire agreement between the parties regarding the Service. If any provision is held unenforceable, the remaining provisions remain in effect. Neither party may assign these Terms without the other’s consent, except in connection with a merger, acquisition, or sale of substantially all assets. No agency, partnership, or joint venture is created by these Terms.

SuperTools
Tangerang, Banten, Indonesia
Email: admin@supertool.web.id