Terms of Service

These Terms of Service ("Terms") govern your access to and use of the Vulnara platform, including all web applications, APIs, browser extensions, and related services (collectively, the "Service") provided by Vulnara Security (Pty) Ltd("Vulnara", "we", "us", or "our").

By creating an account, accessing the Service, or clicking "I agree", you confirm that you have read, understood, and agree to be bound by these Terms. If you do not agree, do not use the Service.

If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

Vulnara provides automated security scanning tools. These tools can only be used lawfully if you have proper authorization to test the target system. You must meet all of the following conditions before running any scan:

• You own the target domain, application, or system; OR
• The target is listed in an active, public bug bounty or Vulnerability Disclosure Program (VDP) scope that explicitly covers the domain you are testing; OR
• ORYou have obtained explicit written permission from the system owner that authorizes security testing.

Vulnara's scanning features are designed for legitimate security research and testing. We actively monitor for abuse and will immediately terminate accounts used for unauthorized testing. We cooperate fully with law enforcement investigations.

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. To the fullest extent permitted by applicable law, Vulnara expressly disclaims all warranties, including but not limited to:

• Fitness for a particular purpose or security objective
• Accuracy, completeness, or reliability of scan results
• Uninterrupted or error-free operation of the Service
• That scans will detect all vulnerabilities in a target system
• That scan results are free from false positives or false negatives

Vulnara does not guarantee that the use of this tool will prevent security incidents, data breaches, or any form of damage to any system. Security testing is one layer of a defence-in-depth strategy and should not be relied upon as the sole means of securing any system.

By using the Service, you expressly acknowledge and agree that:

• You bear full and sole responsibility for any scan you initiate, including all consequences on the target system (downtime, data loss, triggering rate limits, WAF blocks, etc.).
• Vulnara shall not be liable for any direct, indirect, incidental, special, consequential, punitive, or exemplary damages arising from your use of the Service, even if advised of the possibility of such damages.
• You indemnify and hold harmless Vulnara, its directors, employees, and agents from any claim, demand, loss, or damage arising out of your use of the Service or violation of these Terms.
• Security testing can cause unintended side effects on target systems including increased server load, triggered alerts, temporary denial of service, or data corruption. You accept these risks in full.
• Vulnara's maximum liability to you under any circumstances shall not exceed the amount you paid for the Service in the 30 days preceding the claim.

You may not use the Service to:

• Scan any system, application, or network without proper authorization
• Conduct denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks
• Access, extract, modify, or destroy data belonging to other users
• Reverse-engineer, decompile, or disassemble the Service
• Circumvent rate limits, authentication, or access controls of the Service
• Use scan results for extortion, blackmail, or any criminal purpose
• Resell or sublicense access to the Service without our written consent
• Use automated scripts to abuse the Service beyond normal scan automation
• Impersonate another user or entity

Vulnara processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and, where applicable, the General Data Protection Regulation (GDPR).

What we collect: account registration details (email, name), scan configuration and results, usage analytics, and payment information processed by our payment provider.

How we use it: to deliver the Service, improve features, detect abuse, and communicate about your account. We do not sell your personal information to third parties.

Scan data: scan results including API endpoints, request/response samples, and findings are stored securely and associated with your account. You may delete your scan data at any time from the dashboard.

Your rights: you have the right to access, correct, or request deletion of your personal information. Contact us at legal@vulnara.io to exercise these rights.

Data retention: scan data is retained for the duration of your subscription. Upon account deletion, personal data is removed within 30 days.

If you discover genuine vulnerabilities in third-party systems using Vulnara, you are expected to follow responsible disclosure practices:

• Report findings to the affected organization through their official security contact or bug bounty program
• Allow a reasonable remediation period (typically 90 days) before public disclosure
• Do not access, exfiltrate, or tamper with data beyond what is necessary to confirm the vulnerability
• Do not use findings for financial gain outside of an authorized bug bounty program

Vulnara's HackerOne integration facilitates legitimate, authorized bug bounty submissions. It must not be used to submit findings from unauthorized scans.

You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. Notify us immediately at legal@vulnara.io if you suspect unauthorized access to your account.

We reserve the right to suspend or terminate accounts that violate these Terms, engage in suspected abuse, or pose a risk to the security or integrity of the Service or third parties.

The Service, including its code, design, trademarks, and documentation, is owned by Vulnara and protected by South African and international intellectual property laws. These Terms do not grant you any right to use Vulnara's trademarks, logos, or brand assets.

You retain ownership of your scan data. By using the Service, you grant Vulnara a limited licence to process and store your scan data solely to deliver the Service to you.

You may terminate your account at any time from account settings. Upon termination, your access to the Service will cease and your data will be deleted per the retention policy above.

Vulnara may terminate or suspend your access immediately, without prior notice, if you breach these Terms or if we are required to do so by law.

These Terms are governed by the laws of the Republic of South Africa. Any disputes arising under these Terms shall be subject to the exclusive jurisdiction of the courts of South Africa.

Nothing in these Terms limits either party's ability to seek urgent or injunctive relief in any court of competent jurisdiction.

For questions about these Terms, data requests, or to report misuse of the Service, contact: