Terms of Service

1. Acceptance

By creating an account or using CarbonMantis (the "Service"), you agree to these Terms. If you use the Service on behalf of an organization, you represent that you're authorized to bind that organization.

2. The Service

CarbonMantis performs automated penetration testing of web applications and APIs and returns confidence-rated findings with reproducible evidence. It is a complement to, not a replacement for, expert-led security testing and a broader security program.

3. Authorized testing only

You may only scan targets you own or are explicitly authorized to test. Scanning is gated behind ownership verification, but you remain solely responsible for ensuring you have the necessary authorization for every target and scope you configure. Using the Service to test systems without authorization is strictly prohibited and may be unlawful. You agree to indemnify us against claims arising from targets you were not authorized to test.

4. Accounts and security

You're responsible for safeguarding your credentials and API keys and for activity under your account. Notify us promptly of any unauthorized use.

5. Credits, billing, and the free trial

• The Service is usage-based: one credit tests one scan unit, priced at $1.00 USD per credit (plus tax where applicable). A scan unit is one logical operation tested (for example, a REST route, a GraphQL field, or a gRPC method); testing it under multiple roles or input values is not billed separately.
• New accounts receive 50 free credits; no credit card is required to begin.
• Credits are pre-purchased by credit card in a minimum of 10, in preset packs or a custom amount. You may enable auto-reload at a threshold and amount you choose.
• Credits are consumed only when a scan runs. Credits expire after 12 months with no scans; running any scan resets that period.
• Purchased credits are non-refundable except where required by law.

6. Acceptable use

You agree not to misuse the Service, including by attempting to disrupt it, circumvent isolation or rate limits, reverse engineer it, or use it to harm others or violate the law.

7. Availability and changes

We may modify or discontinue features, and we perform maintenance from time to time. We aim to communicate material changes in advance.

8. Disclaimers

The Service is provided "as is." Automated testing cannot find every vulnerability, and a clean scan is not a guarantee of security. You remain responsible for your own security posture and decisions.

9. Limitation of liability

To the maximum extent permitted by law, CarbonMantis is not liable for indirect, incidental, or consequential damages, and our aggregate liability is limited to the amounts you paid us in the 12 months preceding the claim.

10. Governing law

These Terms are governed by the laws of [Jurisdiction — to be finalized].

11. Changes to these Terms

We may update these Terms; material changes will be communicated through the Service.

12. Contact

Questions about these Terms? Email [email protected].