Home/Trust Center/Terms

Legal

Terms of Service

Effective date: September 8, 2026 · Last updated: September 8, 2026

These Terms of Service ("Terms") are a binding agreement between CYRION AI LTD, a company registered in England and Wales (company number 17432699), with its registered office at 124 City Road, London, United Kingdom, EC1V 2NX ("Cyrion," "we," "us") and the person or entity using Cyrion's services ("you," "Customer"). By creating an account, accessing, or using the service available at cyrion.ai and related applications and APIs (the "Service"), you agree to these Terms. If you are agreeing on behalf of an organization, you represent that you have authority to bind that organization.

If you do not agree, do not use the Service.

1. What Cyrion Is

Cyrion is an AI-agent-based security scanning platform that performs automated reconnaissance, vulnerability analysis, and — depending on scan mode and tier — active exploitation attempts against targets you specify (web applications, APIs, mobile applications, source code repositories, cloud infrastructure, and related assets). Scans are executed by large language model ("LLM") agents, which may involve sending target-related data to third-party model providers as described in our Privacy Policy.

The Service is a security testing tool. It is not a guarantee of security, and use of the Service does not certify that any target is secure or free of vulnerabilities.

2. Authorization to Scan — Read This Section

This is the most important section of these Terms.

You may only run scans against targets that you own, or for which you have obtained prior, explicit, written authorization from the owner or operator to perform the type of testing you are initiating, including any active exploitation the scan mode performs.

By submitting any target to the Service, you represent and warrant, for each and every scan, that:

1. You own the target, or you possess documented authorization (e.g., a signed penetration-testing agreement, bug bounty program scope, or written consent from the asset owner) covering the scope and intensity of testing requested;

2. The scan will not violate the terms of service, acceptable use policy, or bug bounty scope rules of any third party whose systems the target touches;

3. You will retain evidence of that authorization for the duration of the engagement and for at least 6 years afterward, and will produce it to Cyrion on request; and

4. You are not using the Service to test, probe, or attack any system on behalf of, or in a manner that benefits, a sanctioned individual, entity, or jurisdiction (see Section 12).

Cyrion does not verify target ownership or authorization before running a scan. Responsibility for lawful use rests entirely with you. Unauthorized scanning of systems you do not own or have permission to test may violate computer-crime laws (including, in the United States, the Computer Fraud and Abuse Act, and equivalent statutes elsewhere) and may expose you to civil and criminal liability. Cyrion may, but is not obligated to, investigate suspected unauthorized use, suspend or terminate accounts on suspicion of unauthorized use, and report suspected unlawful activity to the target owner, hosting provider, or law enforcement.

3. Accounts

You must provide accurate registration information and keep it current. You are responsible for all activity under your account and for safeguarding your credentials. Notify us promptly at security@cyrion.ai if you suspect unauthorized account access.

Accounts may not be shared across individuals beyond the seat count included in your tier, except as your tier's terms expressly permit.

4. Subscription Tiers, Credits, and Billing

4.1 Tiers

The Service is offered in tiers (currently Free, Lite, Hacker, Red Team, and Enterprise), each with its own pricing, concurrent-scan limits, feature set, and model routing, as described at cyrion.ai/pricing. We may modify tier features, limits, or included credits prospectively, with notice as described in Section 4.5.

4.2 Credits

Paid tiers include a monthly credit grant. Credits are consumed based on the actual computational cost of each scan and do not have a fixed "tokens per credit" or "scans per credit" ratio, because cost varies by model, target, and scan mode. Unused credits do not roll over to the following billing period unless expressly stated otherwise for your tier. Credit balances have no cash value and are non-transferable.

4.3 Recurring Billing

Paid tiers are billed on a recurring monthly (or annual, if selected) basis in advance, via our payment processor. Your subscription renews automatically at the then-current price unless you cancel before the renewal date. You authorize us and our payment processor to charge your payment method on file for all fees due.

4.4 Overages, Ceilings, and Refunds

Some tiers may permit metered overage beyond the included credit grant, subject to a payment method on file; others enforce a hard stop when credits are exhausted. Fees are non-refundable except where required by law or expressly stated in a tier's terms. If a scan is interrupted due to a Cyrion-caused platform failure, we will, at our discretion, credit the consumed amount back to your balance or provide a service credit.

4.5 Price and Plan Changes

We may change prices or tier composition. For existing subscribers, changes take effect at your next renewal after at least 30 days' notice via email or in-app notice. Continued use after the change takes effect constitutes acceptance.

4.6 Taxes

Fees are exclusive of applicable taxes, which you are responsible for unless we are legally required to collect them.

5. Acceptable Use

In addition to Section 2, you agree not to:

Use the Service to develop, test, or deploy malware, ransomware, or exploit tooling intended for use against targets you are not authorized to test;
Use scan output to extort, blackmail, or threaten a target owner ("beg bounty" conduct);
Attempt to circumvent rate limits, concurrency limits, or credit metering;
Reverse-engineer, scrape, or resell the Service or its underlying models except via a paid API offering we make available for that purpose;
Use the Service in a way that violates applicable law, third-party rights, or the acceptable use policies of any LLM or infrastructure provider we rely on;
Submit targets, prompts, or data that are unlawful, that infringe others' rights, or that contain malware for any purpose other than authorized malware analysis within scope you're contracted to test.

We may suspend or terminate access for violation of this section, with or without notice, depending on severity.

6. Scan Output and Intellectual Property

6.1 Your Data and Findings

As between you and Cyrion, you own the scan targets you submit and the findings, reports, and output generated from your scans ("Scan Output"). We grant you a license to use Cyrion's platform, reporting templates, and UI to view, export, and act on your Scan Output.

6.2 Cyrion's IP

We own the Service itself — the platform, agent architecture, prompts, models we've fine-tuned or configured, scoring methodology, and all associated intellectual property. Nothing in these Terms transfers that IP to you.

6.3 Aggregated/De-identified Data

We may use de-identified, aggregated data derived from Service usage (e.g., token consumption patterns, vulnerability class frequency) to improve the Service, for research, and for product analytics, provided it does not identify you or your targets.

6.4 Feedback

If you provide feedback or suggestions, we may use them without obligation or compensation to you.

7. Third-Party AI Providers

The Service routes portions of each scan to third-party LLM providers depending on your tier and scan configuration (currently including Google, DeepSeek, and Anthropic, among others as our routing evolves). Submitting a scan means target-related data, tool output, and portions of the scan context will be transmitted to and processed by these providers under their respective terms and data-handling commitments, as further described in our Privacy Policy. We select providers that we believe offer commercially reasonable security and data-handling commitments, but we do not control their infrastructure and are not liable for their acts or omissions except as required by law.

8. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, CYRION DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

Specifically, and without limiting the foregoing:

No guarantee of completeness. Automated and AI-driven scanning cannot identify every vulnerability in a target. Absence of findings in a Cyrion report is not evidence of absence of vulnerabilities.
False positives and negatives. Scan output may contain inaccurate, incomplete, or AI-hallucinated findings. You are responsible for independently validating any finding before acting on it (including before disclosing it to a third party or claiming a bug bounty).
No professional advice. Scan Output does not constitute legal, compliance, or professional security-audit advice or certification (e.g., it is not a substitute for a SOC 2, PCI-DSS, or similar formal audit) unless expressly sold as such under a separate agreement.

9. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW: (A) CYRION WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOST PROFITS, REVENUE, DATA, OR GOODWILL, ARISING FROM YOUR USE OF THE SERVICE, EVEN IF ADVISED OF THE POSSIBILITY; AND (B) CYRION'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE GREATER OF (I) THE AMOUNT YOU PAID CYRION IN THE 12 MONTHS PRECEDING THE CLAIM, OR (II) USD $100.

These limits apply regardless of the theory of liability and even if a remedy fails its essential purpose, except where prohibited by law (some jurisdictions do not allow certain limitations, in which case those limitations apply only to the extent permitted).

10. Indemnification

You agree to indemnify, defend, and hold harmless Cyrion and its officers, employees, and agents from any claim, damage, liability, cost, or expense (including reasonable attorneys' fees) arising from: (a) your breach of Section 2 (Authorization to Scan) or Section 5 (Acceptable Use); (b) your use of Scan Output, including any action taken against a target based on it; (c) your violation of applicable law; or (d) your violation of any third party's rights.

11. Term, Suspension, and Termination

These Terms remain in effect while you use the Service. We may suspend or terminate your access immediately if we reasonably believe you have violated Section 2 or 5, pose a security or legal risk to Cyrion or a third party, or fail to pay fees due. You may cancel a paid subscription at any time; cancellation takes effect at the end of the current billing period, and no refund is issued for the remaining period except as required by law. Sections 2, 6, 8, 9, 10, and 13 survive termination.

12. Export Control and Sanctions

The Service, including its exploitation and offensive-testing capabilities, may be subject to export control laws (including U.S. EAR and OFAC sanctions regimes) and equivalent laws in other jurisdictions. You represent that you are not located in, and will not use the Service from or on behalf of, a country, entity, or individual subject to applicable trade sanctions or export restrictions, and that you will not use the Service for any purpose prohibited by such laws.

13. Governing Law and Disputes

These Terms are governed by the laws of England and Wales, without regard to conflict-of-law principles. Any dispute arising out of or relating to these Terms or the Service is subject to the exclusive jurisdiction of the courts of England and Wales. To the extent permitted by applicable law, you agree that any claim will be brought on an individual basis only, and not as part of any class, collective, or representative proceeding.

14. Changes to These Terms

We may modify these Terms from time to time. Material changes will be notified via email or in-app notice at least 30 days before taking effect for existing subscribers; continued use after that date constitutes acceptance. The "Last updated" date above reflects the most recent revision.

15. Miscellaneous

These Terms, together with the Privacy Policy and any order form or tier-specific terms, constitute the entire agreement between you and Cyrion regarding the Service. If any provision is held unenforceable, the remaining provisions remain in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our written consent; we may assign them in connection with a merger, acquisition, or asset sale. Notices to you may be sent to the email on your account.

16. Contact

CYRION AI LTD

124 City Road, London, United Kingdom, EC1V 2NX

contact@cyrion.ai

This document is a template and does not constitute legal advice. It should be reviewed by qualified legal counsel — ideally with experience in security-industry SaaS — before publication, with particular attention to Sections 2, 9, 10, 12, and 13, which carry the platform's highest liability and regulatory exposure.