Terms of Service

Effective August 10, 2026

These terms govern your use of Ryvx: the dashboard, CLI, and any related services (the "Service") operated by Ryvx ("we", "us"). By creating an account or using the Service you agree to them.

Who can use it

You must be at least 18 to use the Service. If you are using it for an organisation, you confirm you are authorised to accept these terms on its behalf. Ryvx is a tool for testing systems you own or have written permission to test, so this is not a service we offer to children, and we do not knowingly hold accounts for anyone under 18.

What Ryvx does

Ryvx is an autonomous AI security-testing tool. It can run active reconnaissance and exploitation against systems you configure it to target, and produces evidence-backed findings (a working proof of concept, not a guess).

Authorisation: your responsibility

You may only point Ryvx at systems you own, or have explicit written authorisation to test. Running active exploitation against a system you don't control or don't have permission to test is illegal in most jurisdictions and is a material breach of these terms. Passing --i-am-authorized , or ticking “Skip domain verification: I own this target and accept responsibility” when you start a hosted scan, is your assertion of that authorisation. It is not proof of it, and we do not independently verify it. You represent and warrant that every target you submit is one you own or are authorised in writing to test, and you accept sole legal responsibility for that representation and for any consequences of testing that target. We record each such assertion against the scan that relied on it. Domain-ownership verification remains available and is the only mechanism that actually proves control; we may require it before running a scan against a live external target. You are solely responsible for confirming you have the necessary authorisation before every scan.

Accounts

You're responsible for the security of your account credentials and for all activity under your account. Tell us right away if you suspect unauthorised access.

Subscriptions & billing

Paid plans are billed in advance on a recurring basis and metered by usage credits as described on our pricing page. Payments are processed by Stripe. Unused credits do not carry a cash value and, unless stated otherwise at signup, do not roll over between billing periods. You can cancel a subscription at any time, yourself, from the account page (Manage billing); cancellation takes effect at the end of the current billing period.

If you ask within 14 days of buying a subscription or credits, we will refund you in full. No questions asked, even if scans have already run in that time. This is offered to every customer, not only consumers in the UK, and it applies on top of any statutory right you have, never instead of it. To ask for a refund, email support@ryvx.dev.

If you are a consumer in the UK, you also have a statutory right to cancel a new subscription within 14 days of purchase for a refund. Nothing in these terms limits your statutory rights.

Acceptable use

No scanning or exploiting a target without authorisation (see above).
No using the Service to build or distribute malware unrelated to a proof of concept for an authorised finding.
No sublicensing or redistributing the Service itself, on any plan. Reselling security testing built on the Service, to your own clients, is permitted on the Partner plan only (see below).
No reverse-engineering the Service except as permitted by open-source components we distribute.
No attempting to circumvent the approval gates and evidence requirements the product enforces.

We may suspend or terminate accounts that violate this section, including a "production"-tagged target scanned without the required human approval.

Reselling on the Partner plan

If you are on the Partner plan, you may run scans on the Service and deliver the resulting reports, under your own brand, to your own clients as part of a security testing service you sell them. That is the only form of reselling these terms allow. You may not sublicense, redistribute, or give a client access to the Service itself; your client receives a report and your advice, not an account or a login.

Authorisation runs through you. Before pointing Ryvx at any system belonging to one of your clients, you are responsible for holding that client's written authorisation to test it, on the same basis set out above, and you represent and warrant that authorisation to us. Our whole safety model rests on the person running a scan being authorised to test the target; on the Partner plan, that responsibility does not move to us just because you are acting on someone else's behalf.

You own the client relationship. Your deliverables, your advice, and your contract with your client are yours. We supply the engine; we are not a party to that relationship.

No third-party beneficiary. We have no contractual relationship with, and no liability to, your clients. Any claim arising from a report or a scan you deliver to a client is between you and that client, not between them and us.

Ryvx is a UK sole trader and holds no professional indemnity insurance. If you resell on the Partner plan, factor that into your own client contracts and, if you carry it, your own professional indemnity cover.

Findings & your data

You own the scan data, findings, and reports Ryvx generates for you. We process that data to provide the Service, as described in our Privacy Policy.

Disclaimer of warranties

The Service is provided "as is." Ryvx aims for evidence-backed findings, but automated security testing can miss vulnerabilities or, rarely, misreport one; it is not a substitute for a full manual penetration test or compliance audit. We disclaim all warranties, express or implied, including fitness for a particular purpose.

Limitation of liability

To the maximum extent permitted by law, Ryvx is not liable for indirect, incidental, or consequential damages arising from your use of the Service, including damage caused by scans you authorised us to run. Our total liability for any claim is limited to the amount you paid us in the 12 months before the claim arose.

Termination

You can stop using the Service and delete your account at any time. We can suspend or terminate accounts for breach of these terms, non-payment, or misuse of the Service against unauthorised targets.

Changes to these terms

We'll post updates here and, for material changes, notify account holders by email before they take effect.

Governing law

These terms are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from them. If you are a consumer resident elsewhere in the UK, you may also bring proceedings in your local courts, and you keep the benefit of any mandatory protections of the law where you live.

If part of these terms doesn't hold

If any provision is found unenforceable, the rest stays in force. Our failure to enforce a provision isn't a waiver of it. You may not transfer your rights under these terms without our consent; we may transfer ours if the Service changes hands, and will tell account holders if that happens.

Contact

Questions about these terms: support@ryvx.dev