Terms & conditions

1. Acceptance

By using this website or the RootXLabs platform you agree to these terms. If you are agreeing on behalf of an organisation, you confirm you have the authority to bind it.

2. Authorization — the part that matters

RootXLabs performs offensive security testing. Testing a system without the owner's permission is a crime in most jurisdictions, and this is the one clause we will not be flexible about.

• You may only submit a scope that you own, or that you hold current, documented, written authorization to test.
• That authorization must cover automated and agent-driven testing, not just manual review.
• Where your systems run on infrastructure you do not own — a cloud provider, a SaaS platform, a managed host — you are responsible for meeting that provider's testing policy.
• You must withdraw a scope immediately if your authorization to test it lapses.

We may verify ownership before testing begins, refuse or pause any scope at our discretion, and terminate immediately if we believe authorization is absent. Submitting a scope you are not authorized to test is a material breach and you indemnify us for it.

3. Acceptable use

You may not use RootXLabs to:

• test, probe, or attack systems you are not authorized to test;
• build, stage, or launch an attack against a third party, including denial-of-service;
• exfiltrate, retain, or trade data belonging to anyone other than yourself;
• resell, sublicense, or present our output as another provider's work without a written agreement;
• reverse engineer the platform, or use it to develop a competing product.

4. Findings and your data

Findings we produce for your scope are yours to use internally, share with your vendors, and publish. Our underlying methodology, tooling, models and platform remain ours.

Testing produces sensitive material — credentials, tokens, extracts of your data. We treat everything recovered from your scope as your confidential information, use it only to demonstrate and remediate the finding, and delete it on request or at the end of the engagement.

We may describe engagements in anonymised, aggregate form. We will not name you as a customer, quote you, or publish anything identifying without your written permission.

5. Third-party vulnerabilities

If testing your scope surfaces a vulnerability in a third-party product, we will report it to that vendor under our responsible disclosure policy, coordinating timing with you first. We will not name you in that report without your permission.

6. Availability

We aim to keep the platform available but do not promise uninterrupted service on plans without a written service level agreement. Testing may be paused for maintenance, safety, or because a scope requires review.

7. No guarantee of completeness

Security testing is a sampling exercise, not a proof of safety. RootXLabs reports what it can demonstrate within the scope, time and access it is given. An engagement that finds nothing is not a certificate that nothing is there.The platform is provided “as is”, without warranties of merchantability or fitness for a particular purpose to the extent the law allows.

8. Liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, or consequential loss, or for lost profits or data. Our total aggregate liability is capped at the fees you paid us in the twelve months before the claim. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited.

9. Fees

Paid plans are billed as set out in your order. Fees exclude tax. Non-payment may suspend service after notice.

10. Termination

Either party may terminate for convenience with 30 days' notice, or immediately for material breach. On termination we stop testing, and on request we delete the material recovered from your scope.

11. Changes

We may update these terms. Material changes will be notified to account holders before they take effect, and the effective date above will change. Continued use after that date is acceptance.

12. Contact

RootXLabs — legal@rootxlabs.ai