1About these terms
1.1These terms are between you and [company name to be added], an entity formed in [country of formation to be added] ("we", "us"). We run SiBear Security ("the product") at sibearsecurity.com.
1.2The product tests AI agents the way a hostile user would. It shows what leaked, suggests a fix, and gives evidence. The free scan is the first step.
1.3These terms cover the free scan and the website. Paid reviews have their own terms. If the two conflict, the paid terms win for the paid work.
1.4You accept these terms when you tick the authorization box and send a scan request. What that box means is on the Scan authorization page. We store the version of these terms and the version of the box text with your request.
1.5These terms have the version id [version id to be added]. Every published change gets a new version id. These terms take effect on [effective date to be added].
2Who may use the product
2.1The product is for business use. You use it for your own agent, your employer's agent, or an agent you have authority to test.
2.2You must be at least [minimum age to be added] and able to make a binding contract. If you accept for a company, you confirm that you may bind that company.
2.3You must give an email address that you control and confirm. We do not start any scan before you confirm it.
2.4A person must tick the authorization box. Scripts, bots and AI agents must not accept these terms or tick the box for you.
2.5We may refuse or block anyone. Examples: addresses on our block list, disposable email domains, and people who break these terms.
3AI disclosure
3.1The product is run by AI agents. Automated agents run the scan, grade the replies, and write the result and the fix preview.
3.2A free scan result is automated. No person reads or signs it before you get it.
3.3Paid reports are produced by automated agents too.
3.4Support replies come from an AI assistant. It says so, and it can hand your request to a person.
3.5A hosted AI model provider helps grade the replies. The privacy policy says what it receives.
4Scan authorization and limits
4.1Before a scan, you state that you own or control the agent and its web address. Or you state that its owner has authorized you to approve the test. You do this by ticking the authorization box yourself.
4.2By ticking the box you authorize us to send test messages to that address, through its chat interface only, using the test key you gave us, for the scan you asked for.
4.3The authorization covers only the one address you entered, only the scan you asked for, and only the limits in clause 4.4. It does not cover any other system, address or account. It does not cover later scans unless you ask for them.
4.4We follow these limits:
- Chat only. We talk to the agent's chat endpoint, the way a user would. We do not scan networks or ports. We do not test cloud configuration. We do not attack infrastructure.
- Non-destructive. The tests do not ask for anything that deletes or changes your data. An agent can still behave in unexpected ways. If your agent has live tools, connect it to test data or switch the tools off for the scan.
- Rate-limited. We send messages at a limited pace.
- Capped. There is a cap on the number of requests, a time limit per scan and a size limit per reply. We stop at the cap or the time limit.
- Secure address only. The address must start with https. We do not follow redirects. We send your test key only to the verified host.
4.5We allow one free scan per domain per week. We also have a global daily spend limit. When it is reached, we pause new scans. We limit how often a confirmation email can be resent.
4.6Before a scan you must prove you control the address. You do this with a DNS TXT record or with a file under /.well-known/ on the same origin as the agent. The proof expires after 24 hours. Without the proof, we do not scan. If you cannot place a record or file, for example because the agent is a vendor's shared API, we cannot scan it. The proof helps us. It does not replace your own authorization.
4.7Create a throwaway test key that works only for this endpoint. Revoke it after the scan. We encrypt it, never log it, never show it back to you, and delete it when the scan ends or the request expires.
4.8If your agent runs on, or calls, other services (a cloud, a model provider, a tool vendor), check that their rules allow this kind of testing, or get their permission. You are responsible for this, not us.
4.9The tests make your agent do work. That can use your quota or cost you money. Set a spending limit on the test key. We cap our requests. We cannot control what your agent costs to run.
4.10The free scan does not test tools or MCP servers, and it does not test whether answers are correct. It does not test anything we cannot prove you control.
4.11You can ask us to stop a scan by writing to [support email address to be added]. We stop as fast as we reasonably can. We can also stop any scan when we see a problem.
4.12If you do not control the agent and have no authority to approve the test, do not tick the box and do not scan it.
5Acceptable use
5.1You must not:
- scan or try to scan a system you do not own or have no authority to test;
- give false ownership proof;
- tick the box for someone else, or let a bot tick it;
- use the product to attack, harass or harm any person or system;
- try to extract, copy, scrape or publish our test content, rubrics or scoring rules (we keep them private);
- get around our limits, for example with several domains, disposable emails, proxies or automation;
- overload or disrupt the product;
- upload malware or unlawful content;
- describe a free scan result as a certification, an audit or a third-party attestation; or
- resell or reverse engineer the product.
5.2We keep an abuse log. We may block you or your domain.
6What a scan result is and is not
6.1What it is. An automated test of one chat endpoint. It runs 12 probes in 8 categories. Each probe ends as held, leaked or unclear. You get a score, a bar for each category, up to 3 findings and one fix preview. We send the full summary by email to your confirmed address.
6.2Every result shows the date, the number of probes and the words "not a guarantee".
6.3What it is not. It is not a guarantee that your agent is secure. It is not a certification, an audit, an attestation or a penetration test. It is not legal advice or a compliance opinion. "Held" means only that the agent held on that probe, on that date.
6.4Limits. The automated grader can be wrong. Unclear probes are left out of the score and shown. If fewer than 8 of the 12 probes could be graded, the result is shown as incomplete, with no score. AI agents can answer differently each time. We test chat only.
6.5Fix preview. It is a generic example for the category. We do not apply it to your code. It may not fit your system.
6.6If you share a result, share it unaltered, with its date and its labels: automated, not a guarantee.
6.7A result is private to you by default. A public result page or badge exists only if you choose it.
6.8We mask values that look like secrets or personal data. Masking is best effort and can miss something. If a secret appears in a reply, treat it as exposed and rotate it.
7Your data and our use of it
7.1You keep your rights in your agent, your test key and your agent's replies.
7.2You allow us to process what you send and what your agent replies, only to run the scan, grade it, make the result, send you the result, prevent abuse, keep the product secure, and meet legal duties.
7.3We do not use your data to train any model.
7.4Your agent's replies can contain real secrets or personal data that the tests provoked. We store them privately. We delete raw replies after the period in clause 7 of the Privacy Policy. We mask them in anything you can see.
7.5We never show our test text in a result, a page or a log you can see.
7.6We may keep counts and rates that do not identify you, for example how many scans finished, to measure the product.
7.7The Privacy Policy governs personal data.
8Emails we send
8.1We send a confirmation email to the address you entered. The link works once and expires after a short time.
8.2We send the scan summary only to your confirmed address. It is labeled automated. It has no test text. It has a button to book a review.
8.3We send marketing email only if you ticked the separate marketing box. Each marketing message has an unsubscribe link. If you withdraw, your scan and result are not affected. The text of that box is shown next to it.
8.4Running a scan is not marketing consent.
9Intellectual property
9.1We own the product, the website, the test content, the rubrics, the scoring rules, the report templates and our trademarks. You get no rights in them except those in these terms.
9.2We give you a personal, non-exclusive right to use your own result for your own business and to share it with your own customers, if you follow clause 6.6.
9.3You must not copy, scrape or publish our test content.
9.4If you send us feedback, we may use it without paying you.
9.5A free scan gives us no right to use your name or logo. We name a customer only with their separate permission.
10Third-party services
10.1We use a hosted AI model provider, a transactional email service and hosting. The Privacy Policy lists them and what each receives.
10.2We are not responsible for a failure of a third-party service beyond what the law requires.
11Availability and changes to the service
11.1The free scan is free and has no service level. We may pause, limit, change or end it at any time.
11.2We pause new scans automatically when we reach our daily spend limit.
12Warranty disclaimer
12.1The product is provided "as is" and "as available".
12.2We do not promise that the product finds every problem, is free of errors, runs without interruption, or fits your purpose.
12.3Nothing here removes a warranty that the law does not allow us to remove.
13Limitation of liability
13.1To the extent the law allows, we are not liable for indirect, special or consequential loss, lost profit, lost data or business interruption. This includes loss from a scan of your agent and loss from relying on a result.
13.2To the extent the law allows, our total liability for all claims about the free scan and these terms is [liability cap to be added].
13.3Nothing here limits liability that the law does not allow us to limit.
13.4You understand that the tests send messages to your agent and that an agent can behave in unexpected ways. If we followed clause 4, we are not liable, to the extent the law allows, for what your agent does in reply.
14Your responsibility for what you scan
14.1If you say you control or may test an agent and you do not, you are responsible for the loss, costs and claims that follow, for us and for others. You will cover our reasonable losses and costs from such a claim.
14.2We may cooperate with law enforcement where the law requires.
15Suspension and termination
15.1You can stop using the product at any time. You can ask us to delete your data: see clause 11 of the Privacy Policy.
15.2We may suspend or block you if you break these terms, scan without authorization, abuse the product, or if the law requires.
15.3Clauses 6, 9, 12, 13, 14 and 17 stay in force after these terms end.
15.4If we block you, we keep the related abuse log entries for the period in clause 7 of the Privacy Policy.
16Changes to these terms
16.1We may change these terms. We post the new version on the website at least [number of days to be added] before it takes effect.
16.2A scan request is governed by the version you accepted when you sent it.
17Governing law and venue
17.1These terms are governed by [governing law to be added].
17.2The courts of [venue to be added] decide disputes about them.
17.3Rights you have under mandatory law where you live are not affected.
18General
18.1These terms, the Scan authorization and the Privacy Policy are the whole agreement about the free scan.
18.2If a part is not valid, the rest stays in force.
18.3If we do not enforce a right, we do not give it up.
18.4You may not transfer these terms. We may transfer them with our business.
18.5You can send notices to [support email address to be added]. You accept these terms electronically.
19Contact
19.1[company name to be added], [postal address to be added]. Support: [support email address to be added]. Privacy: [privacy email address to be added].