Terms of use

About these terms

These terms are the agreement between you and CipherProof (“we”, “us”) for the website at cipherproof.si and the application at app.cipherproof.si (together, the “service”). By creating an account or using the service you accept them. If you use the service for a company, you confirm that you may bind that company, and “you” then means the company.

CipherProof is a tool for writing penetration-test and security-assessment reports. You enter findings, evidence and scanner results; the service helps you rate, organise and export them as a report. CipherProof does not scan, test or send traffic to any system.

The Privacy page explains how we handle personal data and is part of these terms.

Your account

• You must be at least 18 years old and able to enter a binding contract.
• Give us a real email address and keep it current. We confirm it before the account becomes active.
• Keep your password and any second-factor device or recovery codes to yourself. You are responsible for what happens under your account.
• One account is for one person. Do not share it. Tell us at once if you think someone else has got into it.
• Two-factor sign-in is required, and you must keep your authenticator app and recovery codes safe.

Plans and payment

The Free plan costs nothing and has the limits shown on the pricing page: one project, five entries in your own library, five saved versions per project, PDF export, and a “Generated with CipherProof” line in the report footer.

The Pro plan is paid and raises those limits (up to 50 projects at once, unlimited library entries), adds scanner import, Word export, the brand kit and longer version history, as described on the pricing page when you subscribe.

Fair use. Disk space on our servers is shared between all accounts. Each account gets a fair share, which depends on its plan and can change as more accounts join; the account page shows yours. When an account is full, it can still edit and delete, but cannot add more until it frees space. To keep the service available for everyone, an account may create up to 20 projects an hour. If you need more than your plan allows, write to [email protected].

• Billing. Pro is billed monthly in advance and renews automatically until you cancel. The price, currency and any taxes are shown before you pay.
• Payment provider. Payments are handled by a third-party payment provider. We never see or store your full card number.
• Cancelling. You can cancel at any time from your account or by writing to us. Pro stays active until the end of the period you have paid for, then the account returns to Free.
• Refunds. Fees already paid are not refunded, except where the law requires it or where we choose to as a goodwill gesture.
• Price changes. If we change the price of Pro, we tell you at least 30 days before it applies to you. You can cancel before then.
• Going back to Free. Your work is kept, but features and limits of the Free plan apply again. Anything above the Free limits stays readable and exportable, and you can reduce it or delete it as you like.

Your content

“Your content” means everything you put into the service: projects, findings, notes, screenshots, scanner files, library entries, brand assets and the reports you create.

• It is yours. You keep all rights in it. We do not claim ownership.
• What you allow us to do. You give us permission to host, store, process, copy (for backups and versions), display to you and transmit your content, and only as needed to run the service for you, keep it secure and meet our legal duties.
• What we do not do. We do not sell your content, use it to advertise, or use it to train machine-learning models. We do not access the content of your projects except when you ask us for support, when it is needed to keep the service secure, or when the law requires.
• Your responsibility. You are responsible for your content and for having the right to put it into the service. Keep your own copy of anything you cannot afford to lose; you can export your whole account at any time.

Authorised testing and your reports

• Permission. Only enter information about systems you are authorised to test, and only keep it in the service where your agreement with the system’s owner allows it.
• Your client’s confidence. Findings often contain confidential material belonging to your client. You are responsible for your obligations to them, including deciding whether you may store that material with a service like ours.
• Keep secrets out. Do not put live production credentials, payment-card numbers, health records or similar highly sensitive data into the service. The screenshot editor can cover sensitive areas before a picture enters a report.
• Reports are your work. A report you export is your professional work product, issued under your name or your company’s. Ratings, descriptions and remediation advice, including the text we supply in the library, are starting points for you to check and adapt; you are responsible for their accuracy before you give them to anyone.
• Honest reports. Do not use the service to produce reports, attestations or evidence of testing that did not take place, or to mislead anyone about what was tested.

Acceptable use

Do not:

• break the law, or use the service to plan, carry out or hide an attack on a system you are not authorised to test;
• try to reach another account’s data, probe the service for weaknesses without permission, or interfere with it, overload it or bypass its limits or protections;
• send malware or content that is unlawful, or that infringes someone else’s rights;
• create accounts in bulk or by automated means, resell or sublicense the service, or copy it to build a competing one;
• impersonate another person or organisation.

If you find a security problem in CipherProof, tell us at [email protected] and read the Hall of Fame page for how to report it safely. Good-faith reports made within those rules are welcome and are not a breach of these terms.

Security and confidentiality

We protect your content with the measures described on the Security page, and we keep improving them. We keep your content confidential and share it only with the providers who help us run the service, under the conditions in the Privacy page.

If we find a security breach that affects your content, we will tell you without undue delay, say what we know, and say what we are doing about it.

No online service can promise perfect security. You help by choosing a strong password, using two-factor sign-in, and signing out of shared computers.

The service

• Availability. We work to keep the service running, but we do not guarantee that it will be uninterrupted or error-free. We may pause it for maintenance, and we may change, add or remove features. We will not remove a feature of a paid plan during a paid period without a fair remedy.
• Support. We answer questions at the addresses on the contact page. We aim to reply within a few working days. Paid plans do not include a guaranteed response time.
• If we close the service. We will tell you at least 30 days before, and you can export your data until then.
• Third-party tools. The service reads files from scanners such as Burp Suite, OWASP ZAP and Nessus. Those names are trademarks of their owners. We are not affiliated with them or endorsed by them.

Our rights

We and our licensors own the service: its software, design, text, the library of vulnerability descriptions, templates, names and logos. These terms give you the right to use the service, not to own any part of it.

The library and templates in your reports. Text from the built-in library and the report templates appear in the reports you export. You may use and share those reports with your clients freely, during and after your use of the service.

Feedback. If you send us ideas or suggestions, we may use them without owing you anything.

Ending your use

• By you. You can stop using the service at any time, and you can delete your account from the account page. Deleting it removes every project, file and session in it.
• By us. We may suspend or close an account that breaks these terms, puts the service or other people at risk, or where the law requires it. Where we can, we tell you first and say why, and give you the chance to export your data.
• Inactive free accounts. We may delete a Free account that has not been used for 12 months, after emailing you at least 30 days before.
• After the end. Clauses that by their nature should continue (ownership, disclaimers, liability and governing law) do.

No warranty

The service is provided “as is” and “as available”. To the fullest extent the law allows, we give no warranty that it will meet your needs, that its calculations, ratings or generated text are free of error, or that a report made with it will satisfy any client, auditor or regulator. CVSS scores are calculated from the metrics you select and are an aid to your judgment, not a substitute for it.

Limits of liability

To the fullest extent the law allows:

• we are not liable for indirect or consequential loss, or for loss of profit, business, goodwill or data that you could have avoided by keeping an export;
• our total liability to you for all claims arising from the service is limited to the amount you paid us in the 12 months before the event that caused the claim, or 100 US dollars if you use only the Free plan.

Nothing in these terms limits liability that cannot be limited by law, including liability for fraud, for death or personal injury caused by negligence, or for wilful misconduct. If you are a consumer, you keep the rights that the law of your country gives you and that cannot be waived by contract.

If a claim is made against us

You agree to defend us and cover reasonable losses that arise from a third party’s claim that your content, or your use of the service in breach of these terms, infringes their rights or breaks the law. We will tell you promptly about the claim and let you take part in handling it.

Governing law and disputes

These terms, and any disagreement that arises from them, are governed by the law that applies to the company that operates CipherProof, without regard to its conflict-of-law rules. Rules that protect you as a consumer under the law of the country where you live continue to apply, and nothing here takes away your right to bring a claim in the courts where you live when that law gives you that right.

Please write to us first. We would like to resolve any complaint directly, and we will answer within 30 days.

Changes to these terms

We may update these terms, for example when we add a feature or the law changes. For a change that matters, we email you at least 30 days before it takes effect and show the new date at the top of this page. If you keep using the service after that date, you accept the new terms. If you do not agree, you can stop using the service and delete your account before then.

General

• These terms, together with the Privacy page and anything you accept when you subscribe, are the whole agreement between us about the service.
• If a part of these terms is found unenforceable, the rest stays in force.
• If we do not enforce a right straight away, we have not given it up.
• You may not transfer your account or these terms to anyone else without our written consent. We may transfer ours as part of a sale or reorganisation of our business, and we will tell you if we do.
• Neither of us is responsible for delay caused by events outside our reasonable control.
• We send notices to the email address on your account. You can send notices to us at the address below.

Contact

Questions about these terms: [email protected]. Security problems: [email protected].