Terms of Service

DRAFT, not yet reviewed by a lawyer.
Effective date: [EFFECTIVE DATE]
Last updated: 11 November 2026

These Terms of Service (“Terms“) govern access to and use of the GLAV platform, website (glav.ai), APIs, reports and related services (together, the “Service“). The Service is provided by [LEGAL ENTITY NAME AND FORM], trading as “GLAV”, with its registered address at [REGISTERED ADDRESS], OIB [OIB] (“GLAV“, “we“, “us“).

By creating an account, starting a subscription or using the Service, you agree to these Terms on behalf of the business or organisation you represent (“Customer“, “you“). If you do not have authority to bind that organisation, do not use the Service.

1. Business use only

1.1 The Service is offered exclusively to businesses, organisations and professionals acting for purposes related to their trade, business, craft or profession. It is not offered to consumers.

1.2 By accepting these Terms you confirm that you are not acting as a consumer. Because the Service is provided business-to-business, consumer protection rules that apply only to consumers under EU and Croatian law (including the statutory 14-day right of withdrawal for distance contracts) do not apply.

1.3 If we reasonably believe that an account is being used by a consumer, we may close it and refund any unused prepaid fees for the current period.

2. The Service

2.1 GLAV is an AI-assisted security testing platform. It orchestrates automated penetration testing engines against targets that you define and authorise, validates and de-duplicates findings, organises work into projects and clients, and produces reports, including white-label PDF reports.

2.2 The Service includes an authorisation and scope gate, domain and asset verification, audit logging and per-tenant isolation. These controls support, but do not replace, your own obligation to test only what you are authorised to test.

2.3 We may change, improve or discontinue features of the Service from time to time. If we remove a material feature of a paid plan during a billing period, we will give you reasonable advance notice where practical.

3. Accounts

3.1 You must provide accurate and complete registration information and keep it up to date.

3.2 You are responsible for all activity under your account, including activity by your team members, clients you invite and anyone using your API keys. Keep credentials confidential, enable available security features such as multi-factor authentication, and notify us promptly at [SECURITY CONTACT EMAIL] if you suspect unauthorised access.

3.3 You must ensure that every user you invite is bound by and complies with these Terms and the Acceptable Use & Authorized Testing Policy.

4. Acceptable use and authorisation

4.1 Your use of the Service is subject to our Acceptable Use & Authorized Testing Policy (“AUP“), which forms part of these Terms.

4.2 Authorisation warranty. For every target, domain, IP address, application, API, cloud account or other asset you submit to the Service (“Target“), you represent and warrant that:

• (a) you own the Target, or you hold explicit, written, and currently valid authorisation from the owner of the Target (and, where relevant, from its hosting or cloud provider) to perform the type of security testing the Service will carry out;

• (b) the scope you configure in the Service is no wider than the scope of that authorisation, including permitted dates, times, techniques and exclusions;

• (c) testing the Target will not breach any law, contract or third-party right; and

• (d) you will produce evidence of that authorisation to us promptly on request.

4.3 Passing domain or asset verification, or being allowed through the scope gate, does not mean that GLAV has confirmed your authorisation. Responsibility for authorisation remains entirely with you.

4.4 We may refuse, pause or stop any test, and may suspend your account, if we reasonably believe a test is unauthorised, out of scope, unlawful or harmful.

5. Indemnity

5.1 You will defend, indemnify and hold harmless GLAV and its officers, employees and contractors against any claims, proceedings, losses, damages, fines, penalties, costs and expenses (including reasonable legal fees) arising out of or relating to:

• (a) any testing of a Target that you were not fully authorised to test, or testing outside the authorised scope;

• (b) your breach of these Terms or the AUP;

• (c) your use of findings, reports or other outputs of the Service; or

• (d) any Customer Data (as defined below) you provide, including any claim that it infringes third-party rights or was processed unlawfully by you.

5.2 We will notify you promptly of any claim covered by this section, give you reasonable control of its defence, and cooperate with you at your expense. You may not settle a claim in a way that imposes obligations on GLAV without our prior written consent.

6. AI outputs and limitations

6.1 The Service uses automated tools and artificial intelligence, including large language models provided by third parties, to plan tests, interpret results and draft findings and reports.

6.2 No guarantee of security. Automated testing is inherently limited. Findings may include false positives (reported issues that are not real or not exploitable) and the Service will not detect every vulnerability (false negatives). A report that shows no or few findings does not mean that a Target is secure.

6.3 Outputs are provided to support, not replace, the professional judgement of qualified security personnel. You are responsible for reviewing, validating and prioritising findings before relying on them, sharing them with your clients, or acting on them.

6.4 Security testing can affect the availability or performance of a Target. You are responsible for choosing suitable test windows, environments and settings, and for maintaining backups.

6.5 Except as expressly stated in these Terms, the Service and all outputs are provided “as is” and “as available”, and we disclaim all implied warranties, including fitness for a particular purpose, to the fullest extent permitted by law.

7. Intellectual property

7.1 Your data and reports. As between you and GLAV, you own all data you submit to the Service, the results of tests run on your Targets, and the reports generated for you (“Customer Data“). You grant GLAV a non-exclusive, worldwide licence to host, copy, process and transmit Customer Data only as needed to provide, secure and support the Service, and as described in our Data Processing Addendum.

7.2 White-label reports. You may brand, distribute and share reports generated for you with your own clients, subject to these Terms. You are responsible for any statements you add and for how your clients use the reports.

7.3 Our platform. GLAV and its licensors own all rights in the Service, including the software, orchestration logic, validation methods, templates, documentation and branding. Subject to these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable right to use the Service during your subscription for your internal business purposes and to deliver services to your clients.

7.4 Restrictions. You may not copy, resell or sublicense access to the Service (other than sharing reports as permitted above), reverse engineer it except to the extent the law expressly permits, use it to build a competing product, or remove proprietary notices.

7.5 Feedback. If you give us suggestions or feedback, we may use them without obligation to you.

7.6 Aggregated data. We may use de-identified, aggregated data about use of the Service (for example, volumes of tests or general categories of vulnerability) to operate and improve the Service, provided it does not identify you, your clients, any Target or any individual.

8. Open-source components

8.1 The Service incorporates and orchestrates open-source software, including the Strix security testing engine, which is licensed under the Apache License, Version 2.0, and [OTHER ENGINES AND THEIR LICENCES].

8.2 Open-source components are licensed under their own terms, which take precedence over these Terms to the extent they apply to that component. Copyright notices, licence texts and notices of modification are available at [THIRD-PARTY NOTICES URL].

8.3 Nothing in these Terms restricts any rights you have under an applicable open-source licence.

9. Fees, payment and credits

9.1 Paid plans are offered on a monthly subscription basis at the prices shown on our pricing page (currently €20, €60 or €200 per month, excluding any applicable taxes).

9.2 Payments are processed by Polar Software, Inc. (“Polar“), which acts as merchant of record. When you purchase, you buy from Polar under Polar’s buyer terms, and Polar is responsible for charging, invoicing, applicable taxes and processing refunds. Your right to use the Service is granted by GLAV under these Terms.

9.3 Each paid plan includes a monthly allowance of pentest credits ([CREDITS PER PLAN]). Pentests are first charged against your plan credits. Once credits are used up, further pentests are charged pay-per-pentest at [PAY-PER-PENTEST PRICE].

9.4 Subscriptions renew automatically each month until cancelled. Cancellation, refunds and credit expiry are governed by our Refund & Cancellation Policy.

9.5 We may change our prices with at least [PRICE CHANGE NOTICE DAYS] days’ notice. Changes take effect at the start of your next billing period. If you do not agree, you may cancel before the change takes effect.

10. Data protection and confidentiality

10.1 Our Privacy Policy explains how we process personal data as a controller (for example, account and billing data). Where we process personal data on your behalf as part of the Service, our Data Processing Addendum applies and forms part of these Terms.

10.2 Each party will keep the other party’s non-public information confidential, use it only for the purposes of these Terms, and protect it with at least reasonable care. This does not apply to information that is public through no fault of the receiving party, already known to it, independently developed, or lawfully received from a third party, or that must be disclosed by law (in which case the receiving party will give notice where legally permitted).

11. Limitation of liability

11.1 Nothing in these Terms limits or excludes liability for damage caused intentionally or through gross negligence, for death or personal injury, or for any other liability that cannot be limited or excluded under applicable law.

11.2 Subject to section 11.1, neither party will be liable for any indirect or consequential loss, loss of profit, revenue, business or goodwill, or loss or corruption of data (except GLAV’s obligations to restore data from its backups where available), however arising.

11.3 Subject to section 11.1, GLAV is not liable for any damage to, downtime of, or loss relating to a Target resulting from testing that you configured or authorised, or for any consequences of your reliance on findings or reports without independent validation.

11.4 Subject to section 11.1, each party’s total aggregate liability arising out of or in connection with these Terms is limited to [LIABILITY CAP].

11.5 The limitations in sections 11.2 to 11.4 do not apply to your indemnity obligations under section 5 or to your payment obligations.

12. Suspension and termination

12.1 You may stop using the Service and cancel your subscription at any time as described in the Refund & Cancellation Policy.

12.2 We may suspend access to all or part of the Service immediately and without prior notice if we reasonably believe that: (a) you or your users have breached the AUP or section 4; (b) a test is unauthorised, out of scope or causing harm; (c) your account is compromised; (d) payment has failed; or (e) suspension is required by law or by a competent authority. We will tell you the reason where legally permitted and lift the suspension once the issue is resolved.

12.3 We may terminate these Terms by written notice if you materially breach them and (where the breach can be remedied) do not remedy it within [CURE PERIOD DAYS] days, or immediately for a serious breach of the AUP. We may also terminate for convenience with at least [TERMINATION NOTICE DAYS] days’ notice, in which case we will refund any prepaid fees for the period after termination.

12.4 On termination, your right to use the Service ends. You may export your reports and Customer Data for [EXPORT WINDOW DAYS] days after termination, after which we will delete Customer Data as described in the DPA, unless we must retain it by law or to preserve evidence of a suspected breach of the AUP.

12.5 Sections 5, 6.2–6.5, 7, 10, 11, 12.4, 13 and 14 survive termination.

13. Governing law and disputes

13.1 These Terms and any non-contractual obligations arising out of them are governed by the laws of the Republic of Croatia, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.

13.2 The parties will first try in good faith to resolve any dispute informally. If it is not resolved within [INFORMAL RESOLUTION DAYS] days, the courts of [COMPETENT COURT], Croatia have exclusive jurisdiction, without prejudice to either party’s right to seek urgent interim relief in any competent court.

14. General

14.1 Changes to these Terms. We may update these Terms. For material changes we will notify you by email or in the Service at least [TERMS CHANGE NOTICE DAYS] days before they take effect. If you do not agree, you may cancel before the effective date. Continuing to use the Service after that date means you accept the updated Terms. Changes required by law or to address security risks may take effect sooner.

14.2 Assignment. You may not assign these Terms without our prior written consent. We may assign them to an affiliate or a successor to our business, with notice to you.

14.3 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, other than payment obligations.

14.4 Entire agreement. These Terms, together with the AUP, the Refund & Cancellation Policy, the DPA and any order form, are the entire agreement between the parties about the Service. If there is a conflict, the order of precedence is: (1) a signed order form, (2) the DPA (for personal data matters), (3) these Terms, (4) the other policies.

14.5 Severability and waiver. If any provision is found invalid, the rest remains in effect. A failure to enforce a provision is not a waiver.

14.6 Language. These Terms are drafted in English.

14.7 Notices. Legal notices to GLAV must be sent to [LEGAL CONTACT EMAIL]. We will send notices to the email address associated with your account.

15. Contact

[LEGAL ENTITY NAME AND FORM]
[REGISTERED ADDRESS]
OIB: [OIB]
Legal: [LEGAL CONTACT EMAIL]
Support: [SUPPORT EMAIL]