Terms of Service

Terms of Service

These terms govern your use of the LLM in the Loop Fuzzer platform (llmloopfuzzer.com), including the corporate account portal, the Private Scanner Console, and the CI/CD remote API.

Effective 31 October 2026 · Agreement between your organisation and LLM in the Loop Fuzzer · Contact: [email protected]

1. Acceptance and the agreement

By submitting a corporate account request, signing in, or using a fuz_live_... API key, your organisation agrees to these terms. If your organisation contracts with us under a separate Master Services Agreement, Order Form, or Data Processing Addendum, those documents govern the services they cover and control in the event of conflict.

2. The service

LLM in the Loop Fuzzer performs autonomous, evidence-driven application security verification: it generates hypotheses against authorised targets, executes protocol-level probes, race-condition bursts and headless browser checks, and promotes a finding to the compliance ledger only when a deterministic verifier observes the declared post-condition and an adversarial critic falsifies the signal under a benign control. Output is a set of confirmed findings with reproducible proof-of-concept artifacts.

3. Authorisation to test

You are responsible for the targets you submit, for configuring the request budget and rate limit to match the tolerance of the target estate, and for honouring any restriction, embargo, or exclusion the target owner has imposed. We do not assist with testing you are not authorised to perform, and we terminate accounts that abuse the platform, scan third-party systems without permission, or use results to cause harm.

4. Accounts and access

• Accounts are issued to organisations, not to individuals. Corporate account requests are reviewed before access is granted, and activation requires a single-use password setup link.
• Keep credentials confidential. You are responsible for activity under your account, your API keys, and your CI/CD pipelines; rotate keys immediately if you suspect exposure.
• Seats are per organisation on paid tiers and are not individually metered. You may give colleagues access without additional charge.

5. Bring-Your-Own-Key (BYOK)

The platform is 100% Bring-Your-Own-Key. You connect the model endpoint of your choice (for example Groq, OpenAI, Azure OpenAI, Anthropic, or a self-hosted vLLM/Ollama endpoint) per scan, or run the deterministic engine with no external model at all. We do not host, proxy, resell, or mark up model inference or tokens. You are responsible for your provider account, its acceptable-use policy, the cost of the tokens your scans consume, and any confidentiality obligations that apply to the data you send to that provider. Enterprise tiers support self-hosted or private model endpoints and air-gapped runners with zero data egress.

6. Plans, metering and billing

• Applications are the billing unit; fuzzing hours are the bundled allowance within a billing period. Humans are never counted.
• Published tiers: Free ($0), Starter ($99/mo), Team ($399/mo), Scale ($1,290/mo) and Enterprise (from $3,490/mo). The published price per application falls as your portfolio grows.
• Annual billing is ten months' fees (two months free). Enterprise is annual-only and quote-based, with a published floor.
• Self-serve subscriptions are billed in advance through our payment processor. Enterprise agreements are invoiced under the corporate contract.
• Fees are exclusive of taxes and are non-refundable except where required by law or as stated in your corporate agreement. We credit unused time when you downgrade or terminate mid-period, pro rata to the published monthly rate.
• Suspended or terminated accounts retain access to stored findings for 30 days so that you can export evidence and reports.

7. Acceptable use

You agree not to:

• scan any system without documented authorisation, or attempt to bypass the authorisation gate, the outbound egress guard, or the scope confinement;
• use the platform to cause denial of service, degrade availability, exfiltrate data, or access data you are not authorised to access;
• attempt to access another tenant's account, findings, or API keys, or to probe the platform itself without written permission;
• resell, sublicense, or provide the platform to third parties as a standalone service, or remove attribution from exported reports;
• use the platform in breach of applicable law, including export controls and sanctions.

8. Availability and support

The service is provided on an ongoing basis. Enterprise tiers carry a 99.9% availability commitment, 24×7 coverage and a 1-hour P1 response, with the measurement window, exclusions and service credits set out in your corporate agreement. Scale tiers include a named technical account manager and a 4-hour P1 response. Free and Starter tiers are provided on an as-available basis with community or standard support. Planned maintenance is announced in advance through the changelog.

9. Your content and our licence

You retain all rights in your targets, your scan requests, and the findings they produce. You grant us only the narrow licence needed to operate the service for you: to process requests, retain findings for the retention period applicable to your tier, and produce the reports you ask for. We own the platform, the scanner, the verifiers, the policy packs, and the documentation, and we grant you a non-exclusive, non-transferable right to use them under these terms.

10. Confidentiality

Each party will protect the other's confidential information with at least the care it applies to its own, and will use it only to perform this agreement. This obligation survives termination by the applicable period. Aggregated, de-identified usage telemetry that contains no scan content, target identifiers, or personal data may be used to improve the platform.

11. Disclaimers

Except as expressly stated, the service is provided "as is". We do not warrant that scanning will detect every vulnerability, that findings are exhaustive, or that the platform is uninterrupted. A confirmed finding is a reproducible protocol-level observation, not a guarantee of business impact; you remain responsible for remediation decisions and for validating impact in your own estate.

12. Limitation of liability and indemnity

To the maximum extent permitted by law, neither party is liable for indirect, incidental, consequential, or punitive damages, or for lost profits, revenue, or data. Our aggregate liability is limited to the fees paid or payable for the service in the twelve months preceding the event giving rise to the claim. Nothing in these terms excludes liability that cannot be excluded by law, including for fraud or wilful misconduct. You indemnify us against third-party claims arising from your unauthorised scanning of systems you do not own or control.

13. Termination

You may stop using the service and request account closure at any time; we close the account and delete data as described in the Privacy Notice. We may suspend an account for non-payment, for breach of these terms, or where continued operation would create a legal or security risk, and we will tell you why. On termination, Enterprise entitlements end at the close of the paid term.

14. Changes to these terms

We may update these terms to reflect product, legal, or security changes. We will publish the revised version with an updated effective date and give Enterprise customers 30 days' notice of a material adverse change before it takes effect.

15. Governing law

These terms are governed by the laws of Victoria, Australia, and the parties submit to the exclusive jurisdiction of the courts of Victoria, Australia, unless your corporate agreement specifies a different governing law and forum.

16. Contact

Questions about these terms: [email protected]. For security disclosures, see the Security & Trust page.