Terms
Effective June 2026
The agreement
These terms govern use of uvy.ai and the Uvy service. A larger engagement may be covered by an order form that references these terms; if the two conflict, the order form wins.
The service
Uvy is an AI-native penetration testing service. Its agents probe an application or domain you control to discover, prove, and help remediate security vulnerabilities, and produce an audit-ready report. Testing is scoped to the targets you verify and authorize, and Uvy does not attempt destructive or data-altering actions.
Authorization to test (read this)
You may only request testing of systems you own or are explicitly authorized to test. You must verify control of each target (via the DNS or file check we provide) before it can be assessed, and by launching an assessment you represent that you have all necessary authorization to have that target tested, including from any third party that hosts or operates the target (for example a cloud or infrastructure provider whose policies may require their own permission). Testing systems without authorization may violate computer-misuse laws; you are solely responsible for ensuring you have the right. You agree to indemnify and hold us harmless from any claim arising out of a target you were not authorized to test or your breach of these authorization or acceptable-use terms. We may require evidence of authorization and may refuse or halt any assessment. We do not test any target you have not verified and authorized.
Acceptable use
Use Uvy to test your own assets. Don't use it to attack third parties, evade another provider's rules, access other customers' data, or break the law. We may suspend or refuse service to prevent harm or misuse; where we can, we'll tell you why. Our Acceptable Use Policy sets out the full rules and forms part of these terms.
Risk of testing
Active security testing of your own systems carries inherent risk: even non-destructive probing can trigger alerts, rate-limits or temporary blocks, and incidental load. You are responsible for choosing when and what to test, for testing against the right environment, and for any backups or precautions you want in place. You run assessments at your own risk.
Your data
You own your applications and the findings and reports Uvy produces for you. We process data as described in the privacy policy and any data processing terms in your order form.
AI outputs
Uvy verifies findings with proof-of-exploit to minimize false positives, but automated testing is not a guarantee of completeness, and AI outputs can be wrong. An assessment is one input into your security program, not a warranty that your systems are secure. You remain responsible for your own security decisions.
Fees
Engagements are sold per application (a fixed price per assessment), with continuous coverage available as a subscription. Prices and what's included are shown at checkout or on your order form. A scoped pilot may be offered at our discretion; any pilot terms are set in the order form.
Term and termination
You may stop using the service at any time. We may suspend or terminate access for non-payment, breach of these terms, or to prevent harm or misuse. A purchased engagement remains usable per what was bought. You may request a refund within 72 hours of purchase (unlocking your report) by emailing [email protected]; if you request a refund your signed report will not be issued. After 72 hours, or once your report has been signed, the fee is non-refundable, except where required by law or as expressly provided in our Data Processing Addendum. See our refund policy at /refunds for the full details.
Liability
The service is provided as-is to the extent law allows. Our total liability is capped at the fees you paid in the twelve months before the claim. Neither side is liable for indirect or consequential damages.
Eligibility and changes
You must be at least 18 and, if you act for an organization, authorized to bind it. These terms, the privacy policy, and any order form are the entire agreement between us. We may update these terms; material changes take effect when posted here, and continued use means you accept them. These terms are governed by the laws of the State of Delaware, USA, and disputes are subject to the courts located there.
Contact
Questions about these terms: [email protected].