Terms of Service

Cantic is operated by Cantic Ltd, a company registered in England & Wales (Company No. 17165585) (“Cantic”, “we”, “us”). These terms govern your use of the Cantic security testing service, dashboard, and reports (together, the “Service”). By running a scan or subscribing, you agree to them. If you use the Service for an organisation, you confirm you are authorised to accept these terms on its behalf.

Cantic is an AI-powered security testing tool. You enter a domain; our AI agent attempts to find vulnerabilities by simulating attacks; you receive a report showing what it tried, what worked, and how to fix it. The agent uses read-only tools and cannot modify, delete, or exfiltrate actual data from your application.

You must be authorized to test any domain you submit. Before any scan runs — free or paid — your account must carry two things, both recorded when you sign up: your digital acceptance (a typed electronic signature — see The testing authorizationbelow) confirming you are authorized to approve security testing of the domain on behalf of the organization that controls it, and a concrete proof of that authority — a one-time code sent to your work email address, which verifies control of that mailbox. You state the domain to test separately, explicitly; it does not have to be the domain your email sits on, but you confirm it is your organization's to test. You are solely responsible for ensuring you have proper authorization before running any scan, and for any false claim made to obtain one.

When you sign the authorization at sign-up, typing your name and title and confirming the box — with the domain you entered — constitutes your electronic signature on the following, recorded with a timestamp, your IP address, and the version of this text:

• Scope. You authorize Cantic to conduct non-destructive security testing against the domain you entered and all subdomains, APIs, and internet-facing services under your control. Testing is from the outside only, exactly as a real attacker would experience it, using only what is publicly reachable. No credentials, VPN access, source code, or internal documentation are required or requested. Testing may include benign proof-of-concept exploitation of anything found — up to and including demonstrating remote code execution with read-only, non-persistent commands, and extracting the minimum database records needed to evidence access to data (typically one or two records, never a dump).
• Non-destructive. Testing must not delete, corrupt, or encrypt production data, perform denial-of-service or load testing, or bulk-exfiltrate data. If credentials, keys, or personal data are encountered, only the minimum needed to evidence the finding is used.
• Consent and law.This is lawful consent under the UK Computer Misuse Act 1990 and equivalent laws in your jurisdiction. You confirm you are authorized by the organisation that controls the domain to give this consent, and that the domain and its subdomains are the organisation's to test.
• Proof. The one-time code you received verified control of your work mailbox. Where the domain you entered differs from the domain your email sits on, your signature is what puts that domain in scope — attest accordingly.
• Validity. The authorization is valid for three (3) months from signature, and can be withdrawn by emailing [email protected]with seven (7) days' notice.

• You must have proper authorization to test any domain you submit.
• You are responsible for implementing the fixes Cantic recommends; we provide guidance, not remediation.
• You must keep your dashboard credentials secure.
• You must not use Cantic to test applications you do not own or have written permission to test.
• You must comply with all applicable laws.

You must not:

• submit domains you are not authorized to test;
• use Cantic to attack, disrupt, or harm any system;
• attempt to access other users’ accounts or data;
• probe, disrupt, or overload Cantic’s infrastructure;
• reverse engineer or resell the Service; or
• use false attestations to bypass authorization checks.

We may suspend access to protect the Service or other users.

Our AI agent tests your application by attempting reconnaissance, authentication attacks, injection testing, and infrastructure checks. All tools are read-only: the agent observes responses but cannot modify your application, delete data, or exfiltrate real information. Scans are rate-limited and sandboxed.

Scan reports show what the agent tried, what succeeded, and how to fix it. Reports include copy-paste remediation guidance specific to your stack. You can export reports as PDFs for compliance or sharing. Reports are retained per the Privacy Policy.

The first scan is free. Paid plans are billed monthly or annually as shown at checkout. You can cancel at any time; cancellation stops future charges but does not refund the current billing period. We may change pricing with 30 days’ notice.

We own the Service and its software. You own your applications and the data in your scan reports. You grant us the limited rights needed to operate the Service: to test the domains you submit and generate reports.

Cantic helps you find vulnerabilities, but no security testing is exhaustive. A clean report does not guarantee your application is secure. New vulnerabilities can appear with each deploy, which is why we offer continuous weekly or daily scanning.

The Service is provided “as is” and “as available” without warranties of any kind, to the fullest extent permitted by law. We do not warrant that scans will find every vulnerability or that the Service will be uninterrupted.

To the fullest extent permitted by law, Cantic Ltd is not liable for indirect, incidental, special, or consequential loss, or for loss of profits, revenue, data, or goodwill. Our total liability is limited to the greater of the amounts you paid us in the twelve months before the claim, or one hundred pounds (£100). Nothing limits liability that cannot be limited by law.

You will indemnify us against claims arising from your breach of these terms, including running scans on domains you were not authorized to test.

You can cancel your subscription at any time through the dashboard. We may suspend or end your access if you breach these terms. Sections that should survive termination do so, including intellectual property, disclaimers, limitation of liability, and indemnity.

We may update these terms as the product evolves. The “last updated” date reflects the current version. Continued use after a change means you accept it.

These terms are governed by the laws of England & Wales, and the courts of England & Wales have exclusive jurisdiction.

Questions about these terms can be sent to [email protected].