Terms of Service

Cantic is operated by Cantic Ltd, a company registered in England & Wales (Company No. 17165585) (“Cantic”, “we”, “us”). These terms govern your use of the Cantic security testing service, dashboard, and reports (together, the “Service”). By running a scan or subscribing, you agree to them. If you use the Service for an organisation, you confirm you are authorised to accept these terms on its behalf.

Cantic is an AI-powered security testing tool. You enter a domain; our AI agent attempts to find vulnerabilities by simulating attacks; you receive a report showing what it tried, what worked, and how to fix it. The agent uses read-only tools and cannot modify, delete, or exfiltrate actual data from your application.

You must be authorized to test any domain you submit. The free first scan requires your attestation that you have this authorization. Recurring scans on a paid subscription require verification of domain ownership (DNS record or file upload). You are solely responsible for ensuring you have proper authorization before running any scan.

• You must have proper authorization to test any domain you submit.
• You are responsible for implementing the fixes Cantic recommends; we provide guidance, not remediation.
• You must keep your dashboard credentials secure.
• You must not use Cantic to test applications you do not own or have written permission to test.
• You must comply with all applicable laws.

You must not:

• submit domains you are not authorized to test;
• use Cantic to attack, disrupt, or harm any system;
• attempt to access other users’ accounts or data;
• probe, disrupt, or overload Cantic’s infrastructure;
• reverse engineer or resell the Service; or
• use false attestations to bypass authorization checks.

We may suspend access to protect the Service or other users.

Our AI agent tests your application by attempting reconnaissance, authentication attacks, injection testing, and infrastructure checks. All tools are read-only: the agent observes responses but cannot modify your application, delete data, or exfiltrate real information. Scans are rate-limited and sandboxed.

Scan reports show what the agent tried, what succeeded, and how to fix it. Reports include copy-paste remediation guidance specific to your stack. You can export reports as PDFs for compliance or sharing. Reports are retained per the Privacy Policy.

The first scan is free. Paid plans are billed monthly or annually as shown at checkout. You can cancel at any time; cancellation stops future charges but does not refund the current billing period. We may change pricing with 30 days’ notice.

We own the Service and its software. You own your applications and the data in your scan reports. You grant us the limited rights needed to operate the Service: to test the domains you submit and generate reports.

Cantic helps you find vulnerabilities, but no security testing is exhaustive. A clean report does not guarantee your application is secure. New vulnerabilities can appear with each deploy, which is why we offer continuous weekly or daily scanning.

The Service is provided “as is” and “as available” without warranties of any kind, to the fullest extent permitted by law. We do not warrant that scans will find every vulnerability or that the Service will be uninterrupted.

To the fullest extent permitted by law, Cantic Ltd is not liable for indirect, incidental, special, or consequential loss, or for loss of profits, revenue, data, or goodwill. Our total liability is limited to the greater of the amounts you paid us in the twelve months before the claim, or one hundred pounds (£100). Nothing limits liability that cannot be limited by law.

You will indemnify us against claims arising from your breach of these terms, including running scans on domains you were not authorized to test.

You can cancel your subscription at any time through the dashboard. We may suspend or end your access if you breach these terms. Sections that should survive termination do so, including intellectual property, disclaimers, limitation of liability, and indemnity.

We may update these terms as the product evolves. The “last updated” date reflects the current version. Continued use after a change means you accept it.

These terms are governed by the laws of England & Wales, and the courts of England & Wales have exclusive jurisdiction.

Questions about these terms can be sent to team@cantic.ai.