EdgeBreach Terms of Use
Last updated: October 15, 2026
These Terms of Use (“Terms”) are a legal agreement between you and EdgeBreach, Inc., a Delaware corporation (“EdgeBreach,” “we,” “us”). They govern your access to and use of edgebreach.com, the EdgeBreach platform at app.edgebreach.com, and our related services (together, the “Service”).
Please read Section 3 (Authorization) and Section 6 (Acceptable Use) carefully. EdgeBreach is a penetration testing platform that actively attempts to exploit the systems you tell it to test. You may use it only against systems you are authorized to test.
By creating an account, clicking to accept these Terms, or using the Service, you agree to these Terms. If you are agreeing on behalf of a company or other organization, you represent that you have authority to bind that organization, and “you” means that organization. If you do not agree, do not use the Service.
1. Definitions
- “Account” means your registered account for the Service.
- “Authorized Target” means a system, application, network or asset that you have the legal right to test with the Service, as described in Section 3.
- “Customer Data” means data and content you or your users submit to or generate through the Service, including targets, configurations, credentials, code metadata, findings, evidence and reports.
- “Order” means an order form, online checkout or similar document that sets out your plan, fees and term.
- “Reports” means the reports the Service generates describing findings.
- “Users” means the individuals you allow to use the Service under your Account.
2. The Service and accounts
2.1 What the Service does
EdgeBreach performs automated, AI-driven penetration testing of Authorized Targets. Depending on your plan and configuration, this includes external (“black-box”) testing, authenticated and source-assisted (“white-box”) testing, discovery of your attack surface, attempts to exploit vulnerabilities and chain them into attack paths, collection of evidence, and reporting, including compliance-oriented reports.
2.2 Active exploitation
The Service does not merely scan. It attempts to exploit the weaknesses it finds, and it may escalate the depth of a test if it discovers useful information during the run, such as API documentation, site maps or credentials. The Service uses safeguards designed to avoid destructive, persistent or unsafe actions, but security testing carries inherent risk. You should run tests against a staging or pre-production environment with production-like data before testing production, and you are responsible for choosing what to test and when.
2.3 Accounts and users
To use the Service you must create an Account with accurate information and a business email address. You are responsible for your Account, for your Users, and for all activity under your Account. Keep credentials confidential, use multi-factor authentication where available, and tell us promptly at security@edgebreach.com if you suspect unauthorized access. You must be at least 18 and able to form a binding contract.
2.4 Changes to the Service
We may change, add or discontinue features of the Service. If a change materially reduces the core functionality of a paid plan during your term, we will give you reasonable notice.
2.5 No guarantee of results
Security testing has limits. We do not guarantee that the Service will find every vulnerability, or that your systems are secure after a test. The Service also reports findings it could not fully prove, with a confidence level, and you are responsible for reviewing and acting on results. You remain responsible for the security of your systems.
3. Authorization: you may only test what you are allowed to test
3.1 Your warranty
This is an essential term. Each time you test a target, you represent and warrant that:
(a) you own or control the target; or you have explicit, current authorization from the owner to conduct security testing of it; and
(b) your testing complies with all applicable laws and with any third-party terms that apply, including the penetration-testing policies of any cloud or hosting provider.
3.2 Testing for your clients (agencies, consultants and MSPs)
If you use the Service to test applications or systems belonging to your clients, you additionally represent and warrant that:
(a) you have your client’s written authorization to conduct security testing of the specific systems you test, and your engagement with the client permits you to use a third-party tool such as EdgeBreach to do so;
(b) you are responsible for your use of the Service for that client, including defining the correct scope and honoring any limits the client sets; and
(c) you may share Reports with the client the Report concerns. You are responsible for how your clients use Reports you share with them. EdgeBreach has no agreement with, and no responsibility to, your clients unless we agree otherwise in writing.
Reselling, white-labeling or offering the Service to third parties as a service requires a separate written agreement with us (see Section 4).
3.3 Authorization records
When you confirm authorization in the Service, we record that confirmation, including the user, time and scope. You agree to keep your own records of authorization for each target and to provide them to us on reasonable request. Unauthorized testing of computer systems can violate law, including the U.S. Computer Fraud and Abuse Act (18 U.S.C. § 1030) and state laws. You, not EdgeBreach, are responsible for ensuring you are authorized.
3.4 Cloud and hosting providers
If a target is hosted by a third party (for example, AWS, Azure or Google Cloud), you are responsible for following that provider’s testing rules and getting any approvals they require.
4. Agencies, resellers and partners
Agencies, consultants and managed service providers may use the Service to test their own clients’ systems under Section 3.2, under their own subscription, with each client’s authorization. Reselling or white-labeling the Service, or billing your own clients for access to it, is allowed only under a separate written partner or reseller agreement with EdgeBreach. Without that agreement, you may not resell, sublicense, or provide the Service to any third party, or let anyone who is not your User access it.
5. Plans, trials, fees and renewals
5.1 Plans and Orders
Your plan, fees, billing cadence and term are set out in your Order (including online checkout). Current list pricing is on our website and may change. Where an Order and these Terms conflict, the Order controls for that subscription.
5.2 Free trials and pilots
We may offer a free trial or pilot. Trials and pilots are provided “as is,” may be limited or changed, and may be ended at any time. Unless we agree otherwise in writing for a specific pilot, trial and pilot accounts may not be used to test production systems that serve real end users. If you do not become a paying customer, we may delete trial and pilot data as described in our Privacy Policy.
5.3 Fees and payment
You agree to pay the fees in your Order. Unless your Order says otherwise, subscriptions are billed in advance: monthly plans each month, and annual plans for the full term at the start of the term. Fees are non-refundable except as these Terms expressly state. You authorize us and our payment processor to charge your payment method on file.
5.4 Taxes
Fees do not include taxes. You are responsible for all taxes other than taxes on EdgeBreach’s income.
5.5 Late payment
If a payment is overdue, we may suspend the Service after reasonable notice until you pay, and we may charge interest on overdue amounts at 1.5% per month or the maximum the law allows, whichever is lower.
5.6 Price changes
We may change fees for a renewal term by giving at least 30 days’ notice before the renewal.
5.7 Term, renewal and cancellation
Each subscription runs for the term in your Order.
- Month-to-month plans renew each month until you cancel. You can cancel at any time, effective at the end of the current monthly period, through the app or by contacting us.
- Term plans (for example, annual) renew automatically for successive periods of the same length unless you or we give notice of non-renewal at least 30 days before the current term ends.
Canceling stops future charges. Except where these Terms require a refund, fees already paid are not refunded, and canceling does not entitle you to a refund for the current period.
6. Acceptable Use Policy
This Acceptable Use Policy is part of these Terms. Breaking it is a material breach and can lead to immediate suspension or termination without a refund.
6.1 The core rule
Only use the Service against systems you are authorized to test (Section 3). Do not use it to cause harm. Handle any data you encounter responsibly.
6.2 You must not
(a) test any system you are not authorized to test, or go beyond the scope or time of your authorization;
(b) use the Service to break any law or to help anyone else do so;
(c) use the Service to launch denial-of-service attacks, deploy malware or ransomware, destroy or alter data beyond what is needed to demonstrate a vulnerability, or otherwise intentionally damage a system;
(d) test in a way that you know will affect uninvolved third parties or shared infrastructure without their authorization (for example, other tenants of a shared system);
(e) attempt to disrupt, overload, reverse engineer, decompile, or extract the source code of the Service, or circumvent its access controls, usage limits or safety mechanisms;
(f) use the Service to build a competing product, or resell or provide it to others except as Section 4 allows;
(g) upload material you have no right to upload, or infringe anyone’s intellectual property or privacy rights; or
(h) share your Account, or let anyone who is not an authorized User access the Service.
6.3 Especially sensitive targets
Some targets need extra care and additional authorization, including healthcare systems subject to HIPAA, financial and payment systems, government systems, and critical infrastructure. Do not use the Service against systems where testing could endanger human safety, such as emergency services, medical devices or industrial safety systems.
6.4 Responsible testing
Stay within your authorized scope. Stop if you reach a system you did not intend to test, and report it to the owner. Collect only the minimum data needed to demonstrate a vulnerability. If you discover real credentials or sensitive data, report them to the system owner and do not misuse them.
6.5 Enforcement
We may investigate suspected violations and may suspend or terminate access for violations, particularly of Sections 3 and 6. We may remove or disable access to content or configurations that we reasonably believe violate these Terms or the law. We may report suspected illegal activity to law enforcement and cooperate with lawful investigations. To report abuse of the Service, email security@edgebreach.com.
6.6 Suspension
We may suspend the Service immediately if we reasonably believe it is necessary to prevent harm, protect the Service or others, address a serious violation, or comply with law. We will try to give notice where practical.
7. Customer Data and intellectual property
7.1 Your data
As between you and us, you own your Customer Data and your Reports. You grant us a limited license to host, process and use your Customer Data to provide, secure, support and (as described in our Privacy Policy) improve the Service. You are responsible for your Customer Data and for having the rights needed to give it to us, including for the systems you test and any data in them.
7.2 Your reports
Reports are yours. You may use, modify and share them, subject to Section 3.2 where they concern a client.
7.3 Our intellectual property
We and our licensors own the Service, including its software, models, know-how and trademarks. We grant you a limited, non-exclusive, non-transferable right to use the Service during your term under these Terms. We reserve all rights we do not expressly grant.
7.4 Source code
If you provide source code for white-box testing, we analyze it in a temporary environment and do not store it. We keep only metadata derived from the analysis, and we do not use your source code to train any model. See our Privacy Policy for details.
7.5 Learning from testing and de-identified data
We may use de-identified information about proven vulnerabilities and techniques to improve our models and the Service, as described in our Privacy Policy. This information does not identify you, your clients, your targets or any individual, and we do not use source code or credentials for it.
7.6 Feedback
If you give us feedback or suggestions, we may use them without obligation to you.
8. Confidentiality
Each party may receive the other’s non-public information that should reasonably be understood to be confidential. Your Customer Data and Reports are your confidential information; the non-public parts of the Service are ours. Each party will use the other’s confidential information only to perform under these Terms, protect it with reasonable care, and not disclose it except to people who need it and are bound by similar obligations, or as required by law (with notice where allowed). These obligations do not apply to information that is public through no fault of the receiver, was already known, is independently developed, or is rightfully received from someone else.
9. Third-party services
The Service works with third-party services you choose to connect, such as GitHub, Jira and Slack. Your use of those services is governed by their terms, and we are not responsible for them. You are responsible for the connections you authorize.
10. Disclaimers
The Service is provided “as is” and “as available.” To the fullest extent the law allows, EdgeBreach disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted or error-free, that it will find all vulnerabilities, or that your systems will be secure after testing. You are responsible for how you configure and use the Service and for acting on its results.
11. Limitation of liability
To the fullest extent the law allows:
(a) Neither party is liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, revenue, data or business, even if advised such damages were possible.
(b) Each party’s total liability arising out of or relating to these Terms and the Service will not exceed the fees you paid us in the 12 months before the event giving rise to the liability. For free trial and pilot users, EdgeBreach’s total liability will not exceed US$100.
(c) These limits do not apply to: your breach of Section 3 (Authorization), Section 4 (reselling without agreement) or Section 6 (Acceptable Use); your indemnification obligations; either party’s breach of its confidentiality obligations; your payment obligations; or liability that cannot be limited by law.
These limits apply even if a remedy fails of its essential purpose, and they reflect the allocation of risk between us.
12. Indemnification
You will defend, indemnify and hold harmless EdgeBreach and its officers, directors, employees and agents from any third-party claim, and any resulting losses, damages and reasonable legal fees, arising out of:
(a) your use of the Service in breach of these Terms;
(b) your breach of Section 3 (Authorization), including any claim that you tested a system without proper authorization;
(c) your Customer Data or your Authorized Targets, including claims by your clients or by people whose data is in the systems you test; or
(d) your violation of law.
We will notify you of the claim, let you control the defense (so long as any settlement fully releases us and imposes no obligation on us without our consent), and cooperate reasonably at your expense.
13. Term and termination
These Terms apply while you use the Service and for as long as you have an Account. Either party may terminate for the other’s material breach that is not cured within 30 days of notice; breaches of Sections 3 or 6 may be grounds for immediate termination. We may terminate or suspend immediately if required by law or to prevent harm. On termination, your right to use the Service ends, and you have 30 days to export your Customer Data before we delete it as described in our Privacy Policy. Sections that by their nature should survive termination will survive, including Sections 7, 8, 10, 11, 12 and 14.
14. Governing law and disputes
14.1 Governing law
These Terms are governed by the laws of the State of Indiana, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
14.2 Courts and venue
The state and federal courts located in Marion County, Indiana have exclusive jurisdiction over any dispute arising out of or relating to these Terms or the Service, and each party consents to personal jurisdiction and venue there. Each party waives any right to a jury trial.
14.3 Informal resolution first
Before filing anything, the parties will try to resolve a dispute informally for 30 days after written notice to legal@edgebreach.com.
14.4 Injunctive relief
Either party may seek injunctive relief in those courts to protect its intellectual property or confidential information.
15. General
15.1 Export and sanctions
You represent that you are not located in, or a resident or national of, any country or region subject to U.S. embargo or comprehensive sanctions, and that you are not on any U.S. government restricted-party list. You will not use the Service in violation of U.S. export or sanctions laws.
15.2 Assignment
You may not assign these Terms without our consent. We may assign them to an affiliate or in connection with a merger, acquisition or sale of assets. These Terms bind permitted successors and assigns.
15.3 Notices
We may send notices to the email on your Account; you are responsible for keeping it current. Send legal notices to us at legal@edgebreach.com and at the address below.
15.4 Entire agreement; order of precedence
These Terms and our Privacy Policy, together with any Order, are the entire agreement between you and us about the Service and replace any prior agreement on this subject. If there is a conflict, a signed Order controls over these Terms, and these Terms control over the Privacy Policy, each only to the extent of the conflict.
15.5 Changes to these Terms
We may update these Terms. We will post the updated version and change the “Last updated” date, and for material changes we will give notice by email or in the app at least 30 days before they take effect, unless a change must take effect sooner to comply with law. Using the Service after the changes take effect means you accept them.
15.6 Miscellaneous
If any provision is unenforceable, the rest stay in effect. Our failure to enforce a provision is not a waiver. Neither party is liable for delays caused by events beyond its reasonable control. These Terms do not create any agency, partnership or joint venture, and there are no third-party beneficiaries.
16. Contact
EdgeBreach, Inc.
5255 Winthrop Avenue, Suite 135
Indianapolis, IN 46220
General and legal notices: legal@edgebreach.com
Security and abuse reports: security@edgebreach.com
By using the Service, you acknowledge that you have read and agree to these Terms of Use.