Terms of Service

These Terms govern access to and use of kotavlabs.com and the Kotav Labs platform (the "Service") provided by Kotav International — business and assets, Lda. ("Kotav", "we"). By creating an account or otherwise using the Service, you ("Customer") agree to be bound by these Terms.

If you are accepting on behalf of an organisation, you represent that you have authority to bind that organisation. Throughout these Terms, "you" includes that organisation.

The Service provides fixed-scope security discovery, application penetration testing, recurring security validation and compliance-readiness assessments through the Kotav Labs platform, the argus assessment engine and associated tooling. Kotav does not provide an accredited certification unless expressly stated in an Order. Specific deliverables and exclusions are governed by the Order Form or Master Services Agreement (collectively, "Order").

You shall not, and shall not permit any third party to:

• scan, probe, or test any system without current, written, unrevoked authorisation from the system's lawful owner;
• conduct denial-of-service or resource-exhaustion attacks;
• exfiltrate personal data, payment data, health data, or other regulated data beyond the minimum required to demonstrate a finding;
• use the Service to develop a competing product;
• reverse-engineer or decompile components of the Service, except where permitted by mandatory law;
• share account credentials, or allow more concurrent users than the seats you have paid for.

Unauthorised scanning is a criminal offence in most jurisdictions (Portugal Lei n.º 109/2009; UK Computer Misuse Act 1990; US 18 U.S.C. § 1030; the Convention on Cybercrime). You alone bear the consequences.

Fees are stated in your Order. Currency is EUR unless otherwise agreed. Invoices are Net 30; overdue amounts accrue interest at the higher of 1.5% per month or the maximum permitted by Portuguese law. Fees are exclusive of VAT and other taxes, which are added at the applicable rate.

Subscription Orders auto-renew at the end of each term unless either party gives the other written notice of non-renewal at least 30 days before the end of the then-current term.

You retain all rights in data you submit to or generate through the Service (scan results, findings, evidence, configurations) — "Customer Data". We process Customer Data only to provide the Service and as permitted by the Data Processing Addendum.

Each party shall protect the other's Confidential Information with reasonable care and for at least five (5) years following disclosure, save for trade secrets which are protected for as long as they remain trade secrets under applicable law.

Availability target: 99.5% monthly uptime for the platform control plane. Scan execution: best-effort within the agreed window. Specific SLAs (e.g. P1 response times) are set out in the Order or the OEM Agreement for distributor partners.

Included retest: Website Pentest Orders include one retest of confirmed findings submitted within 14 days. Web Application Pentest, Focused Validation and Full Application Pentest Orders include one retest of reported fixes submitted within 30 days of report delivery. Argus Sentinel includes only the retests expressly listed in its Order.

Reports include remediation recommendations for the Customer's implementation team. Kotav does not implement fixes or provide remediation services unless the parties enter into a separately negotiated consulting Order.

Kotav warrants that the Service will be provided with reasonable skill and care. The Service is otherwise provided "as is" and "as available". To the maximum extent permitted by law we disclaim all implied warranties, including merchantability, fitness for a particular purpose, and any warranty that the Service will detect all vulnerabilities in any target. The Service is a tool — no tool replaces qualified human security judgement.

To the maximum extent permitted by mandatory applicable law, each party's aggregate liability arising out of or relating to these Terms or the Service shall not exceed the fees actually paid by Customer to Kotav in the twelve (12) months preceding the event giving rise to the claim. Neither party shall be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, including lost profits, lost data, or business interruption.

Nothing in these Terms limits liability for (i) death or personal injury caused by negligence; (ii) fraud or fraudulent misrepresentation; (iii) breach of confidentiality; or (iv) any other liability that cannot be excluded under applicable law.

Kotav shall defend Customer against third-party claims that the Service, as delivered and unmodified, infringes a third-party intellectual-property right, and pay damages finally awarded, subject to prompt notice and Kotav's sole control of defence.

Customer shall defend Kotav against third-party claims arising from Customer's breach of Section 3 (Acceptable Use) or from any damage caused to a target arising from Customer's use of the Service.

These Terms are effective until terminated. Either party may terminate for material breach uncured within 30 days of written notice. Kotav may suspend the Service immediately for breach of Section 3, non-payment past 60 days, or where suspension is necessary to protect the Service.

On termination: you cease use of the Service; we provide a 30-day window to export Customer Data; both parties return or destroy Confidential Information.

These Terms are governed by the laws of Portugal, excluding its conflict-of-laws rules. The parties shall first attempt to resolve disputes through good-faith negotiation between named senior executives for 30 days. Unresolved disputes are subject to the exclusive jurisdiction of the courts of Lisbon, Portugal, save that Kotav may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property.

We may update these Terms from time to time. Material changes will be notified by email with at least 30 days' notice. Continued use after the effective date constitutes acceptance.

Kotav International — business and assets, Lda. · Lisbon, Portugal
Commercial: global@kotav.org · Legal: global@kotav.org · Security: global@kotav.org