Definitions
Application. An AI agent, application, API, model, workflow, endpoint, system, or other technology added, connected, or submitted by the Customer to the Services.
Assessment. An automated or manual security evaluation conducted through the Services, including adversarial testing, red teaming, vulnerability testing, prompt injection testing, simulated attacks, and related analysis.
Attack. Any test case, payload, prompt, request, instruction, technique, attack vector, sequence, or configuration selected, defined, approved, uploaded, initiated, or scheduled by the Customer.
Application Data. Information supplied by, obtained from, or required to connect to an Application, including configurations, credentials, prompts, responses, files, and logs.
Assessment Data. Assessment inputs, outputs, evidence, findings, reports, scores, vulnerabilities, logs, and recommendations.
Services. Dwaar’s products, software, platform, APIs, documentation, assessments, and related services.
Licence and Permitted Use
Subject to these Terms, an applicable order form, and payment of fees, Dwaar grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable, and revocable right to access and use the Services during the applicable subscription or evaluation period for the Customer’s lawful internal business and security-testing purposes.
Customer Responsibility for Attacks and Consequences
Every Attack defined, selected, configured, uploaded, approved, initiated, or scheduled by the Customer is undertaken at the Customer’s sole responsibility and risk. The Customer is solely responsible for determining whether an Attack is appropriate for the relevant Application, environment, data, users, contractual obligations, and risk tolerance.
The Customer is solely responsible for all consequences arising from an Attack, including service interruption, latency, degraded performance, unexpected Application behavior, data modification, data corruption, data loss, security alerts, third-party usage charges, regulatory consequences, contractual claims, and third-party complaints or demands.
Before testing, the Customer must:
- Maintain current backups, recovery procedures, monitoring, access controls, and incident-response arrangements.
- Use a staging, isolated, or non-production environment wherever reasonably possible.
- Set appropriate scope, rate limits, timing, concurrency, credentials, and stop conditions.
- Inform affected personnel, vendors, customers, and service providers where required.
- Stop or pause an Assessment if continued testing may cause unacceptable harm.
Dwaar conduct carve-out. The allocation of responsibility in this section does not excuse Dwaar from liability to the extent directly caused by Dwaar’s wilful misconduct, gross negligence, or deliberate testing outside the Customer-approved scope.
Acceptable Use
The Customer must not, and must not permit another person to:
- Access, assess, attack, or interfere with a system without required authorization.
- Use the Services to cause unlawful harm, disruption, unauthorized access, surveillance, or data loss.
- Circumvent the Services’ access controls, security controls, usage limits, or account restrictions.
- Upload malware or content intended to compromise Dwaar, another customer, or a third party.
- Reverse engineer, copy, resell, sublicense, or commercially exploit the Services except as expressly permitted in writing.
- Remove proprietary notices or misrepresent Assessment results as a certification, guarantee, or regulatory approval.
Customer Name and Logo Licence
The Customer grants Dwaar a limited, non-exclusive, non-transferable, worldwide, royalty-free, and revocable licence to display the Customer’s name and logo solely on Dwaar’s website, customer list, presentations, and sales materials to identify the Customer as a Dwaar customer.
Dwaar will follow brand guidelines reasonably provided by the Customer, will not materially alter the logo, and will not imply an endorsement beyond the Customer’s use of the Services. A case study, testimonial, press release, quote, or detailed description of the Customer’s use requires separate written approval.
The Customer may revoke this logo licence by written notice. Dwaar will stop new uses and remove the name and logo from digital materials under its control within 10 business days. Removal from previously distributed, printed, or archived materials is not required, but Dwaar will not create new copies after revocation.
Customer Data and Privacy
The Customer retains ownership of its Application Data and Assessment Data. Dwaar will handle that information in accordance with the Privacy Policy, applicable customer agreements, and applicable law.
Dwaar will not sell, rent, publish, commercialize, or use Application Data or Assessment Data for advertising, unrelated commercial purposes, public benchmarking, or training general-purpose or third-party artificial intelligence models. Dwaar will not disclose such data except as stated in the Privacy Policy or with the Customer’s written authorization.
Confidentiality
Each party will protect the other party’s non-public business, technical, and security information using at least reasonable care and will use it only to perform or exercise rights under the applicable agreements. Customer credentials, Application Data, Assessment Data, architecture, vulnerabilities, and security findings are Customer confidential information whether or not marked confidential.
Confidentiality obligations do not apply to information that the receiving party can demonstrate was lawfully known without restriction, becomes public without breach, is independently developed without the confidential information, or is lawfully received from another source without restriction.
Intellectual Property
Dwaar and its licensors retain all rights in the Services, software, documentation, methodologies, attack libraries, templates, workflows, designs, and underlying technology. Except for the limited licence granted in these Terms, no rights are transferred to the Customer.
The Customer retains all rights in its Applications, Application Data, and Assessment Data. Dwaar may use feedback voluntarily provided by the Customer to improve the Services, provided the feedback does not contain Customer confidential information and does not identify the Customer.
Fees and Taxes
Fees, billing frequency, usage limits, payment terms, and taxes are stated in the applicable order form. Unless the order form states otherwise, fees are non-cancellable and non-refundable except where required by law. Overdue undisputed amounts may result in suspension after reasonable notice.
Assessment and Platform Limitations
The Services assist the Customer in identifying potential security weaknesses. Dwaar does not warrant that every vulnerability or unsafe behavior will be detected, that every finding is exploitable or free from false positives, that an Application is secure or compliant, or that Assessment results will remain accurate after the Application changes.
Assessment reports are security-testing inputs and are not legal advice, regulatory certification, compliance approval, or a guarantee that an Application will be free from incidents or attacks.
Warranty Disclaimer
To the maximum extent permitted by applicable law, the Services are provided on an "as available" basis. Except as expressly stated in an order form, Dwaar disclaims implied warranties of merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation.
Indemnification
The Customer will defend and indemnify Dwaar, its affiliates, and their personnel against third-party claims, penalties, losses, damages, and reasonable legal costs arising from the Customer’s lack of authority to test an Application; the Customer’s selection, configuration, approval, or use of an Attack; the Customer’s breach of these Terms; or the Customer’s violation of applicable law, contract, or third-party rights.
Dwaar will promptly notify the Customer of an indemnified claim, allow the Customer to control the defence and settlement, and provide reasonable cooperation at the Customer’s expense. The Customer may not settle a claim in a manner that admits fault by, imposes liability on, or requires non-monetary action from Dwaar without Dwaar’s written consent.
Limitation of Liability
To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, punitive, exemplary, or consequential damages, or for loss of profits, revenue, goodwill, business opportunity, or anticipated savings.
Except for Excluded Claims, each party’s total aggregate liability arising from or relating to the Services or these Terms will not exceed the fees paid or payable by the Customer to Dwaar during the 12 months preceding the event giving rise to liability.
"Excluded Claims" means fraud, wilful misconduct, gross negligence, breach of confidentiality or data-protection obligations, infringement of the other party’s intellectual-property rights, the Customer’s unauthorized testing of third-party systems, and indemnification obligations.
Suspension and Termination
Dwaar may suspend access immediately where the Customer uses the Services unlawfully, tests a system without authorization, creates a material security risk, fails to pay undisputed fees, or materially breaches these Terms. Where practicable, Dwaar will provide notice and a reasonable opportunity to cure.
Either party may terminate for an uncured material breach after 15 days’ written notice. Termination does not affect accrued payment obligations. Provisions concerning responsibility, confidentiality, data, intellectual property, indemnification, liability, and disputes survive termination.
Changes to the Services or Terms
Dwaar may modify the Services and may update these Terms. Material changes will be notified through the Services, by email, or by another reasonable method. Changes will apply prospectively from the stated effective date. If the Customer does not agree to a material change, it must stop using the Services and may exercise any termination right available under its order form.
Governing Law and Disputes
These Terms are governed by the laws of India, without regard to conflict-of-law principles. The parties will first attempt in good faith to resolve a dispute through authorized representatives for at least 30 days. Subject to any arbitration or dispute clause in an order form, the courts located in Pune, Maharashtra, India will have exclusive jurisdiction.
General Terms
These Terms, the Privacy Policy, the applicable order form, and any expressly incorporated data processing agreement constitute the entire agreement regarding the Services. If an order form expressly identifies and replaces a provision of these Terms, the order form controls for that provision.
The Customer may not assign these Terms without Dwaar’s written consent, except as part of a merger, reorganization, or sale of substantially all its assets. Dwaar may assign these Terms to an affiliate or successor. If a provision is unenforceable, it will be modified only to the minimum extent necessary, and the remaining provisions will continue in effect. A waiver must be in writing and applies only to the specific instance stated.
Notices and Contact
Dwaar legal notices: contact@dwaar.ai
Registered address: 8, Janki Apartments, Anand Nagar, Bhigwan Road, Baramati, Pune, Maharashtra 413102, India
Customer notices: The email address associated with the Customer account or stated in the order form.
Electronic Acceptance Record
The Customer acknowledges that electronic acceptance may be used to form this agreement. Dwaar may retain the accepted Terms version, timestamp, account identity, organization, IP address, and affirmative consent records as evidence of acceptance and testing authorization.
For clarity, Dwaar should obtain separate affirmative consent for (a) authorization to conduct Attacks and (b) the Customer name and logo licence.