Terms of Service

These Terms of Service ("Terms") govern your access to and use of Xfence, the security-testing platform engineered by Vrseclabs (the "Service"). By creating an account or otherwise using the Service, you agree to be bound by these Terms.

1. Acceptance of Terms

By registering for or using Xfence, you confirm that you have read, understood, and agree to these Terms and our Privacy Policy. If you're accepting these Terms on behalf of an organization, you represent that you have the authority to bind that organization.

2. Description of Service

Xfence connects organizations that want their applications, infrastructure, and other assets security-tested with vetted independent security researchers. Xfence publishes each engagement with a defined scope, dates, and do's and don'ts, and assigns researchers to it. Each assigned researcher must accept terms and a non-disclosure agreement for that engagement before seeing its scope. Researchers then file vulnerability reports, which the organization can follow on its dashboard.

3. Account Registration & Eligibility

• You must be at least 18 years old to use the Service
• Access requires an approved application and, for researchers, a manual vetting review
• You are responsible for maintaining the confidentiality of your credentials and for all activity under your account
• Information you provide during registration must be accurate and kept up to date

4. User Roles & Responsibilities

Organizations

Organizations are responsible for giving us an accurate and lawful scope, for triaging reports in good faith and in a reasonable timeframe, and for only asking us to test systems they are authorized to have tested.

Researchers

Researchers are responsible for staying strictly within the defined scope and rules of engagement, testing in good faith, submitting clear and accurate reports, and complying with our Acceptable Use & Responsible Disclosure Policy at all times.

5. Rules of Engagement & Scope

Every engagement has a defined scope, set of in-scope assets, and rules of engagement established by the organization. Testing outside the defined scope, or in violation of the stated rules, is strictly prohibited and constitutes a material breach of these Terms, regardless of intent.

6. Engagements, Assignment & Fees

• Xfence decides which researchers are assigned to an engagement; a researcher cannot join one without an assignment
• Report decisions (valid, invalid, duplicate) are made by Xfence and the organization triaging the report, at their reasonable discretion
• Fees for engagements, and any arrangement with researchers, are agreed separately with Xfence and are not set out on this page

7. Confidentiality & NDA

All users agree to keep all information related to any assessment strictly confidential. Each researcher also signs a non-disclosure agreement written for the specific engagement and its sensitivity level, and Xfence keeps a signed copy. Confidential information includes application details, vulnerabilities discovered, source code, credentials, network topology, and any other data encountered during testing. Disclosure of assessment-related information to third parties without explicit written consent is prohibited and may result in immediate account termination and legal action.

8. Intellectual Property

Xfence and its licensors retain all rights, title, and interest in the platform itself. Vulnerability reports and related work product submitted by a researcher for a specific engagement are licensed to the receiving organization for the purpose of remediation, subject to the confidentiality obligations above.

9. Prohibited Conduct

• Testing any asset outside an authorized engagement's defined scope
• Denial-of-service attacks, or any testing that degrades service availability for others
• Accessing, modifying, or exfiltrating data beyond what's needed to demonstrate a vulnerability
• Social engineering, phishing, or physical-security testing unless explicitly authorized in scope
• Publicly disclosing a vulnerability before the organization has remediated it and given consent
• Circumventing platform access controls, or misrepresenting your identity or affiliation

10. Termination

We may suspend or terminate your account at any time for violation of these Terms, the Acceptable Use & Responsible Disclosure Policy, or applicable law. You may close your account at any time by contacting us. Confidentiality obligations survive termination.

11. Disclaimers & Limitation of Liability

The Service is provided "as is" without warranties of any kind, express or implied. Xfence facilitates connections between organizations and researchers but is not a party to, and does not guarantee the outcome of, any individual engagement. To the maximum extent permitted by law, Xfence's aggregate liability arising from your use of the Service will not exceed the amount you paid us in the twelve months preceding the claim.

12. Indemnification

You agree to indemnify and hold Xfence and Vrseclabs harmless from any claims, damages, or expenses arising from your breach of these Terms, your violation of any law, or your infringement of any third-party right.

13. Governing Law

These Terms are governed by applicable law in the jurisdiction in which Vrseclabs operates, without regard to conflict-of-law principles, unless otherwise required by mandatory local law.

14. Changes to These Terms

We may revise these Terms from time to time. Material changes will be reflected by an updated "Last updated" date above. Continuing to use the Service after changes take effect constitutes acceptance of the revised Terms.

15. Contact

Questions about these Terms? Reach us at security@vrseclabs.in.