Terms of Service

2.1. Ordering Process

Access to paid Services is purchased under an Order identifying the plan, features, usage allowances, Subscription Term, Fees, and additional terms. Customer may purchase additional Services or usage through another Order or account selection.

2.2. Permitted Use

During a Subscription Term and subject to this Agreement, Customer may use the Services for internal defensive-security, vulnerability-management, software-risk, research, and related business purposes in accordance with the Documentation and applicable Order.

2.3. Users

Only authorized Users may access non-public Services using designated login credentials, API keys, OAuth tokens, or other authentication mechanisms (collectively, "Credentials"). Users must keep Credentials confidential. Customer is responsible for its Users' compliance and activity, except to the extent caused by Zero's breach, and will promptly report suspected compromise.

2.4. Restrictions

Customer will not: (a) sell, sublicense, or provide the Services to a third party except as permitted by an Order; (b) use substantial catalog extraction to create a competing vulnerability-data service; (c) reverse engineer non-public code or APIs except as permitted by law; (d) remove proprietary notices or required attribution; (e) circumvent rate limits or access controls; (f) interfere with operation or transmit malicious code; (g) use the Services to gain unauthorized access, conduct unauthorized attacks, facilitate harm, or violate law; or (h) represent unvalidated Outputs as verified. Good-faith testing of systems Customer owns or is authorized to test is permitted.

4.1. Use of Customer Data

Customer grants Zero a non-exclusive, worldwide license to Process Customer Data only as needed to provide and secure the Services, perform integrations, generate Outputs, provide support, comply with law, derive Usage Data, and create Aggregated Data. Zero will not use Customer Data to train a third-party general-purpose large language model unless Customer expressly directs that use under applicable provider terms.

4.2. Security

Zero will maintain reasonable administrative, technical, and organizational safeguards designed to protect Customer Data against unauthorized access, disclosure, destruction, alteration, accidental loss, misuse, or damage. No system is completely secure.

4.3. CCPA

To the extent Zero Processes personal information subject to the California Consumer Privacy Act on Customer's behalf, Zero acts as a service provider or contractor, will not sell or share that information, and will Process it only for the business purposes in this Agreement, an Order, and any applicable data processing addendum.

4.4. Usage Data; Aggregated Data

Zero may Process Usage Data and Aggregated Data for lawful purposes including billing, support, security, abuse prevention, monitoring, analytics, benchmarking, and product improvement. Aggregated Data will not reasonably identify Customer or an individual.

4.5. Public Security Data

Public and third-party security data may be subject to publisher licenses, attribution requirements, usage limits, and other terms. Zero may retain source records and provenance, display attribution, and link to original artifacts. Customer is responsible for source terms when exporting, redistributing, or independently using that data.

10.1. Subscription Term

Initial and renewal Subscription Terms are stated in the Order. Unless stated otherwise, a paid subscription renews for periods equal to its initial term until either party gives notice before renewal. Free or usage-based Services continue until terminated under this Agreement.

10.2. Fees and Taxes

Customer will pay Fees and usage charges stated in each Order in U.S. dollars unless otherwise stated. Fees are non-refundable except as expressly provided. Customer is responsible for sales, use, value-added, withholding, and similar taxes, excluding taxes on Zero's net income. Overdue undisputed amounts may accrue interest at the lesser of 1.5% monthly or the maximum lawful rate.

11.1. Customer Representations, Warranties, and Covenants

Customer represents it has authority to enter this Agreement; owns Customer Data or has sufficient rights to provide it; is authorized to configure each target, repository, integration, workspace, and testing scope; and will use the Services and Outputs in compliance with law and third-party rights.

11.2. Disclaimers

THE SERVICES, PUBLIC SECURITY DATA, IMPLEMENTATION SERVICES, AND OUTPUTS ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, ZERO DISCLAIMS ALL EXPRESS, IMPLIED, AND STATUTORY WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

Security information may be incomplete, delayed, conflicting, stale, or inaccurate. Scores, exploitation signals, affected-software matches, zero-day classifications, remediation guidance, search results, and agent findings are informational and do not replace Customer's security assessment or judgment. Probabilistic models may produce inaccurate Outputs. Customer must validate Outputs and determine whether action is safe. Zero does not warrant uninterrupted operation, complete source coverage, detection of every vulnerability or exploit, or preservation of Customer Data without loss.

12.1. Term

This Agreement begins on its effective date and continues until all Subscription Terms and Orders expire or are terminated.

12.2. Termination

Either party may terminate for a material breach not cured within 30 days after written notice, or immediately if the other party ceases business, becomes insolvent, or enters bankruptcy proceedings not dismissed within 60 days. Zero may terminate free Services on reasonable notice.

12.3. Effect

On termination, Customer's right to use terminated Services ends and outstanding Fees become due. On a timely request, Zero will provide a commercially reasonable opportunity to export Customer Data where an export is available, then may delete it subject to legal, security, backup, and record-retention requirements. Public Security Data and deidentified data are not subject to Customer export or deletion rights.

12.4. Survival

Provisions that by their nature should survive will survive, including payment, restrictions, disclaimers, ownership, liability limits, indemnification, confidentiality, and general terms.

14.1. Consequential Damages Waiver

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR LOST PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THEIR POSSIBILITY.

14.2. Liability Cap

EACH PARTY'S TOTAL AGGREGATE LIABILITY WILL NOT EXCEED FEES PAID OR PAYABLE FOR THE AFFECTED SERVICES DURING THE 12 MONTHS BEFORE THE EVENT. FOR FREE SERVICES, ZERO'S TOTAL LIABILITY WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS.

14.3. Excluded Claims

Section 14.2 does not apply to Customer payment obligations, indemnification obligations, breach of confidentiality, Customer's violation of Sections 2.4 or 13, or liability that cannot lawfully be limited.

14.4. Nature of Claims and Essential Purpose

The limitations apply regardless of form of action and even if a limited remedy fails of its essential purpose. The parties rely on this allocation of risk.

15.1. By Zero

Zero will defend Customer from a third-party claim that authorized use of paid Services infringes a U.S. patent, copyright, or trademark, and indemnify Customer against finally awarded or settled damages and reasonable costs, subject to Sections 15.3 through 15.6.

15.2. By Customer

Customer will defend and indemnify Zero and affiliates from third-party claims arising from Customer Data, Prompts, Customer Systems, unauthorized testing, violation of Sections 2.4 or 5, or Customer's use of Services or Outputs in violation of law or third-party rights.

15.3. Procedures

The indemnified party must promptly notify the indemnifying party, reasonably cooperate at its expense, and allow it to control defense and settlement. No settlement may admit fault by or impose non-monetary obligations on the indemnified party without consent.

15.4. Mitigation

For a likely infringement claim, Zero may obtain continued-use rights, modify or replace the Service, or terminate it and refund prepaid Fees for the unused affected term.

15.5. Exceptions

Zero has no obligation for claims resulting from Customer Data, Third-Party Platforms, Customer modifications, unsupported combinations, continued use after notice, use contrary to Documentation, or free, trial, or beta Services.

15.6. Exclusive Remedy

This Section states the parties' exclusive remedies and obligations for covered third-party intellectual-property claims.

16.1. Definition

"Confidential Information" means non-public information identified or reasonably understood as confidential, including Customer Data, non-public product or security information, business plans, and Order terms. Public Security Data is not Confidential Information merely because it is accessible through the Services.

16.2. Obligations

The receiving party will use Confidential Information only under this Agreement, protect it with at least reasonable care, and disclose it only to personnel, affiliates, contractors, and advisers who need it and are bound by protective confidentiality obligations.

16.3. Exclusions

Confidential Information excludes information lawfully known without restriction, public through no breach, lawfully received from a third party without duty, or independently developed without use of the disclosed information.

16.4. Remedies

Unauthorized use or disclosure may cause irreparable harm. A party may seek equitable relief in addition to other remedies.

20.1. Assignment

Neither party may assign this Agreement without consent, except to an affiliate or with a merger, reorganization, acquisition, or sale of substantially all relevant assets if the assignee assumes the obligations and is not a direct competitor.

20.2. Governing Law, Jurisdiction, and Venue

Unless an Order states otherwise, Delaware law governs without conflict-of-law rules. State and federal courts in San Francisco County, California have exclusive jurisdiction, and each party consents to venue. The U.N. Convention on Contracts for the International Sale of Goods does not apply.

20.3. Attorneys' Fees and Costs

A prevailing party in an action to enforce this Agreement may recover reasonable attorneys' fees and costs where permitted by law.

20.4. Notices

Notices must be in writing. Notices to Customer may go to the account or Order contact. Notices to Zero may be sent to support@zdlake.com. Email notice is effective the next business day unless delivery fails.

20.5. Entire Agreement

This Agreement, Orders, incorporated policies, and applicable data processing addenda are the entire agreement about the Services and supersede prior or contemporaneous agreements on that subject.

20.6. Amendments

A negotiated Agreement or Order may be amended only in a signed writing. Zero may update online terms for future Orders or free Services with notice where required. Material changes will not retroactively reduce contracted rights in a current paid term unless required by law or agreed by Customer.

20.7. Waivers and Severability

A waiver must be written and limited to the specific instance. If a provision is unenforceable, it will be modified minimally and the remainder stays effective.

20.8. Force Majeure

Neither party is liable for delay caused by events beyond reasonable control, including disasters, war, labor disputes, utility or internet failures, cloud-provider outages, government action, epidemics, or widespread cyberattacks, except Customer's payment obligations.

20.9. Subcontractors

Zero may use subcontractors and service providers and remains responsible for their performance to the same extent as its own under this Agreement.

20.10. Independent Contractors

The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, fiduciary, agency, or employment relationship.

20.11. Export

Customer will comply with export-control and sanctions laws and will not permit access by prohibited persons or from prohibited territories.

20.12. Open Source

Software included under an open-source license is governed by that license to the extent it conflicts with this Agreement. Zero will provide required notices.

20.13. Government End-Users

The Services are commercial computer software and documentation. Government users receive only the rights granted under this Agreement and applicable law.

20.14. Conflicts in Interpretation

An Order controls only if it expressly identifies the provision overridden, followed by a data processing addendum, this Agreement, and Documentation. Headings are for convenience only.