Terms of Use

HOW THIS PLATFORM WORKS

We are available to answer any questions by e-mail at contato@vulnera.io.

1) What do we do?

Vulnera is an automated security analysis platform. Through it, the User registers digital assets they own (web applications, APIs, infrastructure assets, and code repositories) and runs scans that identify possible vulnerabilities, presenting technical evidence, severity classification, and remediation recommendations.

2) How does our platform work?

The User creates an account, which gives rise to an Organization, registers a Target, proves ownership of that Target, and triggers the analysis. At the end, the User accesses the findings with technical evidence, severity, CVE identifier, and CVSS score, generates and exports reports, creates schedules, integrates the analysis into their CI/CD pipeline, and can connect artificial intelligence assistants through our MCP server.

You may only scan what is yours or what you are expressly authorized to test. Running security tests against third-party systems without authorization is unlawful and may constitute a crime. For that reason, we require proof of ownership of the Target and, in Attack Mode, express authorization for each scan. Responsibility for that declaration rests entirely with the User.

3) Is the use of our platform paid?

We offer limited free use and a paid subscription. Prices are always available before you subscribe. The subscription can be paid by card (including through Apple Pay and Google Pay), with Link, or by Boleto. To process payments, your data is sent to and transmitted through the independent Stripe platform, which is responsible for processing the financial transactions. We do not have access to your card data, and we use this third-party platform precisely to ensure the security of transactions. When paying by Boleto, the plan is only activated after the payment clears. We recommend reading Stripe's Terms of Use and Privacy Notice.

4) Can these terms be changed?

Our Terms of Use may change, but you can always access the most up-to-date version on the platform. If we are going to take any action that the law requires your authorization for, you will receive a notice beforehand so you can accept or decline.

5) What happens to personal data?

We have a Privacy Notice that addresses what we do with your personal data. It is very important that you read and understand that document as well.

6) What is the content of the Terms of Use?

The Terms of Use below are divided as follows to make it easier for you to access the information:

• Effective date of the text;
• Explanation of technical terms or terms in a foreign language;
• Services;
• Registration of Users, Organization, and Access Profiles;
• Targets, Proof of Ownership, and Authorization for Tests;
• Attack Mode;
• Usage Limits;
• Integrations, Credentials, and Artificial Intelligence Features;
• Payment, Renewal, and Price Adjustment;
• Refund and Cancellation by the User;
• Responsibilities of the Parties;
• Vulnera's Disclaimer and Limitation of Liability;
• Rules of Conduct and Prohibitions;
• Intellectual Property and Confidentiality;
• Processing of Personal Data, Privacy, and Security;
• Consequences of Access to the Platform;
• Changes to the Terms and Conditions of Use;
• General Provisions;
• Governing Law and Choice of Forum;
• Contact Channel.

TERMS OF USE

VULNERA.

This platform, named VULNERA, is owned and maintained by Vulnera Cibersegurança Inova Simples (I.S.), a private legal entity registered with the CNPJ/ME under No. 69.317.570/0001-06, headquartered at Rua 9, nº 1102, Apto 1102, Bairro Norte (Águas Claras), Cidade Brasília, Distrito Federal, CEP: 71908-540.

This document aims to provide information about how the platform is used by Users and its tools, conditions, terminology, rights, and duties. We advise that the entire text be read carefully, and if you do not agree with the content of these Terms and/or our Privacy Notice, do not proceed with browsing or using our services.

Acceptance of these Terms occurs electronically, at the moment of registration, and is recorded in our systems with date, time, IP address, and source logical port, with that record serving as proof of the User's manifestation of will.

1. EFFECTIVE DATE OF THE TEXT

1.1. This version of this document was made available on: 29/09/2026.

1.2. This version fully replaces all previous versions of Vulnera's Terms of Use. In the event of any discrepancy between the Portuguese-language version and any foreign-language version, the Portuguese-language version shall prevail.

2. EXPLANATION OF TECHNICAL TERMS OR TERMS IN A FOREIGN LANGUAGE

2.1. Below are the meanings of the technical terminology and English-language terms used in this document.

• Finding: a record of a possible vulnerability identified in a Target, made up of a description, technical evidence, the affected address and parameter, severity, category, and, when applicable, CVE identifier and CVSS score.
• Target: each digital asset registered by the User to be analyzed, which may be a web application, an API, an infrastructure asset, or a code repository.
• API: acronym for Application Programming Interface. A set of routines and standards that enables communication between different systems.
• CI/CD: acronym for Continuous Integration / Continuous Delivery. A software development automation practice in which analyses can be triggered automatically on every code change.
• CVE: acronym for Common Vulnerabilities and Exposures. A public, standardized identifier for a known vulnerability.
• CVSS: acronym for Common Vulnerability Scoring System. A standardized system for scoring the severity of a vulnerability.
• Scan: the execution of an automated analysis on a registered Target.
• False positive: a finding flagged by the platform that, after verification, does not correspond to a real vulnerability.
• False negative: a vulnerability that exists in the Target but was not identified by the platform.
• Login: the process that allows access to a computer system, controlled through identification and authentication of the User by means of the credentials provided by that same internet user.
• MCP: acronym for Model Context Protocol. A protocol that allows artificial intelligence assistants chosen by the User to connect to the platform and query their Organization's data.
• Passive Mode: a scanning mode that does not run intrusive tests against the Target, limiting itself to observation and information gathering.
• Attack Mode: a scanning mode that runs active and intrusive tests against the Target, subject to the conditions of clause 6.
• OAuth: an authorization protocol that allows the platform to access the User's resources on third-party services without the User having to share their password.
• Online: an English-language term whose literal meaning is "in line." It is commonly used to indicate that a given internet user, or user of another computer network, is connected to the network.
• Organization: the account unit automatically created at registration, to which the Targets, scans, plan limits, subscription, and invited Users are linked.
• Token: an access credential generated by the platform or by a third-party service, used to authenticate automated integrations.
• User(s): the natural or legal person(s) who register(s) on the platform and use(s) our services.
• Ownership Verification: the technical procedure by which the User proves that they hold control over the registered Target.
• Virus: malicious software that infects systems and computers, aiming to cause some kind of harm, makes copies of itself, and attempts to spread to other computers, using various means.

2.2. The following are the types of Users of the platform, according to the profile assigned within each Organization:

2.2.1. Owner: the profile automatically assigned to whoever creates the account and, with it, the Organization. The Owner is responsible for the Organization before Vulnera.

2.2.2. Member: a person invited by the Owner to act within the Organization.

2.2.3. Viewer: a person invited by the Owner with a read-only profile.

2.2.1. These Users, together, will be referred to simply as Users.

3. SERVICES

3.1. What we are: Vulnera consists of, but is not limited to, an automated security analysis platform that allows the User to identify possible vulnerabilities in digital assets they own, through dynamic analysis of web applications and APIs, analysis of infrastructure assets, and analysis of code repositories, with presentation of technical evidence, severity classification, and remediation recommendations.

3.2. What we are not: so that there is no confusion on the User's part, Vulnera is not a manual intrusion testing (pentest) service performed by professionals, nor does it replace that service; it is not information security consulting, independent auditing, or legal advice; it is not a certification, seal, attestation, or report of security, compliance, or regulatory adequacy of the analyzed Target; it is not a remediation, continuous monitoring, incident response, or active defense service for the User's assets; nor is it a hosting, backup, or custody service for the User's assets or source code.

3.3. Vulnera's services constitute a best-efforts obligation, not an obligation of result. The platform employs automated techniques and public databases of known vulnerabilities, and therefore does not guarantee the identification of all vulnerabilities existing in a Target, nor the absence of false positives and false negatives. The result of a scan reflects the configuration of the Target at the time of execution and does not project into the future.

3.4. LGPD compliance module: the module made available on the paid plan is intended exclusively for informational and technical support purposes. It does not constitute a legal opinion, does not attest to the User's compliance with Lei nº 13.709/2018 (the Brazilian General Data Protection Law, LGPD), and does not replace the assessment of a qualified professional or the work of the person in charge of personal data processing.

3.5. When using Vulnera, the User must understand and accept that all of their actions and choices are free and are not subject to any kind of influence or interference from Vulnera, in particular regarding the choice of Targets, the timing of running the analyses, the decision to enable Attack Mode, and the decision to connect third-party tools.

3.6. It is clarified that this service does not establish any employment, corporate, or associative relationship between the parties, with each party remaining solely responsible for all of its respective expenses and charges, whether of a labor, social security, tax, insurance, civil, criminal, or any other nature or kind.

3.7. Vulnera relies on third-party services to enable its provision, currently: Stripe (payment processing), Google (authentication), OpenAI (generation of recommendations through artificial intelligence), GitHub, GitLab, and Bitbucket (access to code repositories authorized by the User), in addition to OWASP ZAP and Vulnera's own code analysis engine, both run on Vulnera's infrastructure. This list may be updated, and the version in force will always be available in this document and in the Privacy Notice.

4. REGISTRATION OF USERS, ORGANIZATION, AND ACCESS PROFILES

4.1. The following information will be required to register for and use Vulnera's services:

4.1.1. To create the account: company or professional name, e-mail address, and password.

4.1.2. To subscribe: name and mobile phone number. Payment data is collected directly by the payment processor, under clause 9, including, for payment by Boleto, the payer's CPF or CNPJ and address.

4.1.3. The User can use Google social login to create their account on our platform. As such, they should be aware that they will be sharing their profile information with us. The personal data shared will depend on the settings of the platform chosen. Visit the chosen platform and review its privacy notice to understand how your personal data is shared and used in that context.

4.2. Creation of the Organization: based on the name provided at registration, an Organization is automatically created, to which the Targets, scans, reports, integrations, plan limits, and subscription are linked. Whoever creates the account receives the Owner profile.

4.2.1. The company name field is free text and is not subject to validation. The platform does not request a CNPJ or CPF on its own subscription screens and, therefore, does not automatically distinguish a legal entity from a natural person, both being accepted. For payment by Boleto, the CPF or CNPJ is provided directly to the payment processor, under clause 9.2.2.

4.3. Each User will determine their own login and access password, and is solely responsible for keeping that information confidential. Vulnera is not liable for actions and damages that may be caused by irregular access to the account by third parties.

4.4. Only 1 (one) account per User is permitted.

4.5. Registration on the platform is permitted only to persons over 18 (eighteen) years of age or to emancipated Users, in accordance with applicable law. By accepting these Terms, the User declares that they are fully capable of exercising all acts of civil life and, when acting on behalf of a legal entity, declares that they have the power to do so.

4.6. Users are responsible for providing truthful, accurate, and up-to-date information.

4.7. Access profiles and permissions: in the platform's current configuration, permissions are distributed as follows:

• Exclusive to the Owner: inviting and removing Members and Viewers; enabling the Attack Mode capability on a Target.
• Owner or platform Administrator: subscribing to and canceling the subscription, and managing coupons.
• Owner or Member: triggering a scan in Attack Mode.
• Any authenticated profile, including the Viewer: registering a Target; deleting a Target, which cascades to erase all associated history; triggering an analysis; viewing technical evidence; generating and exporting a report; creating schedules; creating CI/CD integration tokens; registering credentials for access to authenticated areas of the Target; and generating access tokens for artificial intelligence assistants.

4.7.1. The User expressly acknowledges that, today, the practical difference between the Member and Viewer profiles is limited to triggering a scan in Attack Mode, and that the interface does not restrict the other features by profile.

4.7.2. In light of the foregoing, inviting new people to the Organization is an act of the Owner's exclusive responsibility, who must assess in advance the trust placed in each person invited. Vulnera is not liable for acts committed by invited Members and Viewers, including the deletion of Targets and the corresponding history.

4.7.3. Vulnera may, at any time and at its discretion, review, restrict, or expand the set of permissions of each profile, with the aim of improving the platform's security. The exercise of this option does not constitute an obligation to do so, does not amount to an assumption of a duty to monitor the Organization, and does not transfer to Vulnera the responsibility set out in clause 4.7.2, which remains entirely with the Owner, including as to acts committed by Members and Viewers invited by the Owner, before or after any change in permissions.

4.8. Vulnera may terminate the contract with the User, suspend its services, or refuse or cancel a User's access account without prior notice whenever it suspects that the information provided is false, incomplete, outdated, or inaccurate, or, further, in cases of non-payment, in the cases indicated in applicable laws and regulations, in these Terms of Use, in the Privacy Notice, or in any Policy.

5. TARGETS, PROOF OF OWNERSHIP, AND AUTHORIZATION FOR TESTS

5.1. User's representation and warranty: upon registering a Target and upon triggering any scan, the User represents and warrants, under penalty of law, that:

5.1.1. They own the Target or hold express, prior, and specific authorization from its owner to submit it to security tests;

5.1.2. They have the competence and legitimacy to authorize the execution of automated tests on the Target, including before the hosting provider, the cloud provider, and other contractually involved third parties;

5.1.3. They have obtained all necessary internal, contractual, and regulatory authorizations, and will observe the testing policies of the providers involved;

5.1.4. They will not use the platform against third-party assets, shared assets, or assets over which they do not hold the control required by this clause.

5.2. Responsibility for the truthfulness of the representations in clause 5.1 rests solely with the User. The User undertakes to indemnify and hold Vulnera harmless from any losses, damages, costs, expenses, attorneys' fees, administrative sanctions, and awards arising from a scan run on a Target for which the User did not hold ownership or authorization, including in the face of claims from third parties or authorities.

5.2.1. The User acknowledges that running security tests against third-party systems without authorization may constitute a civil and criminal offense, subjecting the User to full compensation for damages caused and to criminal liability, under art. 154-A of the Código Penal (the Brazilian Penal Code) (unauthorized access to a computer device) and art. 266, §1º, of the Código Penal (interruption of a telematic service), without prejudice to the sanctions set out in Lei nº 13.709/2018 (the Brazilian General Data Protection Law, LGPD) where there is access to personal data.

5.3. Proof of ownership: verification is not required for the first scan, but it determines the depth of the analysis. The model has two levels: (i) unverified Target: the analysis is run only in Passive Mode, with no active tests, limited to 3 (three) scans per Target every 24 (twenty-four) hours; or (ii) verified Target: unlocks the execution of active analysis.

5.3.1. The level is always determined by the Target's verification status, and never by the User's choice at the moment the scan is triggered.

5.4. Verification methods: (i) inclusion of a DNS record of type TXT on a specific subdomain, containing a token issued by Vulnera; or (ii) publishing a file containing the token at the root of the site.

5.4.1. Validity: verification expires after 45 (forty-five) days and is periodically revalidated. Once expired or revoked, the Target automatically reverts to Passive Mode. Three failed attempts mark the verification as failed.

5.4.2. Linkage to the exact address: verification is linked to the exact address registered. Each subdomain is considered a distinct Target, and an address different from the one verified is not treated as the same Target.

5.4.3. Code repositories: repositories are not subject to DNS or file verification. They are recorded as verified at the moment of registration, and ownership is inferred from the access granted by the User themselves, through OAuth authorization with the provider (GitHub, GitLab, or Bitbucket) or through an access token provided by the User. This is a proof regime distinct from the one applied to domains, and granting that access is, for all purposes of these Terms, equivalent to the declaration of ownership set out in clause 5.1.

5.5. Deleting a Target: the User may delete a Target at any time. Deletion is final, immediate, and irreversible, and cascades to remove all scans, findings, evidence, reports, schedules, integrations, and credentials linked to that Target. Vulnera does not keep a recovery copy available to the User for this scenario and is not liable for the loss of history resulting from this act.

5.6. Replacing a Target: this is permitted at any time, with no waiting period and no frequency limit, and is carried out by deleting the current Target and registering another, with the effects described in clause 5.5.

6. ATTACK MODE

6.1. Attack Mode runs active and intrusive tests against the Target. Its execution requires, cumulatively:

• A previously verified Target;
• Enablement of the capability by the Organization's Owner;
• Consent recorded on the Target, with date, IP address, and source logical port;
• Express authorization for each scan; and
• Manual triggering by an authenticated User with an Owner or Member profile.

6.2. Scheduled scans and scans triggered by a CI/CD pipeline cannot consent to Attack Mode and will be run exclusively in Passive Mode.

6.3. The User acknowledges and accepts that running active tests may, depending on the architecture, configuration, and capacity of the Target, cause slowness, instability, temporary unavailability, additional resource consumption and infrastructure costs, generation of logs and security alerts, blocking by protection systems, creation, modification, or removal of data in test environments, and similar effects.

6.3.1. It is the User's sole responsibility to take the necessary precautions in advance, including making backups, choosing an appropriate execution window, communicating with the relevant internal areas, and observing the testing policies of their providers.

6.3.2. Vulnera is not liable for any damage, loss, unavailability, or cost arising from running Attack Mode authorized by the User.

6.4. Vulnera may interrupt, limit, or suspend the execution of scans, including in Attack Mode, whenever it identifies a risk to the integrity of its infrastructure, to the Target, to third parties, or to the stability of the service.

7. USAGE LIMITS

7.1. Limits are calculated per Organization, not per User or individual account.

7.2. Target limit:

• Free use: 1 (one) Target and 1 (one) scan for the account's entire lifetime, with no expiration date. After that scan, you must subscribe to a plan to run new ones;
• Subscribed plan: 5 (five) Targets;
• Manual increase of the limit by the Vulnera team, evaluated case by case, upon request through the contact channel, with the grant in one case not creating a vested right, precedent, or obligation of renewal.

7.3. What counts as a Target: each registered record occupies one slot of the limit, whether it is a web application, an API, an infrastructure asset, or a code repository. A repository occupies one slot, just like a domain, and each subdomain occupies its own slot.

7.3.1. A maximum of 5 (five) simultaneous unverified Targets per Organization is permitted.

7.4. Members per Organization: there is no limit on the number of people invited, and the invitation does not depend on the plan subscribed.

7.5. For subscribers with a verified Target, there is no commercial quota, daily cap, or paid-priority queue. The expression "unlimited scans" is subject only to the following technical and security safeguards:

• A generic limit on requests per minute per origin;
• A maximum of 3 (three) scans per day on an unverified Target;
• A processing queue that runs up to 5 (five) simultaneous scans per instance, with possible waiting during periods of higher demand.

7.5.1. Vulnera may adopt proportional technical measures, including queuing, rate limiting, and temporary suspension, in the face of use that compromises the platform's stability, constitutes abusive automation, resale of the service, or an attempt to circumvent plan limits.

7.6. Free use is granted as a courtesy and for an indefinite period, and may be modified, limited, or discontinued at any time by Vulnera, through notice on the platform, without this giving rise to a right to compensation.

7.7. Creating multiple accounts or Organizations for the purpose of circumventing free-use limits is prohibited, and doing so authorizes the immediate blocking of the accounts involved.

8. INTEGRATIONS, CREDENTIALS, AND ARTIFICIAL INTELLIGENCE FEATURES

8.1. Available integrations: the platform currently offers (i) an MCP server for artificial intelligence assistants; (ii) login with Google; (iii) connection with GitHub, GitLab, and Bitbucket, for cloning the repository and running the code analysis; (iv) CI/CD integration by token, allowing scans to be triggered from the User's pipeline and by repository event triggers; and (v) registration of credentials for access to authenticated areas of the Target itself.

8.2. The operations made available by the MCP server are read-only and restricted to the Organization to which the token belongs.

8.2.1. The User expressly acknowledges that the assistant they choose accesses the complete finding record, including technical evidence, the affected address and parameter, severity, category, description, CVE identifier, CVSS score, and metadata of the Target and the scan.

8.2.2. The decision to integrate with the chosen assistant is free, exclusive, and entirely the User's responsibility, and it is up to the User to assess in advance the terms, retention policy, and security practices of the connected tool.

8.2.3. It is the User's responsibility to keep the generated tokens confidential and to revoke them immediately in the event of suspected compromise or the departure of the person who used them.

8.3. Authenticated-area credentials: the User can register credentials so that the scanner can reach protected pages of the Target itself. In that case, the User undertakes to (i) use credentials created specifically for testing, with the least privilege possible, avoiding administrative or personal-use credentials; (ii) prefer staging environments whenever the analysis may generate data writes; and (iii) revoke the credentials as soon as they are no longer needed.

8.3.1. Credentials and code-provider tokens are stored in encrypted form, as described in the Privacy Notice. Vulnera is not liable for the consequences of registering credentials with excessive privileges or belonging to third parties.

8.4. Recommendations generated by artificial intelligence: the platform uses a third-party language model (OpenAI) to generate remediation recommendations. The generated content is suggestive, may contain inaccuracies, omissions, or outdated information, and must be reviewed by a qualified professional before any implementation. Vulnera does not guarantee the adequacy, sufficiency, or outcome of applying the recommendations, and is not liable for damages arising from their adoption without prior validation. Implementing fixes in a production environment is a decision and responsibility that rest exclusively with the User.

9. PAYMENT, RENEWAL, AND PRICE ADJUSTMENT

9.1. Our platform is licensed for a fee. Prices are always available before you subscribe and at this link.

9.2. To process payment information, the User's data will be sent via API and transmitted through the independent Stripe platform, which is the institution responsible for processing the financial transactions. Card data is provided directly to Stripe, and Vulnera has no access to it. We use this third-party platform so that it can ensure the security of financial transactions. We also recommend that you read Stripe's Terms of Use and Privacy Notice.

9.2.1. Payment methods: the subscription can be paid by card, including through the Apple Pay and Google Pay digital wallets, when available on the User's device; with Link, a Stripe service that lets the User save their payment details for future purchases; or by Boleto (a Brazilian bank payment slip). The payment method chosen when subscribing is also used for renewals, unless changed by the User. PIX is not offered as a payment method for the subscription.

9.2.2. For payment by Boleto, Stripe collects the payer's name, CPF or CNPJ, address, and e-mail, which are required to issue the boleto. This data is provided directly to Stripe, is not stored on Vulnera's servers, and is processed under the Privacy Notice.

9.2.3. Subscribing by Boleto: when the subscription is paid by Boleto, it is only activated after the payment clears, which may take up to 3 (three) business days after payment. While the boleto is pending payment or clearing, a new subscription cannot be started on the same account. A boleto not paid by its due date does not give rise to any charge, and the subscription is not completed.

9.3. Automatic renewal: the subscription is automatically renewed at the end of each cycle, for the same period and through the payment processor, until the User requests cancellation.

9.3.1. The date of the next renewal is permanently available in the User's account, and the User may cancel at any time before it, at no additional cost.

9.3.2. Renewal by Boleto: when the subscription is paid by Boleto, at each renewal Stripe issues a new boleto and sends it to the payer's e-mail, with the due date stated on the document itself, currently 3 (three) days after issuance. Clearing may take from 1 (one) to 3 (three) business days after payment.

9.4. Price adjustment and change: prices may be adjusted annually by the variation of the IPCA/IBGE index (Brazil's official consumer price index) or, in its absence, by an index that may replace it, and may also be changed due to a change in commercial conditions. Any price change will be communicated to the User, by e-mail or by notice on the platform, at least 30 (thirty) days in advance, and will take effect only on cycles that begin after that period has elapsed. A User who does not agree may cancel the subscription before renewal, at no cost.

9.5. Default: a billing failure or non-payment authorizes the suspension of access to paid features, without prejudice to the collection of amounts owed, subject to the following: (i) suspension only occurs after an attempt at a new charge by the payment processor and after the end of a grace period of 7 (seven) days, counted from the date the charge becomes overdue; (ii) for a renewal paid by Boleto, the 7 (seven) day grace period is counted from the due date of the boleto issued for the cycle, and not from the date the charge becomes overdue; (iii) once the payment processor has exhausted its charge attempts, suspension may occur immediately, even if the grace period has not ended.

10. REFUND AND CANCELLATION BY THE USER

10.1. Right of withdrawal: Vulnera respects all of its Users' rights, in particular the right of withdrawal from contracts entered into over the internet within 7 (seven) days, counted from the contracting, as set out in the Código de Defesa do Consumidor (the Brazilian Consumer Protection Code, CDC). If withdrawal is exercised, any amounts paid by the User will be fully refunded.

10.1.1. The right of withdrawal is guaranteed to the User who is a natural person contracting as an end consumer. For the User who is a legal entity contracting in the course of its business activity, only the cancellation rules set out in clause 10.2 apply.

10.1.2. Payments made by Boleto cannot be reversed through the payment processor. Whenever a refund is due, including when the right of withdrawal is exercised, the amount paid by Boleto will be returned by bank transfer, including via PIX, to an account held by the payer, whose details the User must provide in the request.

10.2. Cancellation of the subscription: cancellation is carried out as an interruption of renewal at the end of the current cycle, with the User retaining access to the contracted features until the end of the period already paid for. No penalty is charged, nor is there a proportional refund of the current cycle, except in the case set out in clause 10.1.

10.3. Cancellation may be requested directly in the User's account or through the contact channel indicated in clause 20.

10.4. Effects on data: cancellation, by itself, does not delete Targets, scans, findings, evidence, and reports, which remain stored and become accessible again in the event of a new subscription. Permanent deletion of that data occurs (i) by an act of the User themselves, under clause 5.5, or (ii) upon a deletion request, under the Privacy Notice and applicable law, subject to the legal retention periods.

11. RESPONSIBILITIES OF THE PARTIES

11.1. Vulnera's responsibility:

11.1.1. Perform the services as described in these Terms of Use;

11.1.2. Be responsible for the platform's operation and for any corrections that may become necessary;

11.1.3. Inform Users of any material change to the services, by means of simple notices on the platform or by e-mail;

11.1.4. Adopt technical and administrative information security measures compatible with the nature of the service;

11.2. Users' responsibility:

11.2.1. Use the platform in accordance with the usage criteria defined by Vulnera, without altering its programming, breaking passwords, or carrying out procedures that may cause harm to Vulnera or other Users;

11.2.2. Be responsible, for all purposes, including legal, for the content of the information they enter and for the commitments they make on the platform;

11.2.3. Ensure ownership or express authorization to test each registered Target, under clause 5;

11.2.4. Assess in advance the operational risks of running analyses, particularly in Attack Mode, and take the appropriate precautions, including backups;

11.2.5. Manage their Organization's profiles, invitations, tokens, and credentials, revoking access when no longer needed;

11.2.6. Technically validate findings and recommendations before any implementation;

11.2.7. Maintain confidentiality over the findings and technical evidence they have access to, especially when the Target belongs to a legal entity for which the User is merely an agent or service provider;

11.2.8. Fully comply with these Terms of Use, the Privacy Notice, applicable law, and the contracts entered into between the parties.

12. VULNERA'S DISCLAIMER AND LIMITATION OF LIABILITY

12.1. Vulnera is not liable for:

12.1.1. Any unavailability of the platform that it did not cause.

12.1.2. Users' conduct and their failure to comply with their obligations.

12.1.3. The entry of false, incomplete, and/or outdated information by Users, including as to the ownership of Targets.

12.1.4. Damage the User may experience from actions solely attributable to third parties, as well as network connection failures and malicious interactions such as viruses.

12.1.5. Damage the User may suffer as a result of misuse of the platform in noncompliance with these Terms, with the Privacy Notice, with the law, or with court orders.

12.1.6. Acts of God or force majeure.

12.1.7. Unlawful conduct carried out by Users while using the platform.

12.1.8. Vulnerabilities that exist and were not identified by the platform (false negatives), as well as costs arising from investigating false positives.

12.1.9. Security incidents, attacks, leaks, or damage suffered by the User on their own assets, even if preceded by a scan performed by the platform.

12.1.10. Effects of running Attack Mode authorized by the User, under clause 6.3.

12.1.11. Loss of data resulting from deletion of a Target by the User themselves or by a person invited by the User, under clause 5.5.

12.1.12. Processing carried out by third-party tools connected at the User's choice, including artificial intelligence assistants connected via MCP.

12.1.13. Content, availability, and policies of integrated third-party services.

12.1.14. Technical, business, or regulatory decisions made by the User based on the results presented by the platform.

12.2. Limitation of liability: except in cases of willful misconduct and non-waivable statutory guarantees, Vulnera's total and cumulative liability to the User, for any cause related to these Terms, is limited to the amount actually paid by the User to Vulnera in the 12 (twelve) months prior to the event giving rise to the claim.

12.2.1. Vulnera is not liable, under any circumstances, for lost profits, loss of opportunity, loss of data, or indirect or consequential damages, except as otherwise provided by consumer protection law where applicable.

12.3. Availability: Vulnera makes its best efforts to keep the platform available, but does not currently offer a service level agreement (SLA) with a guaranteed minimum availability rate. Scheduled interruptions for maintenance, updates, and service evolution may occur.

13. RULES OF CONDUCT AND PROHIBITIONS

13.1. Users may not:

13.1.1. Harm the rights of Vulnera, of the platform's operators, of other Users, or of third parties, or act in any way or manner that may contribute to such a violation;

13.1.2. Perform acts that limit or prevent the use of the platform, or unlawfully access Vulnera;

13.1.3. Use the tool to carry out unlawful acts and to spread messages unrelated to the platform or its purposes, including messages with inappropriate content;

13.1.4. Enter data that is false, outdated, or incomplete;

13.1.5. Register, scan, or test a third party's Target without ownership or express authorization, or attempt to circumvent, defraud, or simulate the Ownership Verification;

13.1.6. Use the platform as a tool for reconnaissance, exploitation, or attack against third-party systems, or for any offensive purpose;

13.1.7. Resell, sublicense, assign, share access to, or provide services to third parties through the account, without Vulnera's written authorization;

13.1.8. Create multiple accounts or Organizations to circumvent plan limits, free-use limits, or anti-abuse limits;

13.1.9. Use automated means to extract data from the platform, subject it to load or security tests without written authorization, or reverse-engineer its analysis engines;

13.1.10. Use the platform for purposes prohibited by international sanctions or applicable law;

13.1.11. Hold Vulnera responsible for conduct of Users registered on the platform or of third parties.

13.2. Vulnera may, at its sole discretion, block, restrict, disable, or prevent any User's access to the platform whenever inappropriate conduct is detected, with no need for prior notice or entitlement to any kind of compensation.

14. INTELLECTUAL PROPERTY AND CONFIDENTIALITY

14.1. Ownership of and rights relating to the platform belong exclusively to Vulnera Cibersegurança Inova Simples (I.S.). Access to the platform and its regular use by the User do not grant the User any right or prerogative over intellectual property or other content included in it.

14.2. All content of the platform, including name, brand, domain, programs, analysis engines, databases, files, texts, drawings, photos, layouts, headers, report templates, and other elements, was created, developed, or assigned to Vulnera Cibersegurança Inova Simples (I.S.), and is therefore its exclusive property or licensed to it, and is protected by Brazilian law and by international treaties dealing with intellectual property rights.

14.3. The exploitation, assignment, imitation, copying, plagiarism, reverse engineering, attempted intrusion, storage, alteration, modification of characteristics, expansion, sale, leasing, donation, transfer, assignment, and reproduction, in whole or in part, of any content of the platform are prohibited.

14.4. User content and assets: the User retains ownership of their assets, their source code, and the data they enter, granting Vulnera a non-exclusive, limited license, for the term of the contractual relationship, to access, process, and store such information exclusively to provide the contracted services.

14.4.1. Source code accessed for analysis is used only for that purpose and is not reused to train Vulnera's own models nor made available to other Users.

14.5. Aggregated data: Vulnera may use aggregated and anonymized statistical data, which does not allow identification of the User, their Organization, or their Targets, for the purposes of improving the service, preparing indicators, and producing studies, under art. 12 of Lei nº 13.709/2018.

14.6. A person who violates the prohibitions contained in intellectual property law and in these Terms will be held civilly and criminally liable for the infringements committed, in addition to being subject to penalties on the platform.

15. PROCESSING OF PERSONAL DATA, PRIVACY, AND SECURITY

15.1. Vulnera has a specific policy to govern the collection, retention, and processing of personal data, as well as its security: the Privacy Notice. The Privacy Notice forms an inseparable part of these Terms, and it is emphasized that platform usage data will be retained under applicable law.

15.2. Requests from data subjects, questions, and requests related to the protection of personal data must be sent through the channel indicated in the Privacy Notice.

16. CONSEQUENCES OF ACCESS TO THE PLATFORM

16.1. Despite Vulnera's best efforts to provide the best technologies to maintain the connection and online synchronization and secure access for Users, technical difficulties, internet applications, or transmission problems may result in inaccurate or incomplete copies of the information contained on the platform. In addition, computer viruses or other harmful programs may also be inadvertently downloaded from the platform.

16.1.1. Vulnera recommends installing appropriate antivirus or protective software.

16.2. Vulnera reserves the right to unilaterally modify the platform, as well as its configuration, presentation, design, content, features, tools, or any other element, including discontinuing it.

16.3. Our platform may contain links to third-party sites and platforms. When following a link, the User should check those sites' privacy notices, as we accept no responsibility or obligation for those policies. Please review those policies before sharing any personal data with those sites.

17. CHANGES TO THE TERMS AND CONDITIONS OF USE

17.1. Vulnera may unilaterally add and/or modify any clause contained in these Terms of Use. The updated version will apply to use of the platform from its publication onward. Continued access to or use of the platform after such disclosure will confirm the effectiveness of the new Terms of Use for Users.

17.2. If the change made requires the User's consent, the User will be given the option to freely, unequivocally, and knowingly accept the new text or to decline it.

17.3. If the User does not agree with the change, they may withhold consent for specific acts or may fully terminate their relationship with Vulnera. However, that termination will not release the User from complying with all obligations assumed under prior versions of the Terms of Use.

18. GENERAL PROVISIONS

18.1. Communications: the User agrees that communications relating to these Terms may be made by e-mail to the address provided at registration or by notice displayed on the platform, and it is the User's responsibility to keep that address up to date and able to receive messages.

18.2. Assignment: the User may not assign or transfer their account or the rights arising from these Terms without Vulnera's written authorization. Vulnera may assign its contractual position in the event of a corporate reorganization, merger, acquisition, or transfer of assets, upon notice to Users.

18.3. Tolerance: tolerance regarding noncompliance with any obligation does not constitute a novation, waiver, or amendment of what was agreed.

18.4. Severability: any declaration of nullity or unenforceability of any clause will not affect the others, which will remain valid and effective.

18.5. Entire agreement: these Terms, the Privacy Notice, and the other policies published on the platform constitute the entire agreement between the parties regarding their subject matter.

19. GOVERNING LAW AND CHOICE OF FORUM

19.1. The platform is controlled and administered in the city of Brasília, Federal District, Brazil, and can be accessed from any device connected to the Internet, regardless of its geographic location.

19.1.1. People who access or use Vulnera from other countries do so on their own initiative and are responsible for complying with regional/national laws, including as to the lawfulness of running security tests in their jurisdiction.

19.2. The User agrees that the law applicable for purposes of these Terms and Conditions of Use and the Privacy Notice will be that in force in the Federative Republic of Brazil.

19.3. Vulnera and the User agree that the courts of Brasília, Federal District, Brazil, will have exclusive jurisdiction to resolve any question or dispute arising from or resulting from use of the platform, expressly waiving any other, however privileged it may be or come to be.

20. CONTACT CHANNEL

20.1. Vulnera provides the following channel to receive all communications Users wish to make: e-mail contato@vulnera.io.

20.2. Support is provided exclusively by e-mail. Service hours: ____. Response time: within ____ business days.

20.3. For matters related to the protection of personal data and the exercise of data subjects' rights, the channel indicated in the Privacy Notice must be used.