Terms of Service

1. Contracting entities and agreement

By using this website or the client portal, you agree to these terms. If you use them on behalf of a company, you confirm that you have the authority to bind that company, and “you” means that company.

If your company is established in Canada, your agreement is with Raven Security Inc. (Toronto, ON). If your company is established in the United States or elsewhere, your agreement is with Raven Security LLC (New York, NY). Each security review is also governed by a written scope signed by both sides. If the signed scope and these terms conflict, the signed scope controls for that engagement.

2. Our services

Raven Security reviews websites, web applications, APIs, and AI features using our own modified open-weight security models and human reviewers, and reports the issues we can verify, with evidence. Each engagement includes the review of your predefined scope, a written report mapped to OWASP standards, reasonable answers to your questions about the findings, one complimentary re-scan of the same scope within 45 days of the report (60 days on the Infrastructure plan), and a 1-page Letter of Attestation following the re-scan.

We do not perform remediation or code fixes. Fixing the reported items is your responsibility, which keeps our review independent. If you ask, we may introduce you to third-party development partners; any work a third party performs is strictly between you and that provider.

3. Authorization to test and predefined scope

We will not test any system until you have named the exact domains or hosts in a written scope and signed it. Submitting a contact form, paying an invoice, or having a conversation is not authorization. By signing a scope, you represent and warrant that you own or control every domain and system listed in it (or hold written permission from its owner) and have the legal authority to authorize security testing against it.

Our outbound scope filter restricts testing to the domains listed in your signed scope. When our models observe outgoing links, redirects, or references on your site pointing to domains outside the signed scope (such as an internal ERP, a legacy subdomain, or a third-party vendor like Stripe or Calendly), we do not probe those outside hosts; we list them for your awareness under “Observed Outside of Scope (Not Tested)” in your report.

4. Your responsibilities

• Provide accurate scope information and tell us in advance about any fragile systems, off-limits workflows, or peak windows we should plan around.
• Maintain current backups of your systems and data before and during the review.
• Share test credentials only through our encrypted client portal (never by email), using dedicated test accounts where possible, and revoke or rotate them when the engagement concludes.
• Decide which findings to fix, in what order, and how to test changes in your own environment.

5. AI models and zero training on client data

We run our own open-weight models with directly modified weights and testing logic edited by hand from human security findings. We do not maintain a training dataset, and we never use your application data, credentials, files, source responses, or findings to train or fine-tune any AI model.

6. No guarantee or warranty

We work diligently to uncover what an attacker would find and verify every item we report. However, no security review, model, or reviewer can find every vulnerability, and no system can ever be guaranteed free of flaws. Our report and Letter of Attestation describe what we observed within the agreed scope, during the dates of the review, using the methods described. Neither document is a warranty or certification that a system is immune to breach, now or in the future.

To the fullest extent permitted by law, our services, reports, letters of attestation, this website, and the client portal are provided “as is” and “as available,” without warranties or conditions of any kind, express, implied, or statutory, including implied warranties or conditions of merchantability, fitness for a particular purpose, title, and non-infringement.

7. Limitation of liability

To the fullest extent permitted by law, neither Raven Security LLC nor Raven Security Inc. (nor their officers, employees, or contractors) will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, goodwill, data, or business interruption, arising out of or relating to this website, the client portal, or our services, including any security incident or unauthorized access by a third party, whether or not related to an issue we did or did not report. Our total aggregate liability for all claims arising out of or relating to an engagement will not exceed the total fees you actually paid to us for that specific engagement.

8. Indemnification

You agree to indemnify, defend, and hold harmless Raven Security (Raven Security LLC and Raven Security Inc.) from and against any third-party claims, losses, liabilities, and expenses (including reasonable legal fees) arising out of our testing of systems you named in a signed scope—including any claim that you lacked authority or third-party permission to authorize testing—or from your breach of these terms.

9. Confidentiality and use of deliverables

We treat your findings, reports, credentials, and uploaded files as strictly confidential. We share them only with the reviewers assigned to your engagement and the infrastructure providers listed in our Privacy Policy, and we never publish client results.

Your reports and your 1-page Letter of Attestation are yours to use internally and to share with prospective customers, auditors, cyber insurers, and remediation partners, provided you do not alter them or misrepresent them as a guarantee of absolute security.

10. Client portal and automatic credential purge

Access to the client portal (/portal) is by invitation only. You are responsible for safeguarding your portal password and for activity under your login. Do not upload anything unlawful, malicious, or that you lack the right to share. You may delete your portal records and uploaded files at any time, and we automatically purge remaining shared test credentials from the portal 14 days after your complimentary re-scan concludes.

11. Fees and invoicing

Published prices are in US dollars and apply to the written limits on each plan: Site at $1,800; Application at $4,500; Infrastructure at $9,500. Canadian clients contracting with Raven Security Inc. may request invoicing in USD or CAD. Custom scopes and modular add-ons are priced in writing before any work begins. Payment terms and applicable taxes (such as GST/HST in Canada or state sales tax where applicable in the US) are stated on the invoice.

12. Website acceptable use and security reporting

Do not probe, scan, or test this website or the client portal without our prior written permission, or interfere with their operation. If you believe you have discovered a vulnerability in our own systems, please report it to hello@ravensec.com (see /.well-known/security.txt).

13. Changes and survival

We may update these terms from time to time; the date at the top reflects the current version. Updates do not alter an engagement already underway without written agreement from both sides. Sections 5 through 9, 11, and 14 survive the completion or termination of any engagement.

14. Governing law and venue

For clients contracting with Raven Security Inc. (clients established in Canada), these terms and any dispute arising from them are governed by the laws of the Province of Ontario, Canada and the federal laws of Canada applicable therein, without regard to conflict-of-law principles, and the provincial and federal courts located in Toronto, Ontario shall have exclusive jurisdiction.

For clients contracting with Raven Security LLC (clients established in the United States or outside Canada), these terms and any dispute arising from them are governed by the laws of the State of Delaware, USA, without regard to conflict-of-law principles, and the state and federal courts located in Delaware (or New York County, New York) shall have exclusive jurisdiction.

15. Contact

Questions about these terms: hello@ravensec.com.