Terms of Service

Version: 1.0 · Effective: 10 September 2026 · Provider: JJO Pentester Enterprise, a sole proprietorship registered in Malaysia, business registration number 202003104298 (003107833-D), trading as CheckAI · Notices: legal@checkai-cloud.com

1. The agreement

These Terms are between JJO Pentester Enterprise (business registration number 202003104298 (003107833-D)), trading as CheckAI ("CheckAI", "we", "us") and the organization on whose behalf an account is created ("you", "your organization"). They incorporate the Acceptable Use Policy, the Privacy Policy and the Refunds and Cancellation Policy. Where your organization processes personal data through CheckAI, the Data Processing Addendum also applies.

By creating an account, or by using CheckAI, you accept these Terms. The individual accepting them warrants that they are authorized to bind the organization. CheckAI is offered to organizations for business purposes and is not intended for consumers.

2. What CheckAI is — and what it is not

CheckAI is an automated security engineering platform. It collects public and authorized private security information, normalizes and correlates findings, assigns contextual priority, provides remediation guidance, tracks that work, and maintains compliance evidence and assessments.

CheckAI also does not:

• perform active exploitation, authenticated scanning, port scanning, site crawling or proof-of-concept takeover testing. Some of these are on our longer-term roadmap, but they are not part of the service today, and nothing here commits us to adding them, to any scope, or to any date;
• modify your code, cloud resources or configuration, rotate secrets, or apply any automatic remediation — all connectors are read-only;
• guarantee that it will identify every vulnerability, misconfiguration, compliance gap or risk affecting your systems.

Source tools establish detections. CheckAI preserves those source facts, correlates them and adds context. Findings originating from third-party tools and providers remain subject to the accuracy and coverage of those tools.

3. Accounts, organizations and roles

• The first approved user who creates an organization becomes its first Administrator. An organization may have multiple Administrators and must retain at least one.
• Roles are Administrator, Contributor, Viewer and Auditor. Roles are held per organization membership, and a user may belong to several organizations with a different role in each.
• Multi-factor authentication is mandatory for Administrator and Contributor roles.
• You are responsible for all activity under your organization's account, including the acts and omissions of your members, and for keeping credentials secure. Tell us promptly at security@checkai-cloud.com if you suspect unauthorized access.
• Membership and role changes are recorded in the audit history.

4. Your obligations

You must:

• comply with the Acceptable Use Policy, and in particular hold the authorization it requires for every asset you submit or connect;
• supply accurate information, and keep your billing contact current;
• hold the rights necessary for any material you upload, including penetration-test reports, evidence and customer-supplied framework sources;
• use CheckAI in compliance with applicable law, including computer-misuse, data-protection, export-control and sanctions law.

Framework sources. Many standards are protected by copyright. CheckAI includes built-in framework content only where it has a lawful basis to redistribute it. Where you supply an authoritative copy of a standard, you warrant that you are licensed to use it and to have CheckAI process it on your behalf, and that copy is processed privately within your organization.

5. Artificial intelligence and your provider credentials

• CheckAI's AI features operate on a bring-your-own-key basis. You configure credentials for your own account with a third-party AI provider.
• You contract directly with that provider and pay them directly. CheckAI does not resell AI usage, does not hold provider credit and does not mark up provider charges. Their terms, pricing and data-handling practices apply to that processing.
• Content sent for AI processing may include security findings, asset names, uploaded document text and other material from your organization. The interface identifies the provider and model before sensitive content is transmitted.
• Your credentials are encrypted, never returned to the browser and never logged.
• AI output can be wrong. Contextual priorities, extracted findings, suggested mappings, drafted statements and generated narrative are assistive. You are responsible for reviewing them before relying on them, and CheckAI never resolves an identified conflict on your behalf.
• Availability of any particular provider or model is not guaranteed. Where we plan to retire support for a model, affected Administrators are warned and must select a replacement rather than being migrated silently.

6. Free, modules and the trial

• Free is permanent, requires no payment method, and is not a time-limited trial. It includes one verified domain monitored continuously, with the limits described on our website.
• Security Operations, Penetration Test Management and Compliance Automation are purchased separately and apply to the whole organization. No paid module requires another. The Complete Bundle grants all three through one discounted product and is not a fourth module.
• One 3-day Complete Bundle trial is available per organization. It requires no payment method, starts only by explicit Administrator action, and never converts automatically. Your own AI provider credentials are still required for AI features during a trial.

7. Fees, billing and taxes

• Prices are published on our website, are organization-wide, and are not charged per seat. Organization members are unlimited.
• Annual billing charges the equivalent of ten monthly payments for twelve months, payable in advance.
• Prices are exclusive of tax where legally permitted. Tax is calculated at checkout and shown before you confirm.
• Payment is by card through Stripe-hosted checkout. Stripe's terms apply to the payment itself. Invoices and receipts are issued through Stripe.
• List prices cover up to 500 billable assets for Security Operations and the Complete Bundle. The definition of a billable asset is published on our website. An organization operating a larger estate, or requiring negotiated terms, is quoted separately. Exceeding the threshold does not stop your scans or withdraw any capability; it means we will contact you about a quote.
• There is no mandatory setup fee, and no commercial quota on assessments, penetration-test uploads or generated reports. Technical, concurrency, rate, safety and fair-use controls still apply.
• Custom engineering is discretionary, separately contracted under a statement of work, and normally subject to a minimum of five engineering days or USD 7,500 with 50% payable before work begins.
• We may change prices. Changes take effect at your next renewal, and we will give notice before that renewal.

8. Term, cancellation and suspension

Subscriptions renew automatically for successive periods until cancelled. You may cancel at any time; cancellation takes effect at the end of the paid period and access continues until then. Adding a module or upgrading takes effect immediately once payment is handled, with any proration shown before you confirm.

Non-payment

If a payment fails, purchased functionality remains available for a grace period while retries run and notices are sent. After that grace period the affected modules become read-only. If the subscription remains unpaid it is cancelled, and the affected data enters the retention period in section 9. The current published lifecycle timings apply.

Suspension and termination by us

We may suspend or terminate access, in whole or in part, where you breach these Terms or the Acceptable Use Policy, where required by law, or where necessary to protect the service, other customers or third parties. Where circumstances allow we will contact your Administrators first. A serious or deliberate breach — in particular submitting assets you are not authorized to assess — may result in immediate termination and a permanent ban.

9. Your data, retention and deletion

• Data your organization puts into CheckAI, and the assessments and evidence derived from it, remain yours.
• When paid access ends, the affected module's data becomes read-only for 30 calendar days rather than being deleted immediately. During that window authorized users may view and export existing outputs. Reactivating the same entitlement before the deadline restores the workspace, subject to any reauthorization of connectors or credentials.
• After that period the affected module data is deleted. The billing page displays the exact access-end and deletion timestamps, and notices are sent before deletion.
• Free-tier scan history is retained for 30 days. If you replace your Free monitored domain, the previous domain's remaining history is deleted after 30 days.
• A verified legal or support deletion request may require earlier deletion. Records we must retain for billing, tax, fraud or legal reasons follow their own statutory basis and do not retain unnecessary content.
• A payment dispute does not by itself trigger immediate deletion.

10. Intellectual property

CheckAI, including the platform, its software, models, workflows and documentation, remains our property. You receive a non-exclusive, non-transferable right to use it during your subscription, for your organization's internal business purposes.

You retain ownership of your data and of material you upload. You grant us the rights necessary to host, process and display it in order to provide the service.

You may not resell, white-label or provide CheckAI's output as a service to third parties except under a separate written agreement. Feedback and feature requests may be used without obligation or compensation; submitting a request does not purchase priority or create a delivery commitment.

11. Support

Ordinary best-effort email support is included. There is no service level agreement, no guaranteed response time and no guaranteed uptime, unless separately and expressly agreed in a written contract. No custom engineering request introduces a support commitment by itself.

12. Warranties and disclaimers

We will provide the service with reasonable skill and care. Beyond that, and to the maximum extent permitted by law, CheckAI is provided "as is" and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement.

We do not warrant that:

• the service will be uninterrupted, timely or error-free;
• every vulnerability, misconfiguration, compliance gap or risk will be identified;
• findings, priorities or AI-generated content will be accurate or complete;
• use of CheckAI will result in compliance with any framework, standard or regulation, or in a successful audit.

Nothing in these Terms excludes liability that cannot lawfully be excluded.

13. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive loss, or for loss of profit, revenue, goodwill, business or anticipated savings, however arising.

The cap

Our total aggregate liability arising out of or in connection with these Terms, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the greater of (a) fifty per cent (50%) of the total fees you paid to CheckAI in the twelve months immediately preceding the event giving rise to the claim, or (b) USD 100.

The twelve-month period is a rolling window ending on the date of the event. Fees paid more than twelve months before that date are not counted, so the cap does not accumulate across years.

Where you use CheckAI on the Free tier and have paid us nothing, that cap is USD 100. The Free tier is provided without charge, and our liability for it is limited accordingly.

The cap is aggregate, not per claim

The cap applies in aggregate — once, across every claim, however many there are and whenever they arise. It is not a separate cap for each incident, each module or each claim.

For this purpose you and your affiliates share a single cap, and accounts or organizations under common ownership or control are treated as one customer. "Affiliate" means any entity that controls, is controlled by, or is under common control with you. Creating additional accounts or organizations does not create additional caps.

Time limit for bringing a claim

Any claim arising out of or in connection with these Terms must be brought within twelve months of the date you became aware, or ought reasonably to have become aware, of the circumstances giving rise to it. A claim brought after that period is waived, to the extent permitted by law.

What these limits do not cover

Nothing above limits or excludes:

• your obligation to pay fees due;
• your indemnities under section 14 or the Acceptable Use Policy;
• liability for fraud or fraudulent misrepresentation;
• liability for death or personal injury caused by negligence;
• any liability that cannot lawfully be limited or excluded.

These limits also do not affect the powers of any regulator. A limitation agreed between us has no bearing on penalties a supervisory authority may impose.

14. Indemnity

You will indemnify and hold us harmless against any claim, loss, liability, damage, cost or expense — including reasonable legal fees — arising from or in connection with: your breach of these Terms or the Acceptable Use Policy; any assessment performed on your instruction where you lacked authorization; material you uploaded that you were not entitled to supply; or your use of AI provider services through your own credentials.

15. Confidentiality

Each party will keep the other's confidential information confidential, use it only to perform under these Terms, and protect it with at least reasonable care. This does not apply to information that is public through no fault of the receiving party, independently developed, or lawfully received from a third party, nor where disclosure is legally required.

16. Changes

We may change the service and these Terms. Where a change materially affects your rights or obligations we will give notice, and material changes require an Administrator to accept the updated Terms before continuing to use affected features. Continued use after a non-material change constitutes acceptance. We may discontinue features; where a discontinuation materially reduces what you have paid for, we will refund the unused portion of your prepaid fees on a pro-rata basis for the period affected.

17. Governing law and disputes

These Terms are governed by the laws of Malaysia, and the courts of Malaysia have exclusive jurisdiction, without prejudice to mandatory local-law protections that apply to you. Nothing in this section displaces a data-protection, consumer-protection or other statutory right that applies to you under the law of your own country and cannot be contracted out of.

Before starting proceedings, please contact us. Most disputes are resolved faster by email than by litigation. We ask that you raise the issue with legal@checkai-cloud.com and allow 30 days for us to try to resolve it. This does not prevent either party from seeking urgent injunctive relief at any time.

18. General

• These Terms, with the documents they incorporate, are the entire agreement between us on their subject matter.
• If a provision is unenforceable, the rest continues in force.
• Failure to enforce a provision is not a waiver of it.
• You may not assign these Terms without our written consent. We may assign them to an affiliate or in connection with a merger or sale of assets.
• Neither party is liable for failure to perform due to events beyond its reasonable control.
• Nothing creates a partnership, agency or employment relationship.
• Sections that by their nature should survive termination do so, including sections 9, 10, 13, 14, 15 and 17.

---

Questions: legal@checkai-cloud.com