The agreement, in language you can actually check.

1Who this is between

These terms are between 2A2M SIA, registered in Latvia, and the organisation whose representative accepts them. Using Cidra means accepting them. If you accept on behalf of a company, you are confirming you may bind it.

2The trial

Every account starts with a 14-day trial of the Team plan, and a payment card is required to begin it. Nothing is charged during the trial. On day 15 the subscription converts and the card is charged the then-current fee unless you have cancelled before then.

Cancelling during the trial costs nothing and is done from the billing page inside your workspace, which opens Stripe’s portal. We do not require you to email us, call us, or explain yourself to cancel.

3Fees

The Team plan is EUR 180 per month, inclusive of VAT. VAT is contained within that amount at the rate for your billing country rather than added to it, so EUR 180 is the total payable; a VAT-registered business elsewhere in the EU may enter its number to have the reverse charge applied, and the total remains EUR 180. Checkout may also offer your local currency, which carries a currency conversion fee — paying in euro avoids it.

Fees are billed monthly in advance and are not refundable for a period already begun, except where law requires otherwise. We will give at least 30 days’ notice by email before any price change, and you may cancel before it takes effect.

4What you may scan

This is the clause that matters most, and it is not boilerplate.

You may submit inventories, binaries and API contracts that you own or are authorised to analyse. You may submit a website URL only where you own the target or hold explicit permission from its owner to test it. You confirm that authorisation each time you start a website assessment.

Scanning infrastructure you do not have permission to test is unlawful in most jurisdictions. If you do it through Cidra, that is on you: you indemnify us against claims arising from it, and we may suspend the account immediately.

5What a finding means, and what it does not

Cidra reports what its scanners can establish from the evidence you give it. A finding is an observation, not a proof of exploitability. A clean result is not a certificate of security — it means the checks that ran found nothing, which is a narrower claim.

The platform states what it could not determine rather than reporting silence as safety. You remain responsible for your own security decisions. We do not warrant that the service will find every vulnerability in your estate, and nothing here transfers responsibility for your infrastructure to us.

6Your data

Your inventories, artefacts and findings remain yours. We process them to run the service and for nothing else — not to train models, not to build benchmarks, not to sell. The detail is in the privacy policy and the data processing agreement, which forms part of these terms.

7Availability

We do not currently offer a contractual uptime guarantee, and we would rather say so than publish one we cannot back. The service may be unavailable for maintenance or for reasons outside our control. Where an availability commitment is required, it can be agreed in an Enterprise contract.

8Acceptable use

You may not use Cidra to:

• assess a target you are not authorised to assess;
• attempt to disrupt the service or reach another customer’s data;
• resell access without a written agreement with us;
• break applicable law.

Testing the security of Cidra itself is welcome under our disclosure policy, which asks for coordination first and promises not to pursue researchers who follow it.

9Liability

Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited. Subject to that, our total liability in any twelve-month period is limited to the fees you paid in that period, and neither side is liable for indirect or consequential loss.

10Ending it

You may cancel at any time from the billing page; access continues to the end of the paid period. We may suspend or end an account for a serious or repeated breach of clause 4 or 8, and we will tell you why.

After termination you may ask for an export of your data. We delete workspace data within 30 days of closure, except records tax law requires us to keep.

11Law

These terms are governed by the law of Latvia, and the courts of Latvia have jurisdiction. If you are a consumer rather than a business, this does not remove protections you have under the law of your own country.

Questions: hello@cidra.dev.