Terms of service

These terms cover your use of subcloak.com, set out the terms for Cloak Watch subscriptions (section 9) Cloak Proxy Personal Cloud subscriptions (section 10) and Cloak Proxy Team Cloud subscriptions (section 11), and set out the default terms for work with Subcloak ("we"). Every engagement is also covered by a signed master services agreement and statement of work. If they conflict with these terms, the signed documents win.

1. Our services

We provide security testing and related advice, including Proof Pentests of web apps and APIs, AI Feature Security Tests of AI features, agents and MCP servers, Dev Environment Compromise Checks and hardening, and retainers. Descriptions and prices on this website are for information; the scope, price and dates of any engagement are fixed in the statement of work.

2. Authorization and scope

• We test only systems listed in a signed statement of work, under signed rules of engagement and a written authorization letter.
• You confirm that you own, or have the legal authority to authorize testing of, every system in scope, including any third-party hosting or services they rely on.
• If anything outside the agreed scope needs testing, we stop and get written approval first.
• We may pause testing if it appears to affect the stability of your systems, and will tell you immediately.

3. Fees and payment

• Prices are fixed in the statement of work. Unless it says otherwise, 50% is invoiced when the statement of work is signed and 50% on delivery of the report.
• Clients outside India are invoiced in USD. Clients in India are invoiced in INR plus applicable GST.
• Subcloak is registered as a micro enterprise under the MSMED Act, 2006. Indian clients must pay within the period agreed in writing, and no later than 45 days from acceptance of the work, as the Act requires. Late payments carry the interest the Act prescribes.
• Scope changes are agreed in writing before any extra work is done.

4. Confidentiality and data

Each side keeps the other's confidential information confidential, with at least reasonable care. Findings, reports and evidence are confidential to the client. We delete working data 30 days after acceptance of the report and provide a deletion certificate; see our privacy policy for details. We mention a client by name, for example in a case study, only with the client's written permission.

5. Ownership

Your systems, data and code remain yours. Once paid in full, you may use the reports and letters we deliver for any internal purpose and share them with your auditors, customers and prospects. We keep ownership of our methods, tools, templates and know-how, including Scopegauge, which is released under its own open-source licence.

6. No guarantee

Security testing reduces risk; it can't remove it. A report or attestation letter describes the systems we tested during the testing window, using the agreed method. It doesn't guarantee that no other vulnerabilities exist, then or later.

7. Liability

To the extent the law allows, our total liability for any claim arising from an engagement is limited to the fees paid for that engagement, and neither side is liable for indirect or consequential losses, including lost profits or data. Nothing here limits liability that cannot be limited by law.

8. Using this website

Don't use the site unlawfully, interfere with it, or test its security except under our disclosure policy. Site content is our copyright; you may quote it with attribution. The site is provided as is, and information on it is general, not advice for your specific situation.

9. Cloak Watch subscriptions

This section applies when you buy a paid Cloak Watch plan. The free Cloak Watch app needs no purchase, account or licence key.

• Who you contract with. Cloak Watch is made and licensed to you by Subcloak, a sole proprietorship registered in India (Bengaluru, Karnataka). Paid plans are sold through Polar (Polar Software, Inc.), our reseller and merchant of record. Polar handles payment, sales tax and VAT, invoices and receipts, and pays out refunds, and your purchase is also covered by Polar's buyer terms.
• What the subscription includes. The Personal plan gives you the real-time threat feed: Subcloak incident packs on your Mac within minutes of release, public malicious-package data every 5 minutes, and early warnings about suspected packages. The free app already includes every check and detection; detections are never behind a paywall. Free users get public data daily, Subcloak incident packs 24 hours after release, and headline incidents immediately. The plan's current details and price are on the Cloak Watch page.
• Price and billing. The Personal plan is billed yearly, in advance, at the price shown at checkout (currently US$18 a year, or the founding price of US$15 for your first year where offered). Polar adds any applicable tax at checkout.
• Renewal and cancellation. The subscription renews automatically each year at the then-current price until you cancel. We'll give you at least 30 days' notice before a price change applies to your renewal. You can cancel any time in Polar's customer portal at polar.sh/subcloak/portal (also linked in Polar's emails), or by emailing us; the paid feed keeps working until the end of the year you've paid for, and the subscription then doesn't renew.
• Refunds. You can get a full refund of any subscription payment, the first or a renewal, within 30 days of being charged, with no questions asked. See the refund policy.
• Licence key. After payment, your licence key is sent by email and shown on the checkout confirmation. There's no account: you enter the key in the app. A Personal licence can be used on up to 3 Macs of yours at a time; you can move it by removing it from a Mac. Keep the key private, and don't share, resell or publish it.
• Licence to use the app. We give you a personal, non-exclusive, non-transferable licence to use Cloak Watch and the feed on your own Macs. Subcloak keeps all rights in the app, the feed and the incident packs. You may not redistribute the feed or packs, resell access to them, or use them to build a competing feed. Parts of the app we publish as open source are covered by their own licences.
• Fair use. Don't use Cloak Watch or the feed unlawfully, to infringe anyone's rights, to send spam, or to attack, overload or probe our services or anyone else's. We may suspend or end a subscription for a serious or repeated breach of these terms, non-payment, or fraud or security risk, and will tell you why. If we end it without such a reason, we'll refund the unused part of the year.
• Release. Cloak Watch 1.0 is free. The optional paid live feed is coming. Features can change between versions, and we'll say clearly in the app and on the website which features are in beta.
• No guarantee. Cloak Watch reduces risk; it can't remove it. It checks for known and suspected developer threats using the data available to it, and can't promise to catch every attack, or to deliver every incident pack within a set time. The feed may occasionally be unavailable. Keep backups and follow the fix steps it gives you.
• Liability. To the extent the law allows, our total liability for any claim about a subscription is limited to what you paid for it in the 12 months before the claim, and neither side is liable for indirect or consequential losses. Nothing here limits rights you have as a consumer that can't be limited by contract.

10. Personal Cloud subscriptions

This section applies when you create a Personal Cloud account in Cloak Proxy or buy Personal Cloud ("Cloud" below). Cloud is optional: the free Cloak Proxy app needs no account or purchase. Team Cloud, the plan for teams, has its own terms in section 11.

• Who you contract with. Cloak Proxy and Personal Cloud are made and provided by Subcloak, as in section 9. Paid plans are sold through Polar (Polar Software, Inc.), our reseller and merchant of record. Polar handles payment, sales tax and VAT, invoices and receipts, and pays out refunds, and your purchase is also covered by Polar's buyer terms.
• Price and billing. There's no free trial: you buy Personal Cloud in the app, in Settings › Cloud, and pay on Polar's checkout page. It's billed monthly or yearly, in advance, at the price shown at checkout (currently US$3 a month or US$25 a year, or the founding price of US$20 for your first year on the yearly plan, for the first 50 yearly subscribers). Polar adds any applicable tax at checkout. The plan's current features and price are on the pricing page.
• Renewal and cancellation. The subscription renews automatically at the end of each month or year, at the then-current price, until you cancel. We'll give you at least 30 days' notice before a price change applies to your renewal. You can cancel any time in Polar's customer portal at polar.sh/subcloak/portal, which also opens from the app's Cloud settings and from the link in Polar's emails, or by emailing us. Cloud keeps working until the end of the period you've paid for, and the subscription then doesn't renew; there's no extra grace period after a cancellation. If a renewal payment fails, Cloud keeps working for up to 7 days after the period ends while Polar retries the payment; if it doesn't go through, the subscription ends.
• Refunds. You can get a full refund of any Cloud payment, the first or a renewal, monthly or yearly, within 30 days of being charged, with no questions asked. A refund ends the subscription at once. See the refund policy.
• End-to-end encryption, and its limits. What you sync (rules, mock sets, API client workspaces, environments, saved queries, filters and highlights) and the contents of your share links are encrypted on your devices before they're uploaded, so our servers only ever hold ciphertext for them. Personal Cloud has no features that run on our servers in readable form; if we add any, the app will say so before you use them, and we'll update these terms first. (Team Cloud's monitors and hosted mocks do run on our servers in readable form; see section 11.) The keys stay on your enrolled devices and in your Recovery Kit, and you're responsible for keeping the Recovery Kit safe. If you lose every enrolled device and your Recovery Kit, nobody, including Subcloak, can decrypt or recover your Cloud data. Data on your Macs stays there and keeps working whatever happens to your Cloud account.
• Share links and acceptable use. You're responsible for what you share and who you share it with. Share links are redacted by default; if you turn redaction off, you're responsible for any tokens, keys or personal data the link contains. Don't use share links or any other part of Cloud to store or share illegal content, malware, phishing or credential-harvesting pages, content that infringes anyone's rights, or personal data you have no right to share; to send spam; or to attack, overload or probe systems you don't own or have permission to test. Because share links are end-to-end encrypted, we don't read them. To report abuse, email hello@subcloak.com with the link. On a credible report we may disable a link straight away, without decrypting it, and we may suspend or end an account for serious or repeated abuse.
• Suspension. We may also suspend or end a Cloud account for a serious or repeated breach of these terms, non-payment, or fraud or security risk, and will tell you why. If we end it without such a reason, we'll refund the unused part of your paid period.
• After a subscription ends. When a paid period ends without renewal (or, after a failed renewal payment, when the 7 days of retries run out), or straight away when a payment is fully refunded, your Cloud account becomes read-only and your share links stop working. For 30 days after that you can still restore or download your Cloud data, and subscribing again within those 30 days restores everything as it was. After 30 days we delete all your Cloud data from our servers, and it ages out of our backups within a further 30 days. We keep only the account and billing records we need for tax, accounting and to prevent abuse.
• Deleting your account. You can delete your Cloud account at any time in the app, in Settings › Cloud › Delete Account…. The deletion always waits 72 hours, so a lost or stolen Mac can't delete it behind your back: we email the account's address a link that cancels it, and any of your enrolled Macs can cancel it too. If you no longer have an enrolled Mac, email us from the account's address and we'll delete it. Deleting it cancels the subscription and deletes your Cloud data from our servers; payments stay refundable under the refund policy. Data on your Macs isn't touched. Details of what we keep, and for how long, are in our privacy policy.
• Support. Personal Cloud includes priority email support at hello@subcloak.com: we reply within 2 business days (Monday to Friday, India time, excluding public holidays). A reply means a person has read your message and either solved the problem or told you what happens next; some fixes take longer. This is a response time, not a guarantee of availability or of a fix.
• Changes to the service. We may change, add or remove Cloud features as the service develops, and we'll tell you before a change that significantly reduces what you're paying for. If we stop offering Cloud, we'll give you notice and time to download your data, and refund the unused part of your paid period.
• No guarantee. We work to keep Cloud available and your data safe, but we can't promise uninterrupted service, and Cloud may occasionally be unavailable. Your Macs keep their own copy of what you sync; keep your own backups too.
• Use and liability. We give you a personal, non-exclusive, non-transferable right to use Cloud for your own work while your subscription lasts; don't resell or share access to your account. Subcloak keeps all rights in the service. To the extent the law allows, our total liability for any claim about Cloud is limited to what you paid for it in the 12 months before the claim, and neither side is liable for indirect or consequential losses, including lost data. Nothing here limits rights you have as a consumer that can't be limited by contract.

11. Team Cloud subscriptions

This section applies when an organisation creates a Cloak Proxy Team Cloud team in the Subcloak console ("Team Cloud" below), and to everyone who uses that team. Section 10 applies to Team Cloud too, except where this section says otherwise, with "the customer" in place of "you".

• Who the customer is. The customer is the organisation named when the team is created. The person who buys Team Cloud accepts these terms for that organisation and confirms they're authorised to. That person is the team's owner until ownership is transferred, which team support does on the owner's request.
• The owner's and admins' responsibilities. The customer is responsible for keeping the team's member list current and removing people who leave; for keeping the Team Recovery Kit safe, because whoever holds it can recover the team and read all of its data; for keeping at least one admin with a Mac; for configuring single sign-on and SCIM correctly; and for making sure its members may lawfully put the data they add into Team Cloud. Actions taken by the team's owner, billing managers and admins, such as approvals, removals and policy changes, are the customer's actions.
• Data ownership. Team data belongs to the customer, and members add it on the customer's behalf. When a member leaves or is removed, team data stays with the team, and their own Personal Cloud and local data remain theirs. Subcloak claims no rights in team data, and can't read it, with the exceptions described in our privacy policy.
• Seats. A team has at least 2 paid seats. Each seat is for one named person who uses Cloak Proxy with the team, and seats can't be shared. Owners and billing managers who don't use the app with the team, and CI tokens, don't need a seat. Adding seats is charged at once, prorated to the end of the current period, and the seats become usable when the payment succeeds. Lowering seats takes effect at the next renewal, with no credit for the current period. Switching between monthly and yearly billing is charged or credited as Polar's checkout shows.
• Price and billing. Team Cloud is billed in advance, monthly or yearly, at the price shown at checkout (currently US$5 a seat a month, or US$48 a seat a year), plus any applicable tax, through Polar as described in section 10. The team's subscription is billed to its owner at Polar: if the owner already pays for Personal Cloud or another team with the same address, it's added to that same Polar billing account, and only the owner can open its billing portal. There's no free trial. Renewal, cancellation and notice of price changes work as in section 10.
• Refunds. The customer can get a full refund of any Team Cloud payment within 30 days of being charged, on request to team-support@subcloak.com. Refunding a period's charge (the first payment or a renewal) ends the team: it becomes read-only as described below. Refunding a charge for added seats removes those seats; if more people are in the team than seats, it stops accepting new people at once and becomes read-only 7 days later, until members are removed or seats are added.
• End-to-end encryption, and its limits. Team data is encrypted on members' devices before it's uploaded, with keys held on members' devices, on the CI tokens the customer creates (for the spaces it gives them) and in the Team Recovery Kit, as in section 10, except for the features that run on our servers (below). If every admin's device and the Team Recovery Kit are lost, nobody, including Subcloak, can change the team's members again; the team can start over with new keys; nothing carries over automatically, and members can re-add what they exported from their devices. If the team turns on automatic approval after single sign-on, Subcloak's server and the team's identity provider decide which devices join the team; it's off unless an admin turns it on.
• Features that run on our servers. Team Cloud's monitors and hosted mocks are not end-to-end encrypted: Subcloak's servers read what is published to them in order to run them. A monitor's request, any secrets included in it and its results, and a hosted mock's content, can be read by Subcloak. The customer is responsible for what its monitors request and what its hosted mocks serve. Monitors may only target systems the customer is allowed to test, at the intervals the service allows, and may not be used for load testing, scanning or attacks. Hosted mocks are public to anyone with their address, and may not serve phishing, malware or personal data. We may take down a hosted mock for abuse, and will tell the team's owner; we may end a team whose monitors are used for abuse. To report abuse, email abuse@subcloak.com.
• Admin policies. Some team policies are enforced by Subcloak's servers and some by the Cloak Proxy app on each device. A modified app can ignore the policies the app enforces. The Team Cloud docs list which is which.
• Audit log and history. The team's audit log holds metadata only and is kept for 1 year. Earlier versions of team items, and deleted items, are kept for 90 days.
• Support. Team Cloud includes email support at team-support@subcloak.com: a person sends a first reply within 1 business day (Monday to Friday, India time, excluding public holidays). A reply means what it means in section 10. This is a response time, not a resolution time or a guarantee of availability, and it carries no service credits. Teams on the yearly plan with 10 or more paid seats can also book one 30-minute onboarding call.
• After a subscription ends. After a cancellation, the team keeps working until the end of the paid period; after a failed renewal payment, for up to 7 days while Polar retries; after a full refund of a period's charge, it stops at once. The team then becomes read-only for 30 days: members can read and export its data but not change it, and its monitors and hosted mocks stop at once. After 30 days we delete the team's data from our servers, and it ages out of our backups within a further 30 days. Data on members' devices isn't affected, except that a device deletes its copy of team data when its owner leaves or is removed.
• Deleting a team. The owner can delete the team in the console. The team closes at once and the deletion waits 72 hours; we email the owner and every admin a link that cancels it, and the owner or any admin can also cancel it in the console. Payments made in the 30 days before the owner asked are refunded in full when it runs. Deleting the team sets its subscription to end and deletes the team's data from our servers, keeping only billing records. An owner's own Cloud account can't be deleted while they own a team.
• Data processing agreement. A data processing agreement for Team Cloud is available on request at hello@subcloak.com.
• Suspension, changes and liability. Suspension, changes to the service and the absence of a guarantee work as in section 10. The customer may let its members use Team Cloud for the customer's work; it may not resell access or share a seat. To the extent the law allows, our total liability for any claim about Team Cloud is limited to the fees the customer paid for it in the 12 months before the claim, and neither side is liable for indirect or consequential losses, including lost data.

12. Law and courts

These terms are governed by the laws of India. The courts of Bengaluru, Karnataka have exclusive jurisdiction, unless a signed agreement says otherwise. Clients in the EU or UK keep any rights their local law gives them that can't be waived by contract.

13. Changes and contact

We may update these terms and will change the date above when we do. Questions: hello@subcloak.com.