Read section 9 and section 11 before you buy. They limit what ASIScan promises and cap what we owe you if something goes wrong. They are the sections that would matter most in a dispute, and we would rather you read them now than discover them later.
These Terms of Sale and Licence Agreement (the "Agreement") are a binding contract between you — the individual or legal entity purchasing or using the Software ("you", "your", or "Licensee") — and Protocol 42 ("we", "us", "our", or "Licensor"), operating from Ontario, Canada.
By purchasing, downloading, installing, or using ASIScan, you accept this Agreement in full. If you do not accept it, do not purchase or use the Software.
If you are entering into this Agreement on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" refers to that entity.
Subject to your compliance with this Agreement and payment in full, we grant you a perpetual, worldwide, non-exclusive, non-transferable, non-sublicensable licence to use and modify the Software within the scope of your Licence Tier:
| Tier | Scope |
|---|---|
| Single Project | Use within one (1) codebase or repository, by any number of developers employed by the purchasing entity. |
| Team | Use across unlimited codebases within a single legal entity, by up to twenty-five (25) developers. |
| Consultancy | Use across unlimited codebases, including in paid client engagements, and the right to deliver Output to third-party clients under your own branding. |
"Perpetual" means the licence does not expire on a date. It does not mean irrevocable — see section 13.
You must not:
Delivering Output to your own clients is permitted only under the Consultancy tier.
This section is not boilerplate. Security tooling can be misused, and this clause is what separates your lawful use from ours.
You may run the Software only against Target Systems that you own, or for which you hold documented, current, written authorisation from the owner to perform security testing.
You are solely responsible for obtaining that authorisation and for retaining evidence of it. You must not use the Software:
Under the Consultancy tier, you must hold written authorisation from each client before running the Software against that client's systems, and you remain responsible for your clients' use of any Output you deliver.
Breach of this section terminates your licence immediately and automatically, without notice and without refund.
The Software is licensed, not sold. We retain all right, title, and interest in and to the Software, including all intellectual property rights. This Agreement transfers no ownership.
You own your Output. Reports the Software generates about your own code are yours to use, keep, and share, subject to section 4.
If you send us feedback, bug reports, false-positive reports, or suggested rules, you grant us a perpetual, irrevocable, royalty-free, worldwide licence to use and incorporate that feedback into the Software without obligation or attribution to you. We will not publish your source code or your Output.
Prices are in US dollars unless stated otherwise. Payment is processed by Stripe, Inc.; we do not receive or store your card details. Your purchase is also subject to Stripe's terms.
Prices exclude applicable taxes unless stated. You are responsible for any sales tax, VAT, GST, HST, withholding, or duty arising from your purchase, except taxes on our net income.
We offer a 30-day refund from the date of purchase. To request one, email hello@protocol42.io from the address used at purchase, within 30 days. You do not need to justify the request, and we will not require you to prove anything.
Refunds are issued to the original payment method, normally within five business days of approval. On refund, your licence terminates and you must delete all copies of the Software.
We may decline a refund where we reasonably determine the request is fraudulent, is a repeat request from the same purchaser, or follows conduct that breached section 5.
Nothing in this section limits any non-excludable statutory right you may have as a consumer under the laws of your jurisdiction.
Your Licence Tier includes updates within the v1.x release line at no additional charge. Major version upgrades (v2 and later) may be chargeable.
Support is provided by email on a commercially reasonable-efforts basis. We do not commit to a response time, an uptime level, a defect-resolution timeframe, or a service level of any kind, and no service level agreement forms part of this Agreement.
We may discontinue the Software, any feature, or any distribution channel at any time. If we do, your existing licence continues under this Agreement for the copy you hold.
The software and all output are provided "as is" and "as available", without warranty of any kind, express, implied, or statutory.
To the maximum extent permitted by applicable law, we disclaim all warranties, including the implied warranties of merchantability, fitness for a particular purpose, non-infringement, title, accuracy, and any warranties arising from course of dealing or usage of trade.
We do not warrant that the software will detect any particular vulnerability, that it will identify all or any security weaknesses present in a target system, that its output will be accurate, complete, or free of false positives or false negatives, that it will operate uninterrupted or error-free, or that defects will be corrected.
We do not warrant that use of the software will make any system secure, compliant, or fit for any regulatory, contractual, or certification purpose.
In plain terms, and we would rather say it plainly: ASIScan is a static analysis tool. It reads source code. It cannot observe runtime behaviour, infrastructure configuration, network topology, identity policy, or model behaviour at inference time. It is pattern-matching, not proof. Our own published measurements put precision at roughly 75% on real-world code, and we tell you that openly precisely so you do not treat a clean report as a guarantee. A clean report means "nothing detectable from source." It does not mean secure.
The Output is informational engineering material only. It is expressly not:
References in the Software or its documentation to the OWASP Top 10 for Agentic Applications, the OWASP Top 10 for LLM Applications, or the EU AI Act are provided for engineering convenience. They do not establish compliance with those frameworks or any legal obligation. Determining your regulatory obligations, and whether you meet them, requires assessment by qualified professionals engaged by you.
You acknowledge that you are not relying on any representation, warranty, or statement not expressly set out in this Agreement, including statements on our website, in marketing material, or in correspondence.
You are solely responsible for the security, compliance, and lawful operation of any system you build or operate, and for all decisions you take on the basis of the Output.
To the maximum extent permitted by applicable law, our total aggregate liability arising out of or relating to this agreement, the software, or the output — whether in contract, tort (including negligence), strict liability, statute, or otherwise — shall not exceed the total amount you actually paid us for the software in the twelve (12) months preceding the event giving rise to the claim.
To the maximum extent permitted by applicable law, we shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, goodwill, business opportunity, anticipated savings, or data, however caused and under any theory of liability, even if we have been advised of the possibility of such damages.
Without limiting the foregoing, we shall not be liable for any security breach, intrusion, data loss, data exfiltration, ransomware event, service outage, regulatory investigation, fine, penalty, third-party claim, or reputational harm affecting you or any third party, including where the software failed to detect the weakness that was exploited, produced a false negative, or produced a false positive that you acted upon.
These limitations apply even if a limited remedy fails of its essential purpose, and they reflect an agreed allocation of risk between us that is a fundamental basis of the price charged. The Software would not be offered at this price without them.
Some jurisdictions do not allow the exclusion or limitation of certain warranties or liabilities. Where that applies, the exclusions and limitations above apply to the maximum extent permitted, and nothing in this Agreement excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded.
You will defend, indemnify, and hold harmless Protocol 42 and its owners, officers, employees, contractors, and agents from and against any claim, demand, action, proceeding, loss, liability, damage, fine, penalty, cost, or expense (including reasonable legal fees) arising out of or relating to:
We will notify you of any such claim and may, at our option and expense, participate in its defence. You will not settle any claim in a way that imposes obligation or admits fault on our part without our prior written consent.
This Agreement begins on your purchase date and continues until terminated.
You may terminate at any time by ceasing use and deleting all copies of the Software.
We may terminate this Agreement immediately on notice if you materially breach it, including any breach of sections 4, 5, or 7. Breach of section 5 terminates the licence automatically without notice.
On termination: your licence ends, you must immediately cease all use and delete all copies of the Software, and no refund is due except where termination follows a valid refund request under section 7. Sections 6, 9, 10, 11, 12, 14, 17, and 18 survive termination.
The Software may be subject to export control and sanctions laws, including those of Canada, the United States, and the European Union. You represent and warrant that you are not located in, under the control of, or a national or resident of any country subject to a comprehensive trade embargo, and that you are not listed on any government restricted-party, denied-persons, or sanctions list.
You will not export, re-export, or transfer the Software in violation of any applicable export control or sanctions law.
The Software may include or depend on third-party open-source components, each governed by its own licence. Those licences apply to those components, and to the extent of any conflict they prevail over this Agreement in respect of those components.
OWASP and the OWASP Top 10 are trademarks of the OWASP Foundation. ASIScan and Protocol 42 are not affiliated with, sponsored by, endorsed by, or certified by the OWASP Foundation. References to OWASP frameworks are nominative and descriptive only.
All other trademarks referenced are the property of their respective owners.
We may revise this Agreement for future purchases. The version in effect on the date of your purchase governs your licence, and we will not retroactively reduce the rights of an existing licensee. Each version is dated and versioned at the top of this page.
This Agreement is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
The courts located in Ontario, Canada have exclusive jurisdiction over any dispute arising out of or relating to this Agreement, and you consent to their personal jurisdiction and venue — except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.
Before commencing proceedings, you agree to contact us at hello@protocol42.io and attempt in good faith to resolve the dispute informally for at least thirty (30) days.
Any claim must be brought within one (1) year after the cause of action arises, or it is permanently barred, to the extent permitted by applicable law.
If you are a consumer resident in a jurisdiction whose law grants you a non-waivable right to bring proceedings locally or under local law, nothing here removes that right.
Entire agreement. This Agreement, together with the Privacy Policy, is the entire agreement between us regarding the Software and supersedes all prior discussions, proposals, and representations.
Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions continue in full force.
No waiver. Failure to enforce any provision is not a waiver of it.
Assignment. You may not assign this Agreement without our prior written consent, except to a successor in a merger or acquisition of substantially all your assets, on written notice to us. We may assign freely.
Force majeure. Neither party is liable for delay or failure to perform due to causes beyond its reasonable control.
Independent parties. Nothing creates a partnership, joint venture, agency, or employment relationship.
Headings and language. Headings are for convenience only. This Agreement is drafted in English; any translation is for convenience and the English version prevails.
Protocol 42
Ontario, Canada
hello@protocol42.io