TACANS Platform Terms

1. The agreement

These Platform Terms (the “Terms”) form a legally binding agreement between you and Tacans Technologies Ltd (“TACANS”, “we”, “us”). We are registered in the Dubai International Financial Centre (DIFC) under number 13214, with our office at Unit IH-00-01-02-OF-01, Level 02, Innovation One, DIFC, Dubai, United Arab Emirates. The Terms apply to tacans.com (the “Site”) and the TACANS autonomous security testing platform (the “Platform”).

If you accept these Terms for a business, you confirm that you are authorized to bind it, and “you” then includes that business. If you do not agree to these Terms, please do not use the Site or the Platform.

Paid use of the Platform is also governed by your order form or customer agreement and, where personal data is processed for you, our Data Processing Agreement (“DPA”). If any of those documents conflicts with these Terms, that document prevails.

2. What TACANS provides

TACANS tests the security of travel and fintech businesses using a fleet of autonomous AI agents. Our services include:

• free attack-surface mapping and continuous monitoring of your security posture and changes;
• autonomous attack simulation against booking, payment, settlement, identity and loyalty flows, partner APIs and AI agents;
• exploit validation, with evidence and reproduction steps for confirmed findings;
• business-impact reporting, retesting of fixes, and integrations with tools such as Jira, Linear and Slack;
• penetration testing engagements led by people.

3. Your account

The Platform is for businesses and professionals. To use it, you must be at least 18, act for a genuine business, and be legally able to accept these Terms. The details you give us when you sign up must be accurate and complete.

Keep your login details private. You are responsible for everything done through your account. If you suspect unauthorized access, tell us immediately at legal@tacans.com.

4. Testing only what you are authorized to test

Before any active testing starts, you must confirm that you own each domain, host or endpoint you submit (a “Target”), or that you have its owner’s written permission. This includes any consent needed from hosting, payment, GDS or partner providers. We may verify this through DNS, file or email checks. We may decline or stop testing any Target we cannot verify.

Once a Target is verified, you authorize TACANS and its agents to access and attack it within the agreed rules of engagement. The free surface map uses only passive, non-intrusive discovery and does not attack anything.

5. Testing risks and AI-generated findings

Operational risk. Real security testing can cause extra load, alerts, account lockouts, test transactions or service disruption. We have safeguards to keep this to a minimum, but you accept that some risk remains. You should back up critical systems and warn your providers before testing begins. You can pause a run at any time.

AI-generated findings. Our findings come partly from autonomous AI agents. Confirmed findings are supported by evidence, and unconfirmed items are labelled as candidates. Even so, AI output can be incomplete or wrong, and no form of testing finds every weakness. Decisions about remediation remain yours.

6. Acceptable use

When using the Site or Platform, you must not:

• break any applicable law;
• try to access any part of the Site, the Platform or connected systems without permission;
• run bots, scrapers or other automated tools against the Site without our written consent;
• direct the Platform at any system you do not own and are not authorized in writing to test;
• upload malware or any code intended to damage or disrupt systems;
• get around security measures, access controls or robot-exclusion rules;
• reverse engineer, decompile or disassemble the Platform, or copy our agents, attack libraries, models or prompts;
• resell or sublicense the Platform;
• give false information when you register or use the Platform.

We may suspend access immediately if we reasonably believe the Platform is being misused, and we may report unlawful activity to the authorities.

7. Ownership and licences

What we own. TACANS and its licensors own all intellectual property in the Site and Platform. This includes the software, agents, models, attack libraries, report templates and methods, designs, text, logos and trademarks (“TACANS IP”). These Terms give you only a limited, non-exclusive right to use the Site and Platform as they allow. You may not copy, modify, distribute or create derivative works from TACANS IP without our written consent.

What you own. You own your data and the findings about your own systems. Where a report includes TACANS IP, we grant you a perpetual, royalty-free licence to use, copy and share that report for your internal purposes. This includes sharing it with your auditors, regulators, insurers and service providers.

Improving the Platform. We may use de-identified, aggregated technical patterns from the Platform to improve our agents, provided they cannot identify you, your systems or any individual. If you send us feedback, we may use it freely and without payment.

8. Protecting confidential information

The Platform handles highly sensitive security data, and its misuse can have serious legal and operational consequences. Both parties therefore commit to the following.

• Your side. You must keep any non-public information about TACANS that you receive, including our methods and Platform details, strictly confidential. You may use it only for its intended purpose and may not share it with third parties without our written consent.
• Our side. We keep your findings and test data confidential and use them only to provide the Platform. We will never publish or share them, including in marketing or research, without your written consent unless the law requires it.

9. Personal data

Our Privacy Notice at tacans.com explains how we handle personal data. Where we process personal data on your behalf during testing, our DPA applies. Each party must comply with the data protection laws that apply to it when handling security data.

10. No warranties

The Site and Platform are provided “as is” and “as available”. To the extent the law allows, we give no warranties of any kind, whether express or implied. This includes any warranty of merchantability, fitness for a particular purpose, title, security, accuracy or non-infringement. We do not promise that your systems will be secure, or that the Site or Platform will run without interruption or errors.

11. Liability limits

To the extent the law allows, TACANS is not liable for indirect or consequential loss, or for loss of profits, revenue, bookings or data.

Our total liability to you under or in connection with these Terms is limited to the greater of the fees you paid us in the 3 (three) months before the claim arose and USD 1,000.

These limits do not apply to liability that cannot lawfully be limited. This includes liability for fraud, and for death or personal injury caused by negligence.

12. Your indemnity

You will indemnify and hold harmless TACANS and its officers, directors, employees and agents against all claims, damages, losses and costs, including legal fees, that arise from any of the following: your use of the Site or Platform; your breach of these Terms; testing you requested on any system you were not authorized to have tested; or your infringement of a third party’s rights.

13. Changes, suspension and termination

Changes to these Terms. For material changes, we will give you at least 30 days’ notice through the Platform or by email before they take effect. Other changes take effect when we post them and update the date at the top. If you do not accept a change, you must stop using the Site and Platform. Paid customers may also end their subscription as allowed in their customer agreement.

Suspension and termination. We may suspend or end your access to the Site or the free services at any time. For paid subscriptions, suspension and termination follow the notice and refund terms in your customer agreement. Any provision that is meant to continue after termination will continue, such as confidentiality, liability limits and the indemnity.

14. Law and disputes

These Terms are governed by the laws of the Dubai International Financial Centre. The DIFC Courts have exclusive jurisdiction over any dispute or claim that arises out of or in connection with these Terms.

15. Other legal terms

• Whole agreement. These Terms, together with your customer agreement and the DPA where they apply, make up the whole agreement between you and TACANS about their subject matter. Our Privacy Notice is provided for information and is not part of this contract.
• Severability. If any provision is found invalid, the rest of these Terms remain in force.
• No waiver. Choosing not to enforce a right now does not mean we give it up.
• Transfer. You may not transfer your rights under these Terms without our prior written consent.

16. Contacting us

For legal notices and questions about these Terms, write to legal@tacans.com. To report a vulnerability in TACANS’s own services, write to legal@tacans.com, marking your message “Security”.