Terms of Service

These Terms of Service ("Terms") govern your access to and use of Necio, an AI security testing and behavioral compliance platform ("Service") operated by Prompt SecOps, LLC ("Prompt SecOps", "we", "us", or "our"). By creating an account or using the Service, you agree to these Terms. If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

These Terms incorporate by reference our Privacy Policy, Acceptable Use Policy, Security Testing Authorization, Export Control Compliance requirements, and any other policy or notice presented during registration or use of the Service.

AI Can Make Mistakes — Human Verification Required

Necio is built on artificial intelligence, and artificial intelligence makes mistakes. Prompts, grades, scores, verifications, summaries, and reports produced by the Service may be inaccurate, incomplete, out of date, or fabricated, including when more than one model agrees. A reported finding may be a false positive, and the absence of a finding is not evidence that a system is secure.

You are responsible for having a qualified human review and independently verify every result before you rely on it, act on it, share it, or present it to anyone else — including for remediation, disclosure, procurement, audit, or compliance decisions. Necio is intended to support professional judgment, not to replace it.

To the maximum extent permitted by applicable law, Prompt SecOps is not responsible or liable for any decision you make, action you take, or loss you suffer in reliance on Service output. Sections 8, 9, and 10 govern.

Sensitive Evidence & Grading

The Service masks detected sensitive values in evidence presented through the app, reports, exports, notifications, and telemetry. You authorize this processing to reduce further exposure while retaining useful context and detection information. Original evidence is still processed by authorized testing and grading workflows as described in our Privacy Policy; masking does not alter grading inputs or scores.

Evidence masking may remove details from exported material, and browser artifacts may use sanitized text reconstructions in place of source-page images. Unverified historical images may be unavailable. Detection is automated and is not a guarantee of anonymization or complete discovery of personal information or secrets. You remain responsible for reviewing findings and taking appropriate action on exposed credentials or personal data.

1. Description of Service

Necio provides automated vulnerability scanning, behavioral integrity monitoring, and compliance reporting for large language model (LLM) applications and AI systems. The Service sends security testing prompts, including adversarial prompts and any files you attach to them, to AI systems you configure, analyzes responses, and produces security reports aligned with frameworks such as OWASP Top 10 for LLM Applications.

Target types. A target may be an API endpoint you hold a key for; a browser-based chat interface, which the Service reaches by driving an automated browser session against a URL you supply and, where required, signing in with credentials you supply; or a bot reached through a messaging channel such as Discord, Slack, Telegram, or Microsoft Teams, where the Service may create a temporary channel and invite the bot in order to run the test. Browser-driven and channel-based testing are beta features.

How test prompts are generated. The Service generates adversarial test prompts and Maestro campaign turns using AI models we select, including open-weight models. This is deliberate: real attackers use openly available models, and a model with fewer built-in refusals produces payloads that resemble what an adversary would actually send. Generating realistic attack payloads is the function the Service performs. Accordingly, prompts generated by the Service may be blunt, manipulative, deceptive, or offensive by design, and may contain content a consumer-facing assistant would decline to produce. They are testing artifacts, intended solely to be sent to systems you are authorized to test. See Section 8.

Web search and cited sources. Certain features of the Service, including prompt generation and response verification, may use web search through third-party search providers to ground output in current threat research. Search results originate from third parties and are used as reference material only.

For web searches, the third-party search provider retrieves the pages. The Service receives text excerpts and web addresses. It does not fetch, download, or execute content from cited sites. Citations identify the source of retrieved text. They do not indicate that we reviewed, endorsed, or checked the safety of a site. We do not control or inspect those sites. Search results can be in any language and may be inaccurate, misleading, machine-translated, republished, or hostile. You are responsible for deciding whether to open a cited link, and you do so at your own risk.

2. Eligibility & Account Registration

You must be at least 18 years old and capable of forming a binding contract to use the Service. You agree to provide accurate account information and to keep it current. You are responsible for all activity under your account. Notify us immediately at [email protected] if you suspect unauthorized access.

If you register or sign in using a third-party identity provider (such as Google), you authorize us to receive your name, email address, and verified-email status from that provider, and you are responsible for maintaining the security of your account with that provider. Your use of the identity provider is governed by its own terms and privacy policy.

You are responsible for protecting every credential you submit, including API keys, browser sign-in credentials, bot tokens, and channel identifiers. Use credentials with permissions appropriate to the authorized test. You represent that you are entitled to use each credential. Do not submit another person's credentials. We strongly recommend a dedicated test account instead of a personal or production account. Rotate credentials according to your organization's policy and immediately after actual or suspected exposure. To replace a saved schedule credential, open the Schedule page through Edit schedule; future runs will use the replacement credential.

3. Authorized Use: Security Testing

Necio is a professional security testing tool. You may only use it to test AI systems and LLM endpoints that you own or for which you have explicit written authorization from the system owner.

By using the Service you represent and warrant that:

• You have legal authority to test every AI system, endpoint, chat interface, or bot you configure in Necio
• Your use complies with all applicable laws, regulations, and the terms of service of any third-party provider or platform you target
• You will not use the Service to harass, harm, or disrupt systems you do not own or have permission to test
• For a browser-based target, you are authorized to access and to automate that interface, and you authorize the Service's automated session to accept cookie, consent, and terms-of-use dialogs on that site on your behalf in order to reach the chat
• For a channel-based target, you are authorized to create channels in, invite bots to, and send messages through the workspace, server, or account you configure, and to test the bot you name
• You hold the rights necessary to attach each file you upload and to transmit it to the target
• Your authorization covers the particular targets, test activities, automation, and testing period you select; you will keep the supporting records and stop testing when permission expires or is withdrawn

Holding an account is not authorization to attack it. Being a legitimate user of a third-party chat service, workspace, or bot does not by itself give you the right to run adversarial testing against it or to automate it. Several providers prohibit both in their terms. Authorization to test must come from the party that owns the system.

Prompt SecOps is not liable for any unauthorized or illegal testing you conduct using the Service. Unauthorized testing of third-party systems may violate the Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, or equivalent laws in your jurisdiction.

4. Prohibited Uses

You agree not to:

• Use the Service to attack, disrupt, or degrade systems you do not have authorization to test
• Use the Service's prompt generation to produce jailbreaks, attack payloads, or other adversarial content for use outside authorized testing of systems you control
• Use the Service to obtain restricted AI content for purposes other than testing your configured target, or to bypass another provider's safety controls
• Extract, stockpile, publish, or resell prompts generated by the Service as an attack toolkit or dataset
• Use browser automation or channel features to defeat a target's access controls, anti-automation measures, bot detection, CAPTCHAs, or rate limits where you are not authorized to do so
• Submit credentials belonging to another person, or credentials you are not entitled to use
• Attempt to circumvent authentication, rate limits, or security controls of the Service itself
• Scrape, resell, or redistribute Necio's proprietary prompt templates without written permission
• Reverse engineer, decompile, or extract source code from the Service
• Use the Service for any unlawful purpose or in violation of any applicable regulations
• Impersonate another user, organization, or Prompt SecOps employee
• Upload or transmit malware, viruses, or malicious code through the Service
• Submit, request, generate, test, store, distribute, or attempt to obtain child sexual abuse material (CSAM), child sexual exploitation material, sexual content involving minors, or instructions involving exploitation of minors
• Use the Service to create, facilitate, or conceal sexual exploitation, non-consensual sexual imagery, trafficking, grooming, extortion, harassment, doxxing, credential theft, phishing, malware deployment, unlawful surveillance, or other criminal activity
• Use the Service to plan, facilitate, or promote terrorism or violent extremism; to develop, acquire, or deploy chemical, biological, radiological, or nuclear weapons; or to attack, disrupt, or compromise critical infrastructure
• Use the Service in violation of export control laws, sanctions, embargoes, or restrictions on prohibited end users, jurisdictions, or end uses

You are solely responsible for all prompts, uploads, targets, outputs, and activity under your account. Prompt SecOps does not author, direct, endorse, or assume responsibility for user-generated prompts or illegal use of the Service. If you submit, request, generate, test, store, or distribute CSAM, child sexual exploitation material, sexual content involving minors, or other illegal sexual content, you may be reported to law enforcement and are solely responsible for any civil, criminal, regulatory, or other legal consequences.

5. Subscriptions, PAYGO Credits & Billing

Subscription plans are billed in advance on a monthly or annual cycle through Stripe. Prepaid PAYGO purchases are one-time payments, with automatic top-ups only when separately authorized as described below. You authorize the payments you confirm and any applicable taxes disclosed at checkout.

Prepaid pay-as-you-go (PAYGO). New accounts start on prepaid PAYGO without a credit purchase or payment method. After registration, you can set up your Use Case Applications and templates. Purchase credits before starting billable AI work, including AI prompt generation and scans. Credit purchases start at $5 through Stripe; generation and scan costs are deducted from your available balance. Additional credits are purchased in $5 increments; $5 buys $5 of usage credit. Prepaid PAYGO has no monthly base fee. Purchased credits do not expire and are applied to eligible usage on your account. Credits are usage balances, not AI tokens: the number of tokens they cover depends on the model, feature, and applicable rates. Existing legacy metered PAYGO accounts remain on their disclosed billing terms until migrated; purchasing credits does not itself cancel an existing subscription.

Minimum charges. Metered rates reflect the cost of running a request on our platform, not only the price the model provider charges us. A minimum per-token charge may therefore apply to any metered request, including requests routed to models a provider offers at no cost to us. The rate shown in the app at the time of use is the rate you are billed.

Available credit and automatic top-up. Usage is deducted from prepaid credits. Credit may be reserved for work in progress and settled against recorded usage when that work completes; unused reservations are released. Work may be blocked or interrupted when available credit is insufficient. Prepaid PAYGO does not use the legacy monthly usage spend cap. If you enable automatic top-up, you separately authorize charging your saved card for the selected amount when available credit falls below your selected threshold, subject to your monthly top-up limit. That limit includes applicable tax and pending charges and resets on the first day of each month (UTC). Saving a card alone does not enable automatic top-up. You may disable it in Billing & Plans; payments already initiated may still complete. Failed payments, required authentication, or reaching the limit can interrupt usage. We recommend enabling automatic top-up for scheduled prepaid PAYGO scans to help avoid interruptions when credits run low. It is optional; scheduled runs may proceed without it when enough credit is available.

Complimentary and promotional access. We may offer free trials, complimentary plan upgrades, credits, or other promotional access at our discretion. Promotional access is provided "as is," may be subject to additional conditions, may be modified or revoked at any time, and does not create any entitlement to continued access, features, or pricing. When promotional access ends, your account may revert to your paid plan or to restricted access until you select a plan.

Pricing and Token Costs. Necio records input and output tokens and other applicable usage, including billable prompt generation, grading, verification, and web-search activity. Charges vary by model and feature and may include a margin over provider costs. Usage already incurred may remain chargeable even if a scan is later canceled or does not produce a usable result. Each scan or Maestro campaign that reaches its target bills at least $0.02 of AI usage; automated Web Chat scans also incur a $0.50 execution fee. Usage records generated by the Service are the basis for credit deductions and legacy PAYGO charges; report a good-faith dispute within 30 days. AI providers may change their pricing or billing structures. Updated usage rates apply prospectively and are displayed in the application; a credit balance does not lock in a token price.

Refunds. Monthly and annual subscription fees, PAYGO credit purchases (including automatic top-ups), and consumed usage are non-refundable except where required by applicable law. If you believe you were charged in error, contact us within 30 days at [email protected].

Cancellation. You may cancel your subscription at any time through the account or billing settings made available in the Service, or by contacting us. Cancellation takes effect at the end of the current billing period; you retain access until then.

Third-party provider fees. Necio selects and may change providers and models based on performance, availability, and suitability for each scan task. You are solely responsible for third-party fees, quotas, rate limits, and charges from your scans. These include charges from the target provider and any messaging or chat service you test.

We may suspend or downgrade access for failed payments, chargebacks, payment fraud, or billing abuse.

We reserve the right to change pricing with at least 30 days' notice to active subscribers.

6. Intellectual Property

The Service, including its software, prompt templates, scoring algorithms, UI, and documentation, is owned by Prompt SecOps and protected by intellectual property laws. These Terms do not transfer any ownership rights to you.

Your data. You retain ownership of all data you bring to the Service, including AI system outputs captured during scans. You represent that you have all rights, permissions, and authorizations necessary to submit that data to the Service. You grant Prompt SecOps a limited license to process this data solely to provide, secure, support, and improve the Service. We do not use your scan data to train AI models or share it with third parties except as described in our Privacy Policy.

Data availability and retention. The Service automatically expires or minimizes raw scan and Maestro campaign content, private screenshot evidence, activity records, and detailed findings according to the schedule in our Privacy Policy, including while an account remains active. Files you attach to test prompts are deleted 48 hours after upload. Necio is not an archival or backup service.

30-day availability and compliance storage. Prompt SecOps does not undertake responsibility for storing, retaining, or making scan data, scan results, or web chat image artifacts available beyond 30 days after creation, except as required by applicable law or a separate written agreement. This is not a guarantee that every record will be deleted on day 30; the Privacy Policy describes the applicable data-processing retention schedule. If you need records for longer than 30 days for compliance, you must configure a SIEM connection in Settings → SIEM Integration before the applicable availability period ends. You are responsible for verifying successful delivery and configuring retention and access controls in your SIEM. SIEM delivery does not extend Necio storage and may not include every field or image artifact; separately export and preserve any required records or artifacts not delivered by the integration. Uploaded prompt attachments remain subject to their shorter 48-hour deletion period.

Feedback. If you provide feedback, suggestions, or ideas about the Service, you grant Prompt SecOps a perpetual, irrevocable, worldwide, royalty-free license to use that feedback without restriction or compensation.

The OWASP Top 10 for LLM Applications framework referenced within Necio is licensed under CC BY-SA 4.0. OWASP® is a registered trademark of the OWASP Foundation.

7. Service Availability, Maintenance, and Security Updates

We may suspend, interrupt, limit, disable, or modify access to all or part of the Service at any time, with or without prior notice, to perform maintenance, deploy security updates, remediate vulnerabilities, respond to security incidents, prevent abuse, preserve platform integrity, or comply with legal obligations.

Stopping hosted testing. You may cancel a scan, and we may stop testing for an account or pause hosted testing across the platform for security or operational reasons. These controls also apply to new attempts, retries, and scheduled testing. If the Service cannot verify the control state required for execution, it stops sending new work until that state can be verified. A stopped run may contain partial results and may require a new run to continue. Cancellation is not a recall: a request already accepted by a target or model provider may finish and incur charges, and stopping cannot retrieve content already sent to a third party.

When practical, we will use commercially reasonable efforts to notify affected users in advance or promptly after the action begins, and to provide reasonable updates through email, in-app notices, a status page, or other appropriate channels. Emergency security actions may be taken without prior notice when delay could increase risk to the Service, users, data, or third parties.

Unless separately agreed in writing, the Service does not include any uptime commitment, support service level, or guarantee of uninterrupted availability. Security and platform integrity may require immediate action, including temporary downtime.

AI Model Availability. Necio selects models for each internal task, including open-weight models for test prompts and Maestro turns. We may substitute equivalent models or providers at any time because of availability, deprecation, outages, cost, or quality. Substitutions are intended to maintain or improve service quality and functionality. We do not guarantee a particular model, model family, provider, or hosting jurisdiction. Model selection is not a subscription term.

8. AI-Generated Output; No Professional Advice

Necio uses artificial intelligence systems to generate test prompts, grade responses, verify results, and produce reports. AI-generated output may contain inaccuracies, hallucinations, false positives, false negatives, or unintended content, even when multiple models are used to verify a result. You must independently review and validate findings before relying on them or taking action, including remediation, disclosure, procurement, or compliance decisions.

Adversarial output is intentional. The Service intentionally generates attack payloads using models, including open-weight models, selected partly for their ability to produce them. Prompts may contain offensive, manipulative, deceptive, or unsafe content for testing. They are not our recommendations, views, instructions, or endorsement of that conduct. A model producing a payload does not make it lawful to send. You control where prompts go, who can see them, and how results are handled. Do not forward, publish, or reuse payloads outside authorized testing.

Browser-driven and channel-based testing. Results from browser-based or channel-based targets depend on third-party interfaces we do not control. Layout changes, sign-in walls, bot-detection or CAPTCHA challenges, rate limits, session expiry, and message-delivery failures can cause a run to stop, time out, or capture an incomplete response. The Service reports these outcomes rather than grading them as a pass or a failure, but they still affect coverage and comparability between runs. These features are beta and may change or be withdrawn.

Some features consult third-party web sources to generate or verify output. Those sources may be inaccurate, outdated, incomplete, or manipulated, and grounding output in web search does not guarantee its accuracy. Web-derived content is provided as reference material only and remains subject to your obligation to independently review and validate findings.

Scores, grades, report cards, framework mappings (such as OWASP Top 10 for LLM Applications), and other results produced by the Service are informational security-testing output only. They are not legal, regulatory, audit, or compliance advice; they are not a certification, attestation, or guarantee of compliance with any law, framework, or standard (including SOC 2, ISO 27001, GDPR, HIPAA, or the EU AI Act); and they do not establish that any system is secure or free of vulnerabilities. You assume full responsibility for any decision made or action taken in reliance on Service output.

9. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. PROMPT SECOPS DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF VULNERABILITIES. SECURITY TESTING RESULTS ARE INFORMATIONAL AND DO NOT CONSTITUTE A GUARANTEE THAT YOUR AI SYSTEMS ARE FREE FROM SECURITY FLAWS.

Beta, preview, experimental, or free features may be changed, suspended, or discontinued at any time.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, PROMPT SECOPS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING FROM YOUR USE OF OR INABILITY TO USE THE SERVICE. OUR TOTAL LIABILITY TO YOU FOR ANY CLAIM ARISING UNDER THESE TERMS SHALL NOT EXCEED THE GREATER OF (A) THE TOTAL FEES PAID BY YOU IN THE 12 MONTHS PRECEDING THE CLAIM OR (B) USD $100.

11. Indemnification

You agree to indemnify, defend, and hold harmless Prompt SecOps, its officers, directors, employees, and contractors from and against any claims, liabilities, damages, losses, and expenses (including reasonable attorneys' fees) arising from: (a) your use of the Service in violation of these Terms; (b) your unauthorized testing of third-party systems; (c) data or content you submit to the Service, including any claim that it infringes or misappropriates third-party rights or was submitted without necessary rights or authorizations; or (d) your violation of any applicable law or third-party rights.

12. Termination

You may terminate your account at any time from the account settings page. We may suspend or terminate your access immediately, without prior notice, if you breach these Terms or if we determine your use poses a risk to the Service or other users. Upon termination, your right to use the Service ceases. Any provisions that by their nature should survive termination will survive, including intellectual property, warranty disclaimers, liability limitations, indemnification, dispute resolution, and payment obligations.

After termination or account deletion, we may delete scan data and account content. We may retain consent, authorization, billing, usage, and security records as described in our Privacy Policy. Export any reports you need before closing your account.

13. Export Controls & Sanctions

The Service, including its security-testing capabilities, may be subject to U.S. export control and sanctions laws, including the Export Administration Regulations (EAR) and regulations administered by the Office of Foreign Assets Control (OFAC). You represent and warrant that you are not located in, organized under the laws of, or ordinarily resident in any embargoed or comprehensively sanctioned jurisdiction; that you are not on any U.S. or other applicable restricted-party list; and that you will not use, export, re-export, or transfer the Service in violation of applicable export control or sanctions laws, or for any prohibited end use.

14. Governing Law & Disputes

These Terms are governed by the laws of the Commonwealth of Virginia, USA, without regard to conflict-of-law provisions. Any dispute arising under these Terms shall be resolved by binding arbitration under the rules of the American Arbitration Association, except that either party may seek injunctive relief in a court of competent jurisdiction or bring an individual claim in small claims court where permitted. You and Prompt SecOps each waive the right to a jury trial and the right to participate in a class-action lawsuit, class-wide arbitration, private attorney general action, or other representative proceeding.

Informal resolution first. Before initiating arbitration, you agree to first contact us at [email protected] with a written description of the dispute and give us 60 days to work with you to resolve it informally. Arbitration may be conducted remotely or in Virginia unless the parties agree otherwise.

Arbitration opt-out. You may opt out of this arbitration agreement by emailing [email protected] within 30 days of first accepting these Terms, including your name, account email, and a statement that you opt out of arbitration. Opting out does not affect any other provision of these Terms.

Changes to this arbitration agreement. If we make a material change to this Section 14, you may reject the change by emailing [email protected] within 30 days after the change takes effect, stating that you reject it. If you reject a change, the version of this Section 14 you most recently accepted before the change continues to govern disputes between you and Prompt SecOps. A change to this Section 14 never applies to a dispute that arose, or that either party had notified the other of, before the change took effect.

15. Changes to These Terms

We may update these Terms from time to time. Material changes will be communicated via email or in-app notice at least 30 days before taking effect. Continued use of the Service after the effective date constitutes acceptance of the updated Terms.

Changes apply going forward only. A dispute is governed by the version of these Terms in effect when the dispute arose, and changes to Section 14 are subject to your right to reject them described in that Section.

16. General Terms

These Terms, together with the policies incorporated by reference, are the entire agreement between you and Prompt SecOps regarding the Service. If any provision is found unenforceable, the remaining provisions remain in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our prior written consent; we may assign them in connection with a merger, acquisition, reorganization, or sale of assets. We are not responsible for delays or failures caused by events beyond our reasonable control. Notices may be provided by email, in-app notice, or posting through the Service.

Notice to California residents. Under California Civil Code Section 1789.3, California users are entitled to the following notice: you may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, California 95834, or by telephone at (800) 952-5210, to resolve a complaint regarding the Service or to receive further information regarding use of the Service.

17. Contact