Last Updated: April 7, 2026
By accessing or using the Phantava platform ("Service"), operated by Phantava ("Company," "we," "us"), you agree to be bound by these Terms & Conditions. If you do not agree, do not use the Service.
Phantava is an AI-powered offensive security operations platform that provides automated and semi-automated penetration testing, vulnerability assessment, reconnaissance, and security reporting capabilities. The Service integrates with third-party tools via the Model Context Protocol (MCP) and large language models (LLMs) to execute security testing workflows.
Phantava's core service, Assessments, operates autonomously using AI agents with no human intervention during execution. Once an Assessment is initiated, the AI will independently plan, execute, and adapt its testing activities within the defined scope. Phantava also provides a Terminal environment in which users may interact with AI-assisted workflows directly. These two modes of operation carry different risk profiles, and you acknowledge that you understand the distinction between them before use.
Phantava's capabilities include, but are not limited to:
The specific LLM providers and MCP integrations utilized by the Service are disclosed in our Privacy Policy, which is updated as those integrations change.
You represent and warrant that you have explicit, written authorization from the owner of any target system, network, or application before initiating any security assessment using the Service. Unauthorized access to computer systems is a violation of federal and state law, including but not limited to the Computer Fraud and Abuse Act (18 U.S.C. § 1030).
Because Phantava's Assessments operate autonomously without human intervention, scope definition is your sole responsibility. Before initiating any Assessment, you must define a precise scope including all authorized IP ranges, domains, subdomains, URLs, and asset identifiers. You acknowledge that the AI agent will act independently within that defined scope, and that any scope definition errors — including overly broad or incorrect target definitions — are entirely your responsibility.
You agree to:
Phantava does not independently verify that you hold authorization for any target system. The responsibility for ensuring lawful and authorized use rests entirely with you.
You may NOT use the Service to:
We reserve the right to suspend or terminate your account immediately if we reasonably believe you are violating this policy.
Phantava's Assessment feature operates through AI agents that act independently — without human oversight or intervention during execution. By initiating an Assessment, you acknowledge and accept the following:
Unpredictability of AI behavior. AI agents may take actions that are unexpected, non-linear, or not explicitly anticipated by the user. The AI adapts its approach based on discovered information and may pursue attack paths that were not specifically requested. This is inherent to autonomous AI-driven security testing.
No real-time human review. Unlike traditional penetration testing, Phantava Assessments are not supervised by a human operator in real time. You are solely responsible for monitoring active Assessments and for terminating them if circumstances change.
Potential for unintended impact. Autonomous security testing carries an inherent risk of causing unintended disruption to target systems, including service degradation, data modification, account lockouts, or triggering of security controls. You acknowledge and accept this risk as a condition of using the Assessment feature.
Prompt injection risk. Because Phantava's AI agents process content returned from target systems (including web pages, API responses, file contents, and error messages), those systems may contain adversarial content designed to manipulate AI behavior — a class of attack known as prompt injection. Phantava does not guarantee that its AI agents are immune to prompt injection attacks, and is not liable for any actions taken by the AI as a result of adversarially crafted target content.
Terminal use. The Terminal environment allows human-in-the-loop interaction with AI-assisted workflows. Users operating in the Terminal retain greater direct control but remain subject to all Terms herein. Terminal use does not reduce your responsibility for scope definition, authorization, or compliance.
Your responsibility to stop. You may terminate an active Assessment at any time through the Service interface. If you are unable to stop an Assessment and believe it is causing harm, you must contact Phantava immediately at legal@phantava.com. Phantava reserves the right to terminate any Assessment at its discretion.
You must provide accurate information when creating an account. You are responsible for maintaining the confidentiality of your credentials and for all activity under your account. Team administrators are responsible for managing team member access and permissions, including who is authorized to initiate Assessments on behalf of the team.
Certain features require a paid subscription. Billing is handled through our payment processor. Subscriptions auto-renew unless cancelled before the next billing period. Refunds are handled on a case-by-case basis. Free-tier and alpha access may be subject to usage limits and feature restrictions.
We take the security of your data seriously. Assessment data, credentials, findings, and reports are stored in encrypted databases. However:
Evidence artifacts. Assessments may generate evidence artifacts including screenshots, payloads, raw HTTP request/response data, and captured traffic. These artifacts are stored encrypted and associated with your account. You are responsible for handling, storing, and disposing of these artifacts in accordance with your engagement agreements and applicable law. Phantava retains evidence artifacts for a period defined by your subscription tier, after which they are permanently deleted.
AI training. Phantava does not use your assessment data, findings, custom prompts, or uploaded documents to train AI models without your explicit opt-in consent. Default LLM provider integrations are governed by those providers' own data usage policies, which are disclosed in our Privacy Policy. Where available, zero-retention API configurations are used.
Breach notification. In the event of a confirmed data breach affecting your assessment data, Phantava will notify affected account holders within 72 hours of confirming the breach, in accordance with applicable law.
Third-party LLM processing. AI-generated outputs (findings, reports) may be processed by third-party LLM providers as configured by your team. See our Privacy Policy for details.
We do not sell your data to third parties.
Your content: You retain ownership of assessment configurations, custom prompts, uploaded documents, and assessment findings generated through your use of the Service.
Our content: The Service, including its software, UI, documentation, default prompts, AI agent logic, and underlying models, is the intellectual property of Phantava and is protected by copyright and other intellectual property laws.
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED. We do not guarantee that:
Penetration testing inherently carries risk. You acknowledge that security testing — particularly autonomous AI-driven testing — may cause unintended disruptions to target systems, and you accept that risk.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, PHANTAVA SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO: loss of data, system downtime, business interruption, service disruption caused by autonomous AI actions, damages arising from prompt injection attacks on the AI agent, or damages arising from your use of the Service to test systems. Our total liability shall not exceed the amount you paid for the Service in the 12 months preceding the claim.
You agree to indemnify, defend, and hold harmless Phantava, its officers, employees, and agents from any claims, damages, losses, or expenses (including legal fees) arising from:
We may suspend or terminate your access at any time, with or without cause, including for violation of these Terms. Phantava reserves the right to immediately terminate any active Assessment if it determines, at its sole discretion, that the Assessment poses a risk of harm. Upon termination, your right to use the Service ceases immediately. You may export your data prior to termination where technically feasible.
We may update these Terms at any time. Material changes will be communicated via email or in-app notification. Continued use after changes constitutes acceptance of the updated Terms.
These Terms are governed by the laws of the Commonwealth of Massachusetts, USA, without regard to conflict of law principles. Any disputes shall be resolved in the courts of Massachusetts.
Customer acknowledges that all security testing performed through Phantava constitutes a point-in-time assessment of the target systems as configured at the time of testing. Phantava does not warrant or guarantee that any scan, assessment, or report will identify all vulnerabilities, misconfigurations, or security flaws present in the target environment, nor that results will be free from false positives, false negatives, errors, or omissions. Remediation guidance provided by Phantava is informational only and does not constitute a warranty, certification, or assurance of security.
Customer acknowledges that Phantava's outputs are generated by artificial intelligence and machine learning models, which may produce findings that are probabilistic in nature, non-deterministic, not fully explainable, or not reproducible across repeated assessments. Phantava expressly disclaims any liability arising from Customer's reliance on such outputs without independent verification.
Because Phantava's AI agents actively process content retrieved from target systems during autonomous Assessments, those systems may contain adversarial content designed to manipulate, redirect, or subvert AI behavior (prompt injection). Phantava makes no representation that its AI agents are fully resistant to such attacks and expressly disclaims liability for any assessment actions, outputs, or behaviors that result from the AI processing adversarially crafted content within a target environment.
Phantava may be used in the context of responsible disclosure programs or bug bounty engagements operated by third-party organizations ("Bug Bounty Programs"). If you are using Phantava within a Bug Bounty Program:
The Service integrates with third-party tools and services via the Model Context Protocol (MCP) and other integration mechanisms. With respect to such integrations:
Phantava reserves the right to add, remove, or modify third-party integrations at any time. Material changes to integrations that affect data handling will be communicated via our Privacy Policy.
For questions about these Terms, contact us at legal@phantava.com.