Terms of service

1. Who we are

Unwhisper is provided by CYBERROCK LTD, a company registered in England and Wales (company number GB15069070, VAT number GB490464379), with its registered office at 128 City Road, London EC1V 2NX, United Kingdom. In these terms "we", "us" and "our" mean CYBERROCK LTD, and "you" means the organisation entering into these terms.

2. These terms

These terms, together with the privacy policy and the information provided on the billing page, form the agreement between us. By creating an account or using the service you accept them. If you are accepting on behalf of an organisation, you confirm you have authority to bind it.

We may change these terms from time to time. For changes that materially reduce your rights we will give at least 30 days' notice by email to your account address, and you may terminate without penalty before they take effect. Other changes take effect when published.

When we do change these terms, you will be asked to agree to the updated terms in the console. Your API keys continue to work in the meantime, so an integration already in production is not interrupted while you review the changes.

If you have not agreed to the updated terms within three months of them being made available, we reserve the right to cancel the agreement. Where a refund is due, it will be calculated pro rata for the unused part of the period you have paid for.

3. The service

Unwhisper inspects text and files you submit and returns a verdict indicating whether prompt-injection content was detected, together with confidence scores and per-finding detail as a forensic report when requested. It is available as a hosted API, testing via a browser console, and for on-premises deployment under a separate licence (clause 10).

4. What the service does not do

Unwhisper is a detection aid, not a guarantee. It uses statistical classifiers. No such system detects every attack, and no such system is free of false positives.

A PASS verdict means no prompt-injection content was detected. It is not a warranty that the content is safe, benign, or free of any other category of malicious content. A FAIL verdict means content was detected that matches patterns of prompt injection; it is not an assertion that any person acted unlawfully.

Unwhisper is one control among several. You remain responsible for the design and security of your own systems, and for deciding what to do with a verdict. You should design robust processes in your product to manage both false negatives and false positives. You should not use it as the sole safeguard where failure would cause material harm. It is not a substitute for anti-virus, data-loss prevention, content moderation, or human review.

5. Your content

You keep all rights in the content you submit. You grant us only the limited permission needed to process it in order to return a verdict.

Content submitted for scanning is never retained. It is discarded once the verdict is returned. We do not log or store it, and we do not use it to train our models. We keep the verdict and the usage metrics needed to bill and operate the service. Where you request a forensic report, that report is available through a signed link for five minutes and is then deleted. See the privacy policy.

You are responsible for having the right to submit the content you scan, and for any personal data within it. Where we process personal data on your behalf we do so as processor and you as controller, on the terms of our data processing agreement.

6. Acceptable use

You may use Unwhisper only on content you are authorised to test. You must not:

• use it to attack, probe or disrupt systems you do not own or have permission to test;
• attempt to disrupt, overload or circumvent the service, its rate limits or its credit accounting;
• resell, sublicense or provide the service to third parties as a standalone offering, except under a written agreement with us;
• reverse engineer the service or attempt to extract, copy or reconstruct our models, weights or training data;
• use it in breach of applicable law, or for any purpose intended to cause harm.

Probing Unwhisper's own detection with adversarial content is expected and permitted; that is what it is for. Attacking the infrastructure it runs on is not.

7. Accounts and security

Accounts require a verified work email address and are for organisations, not consumers. You are responsible for keeping your API keys confidential and for all activity carried out with them. Tell us promptly at info@cyberrock.ai if you believe a key has been compromised, and we will revoke it.

8. Plans, credits and payment

Usage is metered in credits. Current plans and their allowances are shown on the billing page, which forms part of these terms. Prices are exclusive of UK VAT, which is charged where applicable.

Subscription fees are billed in advance and are non-refundable except where required by law or where these terms allow. Credits included with a plan are valid for the billing period and do not carry over. Purchased credit bundles do not expire while your subscription remains active. Credits have no cash value and are not refundable or transferable.

When your subscription ends, or your account is closed, all remaining credits are cancelled — both the allowance included with your plan and any credit bundles you have purchased. If you have unused purchased credits and intend to keep using the service, do not let your subscription lapse.

You may cancel at any time; cancellation takes effect at the end of the current billing period and you keep access until then. Non-payment may lead to suspension after notice.

9. Availability and support

We aim to keep the hosted service available and to give reasonable notice of planned maintenance, but we do not commit to a service level unless one is agreed in writing with your plan. We may suspend the service without notice where necessary to protect its security, integrity or other users, and will restore it as soon as practicable.

Support channels vary by plan and are listed on the billing page and web portal.

10. On-premises deployment

Where you run Unwhisper inside your own environment, we grant you a non-exclusive, non-transferable licence to run it for your own internal business purposes for the term agreed. Deployed instances validate their licence periodically over the network. If validation fails continuously beyond the grace period, scanning stops rather than continuing unlicensed. You must not tamper with, disable or circumvent licence validation.

The software, models and weights remain our property. Nothing in these terms transfers ownership of them.

11. Warranties and liability

We provide the service with reasonable care and skill. Except as expressly stated in these terms, and to the extent permitted by law, we exclude all other warranties, whether express or implied, including any implied warranty of satisfactory quality or fitness for a particular purpose.

Nothing in these terms limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited or excluded.

Subject to that, neither party is liable for loss of profit, loss of business, loss of anticipated savings, loss of goodwill, or any indirect or consequential loss. Subject to that, our total aggregate liability arising out of or in connection with these terms is limited to the total fees paid by you in the twelve months before the event giving rise to the claim.

In particular, and given clause 4, we are not liable for loss arising from content that Unwhisper did not detect, or from content it flagged that you considered benign.

12. Confidentiality

Each party will keep the other's confidential information confidential and use it only for the purposes of this agreement. This does not apply to information that is public through no breach, independently developed, or required to be disclosed by law.

13. Termination

Either party may terminate on 30 days' written notice, or immediately if the other is in material breach and has not remedied it within 14 days of being asked to. We may suspend or terminate immediately for breach of clause 6. We may also cancel under clause 2 if you have not agreed to updated terms within three months of their being made available.

On termination your right to use the service ends. We will delete your account data within a reasonable period, except where we must keep records to meet legal or accounting obligations. Clauses 5, 11, 12 and 14 survive termination.

14. Governing law and jurisdiction

These terms and any dispute arising out of or in connection with them, including non-contractual disputes, are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

15. General

You may not assign this agreement without our written consent; we may assign it to a group company or in connection with a sale of the business. If any provision is held unenforceable, the rest remains in force. Failure to enforce a term is not a waiver of it. These terms are the entire agreement between us on this subject. No third party may enforce them under the Contracts (Rights of Third Parties) Act 1999.

16. Contact

info@cyberrock.ai

CYBERROCK LTD, 128 City Road, London EC1V 2NX, United Kingdom