Terms of Service

These Terms of Service (hereinafter "Terms") apply to all contracts between IJONIS UG (haftungsbeschränkt) (a German limited-liability company, hereinafter "IJONIS") and the customer concerning autonomous penetration tests and related services delivered under the "DeepMantis" brand (deepmantis.io).

Full mandatory disclosures regarding IJONIS (registered address, management, commercial register) are listed in our Legal Notice.

Any conflicting, differing, or supplementary terms of the customer shall not become part of the contract unless IJONIS has expressly agreed to their applicability in writing. These Terms apply exclusively even if IJONIS, with knowledge of conflicting customer terms, performs a service without reservation.

These Terms apply exclusively to business customers (Unternehmer within the meaning of § 14 BGB, German Civil Code), legal entities under public law, and special funds under public law. No contracts are concluded with consumers (Verbraucher within the meaning of § 13 BGB).

The contractual services provided by IJONIS comprise autonomous penetration tests against customer-defined targets (in particular web applications, APIs, and cloud configurations) within the framework of the DeepMantis platform methodology, as well as related advisory and reporting services.

The deliverables for an engagement typically include:

• a report identifying vulnerabilities, with reproduction steps, business-impact assessment, and remediation guidance;
• reproductions of identified vulnerabilities at the level of detail agreed in the scope-of-work;
• re-testsfollowing the customer's remediation, to the extent agreed in the scope-of-work.

Specific service scope — in particular tier selection, number of re-tests, delivery times (turnaround), additional advisory services, and any special services — is agreed exclusively in the relevant scope-of-work (see § 3) between the parties.

No warranty of completeness: By their nature, penetration tests are best-effort services against the defined scope. IJONIS owes the professional execution of tests in line with the state of the art and the DeepMantis methodology, but does not owe any specific outcome and in particular does not guarantee the discovery of all existing vulnerabilities. A reversal of the burden of proof for undiscovered vulnerabilities is excluded.

These Terms form the master agreement between the parties. Each individual penetration-test order (hereinafter "engagement") is concluded via a separate "scope-of-work" on the basis of these Terms. The scope-of-work governs in particular: service scope, target systems (in-scope / out-of-scope), tier selection, delivery times, fees, and engagement-specific cooperation duties.

The contract is concluded upon signing of the scope-of-work by an authorised representative of the customer through the DeepMantis onboarding portal. Signing takes place as an OTP-gated typed signature with a cryptographic SHA-256 audit hash and a timestamp- and IP-based audit trail. The parties recognise this form of electronic signature as legally binding under § 127(2) BGB (text form requirements).

By signing the scope-of-work, the customer confirms bindingly:

• its authorisation to commission the agreed services, in particular internal approval by a person empowered to commission;
• ownership or sole control of all systems listed in scope, or the existence of all required third-party permissions (see § 4);
• its knowledge of these Terms and its express agreement to their application to the relevant engagement.

In the event of a conflict between these Terms and the scope-of-work, the provisions of the scope-of-work shall prevail to the extent that expressly divergent provisions have been agreed there. In all other respects these Terms apply on a supplementary basis.

The customer expressly warrants its authorisation to commission the agreed penetration tests as well as ownership or sole control over all systems listed in scope.

The customer ensures that systems operated or hosted by third parties (for example, cloud providers, SaaS providers, external hosters, shared infrastructure) are only included in scope if the required express permission of the third party has been obtained. The customer shall provide such permission to IJONIS in writing or text form upon request. The customer indemnifies IJONIS against all third-party claims arising from a missing or insufficient permission.

The customer cooperates in good faith throughout the engagement. In particular, the customer is obliged:

• to provide all information necessary for performance in a timely and complete manner — in particular scope definitions, credentials (where applicable), indications of fragile systems, maintenance windows, and black-out periods;
• to name a technically competent and decision-empowered point of contact for the duration of the engagement and to ensure that this person is reachable;
• to inform IJONIS without undue delay about changes to scope, to the availability of target systems, or about security-critical incidents during the engagement;
• to maintain suitable backup and rollback measures for the target systems where this is appropriate given the nature of the systems being tested.

No set-off: The customer may set off claims against IJONIS only to the extent that the counterclaim is undisputed or has been finally adjudicated. The customer may exercise a right of retention only if the counterclaim arises from the same contractual relationship.

If the customer breaches its cooperation or authorisation duties under this § 4, IJONIS is entitled to suspend or terminate the affected engagement without notice. The customer is liable to IJONIS for all damages arising from such breaches, including third-party claims.

IJONIS tests exclusively against the scope authorised in the relevant scope-of-work. No tests take place outside the authorised scope.

Tests are carried out in accordance with the publicly documented DeepMantis methodology (currently available in the engagement onboarding portal; a publicly linked methodology page at /en/methodology will be made available in a later update). IJONIS undertakes to conduct tests in line with the state of the art and with the professional standards recognised among professional penetration-test service providers.

Test ethics: tests are carried out in a non-destructive manner where compatible with the test objective. In particular, IJONIS undertakes:

• to limit data access to what is required to demonstrate the specific vulnerability — typically boundary mapping (structures, schemas, metadata, access paths), supplemented where necessary by targeted, volume-minimised samples to evidence sensitivity (for example, to classify data as personal, payment or health data). The scope depends on the vulnerability concerned and is documented in the report;
• not to leave persistence mechanisms (for example, backdoors, durable implants) on target systems;
• not to perform lateral-movement activities outside the authorised scope;
• to document all test artefacts (for example, temporary files, test accounts) at the close of the engagement and to remove them at the customer's request.

Data handling during tests: All customer data accessed or retrieved in the course of an engagement is treated confidentially in accordance with § 8 of these Terms. Such data is processed solely for the purposes of vulnerability analysis, preparation of the report and the evidence contained therein; stored in the EU regions of our processors as listed at /en/legal/privacy; transmitted in encrypted form; and deleted no later than 90 days after delivery of the report. Earlier deletion is performed on the customer's written request. Customer data is not used to train AI models or for any purpose unrelated to the engagement; methodological insights (see § 8 (4)) are used solely in anonymised form and without customer-identifiable content.

Delivery of the report takes place within the time frame agreed in the scope-of-work (standard: between 2 and 10 business days after completion of the test phase, depending on tier). Delays caused by incomplete cooperation by the customer (§ 4) shall not be borne by IJONIS.

Fees are determined by the fixed price agreed in the relevant scope-of-work. All prices are stated in euros (EUR) plus statutory value added tax (VAT).

Unless otherwise agreed in the scope-of-work, invoices are payable net within 14 days of receipt without deduction.

In the event of payment default, IJONIS is entitled to claim statutory default interest under § 288(2) BGB at 9 percentage points above the base rate for transactions between entrepreneurs. The right to claim further damages caused by default remains reserved.

If the customer is in default with a payment that has fallen due, IJONIS is entitled, after a prior written reminder with a reasonable deadline, to suspend provision of further services — including under other scope-of-work agreements with the same customer — until full receipt of payment.

Subscription fees are governed by § 6a.

(1) Subscription model. As an alternative to per-engagement procurement under § 3, IJONIS offers annual subscriptions to the DeepMantis platform across tiered service levels. Subscription tiers — including the monthly rate, included testing scope (target count, retest frequency, advisory hours), and any usage caps — are defined in the relevant subscription scope-of-work. The customer commits to a fixed twelve-month term, billed in full upfront in euros (EUR) plus statutory value added tax (VAT).

(2) Formation and eligibility. Subscription contracts are concluded via the same OTP-gated typed-signature mechanism set out in § 3. Subscriptions are available exclusively to business customers (Unternehmer within the meaning of § 14 BGB); § 1 paragraph 4 applies in full.

(3) No refunds; narrow carve-outs. Subscription fees are non-refundable in whole or in part on customer-initiated cancellation, on termination for cause attributable to the customer, or on partial dissatisfaction. A pro-rata refund of the unused subscription period is granted only where (a) IJONIS terminates the subscription without cause attributable to the customer, or (b) the DeepMantis platform is materially unavailable for more than thirty (30) consecutive days during the subscription term despite the customer's complete cooperation. No further refund mechanism is offered.

(4) Mid-term tier upgrade. The customer may upgrade to a higher tier mid-term by signing an upgrade scope-of-work. The upgrade fee equals the difference between the new tier monthly rate and the original tier monthly rate, multiplied by the number of months remaining in the current subscription term, and is invoiced on the upgrade date. The subscription end-date remains unchanged; the upgraded tier scope applies from the upgrade date forward. Mid-term downgrades are not permitted; any downgrade takes effect at the start of the next subscription term only. Where the customer's actual scope exceeds the highest available tier, additional engagements are commissioned as separate scope-of-works under § 3 at IJONIS's then-current standard rates.

(5) Renewal and price changes. Subscriptions do not auto-renew. Renewal requires a fresh subscription scope-of-work signed prior to the expiry date of the current term; if no renewal is signed, service ceases on the expiry date. IJONIS may set different pricing for any renewal term and shall notify the customer at least sixty (60) days before the expiry date of any change to the renewal rate. The customer is free to renew at the notified rate or to allow the subscription to expire.

(6) Suspension and termination for breach. If the customer is in default on a subscription payment for more than fourteen (14) days, IJONIS may, after a further seven (7) days' written notice, suspend access to the subscription until full payment is received; the subscription term continues to run during suspension. In the event of a material breach by the customer — in particular violations of § 4 (authorisation and cooperation duties), inclusion of unauthorised systems, or breach of § 8 (confidentiality) — IJONIS may immediately suspend the subscription and, failing cure within thirty (30) days of written notice, terminate the subscription with no entitlement to any refund.

(7) Transferability. Assignment of a subscription by the customer requires IJONIS's prior written consent, except in connection with a bona fide merger, acquisition, or sale of substantially all of the customer's business or assets, in which case IJONIS's consent shall not be unreasonably withheld, provided the successor entity expressly assumes all obligations under the subscription and meets the scope-authorisation requirements under § 4.

(1)IJONIS's liability shall be limited to the fee agreed in the relevant engagement, to the extent permitted by law.

(2) IJONIS shall not be liable for indirect damages, consequential damages, lost profits, loss of data, or business interruption, to the extent permitted by law.

(3) The limitations in paragraphs (1) and (2) shall not apply to liability for:

• intent (Vorsatz) and gross negligence (grobe Fahrlässigkeit);
• culpable injury to life, body, or health;
• fraudulent misrepresentation (arglistige Täuschung);
• liability under the Produkthaftungsgesetz (German Product Liability Act);
• breach of cardinal contractual duties (Kardinalpflichten) — that is, duties whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely; in such case, however, liability is limited to foreseeable damages typical for this type of contract.

(4) IJONIS shall not be liable for damages arising from incorrect, incomplete, or late scope definitions provided by the customer, from breaches by the customer of § 4 of these Terms, or from the absence of required third-party permissions (§ 4 paragraph 2).

(5) Penetration tests may, in rare cases, have unintended effects on tested systems. The customer bears the risk for maintenance windows not announced prior to testing, for systems not flagged as fragile, and for the maintenance of suitable backup and rollback mechanisms on its side (§ 4 paragraph 3).

(6)To the extent that IJONIS's liability is excluded or limited, this also applies to the personal liability of IJONIS's bodies, legal representatives, employees, and vicarious agents (Erfüllungsgehilfen).

(1) The parties mutually undertake to maintain the confidentiality of all confidential information of the other party that becomes known to them in the course of the contract performance. Confidential information includes in particular: scope definitions, identities and configurations of target systems, findings and vulnerability details, reproduction steps, reports, technical architectures, and business and operational secrets.

(2) The confidentiality obligation applies for the duration of the contract and for five (5) years after its termination.

(3) IJONIS retains engagement artefacts (reports, reproduction data, audit logs) in accordance with the retention periods documented in the Privacy Policy. Upon written request from the customer, engagement data shall be deleted prior to the retention deadline, unless statutory retention obligations — in particular under § 257 HGB (German Commercial Code) and § 147 AO (German Fiscal Code) — stand in the way.

(4) Methodology learning clarification. Aggregated, anonymised insights into attack patterns, vulnerability classes, and their statistical frequency may be used by IJONIS to improve the DeepMantis platform and the underlying methodology, provided that no inference back to individual customers, individual engagements, or individual target systems is possible. Concrete findings, reports, reproductions, target system identities, and all other customer-specific content remain strictly confidential and are expressly NOT used for platform improvement, model training, public disclosure, or marketing purposes.

(5) The confidentiality obligation does not apply to information that

• was demonstrably already known to the receiving party prior to receipt;
• is or becomes generally available without fault of the receiving party;
• was lawfully disclosed to the receiving party by a third party without an obligation of confidentiality; or
• was independently developed by the receiving party without use of the other party's confidential information.

(6) In the case of disclosure ordered by an authority or a court, the disclosing party shall inform the other party in advance to the extent legally permitted, so that the other party can take appropriate protective measures.

The processing of personal data in connection with the marketing website and the onboarding process is governed by our Privacy Policy.

For processing that takes place during an active engagement on the DeepMantis platform, the parties additionally conclude a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. IJONIS provides the DPA on written request at ops@deepmantis.io.

Engagement contracts end upon full delivery of the report agreed in the scope-of-work and any agreed re-tests, unless a longer term (for example, periodic engagements or retainer models) has been agreed in the scope-of-work. Subscription term, renewal, and termination are governed by § 6a.

The right to extraordinary termination for cause remains unaffected for both parties. Cause exists in particular in the case of:

• material or repeated breaches of § 4 of these Terms by the customer;
• payment default by the customer despite a prior reminder with a reasonable deadline;
• an application to open insolvency proceedings over the assets of either party, or rejection of such an application for lack of assets;
• material breach of the confidentiality obligations under § 8.

Notices of termination require at least text form (§ 126b BGB).

Neither party shall be liable for delays or non-performance of contractual duties to the extent that these are caused by events of force majeure. Force majeure includes in particular natural disasters, acts of war, terrorist attacks, pandemics, governmental orders, and outages of essential internet or cloud-provider services not attributable to the affected party.

The affected party shall inform the other party without undue delay of the occurrence and the expected duration of a force-majeure event. Both parties shall subsequently endeavour in good faith to reach a reasonable adjustment of the contract.

Place of performance and jurisdiction: The place of performance and the exclusive place of jurisdiction for all disputes arising out of or in connection with the contractual relationship is Hamburg, provided that the customer is a merchant (Kaufmann), a legal entity under public law, or a special fund under public law. IJONIS is also entitled to bring proceedings against the customer at the customer's general place of jurisdiction.

Governing law: German law shall apply exclusively, under exclusion of the United Nations Convention on Contracts for the International Sale of Goods (CISG / UN Sales Convention).

Severability: Should individual provisions of these Terms be or become invalid in whole or in part, the validity of the remaining provisions shall remain unaffected. The invalid provision shall be replaced by a valid provision that comes closest to the economic intent of the invalid provision. The same applies in the event of a regulatory gap.

Written and text form: Amendments and additions to these Terms and to scope-of-work agreements concluded on their basis require at least text form (§ 126b BGB). This also applies to the waiver of this text-form requirement.

No waiver: The non-exercise or delayed exercise of a right under these Terms does not constitute a waiver of that right.

Assignment: An assignment of rights or obligations under these Terms by the customer requires the prior written consent of IJONIS, unless mandatory statutory provisions stand in the way.

Language and precedence: These Terms are issued in German and English. The English version is provided for accessibility. In case of any conflict or discrepancy between the German and English versions, the German version prevails.