Terms of Service

These terms govern your use of Coeur.AI — the continuous, outside-in exposure monitoring service operated by Coeur, Inc. ("Coeur", "we", "us"). By running a scan, creating an account, or watching an app with Coeur, you agree to them. If you're using Coeur on behalf of a company, you're agreeing for that company too, and you confirm you have the authority to do so.

1. What Coeur does

Coeur watches the apps you point it at from the outside — the way an attacker would, using only what those apps already make public — and alerts you in plain English when something is exposed. Every check is read-only and non-destructive: we detect exposure, we never extract, store, or modify the data behind it.

2. You may only scan what you're authorized to scan

This is the most important term. You may only point Coeur at apps and domains that you own or are explicitly authorized to test. Scanning someone else's app without permission may be illegal in your jurisdiction, and it's a violation of these terms that results in immediate termination. You are solely responsible for having that authorization, and you agree to cover us (indemnify us) for claims that arise from a target you weren't authorized to scan.

We may require proof of ownership (a DNS record or a file on the domain) before monitoring an app continuously, and we may decline or stop scanning any target at our discretion.

3. Your account

Coeur signs you in with a magic link sent to your email — there's no password. Anyone with access to your inbox can access your Coeur account, so keep your inbox secure. You're responsible for activity under your account and for the accuracy of the email addresses you route alerts to.

4. Test accounts and connected access

Some deeper checks need a login. When you connect a test account, you agree that it is a throwaway account you created for testing — never a real user's login, and never credentials you don't have the right to share. When you connect read-only backend access, you confirm you're permitted to grant it. We store only a short-lived, revocable session — you can revoke it at any time from your settings.

5. Plans and billing

• Checkup — one app, one point-in-time scan, no card required.
• Vitals — a monthly subscription, billed in advance through our payment processor (Stripe). It renews automatically until you cancel; cancel any time and monitoring runs through the end of the paid period.
• Vitals Enterprise — custom terms agreed in writing, which take precedence over this section.

If a payment fails we'll tell you and retry; if it keeps failing we may pause monitoring until it's resolved. Each plan has limits (number of watched apps, scan frequency) shown at purchase — we enforce them in the product, not with surprise charges. Prices can change with at least 30 days' notice, taking effect at your next renewal.

6. Acceptable use

You agree not to:

• Scan targets you don't own or lack authorization to test (see section 2).
• Use Coeur to attack, disrupt, or gain unauthorized access to any system, or to build a dataset of other people's vulnerabilities.
• Probe, overload, or attempt to bypass Coeur's own security or plan limits.
• Resell or white-label the service without a written agreement with us.

7. Findings are ours to generate, yours to use

You keep all rights to your apps and data. We keep all rights to the Coeur service, its scanning engine, and its report formats. The findings and reports we generate for your apps are yours to use freely — share them with your team, your customers, or your auditor. We treat your findings as confidential and never publish or share them with third parties except as described in our Privacy Policy.

8. What Coeur is not

Coeur is a monitoring tool, not a guarantee. No scanner finds every issue, and a healthy report means we found no exposure in the checks we ran — not that your app is invulnerable. Coeur is not a substitute for a full penetration test or a security audit where one is required, and it is not legal or compliance advice. The service is provided "as is", without warranties of any kind, express or implied.

9. Limits on liability

To the fullest extent the law allows, Coeur will not be liable for indirect, incidental, special, or consequential damages — including lost profits, lost data, or the consequences of a breach of your app — and our total liability for any claim is capped at the amount you paid us in the twelve months before the claim arose (or $100 if you're on the free plan). Some jurisdictions don't allow certain limits, so parts of this section may not apply to you.

10. Suspension and termination

You can stop using Coeur and delete your account at any time. We may suspend or terminate your access if you break these terms — immediately and without refund in the case of unauthorized scanning — or with notice if we discontinue the service. Sections that by their nature should survive (confidentiality, liability limits, indemnity) survive termination.

11. Changes to these terms

We may update these terms as the product evolves. For material changes we'll email you or show a notice in the product at least 14 days before they take effect. Continuing to use Coeur after that means you accept the new terms.

12. Governing law and contact

These terms are governed by the laws of the State of California, and disputes will be resolved in the state or federal courts of San Francisco County. Questions? Write to us at hello@coeur.ai or through the contact page.