THESE GENERAL TERMS OF USE (these "Terms") should be read by you (the "User" or "you") in their entirety prior to your use of the Platform (hereinafter defined). These Terms constitute a legally binding agreement between you and Spearbit Labs, Inc. (DBA Cantina Security), a Delaware corporation (referred to herein as "Cantina", "us" or "we"). Cantina owns and operates web-based platforms and products, including Cantina, Cantina Code, Apex, Clarion and AgentSight, available at https://cantina.security and related domains (together, the "Platform"). Through the Platform, Cantina provides security products and services, including security reviews, penetration testing, AI-powered security tools, managed detection and response and other managed security services, bug bounty programs and security competitions, covering software, applications, cloud and on-premises infrastructure, and blockchain systems such as smart contracts (the "Services"). Services may be performed by Cantina personnel and contractors, by automated or AI-powered tools, or by security researchers who participate in Cantina's marketplace programs (each a "Security Researcher" and collectively, the "Security Researchers"), in each case for the benefit of Clients (hereinafter defined). "Clients" are those persons, entities, organizations, or protocols that seek to obtain the Services through the Platform. The definition of Clients shall include any DAOs, guilds, committees, councils, individual persons or groups requesting the Services on behalf of an affiliated protocol or project. Certain Services provided by or available through the Platform may require the User to accept certain additional terms and conditions or policies ("Other Policies"), or to enter into a written Statement of Work ("SOW") to be signed by the User and certain counterparties. Any such Other Policies or SOWs shall be incorporated into these Terms by this reference. Other Policies include the Cantina Community Code of Conduct, available at https://docs.cantina.security/resources/code-of-conduct, which applies to all Users. These Terms apply to everyone who accesses or uses the Platform, including Clients, Security Researchers and any other account holders or visitors (each, a "User"). Where a provision applies only to Clients or only to Security Researchers, it says so.
BY CLICKING THE "I ACCEPT THESE GENERAL TERMS OF USE" OR SUCH SIMILAR FUNCTION PROVIDED BY CANTINA PRIOR TO ACCESSING ANY OF THE SERVICES AND/OR BY OTHERWISE USING OR ACCESSING THE PLATFORM, YOU REPRESENT THAT YOU HAVE READ, UNDERSTOOD, ACCEPTED AND AGREED TO BE BOUND BY THESE TERMS AND ALL TERMS INCORPORATED BY REFERENCE HERETO. IF YOU DO NOT AGREE TO THESE TERMS, DO NOT ACCESS THE PLATFORM OR USE THE SERVICES. WITHOUT DEROGATING FROM THE FOREGOING, THE USE OF THE SERVICES WILL BE DEEMED AN ACCEPTANCE OF THESE TERMS. FURTHER, BY ACCEPTING THESE TERMS, YOU HEREBY REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND THE ORGANIZATION OR LEGAL ENTITY FOR WHICH YOU ACT, IF YOU ARE ACTING ON BEHALF OF AN ORGANIZATION OR OTHER LEGAL ENTITY, IN WHICH CASE, "YOU" SHALL ALSO MEAN THE ORGANIZATION OR LEGAL ENTITY YOU REPRESENT. FOR CLARITY, THE USE OF THE TERM "YOU" WITH RESPECT TO CLIENTS MAY REFER TO BOTH AN INDIVIDUAL REPRESENTATIVE OF A CLIENT AS WELL AS THE CLIENT ITSELF ON WHOSE BEHALF YOU ARE ACCEPTING THESE TERMS, TO THE EXTENT APPLICABLE.
These Terms apply to any Services you obtain or otherwise receive from Cantina that reference these Terms, unless you or your organization has entered into a separate written agreement with Cantina that governs your use of the Platform or those Services, such as a master services agreement ("MSA"), statement of work, mutual non-disclosure agreement, data processing agreement, business associate agreement, or a researcher, contractor or program agreement (each, a "Written Agreement"). If these Terms conflict with a Written Agreement, the Written Agreement controls for that conflict. These Terms continue to apply to matters a Written Agreement does not address. Product- and program-specific supplemental terms, including the Apex Terms of Service, the Clarion Terms of Service, the Bug Bounties Terms of Service and the Competitions Terms of Service, published on the Platform, control over these Terms for that product or program, but only to the extent of the conflict.
1. User Account
You must be at least eighteen (18) years old to create an account or use the Platform. Registration on the Platform may require you to input your first and last name, legal name of your organization, jurisdiction of formation of your organization, your email address, a unique username, a unique password, and certain links and pages associated with the User. You are responsible for maintaining the security of your account and you are fully responsible for all activities that occur under the account and any other actions taken in connection with the account. You agree to notify Cantina immediately of any unauthorized use of your account, or any other breaches of security at security@cantina.security. Cantina is not responsible for any liabilities, losses, or damages arising out of the unauthorized use of your account.
2. Representations and Warranties
You represent and warrant that: (i) if you act on behalf of an organization, you have the authority to bind that organization to these Terms; (ii) your use of the Platform will be solely for purposes that are permitted by these Terms; (iii) your use of the Platform will not infringe or misappropriate the intellectual property rights of any third party; and (iv) your use of the Platform will comply with all applicable laws, rules, and regulations, and with all Other Policies.
3. Third Party Content
In connection with your use of the Platform, Cantina may provide you with links to third party website(s) as well as other forms of third-party content ("Third-Party Content"). Your acceptance of these Terms and use of the Platform constitutes your consent to Cantina presenting you with such Third-Party Content. You acknowledge all responsibility for, and assume all risk for, your use of Third-Party Content. Cantina has no control over Third-Party Content, including, without limitation, the promotions, materials, information, goods or services available therein. By linking to such Third-Party Content, we do not represent or imply that we adopt or endorse, nor are we responsible for, the accuracy or reliability of any products, services or information available through such Third-Party Content.
4. Fees
Access and registration on the Platform will not require payment of any fees. You will only be required to pay fees related to any Services or other products or features you expressly requested or opt in to. These fees may include taxes, network fees, gas fees, and processing fees. Clients agree to pay for all Services requested through the Platform on such terms as shall be outlined on the applicable submission page. Any disputes with respect to payment shall be submitted via email to support@cantina.security. Disputes about bug bounty or competition submissions and rewards are handled under the applicable program terms. If the Services requested require payment in installments, an ongoing payment structure, retainer, or certain other payment schemes other than payment in full prior to the Services start date, Cantina reserves the right to request credit card authorization or certain other means to charge your payment account.
5. Balances
Your account may hold funds deposited for use on the Platform (for example, to fund bug bounty rewards or security competitions). You acknowledge and agree that, for deposits to your Platform account balance, ONLY the payment methods offered on the Platform at the time of the deposit are supported, and funds sent by any other means may be lost, for which Cantina shall NOT be responsible. Payment of invoiced fees for Services is governed by the applicable invoice or Written Agreement, which may permit other payment methods, such as USD wire transfer.
6. Use and Conduct Restrictions
You agree that you will not under any circumstances transmit any content (including code, software, text, images, or other information) that:
is unlawful or promotes unlawful activity;
defames, harasses, abuses, threatens, or incites violence towards any individual or group;
is discriminatory, pornographic, or otherwise victimizes or intimidates an individual or group on the basis of religion, gender, sexual orientation, race, ethnicity, age, or disability;
is spam, is machine- or randomly-generated, constitutes unauthorized or unsolicited advertising, chain letters, any other form of unauthorized solicitation, or any form of lottery or gambling;
contains or installs any viruses, worms, malware, Trojan horses, or other content that is designed or intended to disrupt, damage, or limit the functioning of any software, hardware, or telecommunications equipment or to damage or obtain unauthorized access to any data or other information of any third party;
infringes on any proprietary right of any party, including patent, trademark, trade secret, copyright, right of publicity, or other rights;
impersonates any person or entity, including any of our employees or representatives; or
violates the privacy of any third party.
7. Cantina Rights
Quality Control and Monitoring. Cantina may actively monitor the Services as they are being performed for security and quality control purposes. Accordingly, at our discretion, we, or the technology we employ, may monitor and/or record your general interactions within the Platform.
Data Analytics. Cantina shall have the right to collect and analyze data and other information relating to the provision, use and performance of various aspects of the Services and related systems and technologies (including, without limitation, information concerning data input by Users and data derived therefrom), and Cantina will be free (during and after the term hereof) to (i) use such information and data to improve and enhance the Services and for other development, diagnostic and corrective purposes in connection with the Services and other Cantina offerings, and (ii) disclose such data solely in aggregate or other de-identified form in connection with its business. Subject to the confidentiality obligations in any Written Agreement or applicable program terms, you further acknowledge and agree to, and hereby grant Cantina a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display, upload, download, and distribute any deliverables, in connection with Cantina's internal business. For clarity, these rights include the right for Cantina to analyze materials and other information in the deliverables to improve the Services, including, for example, for use with and training of Cantina's machine learning and artificial intelligence models (whether generative or another type).
Right to Terminate Accounts. Cantina reserves the right and discretion to determine whether or not any User conduct violates these Terms. Notwithstanding any violation, Cantina reserves the right to terminate accounts or deny access to the Platform to any User for any reason, with or without prior notice. Termination of your account or access will not affect your legal obligations hereunder or with respect to any other User with whom you entered into contractual arrangements. All legal, contractual, and ethical duties, obligations and responsibilities between Users shall expressly survive termination of a User's account. Further, all provisions of these Terms which, through express clauses or by their nature should survive termination of a User's account, will survive such termination, including, without limitation, IP ownership provisions, warranty disclaimers, indemnification obligations and limitations of liability.
8. User Termination
If you wish to terminate your use of the Platform, you may simply discontinue using Cantina. If you wish to delete your User account, please contact us at support@cantina.security. We may retain and use certain data and other information associated with your account in a secure archive as may be necessary to comply with our legal obligations, to resolve disputes, and enforce our rights.
9. Grant of License and Intellectual Property
License. Cantina grants each User a non-exclusive, personal, non-transferable right to use the Platform for the sole purpose of providing or receiving the Services or any other features or functions expressly marketed to Users, in all cases subject to these Terms. Cantina reserves all rights that are not expressly granted to you under these Terms.
Ownership of technology. Except any open-source software incorporated in the Platform, Cantina is the sole owner of all rights in and to the code and associated technology behind the Platform, including all copyrights, copyrightable materials, patents, and trademarks, trade names, trade secrets and all other intellectual property. You may not: (a) copy, create derivative works, distribute, publish, reverse engineer, decompile, disassemble, modify, or translate the Platform or any of its features; or (b) use the Platform or the Services in any way that is prohibited by applicable laws or regulations (collectively, an "Unauthorized Use").
Use of Marks. Other trademarks, service marks, graphics and logos used in connection with or displayed on Cantina (the "Marks") may be the trademarks of Cantina or other third parties. Absent separate written agreement between you and Cantina, these Terms do not create any license or right for you to use any Marks in any marketing, social media posts or in any other publicly facing materials. In the event Users are permitted to use the Marks under an individual SOW, such use shall in all cases comply with Cantina's branding and citation requirements, made available at the following URLs, respectively: https://www.cantina.security/about/branding and https://www.cantina.security/citation.
10. Safe Harbor
This Section 10 applies to bug bounty programs and security competitions. A Sponsor may offer a safe harbor (the "Safe Harbor") authorizing Security Researchers to test its systems, as described in the applicable program terms. The Safe Harbor is an agreement between the Sponsor and the Security Researchers, and Cantina is not a party to it. Cantina's role is to host the program and, where the Sponsor enables it, to provide KYC. Each Security Researcher is responsible for understanding the Safe Harbor terms and staying within them, and Cantina is not responsible for any acts or omissions of any party in connection with a Safe Harbor.
11. Disclaimers
Cantina provides Services through its own personnel and contractors and through automated or AI-powered tools, and it also operates marketplace programs, such as bug bounty programs and security competitions, in which Security Researchers participate. Security Researchers may be independent parties or employees or contractors of Cantina. Except for Security Researchers who are employed or engaged by Cantina, Security Researchers participate in marketplace programs as independent parties and are not employees, partners, joint venturers or agents of Cantina. Cantina does not endorse any individual Security Researcher and makes no warranty, guarantee or representation as to the ability, competence, quality, qualifications or insurance coverage of any Security Researcher. Any warranties for Services performed by Cantina are set out only in the applicable Written Agreement. CANTINA PROVIDES THE PLATFORM ON AN "AS IS" BASIS WITHOUT WARRANTIES OF ANY KIND. WITHOUT LIMITING THE FOREGOING, CANTINA EXPRESSLY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, REGARDING THE PLATFORM, WITHOUT LIMITATION, ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, SECURITY, ACCURACY AND NON-INFRINGEMENT. Specifically, Cantina makes no representation that the Platform will meet any Users requirements; that the Platform will be available at any particular time or location; that the Platform will function in an uninterrupted manner; that the Platform will be free from defects or errors; or that the Platform is free of viruses or other harmful components. Outputs generated by automated or AI-powered features of the Platform (including Apex, Clarion and AgentSight) may be incomplete or inaccurate, should be reviewed before you rely on them, and do not guarantee that every vulnerability, threat, misconfiguration or incident will be identified. Users assume full responsibility and risk of loss resulting from use of the Platform, the Services, or any other information, content or other material obtained in connection therewith. The foregoing disclaimers shall apply to the full extent permitted under applicable law.
12. Prohibited Use
Persons located in, or ordinarily resident in, any country or region subject to comprehensive U.S. sanctions administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC") (the "Prohibited Jurisdictions"), and any person or entity identified on a U.S. government restricted-party list, including OFAC's Specially Designated Nationals and Blocked Persons List, are not permitted to use the Platform. You must comply with all applicable export control and sanctions laws in connection with your use of the Platform and the Services. The foregoing restrictions on use of the Platform in or from Prohibited Jurisdictions applies equally to residents and citizens of other nations while located in a Prohibited Jurisdiction. Any attempt to circumvent the restrictions on usage by any persons located in a Prohibited Jurisdiction shall be deemed a breach of these Terms. An attempt at circumvention includes, but is not limited to, manipulating the information used by Cantina to identify your location and providing Cantina with false or misleading information regarding your location or place of residence.
13. Limitation of Liability
NEITHER CANTINA NOR ANY OTHER PARTY INVOLVED IN CREATING, PRODUCING, OR DELIVERING THE PLATFORM WILL BE LIABLE FOR ANY INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES, OR DAMAGES FOR LOST PROFITS, LOST REVENUES, LOST SAVINGS, LOST BUSINESS OPPORTUNITY, LOSS OF DATA OR GOODWILL, SERVICE INTERRUPTION, COMPUTER DAMAGE OR SYSTEM FAILURE OR THE COST OF SUBSTITUTE SERVICES OF ANY KIND ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR FROM THE USE OF OR INABILITY TO USE THE PLATFORM OR THE SERVICES, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT WE OR ANY OTHER PARTY HAS BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGE, EVEN IF A LIMITED REMEDY SET FORTH HEREIN IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, AND THUS, THE ABOVE LIMITATION MAY NOT APPLY TO ALL USERS. EXCEPT FOR ANY PAYMENT OBLIGATIONS YOU MAY HAVE TO CANTINA AND CANTINA'S OBLIGATION TO PAY REWARDS OR PAYOUTS EARNED UNDER THE APPLICABLE PROGRAM TERMS OR WRITTEN AGREEMENT, SUBJECT TO CANTINA'S RECEIPT OF ANY SPONSOR FUNDS FOR THAT REWARD OR PAYOUT, IN NO EVENT WILL CANTINA'S TOTAL LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR FROM THE USE OF OR INABILITY TO USE THE PLATFORM EXCEED THE TOTAL AMOUNT OF FEES PAID OR PAYABLE TO CANTINA BY YOU FOR THE THREE (3) MONTHS OF SERVICES PRECEDING THE EVENT GIVING RISE TO THE CLAIM.
14. Indemnification
User agrees to defend, indemnify, and hold harmless Clients, Cantina, its affiliates, licensors, and service providers, and its and their respective officers, directors, employees, contractors, agents, licensors, suppliers, successors, and assigns from and against any claims, liabilities, damages, judgments, awards, losses, costs, expenses, or fees (including reasonable attorneys' fees) arising out of or relating to: (i) User's violation of these Terms; (ii) User's use of the Platform or the Services, including without limitation the User's interactions with other features made available on the Platform, (iii) User's use of or reliance on the Services or the Platform other than as expressly authorized in these Terms; (iv) User's use of or reliance on any information obtained from the Platform; or (v) any other party's access and use of the Platform or Services with User's assistance or by using any device or account that User owns or controls.
15. Nature of Blockchain; Assumption of Risk; Waiver of Claims
Blockchain related technologies and functionalities are still emerging innovations that carry a relatively high amount of foreseeable and unforeseeable risk from security, financial, technical, political, social, and personal safety standpoints. The mere access to and interaction with blockchains requires high degrees of skill and knowledge to operate with a relative degree of safety and proficiency. Digital assets are highly volatile in nature due to many diverse factors, including without limitation use and adoption, speculation, manipulation, technology, security, and legal and regulatory developments and application. Further, the speed and cost of transacting with cryptographic technologies, such as those code bases requiring review in connection with the Services, are variable and highly volatile.
To the extent the User accesses or uses the Platform or the Services in connection with blockchains, digital assets or smart contracts, the User acknowledges the foregoing, and agrees and represents that it understands and assumes such and other risks involved with blockchains related technologies (including without limitation any specific technical language used in these Terms, an SOW, Other Policies, or elsewhere within the Platform). The User further represents that it has all knowledge sufficient to work, and is informed of all foreseeable risks and the possibility of unforeseeable risks, associated with blockchains, digital assets, DEXs, DeFi, yield farms, vaults, and all other Web3 utilities. The User further acknowledges, and assumes all risk related to the possibility, that any information presented via the Platform or the Services may be inaccurate, possibly due to another party's malicious activities and possibly to the User's severe harm or detriment. The User agrees that Cantina is not responsible for any of these or related risks and shall not be held liable for any resulting harms, damages, or losses incurred by or against the User in connection with or as a result of the Services. The User expressly waives and releases Cantina from any and all liability, claims, causes of action, or damages arising from or in any way relating to the User's use of the Platform and the User’s interaction with the Services, except Cantina's obligation to pay rewards or payouts earned under the applicable program terms or Written Agreement, subject to Cantina's receipt of any Sponsor funds for that reward or payout.
16. KYC and Collection of Data
"KYC" shall mean Cantina's ‘Know Your Customer' processes, wherein certain information may be required to be submitted by each User through Cantina's third party identity verification service provider (the "KYC Provider"). Certain personally identifiable data may be collected and stored in connection with the KYC of Users, which is all collected and stored by the KYC Provider. Such data may include, without limitation, scans of government identification. Cantina's handling of personal data is described in its Privacy Policy at https://www.cantina.security/privacy-policy. A current list of Cantina's sub-processors is published on the Cantina Trust Center, and a data processing agreement is available on request. By using our Platform, you agree to submit to KYC as described herein, in accordance with the KYC Provider's terms of service and privacy policies available at https://withpersona.com.
17. Taxes
Cantina takes steps to comply with applicable tax reporting requirements, including those of the U.S. Internal Revenue Service (the "IRS"). This may include requiring Users involved in payments both on and off the Platform to follow applicable tax reporting procedures. Cantina uses various services for submitting tax documents. Where payments are made in digital assets, Cantina will report those transactions as required by the IRS. Cantina will report information to the IRS as required by applicable law. Before receiving any payout, each User must (a) complete KYC and (b) submit a valid and accurate IRS Form W-9, W-8BEN or W-8BEN-E, as applicable. Cantina will hold payouts to any User whose KYC or tax form is missing, incomplete, inaccurate or expired, and will release held payouts in the next scheduled payment batch after both are complete. Held payouts are not forfeited because of the hold. KYC remains valid until the identity document used for KYC expires. Tax forms, including Form W-9, are valid for three (3) years from submission, or until the form expires under IRS rules, whichever is earlier, and Users must submit an updated form promptly if their name, address, country of residence or tax status changes. Cantina may review submitted tax forms, including with automated tools, and may request a corrected form.
18. Disintermediation
The parties acknowledge that Cantina uses substantial labor and effort to connect users on the Platform. Users seeking Service on the Platform hereby covenant that they will not circumvent or attempt to circumvent the Platform for the receipt of the services without Cantina's prior written consent. In the event such User breaches this covenant, such Users shall be liable for damages to Cantina in the amount of 50% of the fees paid by such User in the 12 months from the first date such ex parte Services were solicited.
19. [Reserved]
Intentionally omitted; indemnification is addressed in Section 14.
20. Modification of these Terms and Notice
We reserve the right to update these Terms at any time, in our sole discretion. If we make material changes, we will notify you through the Platform, by email or by other written communication. Your continued use of the Platform shall serve as your acceptance of and agreement to any updated version of these Terms. Updates to these Terms do not amend any Written Agreement. We further reserve the right to change or discontinue all or any part of the Platform, at any time and without notice, at our sole discretion.
21. Insurance
Without limiting either Party's indemnification obligations hereunder, Security Researchers who are not employed or engaged by Cantina shall obtain and maintain appropriate insurance to the extent necessary to allow them to meet their liability obligations under these Terms.
22. Severability
If any part of these Terms is held invalid or unenforceable, that portion of these Terms will be construed to reflect the parties' original intent. The remaining portions will remain in full force and effect. Any failure on the part of Cantina to enforce any provision of these Terms will not be considered a waiver of our right to enforce such provision.
23. Entire Agreement
These Terms, together with any Other Policies and product-specific supplemental terms, constitute the entire agreement between you and Cantina regarding your use of the Platform. Nothing in these Terms replaces, supersedes or amends any Written Agreement, whether signed before or after your acceptance of these Terms, and each Written Agreement remains in full force and effect in accordance with its terms.
24. Non-Assignability
Cantina may assign or delegate these Terms in whole or in part, to any person or entity at any time with or without your consent. You may not assign or delegate any rights or obligations under these Terms of Use without Cantina's prior written consent, and any unauthorized assignment and delegation by you is void.
25. Notice and Email Communications
We use email and electronic means to stay in touch with our users. For contractual purposes, you (i) consent to receive communications from Cantina in an electronic form via the email address you have submitted during account registration; and (ii) agree that all policies, agreements, notices, disclosures, and other communications that Cantina provides to you electronically satisfy any legal notice requirements. This Section 25 does not affect your non-waivable rights. Any notices to Cantina shall be sent to support@cantina.security.
26. Electronic Acceptance
You agree that by checking a designated box or otherwise clicking a proceed function associated with language indicating your acceptance of these Terms, such acceptance constitutes valid and binding agreement to be bound by these Terms, effective as of the date and time you effected such acceptance.
27. Governing Law and Venue
These Terms, and any dispute arising out of or relating to these Terms, the Platform or the Services, are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. The state and federal courts located in Wilmington, Delaware have exclusive jurisdiction over any such dispute, and you and Cantina consent to the personal jurisdiction and venue of those courts. If a Written Agreement contains a different governing law or venue clause, that clause controls for matters covered by the Written Agreement.