Apex Terms of Service

Relationship to Other Agreements

These Terms apply to Apex alongside any separate written agreement between you or your organization and Cantina, including a master services agreement, statement of work, mutual non-disclosure agreement, data processing agreement, or business associate agreement. If these Terms conflict with a written agreement, the written agreement controls for that conflict. These Terms do not supersede, amend, or limit any written agreement.

The Cantina General Terms of Use continue to apply to Apex, including provisions and obligations relating to account security, authority to bind an organization, permitted use, third-party content, fees, Cantina rights, suspension or termination, user termination, license and intellectual property, use of marks, disclaimers, prohibited jurisdictions, limitation of liability, indemnification, changes to terms, severability, assignment, notices, and electronic acceptance. Some Cantina General Terms of Use provisions are specific to Cantina marketplace, security review, researcher, payment, KYC, tax, blockchain, or similar workflows and apply to Apex only where relevant.

If these Terms conflict with the Cantina General Terms of Use for Apex, these Terms control only for Apex and only to the extent of the conflict.

Cantina's privacy policy is available at https://www.cantina.security/privacy-policy.

Apex trials started in a workspace created through a private Cantina trial link are governed by the Apex Trial Data Policy at https://www.cantina.security/apex/data-policy, which controls over these Terms for those trials. The Service Improvement paragraph of these Terms does not apply to Customer Data, Service Records or Output from those trials.

Apex Service

Apex provides automated and AI-assisted analysis of your codebases, repositories, pull requests, and related development artifacts, on an on-demand basis and, where available, on a continuous basis, as configured by you. Apex may use automated agents, code execution, dependency installation, build and test activities, vulnerability validation, and interaction with repositories, development environments, and other resources you designate.

You are responsible for ensuring that you have the rights, permissions, and consents needed to connect repositories and other systems to Apex and to submit data to Apex, and you authorize these activities within the scope of the service you use.

You authorize Apex to execute code, install dependencies, run builds and tests, and access external networks as reasonably necessary for the service you configure. You are responsible for the contents of the repositories and systems you connect, including any credentials and secrets, and for the effects of your code, dependencies, and configuration. Do not include production credentials in connected repositories unless required for a supported integration. Cantina is not responsible for loss to the extent it results from your code, dependencies, or configuration.

Accounts and Workspaces

You are responsible for maintaining the confidentiality of your account credentials and for activity that occurs through your account or workspace. You must promptly notify Cantina of unauthorized access, credential compromise, or other security concerns at security@cantina.security.

Workspace administrators are responsible for managing authorized users, integrations, permissions, and workspace configuration.

Cantina may monitor, log, audit, and analyze use of Apex to provide, secure, maintain, support, troubleshoot, and improve Apex, subject to these Terms, the Cantina General Terms of Use, and any applicable written agreement.

Acceptable Use

You may not use Apex to:

• violate applicable law or third-party rights;
• gain unauthorized access to systems, accounts, data, or networks;
• interfere with, disrupt, overload, or degrade Apex or third-party services;
• submit malware, exploit code, or harmful content except as part of an authorized security workflow;
• reverse engineer, copy, or create derivative works of Apex except where applicable law prohibits this restriction;
• bypass usage limits, security controls, or access controls;
• analyze code or systems you are not authorized to test;
• systematically extract Output to replicate Apex or to train a competing security-analysis product or model;
• use Apex for spam, phishing, fraud, harassment, or unlawful surveillance.

Customer Data

"Customer Data" means source code, repositories, pull requests, development artifacts, configuration, credentials, logs, and other information submitted to or accessed by Apex through your account, workspace, integrations, or authorized use of the service.

"Output" means findings, reports, and other results Apex generates for you. You own Output, other than Cantina's technology and any Cantina materials it contains. Cantina retains all rights in Apex and its underlying technology, methods, and models.

Cantina will protect Customer Data, Service Records, and Output using reasonable care and will use them only as permitted by these Terms. Uses permitted by this section are not a breach of this obligation. Cantina may process Customer Data to provide, secure, maintain, support, troubleshoot, analyze service performance, and improve Apex; to comply with applicable law; and as agreed with the customer.

"Service Records" means records Apex generates in the course of performing the service, other than Output, including agent transcripts, prompts, tool calls and their results, reasoning traces, and logs. Service Records may contain excerpts of Customer Data that Apex accessed while performing the service.

Service Improvement. Except as otherwise expressly agreed in a written agreement with Cantina, you grant Cantina a worldwide, non-exclusive, perpetual, irrevocable, royalty-free license to retain, use, copy, process, analyze, and adapt Output and your feedback on Output to develop, train, test, and improve Cantina's services, tools, models, and methodologies, and to sublicense these rights to service providers acting on Cantina's behalf. Cantina does not use your repositories, other Customer Data or Service Records to train models. These rights apply by default and survive termination of these Terms and deletion of your account.

Before using Output to train models, Cantina will take reasonable measures to exclude personal data and to remove information identifying you. Cantina will not disclose Service Records or Output except to service providers bound by confidentiality obligations or as required by law, and will take reasonable measures to avoid reproducing your code or other confidential material in outputs provided to other customers. This paragraph does not apply to protected health information subject to a business associate agreement between you and Cantina.

If Apex processes personal data on your behalf, Cantina's data processing agreement applies once signed by you and Cantina; it is available on request.

Cantina keeps repository contents only as long as needed to run analysis and deliver Output, and keeps cloned repository data until you request its deletion, in accordance with Cantina's data management policy and applicable law. You may request deletion of Customer Data at any time by emailing security@cantina.security, and Cantina will confirm deletion in writing within thirty (30) days. Cantina may retain data as required by law, to resolve disputes, to enforce its rights, to maintain security, and in backups until they expire. Deleting your Customer Data does not require deletion of Service Records or Output that Cantina retains as permitted by this section.

"Usage Data" means technical and statistical information about the operation and use of Apex, excluding the content of Customer Data, Service Records, and Output. Cantina owns Usage Data and may use it for any lawful business purpose. Cantina may also create aggregated or de-identified data from Service Records and Output and use it for any lawful purpose, provided it does not identify you or any individual.

Third-Party Services and AI Providers

Apex may interoperate with third-party services that you connect or authorize, such as your code-hosting provider. Your use of those services remains subject to their own terms, policies, and permissions.

Apex uses third-party service providers, including AI model providers used for inference, to provide Apex functionality requested by users or workspace administrators. Cantina remains responsible for using those providers consistently with these Terms and applicable customer agreements. The current list of sub-processors is published on the Cantina Trust Center.

Trials, Fees, and Suspension

Apex is sold as prepaid credits, as a subscription, or both. Some Apex functionality may be provided through a trial, pilot, paid subscription, order form, statement of work, or other written agreement. Fees, payment terms, usage limits, and subscription terms are governed by the applicable agreement or ordering document. Credits expire at the end of the period stated in the applicable ordering document, without refund or rollover.

Cantina may suspend or restrict access to Apex if we reasonably believe use of the service creates a security risk, violates these Terms, violates the Cantina General Terms of Use, violates applicable law, or could harm Apex, Cantina, users, customers, or third parties.

Cantina may modify, add, or remove features, models, integrations, and usage limits. Any such changes remain subject to notice requirements under applicable law or an applicable written agreement.

You may terminate your use of Apex by discontinuing use of the service or by contacting Cantina to request account deletion, subject to Cantina's need to retain information as required by law, to resolve disputes, to enforce rights, to maintain security, or as agreed with the customer.

Security Analysis

Apex is not a traditional third-party audit, certification, attestation, or formal assurance service, and does not constitute an endorsement, guarantee, or assurance of any security outcome. Cantina does not guarantee the identification of all vulnerabilities, defects, or security risks, nor the prevention of exploits, incidents, or losses, and no automated or AI-assisted analysis can provide complete or absolute protection.

The results of Apex depend on the completeness, accuracy, and timeliness of the information, code, configurations, and access you provide. You remain solely responsible for all decisions regarding the development, deployment, operation, and security of your systems and code, including whether and how to act on any output generated by Apex.

Intellectual Property

Cantina owns Apex and all related software, documentation, interfaces, designs, and technology, excluding Customer Data and third-party materials. Subject to these Terms and any applicable agreement, Cantina grants you a limited, non-exclusive, non-transferable right to access and use Apex for your internal security operations.

You retain ownership of Customer Data. You grant Cantina the rights needed to process Customer Data to provide and support Apex and as otherwise described in these Terms and any applicable customer agreement.

If you provide feedback or suggestions about Apex, you grant Cantina a perpetual, irrevocable, worldwide, royalty-free license to use them without compensation or attribution.

Prohibited Jurisdictions and Compliance

You may not access or use Apex from a jurisdiction where such access or use is prohibited by applicable law, sanctions, export controls, or the Cantina General Terms of Use. You may not misrepresent your location, identity, organization, authority, or eligibility to use Apex.

Disclaimers

Apex is provided "as is" and "as available" except as expressly stated in a written agreement. To the maximum extent permitted by law, Cantina disclaims all warranties, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.

Limitation of Liability

To the maximum extent permitted by law, Cantina will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, lost savings, lost business opportunity, loss of data, or service interruption arising from or related to Apex.

If no separate written agreement sets a different liability limit, Cantina's total liability arising from or related to Apex will not exceed the greater of US$100 or the fees paid or payable to Cantina for Apex by you or your organization for the three (3) months of Apex services preceding the event giving rise to the claim.

Indemnification

You agree to defend, indemnify, and hold harmless Cantina, its affiliates, service providers, and their respective officers, directors, employees, contractors, agents, successors, and assigns from claims, liabilities, damages, losses, costs, and expenses arising out of or relating to your violation of these Terms, your violation of the Cantina General Terms of Use, your use of Apex, your Customer Data, your integrations, or access to Apex through your account or workspace.

Changes to These Terms

Cantina may update these Terms from time to time. Updates are effective when posted unless a later effective date is stated. If changes materially affect your rights or obligations, Cantina may provide additional notice through Apex, email, or other reasonable means.

Your continued use of Apex after updated Terms become effective means you accept the updated Terms.

General Legal Terms

If any part of these Terms is held invalid or unenforceable, the remaining provisions remain in effect. Cantina may assign or delegate these Terms as permitted by the Cantina General Terms of Use. You may not assign or delegate your rights or obligations under these Terms without Cantina's prior written consent.

You consent to receive notices and communications electronically. By checking an acceptance box, clicking a similar acceptance control, accessing Apex, or continuing to use Apex, you agree that your action constitutes valid electronic acceptance of these Terms and any incorporated terms.

These Terms are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules, and the state and federal courts located in Wilmington, Delaware have exclusive jurisdiction over any dispute arising out of or relating to these Terms or Apex, unless a written agreement provides otherwise.

Contact

Questions about these Terms can be sent to support@cantina.security.