Terms of Service

Last updated: 7 October 2026

Welcome to BugBunny.ai. By accessing or using our products, websites, security scans, inference endpoint, or other services (collectively, the “Services”), you agree to these Terms of Service.

Company

The Services are provided by Sequester AG, Baarerstrasse 10, 6300 Zug, Switzerland.

A written order form or addendum agreed by both parties takes precedence over these Terms for the matters it expressly covers. An agreed data processing agreement governs its personal-data-processing subject matter. These Terms apply to the remaining matters. Nothing in these Terms limits rights or remedies that cannot lawfully be excluded, including mandatory consumer rights.

Individual written addenda may be agreed for business customers with special requirements; please contact support@bugbunny.ai to discuss your needs.

1. Acceptable Use

You are responsible for ensuring your use of the Services, including the inference endpoint, complies with applicable laws and third-party terms. When using BugBunny.ai for security testing, you may test only systems you own or are explicitly authorized to test. We may suspend or terminate access for abuse or suspected unlawful activity.

Before starting any scan, you confirm that you are fully authorized to scan the target. If requested, you will provide written proof of your authorization to scan that target. We may suspend or terminate your account, pause scans, or withhold access to scan results if authorization is not provided or if we reasonably believe a scan is unauthorized, out of scope, unlawful, or disruptive.

• No testing without proper authorization.
• No testing of assets outside the scope of your authorization, including third‑party infrastructure, cloud services, CDNs, or vendors unless they are expressly included.
• Do not bypass the access, billing, isolation, or other controls protecting BugBunny or unrelated third parties. Testing controls on an expressly authorized target is permitted within the agreed testing scope.
• No harmful or destructive actions beyond what is strictly required to validate a PoC.
• No denial‑of‑service, spam, credential stuffing, phishing, social engineering, or other disruptive activity.
• You are responsible for any scan notes, credentials, files, logs, configurations, or other context you upload or provide.
• Protect BugBunny instructions: do not deliberately extract or reconstruct confidential BugBunny system prompts, hidden policies, or agent instructions, or publish them without authorization. This restriction does not prohibit authorized testing of a target application, confidential reporting of a suspected BugBunny vulnerability, or disclosure required by law.

Customer testing precautions. You are responsible for preparing your targets for testing, including appropriate backups and recovery procedures, testing windows, monitoring, and coordination with target owners and affected service providers. You must obtain any required approvals, define the permitted scope, and use appropriately scoped test credentials where credentials are needed. You must review outputs before implementing changes and respond promptly to disruption, including pausing or stopping affected scans, notifying us, and taking steps to contain harm and restore affected systems. For systems outside your control, you must arrange the required precautions with their owners before testing.

2. Accounts & Access

To the extent permitted by applicable law, you are responsible for securing your accounts, API keys, tokens, and other credentials and for activity carried out through them, including use by your employees, contractors, and other permitted users. This includes usage charges incurred through those credentials and the consequences of failing to protect them or promptly report suspected compromise. Do not share individual login credentials; use authorized account-access features instead. Notify us promptly of suspected account or credential compromise. Suspension, service changes, and termination are subject to sections 5, 11, and 12 and any applicable written agreement.

3. PAYG Wallet & Scans

BugBunny operates on a pay-as-you-go (PAYG) basis. You top up a prepaid wallet, and usage charges are deducted from its balance as you use the Services. The same wallet balance can be used for both security scans and inference through the BugBunny inference endpoint. Usage of either service reduces the balance available to the other. Wallet credits represent usage balance, not a fixed number of scans or findings.

An active, paid platform subscription is required to start, run, or resume scans, even if your wallet balance is positive. The subscription fee is separate from wallet top-ups and does not itself purchase scan usage. Topping up the wallet does not activate or renew the subscription. If the subscription becomes inactive, scanning is unavailable until it is reactivated and sufficient wallet balance is available.

A scan may pause when the wallet is depleted or the available balance is insufficient to continue with the required safety margin. This can occur while the displayed balance is still positive. A scan paused for insufficient balance can resume only after you top up the wallet sufficiently to cover continued usage and the safety margin, and only while the required subscription is active. A top-up does not guarantee immediate resumption or a particular completion time.

4. Inference Service

Inference usage is charged to the same prepaid wallet at the applicable usage tariffs. Sufficient available balance is required; requests may be refused or interrupted if the balance is insufficient.

The inference service is provided on an as-available basis and may be paused or interrupted at any time. There is no uptime or continuous-availability guarantee. A positive wallet balance or an active scan subscription does not guarantee access to the inference endpoint. This availability condition is separate from the account suspension and termination provisions in section 11.

5. Payments, PAYG Wallet & No Refunds

All payments are final and non-refundable to the fullest extent permitted by law. This applies to platform and subscription fees, wallet top-ups, usage charges, add-ons, and custom services. We do not provide voluntary cash refunds or prorated reimbursements, including for cancellation, non-use, unused or expired balances, failed or interrupted scans, service failures, termination, or discontinuation. Billing corrections are handled through account credits as described below. Mandatory rights that cannot lawfully be excluded remain unaffected.

The recurring platform subscription fee provides access to scanning, subject to the wallet requirements in section 3. The amount and billing interval are stated at checkout or in your written order. The platform fee does not itself fund the usage wallet unless a separate promotion expressly says otherwise. Promotional or welcome credit is separate from the platform fee. Wallet top-ups purchase usage balance for BugBunny Services. Except where mandatory law requires otherwise, that balance is non-transferable, non-withdrawable, and not redeemable for cash; it is not a bank deposit.

We provide the applicable fees, usage tariffs, currency, taxes, and any minimum top-up before purchase, at checkout or in the written order. Scan-price examples, historical averages, and budget estimates are indicative, not fixed prices or guaranteed scan counts. Model choices, scan scope, inference usage, and the work performed affect consumption. We may offer new models or change usage tariffs for future usage and subscription fees for future renewal periods, subject to section 12; prices may increase or decrease. A wallet top-up purchases monetary usage balance, not a fixed usage tariff, model price, token allocation, or number of scans. Usage is charged at the applicable tariff when it is incurred, including when funded from an earlier top-up. Funding a wallet does not lock future usage prices. Tariff changes do not recalculate usage already incurred, reduce the nominal value of an existing purchased balance, or shorten its agreed expiry. Rates or other commitments expressly fixed for a stated period or purchase remain binding for that agreed scope and term.

PAYG usage is charged as work is performed, including model, agent, tool, and inference activity. The scan pause and top-up requirements in section 3 apply when funds are insufficient. Neither a budget estimate nor the safety margin is a guaranteed hard spending cap unless expressly agreed. Stopping, pausing, or abandoning a scan or inference request does not reverse valid usage already incurred. A scan with no findings, or findings later assessed as duplicates or false positives, does not by itself entitle you to a refund. The account-credit corrections below remain available.

Each purchased top-up expires 365 days after it is credited, unless a different period is disclosed before that purchase and agreed with you. This applies to purchased credit funded through an agreed manual payment process as well as online checkout. Welcome credit expires after 365 days unless different promotional terms are disclosed when awarded. The expiry of other promotional or discretionary credits is communicated when awarded.

Wallet balances do not replace the active subscription required for scanning. Their original expiry dates continue to run while the subscription is inactive; reactivation does not restart the expiry period. Promotional and discretionary credits have no cash value.

Subscriptions renew for the billing interval agreed at checkout or in the order unless canceled before renewal. You may cancel through the billing portal or by contacting support. Cancellation prevents the next renewal; the scan subscription remains active until the end of the already-paid period, unless suspension or earlier termination is justified under section 11. Voluntary cancellation, non-use, or expiry does not create a right to a refund of valid past charges or unused balances, subject to mandatory rights that cannot lawfully be excluded.

We will investigate reported billing errors and, where appropriate, correct verified duplicate, erroneous, or unauthorized charges attributable to us by topping up your BugBunny account credits. These credits may be used for the Services and are not withdrawable or redeemable for cash. Credits correcting a paid charge are not promotional credits. This correction process does not create a contractual right to a cash refund. It does not replace a refund or other remedy that mandatory law requires and does not permit us to exclude, including non-waivable consumer rights.

6. Reports & Output

Findings and outputs, including inference responses, are generated by AI models, agents, and automated tooling. Results are provided “as is” and may require human review. You are responsible for how you use outputs and reports, and for responsible disclosure to vendors.

No particular finding count, detection rate, completion time, or service level is guaranteed unless expressly agreed in writing. Demonstrations, pilots, and historical results do not establish a performance commitment for other targets or configurations. Review findings and proposed changes before relying on or implementing them.

7. Intellectual Property

We retain our rights in the platform, software, models, prompts, methods, and other underlying technology. You retain your rights in the data you upload or provide.

To the extent we hold rights in scan reports, findings, PoCs, summaries, and other scan outputs produced for you and paid for, we grant you a perpetual, non-exclusive, paid-up license to use, copy, and retain them for your internal security assessment, remediation, and compliance. You may share only the portions reasonably necessary for those purposes with recipients who need that information and are subject to confidentiality obligations. This includes confidential disclosure to an affected vendor where necessary for remediation. Public publication, sale, resale, sublicensing, or other redistribution of scan outputs requires our prior written permission, except where disclosure is required by law or a competent regulator or expressly permitted by a binding written agreement. This restriction does not prevent postings made by the Services through a feature expressly enabled under section 8, within that feature's described scope and subject to narrower written restrictions. It does not withdraw output rights already granted under an earlier binding agreement.

To the extent we hold rights in inference responses produced for you and paid for, we grant you a perpetual, non-exclusive, paid-up license to use, copy, retain, and share them for lawful purposes, subject to applicable third-party rights and model terms. These output licenses survive the end of your subscription and do not grant rights to the underlying platform or third-party materials. Preserve applicable proprietary notices and do not misrepresent AI-generated content as your original authorship. Nothing here restricts disclosure required by law or a competent regulator.

8. Data Use, Confidentiality & Contractual Penalty

We treat your non-public inputs and outputs, including target details, source code, credentials, findings, and reports, as confidential. We use and disclose them to deliver, support, and secure the agreed Services, for the permitted model-development and improvement purposes described below, or as required by law. Applicable customer instructions, data processing agreements, and written restrictions govern the relevant processing. Access by personnel and service providers is limited to the permitted purposes and subject to appropriate confidentiality obligations. We do not publish your non-public inputs or outputs externally or make changes or posts to your connected systems unless you instruct us to do so or enable a feature that describes that action. Your written order or addendum controls any narrower permissions.

Model training and improvement. To the extent you have the necessary rights and applicable law permits, you grant Sequester AG a non-exclusive, worldwide, royalty-free licence to use data and content you upload, submit, transmit, or otherwise provide, or cause the Services to collect or generate in connection with your use. This includes uploaded files and source code; scan targets, configurations, target responses, findings, results, reports, and proofs of concept; execution traces, logs, tool interactions, comments, messages, feedback, and usage metadata; inference prompts, inputs, and outputs; and annotations, aggregated, transformed, synthetic, or other derived data. For these purposes, we may retain, copy, analyse, label, transform, combine, and otherwise process that content to research, develop, train, fine-tune, evaluate, benchmark, test, validate, and improve our current and future AI models, agents, detection methods, software, products, and Services. We may perform this work ourselves or through service providers acting on our behalf under the applicable confidentiality and data-protection obligations. You retain your ownership rights; this permission does not authorise public disclosure of your non-public content.

This permission is subject to applicable data protection law, the Privacy Policy, and any applicable data processing agreement or written customer-specific restriction, including an agreed exclusion of model training or improvement. It does not by itself establish a lawful basis for processing personal data or replace any required notice, consent, or other authorisation. Where we act as a processor, processing remains subject to the controller's documented instructions and the applicable data processing agreement. Retention, deletion, and data-subject rights remain subject to those requirements. This expanded permission applies only once this version becomes binding on you. Publishing it does not retroactively expand our rights to previously collected data, including by creating new derivatives of that data.

For example, enabling a GitHub review feature or requesting a review through its supported trigger can authorize scan execution and posting findings to that repository. Automated triggers can consume usage without a separate manual start for each scan. Configure repository and automation permissions to match your intended scope.

Confidential BugBunny system prompts, hidden policies, and agent instructions remain protected as described in section 1. If such information becomes available to you, you must keep it confidential, must not exploit, reproduce, or disclose it without our authorisation, and must report suspected exposure to us confidentially. These obligations do not cover information lawfully public, independently developed, or lawfully obtained without a confidentiality duty. Disclosure required by law or a competent authority is permitted; where lawful and practicable, give advance notice and limit the disclosure to what is required.

For each deliberate, unauthorized extraction, reconstruction, disclosure, or publication of confidential BugBunny system prompts, hidden policies, or agent instructions, including a deliberate attempt prohibited by section 1, you owe Sequester AG a contractual penalty of CHF 250,000. The penalty becomes due upon the breach without prior warning and without requiring proof of actual loss or its amount. The permitted activities and disclosures described in sections 1 and 8 do not trigger the penalty. Payment does not release you from the protected obligation or prevent us from seeking injunctive relief or damages exceeding the penalty where recoverable under applicable law, without double recovery. Mandatory rights to contest liability and judicial powers to reduce an excessive penalty remain unaffected. The supplier-liability limits in section 10 apply to our liability, not the contractual penalty or other amounts you owe us.

9. Disclaimers & Service Availability

Except for commitments expressly agreed in writing and rights that cannot lawfully be excluded, the Services and outputs are provided as available, without a guarantee of complete accuracy, detection of every vulnerability, or fitness for every purpose. Security testing can have side effects; agree appropriate scope and safeguards for your targets. This section does not exclude our express obligations or the account-credit corrections in section 5.

For the BugBunny.ai website and platform, security scans, and inference service, there is no uptime or continuous-availability guarantee, unless expressly agreed in writing. An active subscription or positive wallet balance does not guarantee uninterrupted access or scan execution.

Capacity and model flexibility. We may queue, rate-limit, or throttle requests, impose or change concurrency, compute, context, storage, or other resource limits, perform maintenance, and replace, modify, or retire models, model versions, and features. Unless expressly agreed in writing, no particular model, capacity, throughput, concurrency level, or execution priority is promised. These rights are subject to binding customer agreements and applicable law, including the data-use restrictions in section 8 and any applicable data processing agreement or required service-provider approvals. Pricing changes follow sections 5 and 12.

10. Liability & Customer Indemnity

To the fullest extent permitted by applicable law, the total combined aggregate liability of Sequester AG, its affiliates, and their respective officers, employees, and service providers to each customer arising out of or relating to the Services or these Terms, under any legal basis, is limited to CHF 10 in total. This is one cumulative limit across all claims, events, Services, accounts, subscriptions, and periods for that customer; it does not reset annually or apply separately to each claim. It applies regardless of the fees paid and whether a claim is based on contract, tort, negligence, or another legal basis. This cap does not reduce the amount of any account-credit adjustment we grant under section 5.

To the same extent, we exclude liability for indirect, incidental, special, consequential, exemplary, or punitive damages, and for loss of profits, revenue, business opportunities, data, or goodwill, or business interruption. These exclusions apply even if we were advised that such losses were possible.

Nothing in this section excludes or limits liability to the extent applicable mandatory law prohibits doing so, including liability for our unlawful intent or gross negligence under Swiss law and non-waivable consumer rights. No exception is created beyond what mandatory law requires or what we expressly agree in a written order or addendum. The limits protect the parties identified above and do not limit your payment obligations to us.

Business Customer Indemnity

If you use the Services in the course of a business, you must indemnify Sequester AG, its affiliates, and their officers and employees against third-party claims to the extent caused by your or your users' unauthorized or out-of-scope scans, unlawful instructions, uploaded or supplied content that infringes third-party rights, or prohibited misuse of the Services. For covered claims, you must cover defence costs, including lawyers', experts', court, and arbitration fees incurred in defending those claims, as well as damages awarded and settlement amounts we approve in writing, without double recovery.

You must notify us promptly of any covered claim and cooperate in its defence at your expense. We may control the defence and appoint legal advisers. You must not settle a claim in a way that binds any indemnified party, admits liability on its behalf, or imposes obligations on it without our prior written consent. Our control of the defence or approval of a settlement does not itself establish that a claim is covered by this indemnity. This indemnity does not shift liability to the extent prohibited by applicable law, including liability for Sequester's unlawful intent or gross negligence. The CHF 10 cap above limits our liability; it does not limit your indemnification obligations.

11. Termination

You may stop using the Services at any time; subscription cancellation and its financial effects follow section 5. Subject to applicable law and binding customer agreements, we may, at our discretion, suspend or restrict access, terminate an account or service, or discontinue all or part of the Services for operational, commercial, security, or legal reasons, including suspected abuse, unauthorized testing, non-payment, or a breach of these Terms. Unless applicable law or a binding agreement requires otherwise, we are not obliged to provide advance notice, an explanation, or an opportunity to remedy the issue before acting. The no-refund policy and account-credit corrections in section 5 also apply to termination or discontinuation, subject to mandatory rights that cannot lawfully be excluded. Accrued payment obligations, indemnities, the paid-output license, confidentiality, and provisions intended to survive remain effective after termination.

12. Changes

We may update these Terms, recurring fees, and usage tariffs at any time by publishing the revised terms or pricing on our website or in the platform. Unless applicable law or a binding agreement requires otherwise, we are not required to send individual notifications or give advance notice. Subject to any required notice or consent, updates take effect when published, or on a later date stated with the update, for future use, purchases, and renewals. You are responsible for reviewing the current Terms and applicable pricing before using the Services.

Changes apply prospectively and do not recalculate usage already incurred, reduce the nominal value of a purchased wallet balance, or shorten its agreed expiry. Subscription fees already agreed for the current paid period and any expressly fixed usage rates or other binding commitments remain effective for their agreed scope and term. An ordinary wallet top-up does not fix future usage tariffs; the pricing rules in section 5 apply. Where applicable law or a binding agreement requires notice or consent, we will provide that notice or obtain that consent. Changes do not remove accrued rights or mandatory remedies.

13. Governing Law & Venue

Swiss law governs these Terms and related non-contractual matters, subject to protections that apply mandatorily under another applicable law. The dispute procedure for business customers is set out below. Mandatory rights to bring proceedings before a competent court, including consumer rights, remain unaffected.

14. Dispute Resolution (Arbitration)

For business customers, disputes connected with these Terms, including questions about their existence, validity, performance, breach, or termination, will be finally decided by arbitration administered by the Swiss Arbitration Centre. The procedure follows the Swiss Rules of International Arbitration effective when the Notice of Arbitration is submitted under those Rules. The legal seat is Zug, Switzerland; a single arbitrator will hear the case in English unless the parties agree otherwise. This clause does not prevent applications to competent courts for interim relief, assistance with arbitration, enforcement, or any review available under mandatory law. It does not displace mandatory court jurisdiction and does not require consumers to arbitrate.

15. Contact

Questions? Contact us at support@bugbunny.ai.