Themis Terms of Service

Effective date: July 1, 2026 | Last updated: September 21, 2026

These Terms of Service ("Terms") are a binding agreement between you and Themis Security Labs Limited, a company incorporated in Hong Kong with its registered office at The L. Plaza, 367 - 375 Queen's Road Central, Sheung Wan, Hong Kong ("Themis", "we", "us"), the operator of themislabs.ai and its related APIs and tools (together, the "Service"). By accessing the Service, connecting a wallet, submitting a form, or purchasing anything, you agree to these Terms and acknowledge our Privacy Notice. If you do not agree, do not use the Service.

If you use the Service on behalf of a company or protocol team, you represent that you are authorized to bind that entity, and "you" includes it.

1. What the Service is (and is not)

Themis provides offensive security services and tooling for AI agents, web applications and APIs, and smart contracts and on-chain systems, including:

  • AI agent support checks: a human-reviewed, preliminary determination of whether an AI agent appears to fit our current assessment path, based only on the information you submit.
  • AI Agent Security Assessments: adversarial testing engagements governed by a separate written agreement or statement of work.
  • RedSwarm authorized security testing: autonomous offensive testing of web applications and APIs that you own or are authorized to test, performed only under an agreed scope and governed by a separate written agreement, statement of work, or Rules of Engagement.
  • Continuous Agent Validation: re-testing of an AI agent after material changes, available after an initial AI Agent Security Assessment and governed by a separate written agreement or statement of work.
  • Themis Agent Intelligence: runtime authorization of consequential AI agent actions, offered in early access and private pilots under a separate written agreement.
  • Scans and reports: automated analysis of a protocol's upgrade authority, governance surface, and related risk indicators, summarized as scores and reports.
  • Approvals checker: a tool that reads public blockchain data about token approvals for a wallet address and, at your instruction, prepares revocation transactions for you to sign in your own wallet.
  • Monitoring and alerts: notifications about on-chain governance and upgrade events, including public alerts we may post on social media.
  • Paid workspaces and engagements: deeper analysis and monitoring for specific protocols.
  • Website and public tools: the public website, research publications, sample reports, and free tools.

A support-check response is preliminary, informational, and not a security assessment, guarantee of compatibility, offer, or commitment to accept an engagement. Final scope and support are confirmed during technical preflight and, where applicable, in a separate written agreement.

Commissioned security work (including AI Agent Security Assessments, RedSwarm testing, Continuous Agent Validation, Agent Intelligence pilots, and Web3 audits) is performed only under separately executed documents, such as a statement of work, engagement contract, Rules of Engagement, or security-testing authorization. These Terms do not replace those documents. Where they conflict with these Terms, the signed engagement documents control for that work.

The public website, tools, scores, reports, and alerts are informational tooling. The Service is NOT:

  • financial, investment, legal, accounting, or tax advice;
  • an audit, certification, guarantee, or endorsement of any protocol;
  • a recommendation to buy, sell, hold, or interact with any token, contract, or protocol;
  • a custody, brokerage, exchange, or wallet service. We never hold your funds or keys.

No fiduciary, advisory, or professional-client relationship is created by your use of the Service.

2. Scores and reports are opinions, not guarantees

Our scores and reports are automated, point-in-time assessments built from public blockchain data, third-party data sources, and our own heuristics. You acknowledge and agree that:

  • A high safety score is not a guarantee. Protocols with strong scores can still be exploited, rugged, mismanaged, or fail. A score reflects the factors we measure, at the time we measured them, and nothing more.
  • Scores can be wrong or stale. On-chain state changes constantly; ownership, upgrade authority, and permissions can change minutes after a scan. Data sources can be incomplete, delayed, or inaccurate, and our analysis can contain errors.
  • Coverage is partial. We analyze specific dimensions (for example upgrade authority and governance control). We do not detect all vulnerability classes, and a factor we do not measure can be the one that matters.
  • You are responsible for your decisions. Any decision to deposit, invest, integrate, approve, revoke, or otherwise act is yours alone. Always do your own research and, where appropriate, obtain professional advice.

3. Eligibility and compliance

You must be at least 18 years old and legally able to enter into these Terms. You may not use the Service if you are (a) subject to sanctions administered by OFAC, the EU, the UK, or the UN, (b) located in or ordinarily resident in a comprehensively sanctioned jurisdiction, or (c) prohibited from using the Service under any applicable law. You are responsible for complying with the laws that apply to you.

4. Wallets, signatures, and transactions

  • You are solely responsible for your wallet, its private keys, and anything signed or sent from it. We never ask for, receive, or store private keys or seed phrases.
  • Signing an authentication message with your wallet identifies you to the Service and constitutes your agreement to these Terms for that session.
  • The approvals tool only prepares transactions; you review, sign, and broadcast them from your own wallet, at your own risk and expense (including gas). Blockchain transactions are irreversible. Verify every transaction in your wallet before signing. We are not responsible for transactions you sign, for wallet or RPC malfunctions, or for network congestion, forks, or reorgs.
  • Revoking an approval removes future spending permission only; it cannot undo past transfers, and a malicious contract may have other paths to funds that revocation does not close.

5. Payments, subscriptions, and refunds

  • Prices are listed on the Service and may change at any time; changes do not affect amounts you have already paid.
  • Payments are made in cryptocurrency on-chain. You are responsible for sending the correct amount, on the correct chain, to the correct address, with sufficient gas. Mis-sent funds may be unrecoverable.
  • A purchase is complete when we verify the transaction on-chain. All sales are final and non-refundable, except where a refund is required by applicable law or we fail to deliver the purchased service entirely.
  • You are responsible for any taxes arising from your purchases, other than taxes on our income.
  • Paid engagements (for example AI Agent Security Assessments, RedSwarm testing, protocol workspaces, or bespoke analysis) may be governed by a separate written agreement or statement of work; if so, that agreement controls over these Terms for that engagement.

6. Acceptable use

You agree not to:

  • use the Service, or information or outputs obtained from it, to plan, facilitate, or execute an unauthorized attack, exploit, or theft, or otherwise to harm any protocol, contract, system, or person;
  • request, direct, or use Themis security testing against any system, application, API, agent, or contract that you do not own or are not authorized to test, or outside the scope agreed in the applicable statement of work, Rules of Engagement, or testing authorization;
  • probe, scrape, crawl, or bulk-extract the Service or its data, or access the API by any means other than our published interfaces;
  • circumvent rate limits, trial limits, authentication, or access restrictions, including by rotating IPs, wallets, or emails;
  • resell, sublicense, or provide the Service or reports to third parties as your own offering without our written agreement;
  • misrepresent Themis output, including presenting a score or report as an audit, certification, or endorsement, or quoting it out of context in marketing;
  • submit unlawful, infringing, or malicious content through forms, or impersonate any person or protocol team;
  • interfere with the operation of the Service, introduce malware, or place unreasonable load on our infrastructure;
  • use the Service in violation of applicable law, including sanctions and export-control laws.

Authorized security testing performed by or with Themis under an agreed scope, statement of work, or Rules of Engagement is not a violation of this section.

We may investigate suspected violations and suspend or terminate access (Section 11).

7. Your content and licenses

  • Your submissions. You retain ownership of the content you submit (messages, protocol details, notes). You grant us a non-exclusive, worldwide, royalty-free license to use it to operate, provide, secure, and improve the Service and to respond to you. Contract details and materials you share with us privately stay confidential: we do not publish or sell them.
  • Feedback. If you send suggestions or feedback, we may use them without restriction or compensation.
  • Our IP. The Service, including software, scores, methodologies, reports, branding, and content, is owned by us or our licensors and protected by intellectual-property laws. Except for the license below, no rights are granted.
  • Report license. For reports you lawfully obtain, we grant you a non-exclusive, non-transferable license to use them for your own (or your organization's) internal evaluation, security, and compliance purposes. Public reports we choose to publish may be shared with attribution and without modification. You may not remove notices, alter conclusions, or present a report as your own or as an audit.

8. Third-party services and data

The Service depends on third parties we do not control, including blockchain networks, RPC node providers, block explorers, and market-data APIs. We are not responsible for their accuracy, availability, or conduct. Links to third-party sites (explorers, social profiles, GitHub) are provided for convenience; your use of them is at your own risk and subject to their terms.

9. Alerts, monitoring, and public posts

Monitoring alerts (including email, Telegram, or public posts on X) are provided on a best-effort basis. They may be delayed, incomplete, erroneous, or missed entirely, and may describe events that are later reverted or reinterpreted. Alerts are informational only; do not treat the presence or absence of an alert as confirmation that an action is safe or unsafe. Waitlisted and beta features may change or be discontinued at any time.

10. Disclaimer of warranties

THE SERVICE, INCLUDING ALL SCORES, REPORTS, ALERTS, AND TOOLS, IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, OR UNINTERRUPTED OR ERROR-FREE OPERATION. WE DO NOT WARRANT THAT ANY PROTOCOL, CONTRACT, OR WALLET IS OR WILL REMAIN SECURE. SOME JURISDICTIONS DO NOT ALLOW CERTAIN WARRANTY EXCLUSIONS, SO SOME OF THE ABOVE MAY NOT APPLY TO YOU.

11. Suspension and termination

You may stop using the Service at any time. We may suspend or terminate your access (including revoking tokens and blocking wallets or IPs) at any time, with or without notice, if we reasonably believe you violated these Terms, created risk for us or others, or where required by law. Upon termination, licenses granted to you end, but Sections 2, 7 through 15 survive. If we terminate a paid service without cause before delivering it, your sole remedy is a pro-rata refund of the undelivered portion.

12. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

  • WE ARE NOT LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR DIGITAL ASSETS OR FUNDS (INCLUDING LOSSES FROM EXPLOITS, PROTOCOL FAILURES, DEPEGS, TRANSACTIONS YOU SIGN, OR RELIANCE ON ANY SCORE, REPORT, OR ALERT), EVEN IF ADVISED OF THE POSSIBILITY.
  • OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICE IS LIMITED TO THE GREATER OF (A) THE AMOUNTS YOU PAID US IN THE 12 MONTHS BEFORE THE CLAIM AROSE AND (B) ONE HUNDRED US DOLLARS (USD 100).
  • NOTHING IN THESE TERMS EXCLUDES LIABILITY THAT CANNOT BE EXCLUDED BY LAW, INCLUDING LIABILITY FOR FRAUD OR FOR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE.

You acknowledge that the disclaimers and limits in Sections 2, 10, and 12 are a fundamental basis of the bargain, and that the Service (much of it free) would not be provided without them.

13. Indemnification

You will defend, indemnify, and hold harmless Themis and its officers, directors, employees, and agents from any claims, damages, liabilities, and expenses (including reasonable attorneys' fees) arising from (a) your misuse of the Service, (b) your violation of these Terms or applicable law, (c) transactions you sign or broadcast, or (d) your content or your presentation of our output to third parties.

14. Governing law and disputes

These Terms are governed by the laws of the Hong Kong Special Administrative Region, without regard to conflict-of-laws rules.

Any dispute, controversy, or claim arising out of or relating to these Terms or the Service will be referred to and finally resolved by arbitration administered by the Hong Kong International Arbitration Centre (HKIAC) under the HKIAC Administered Arbitration Rules in force when the Notice of Arbitration is submitted. The seat of arbitration is Hong Kong, the tribunal consists of one arbitrator, and the language of the arbitration is English. Disputes must be brought on an individual basis only: TO THE EXTENT PERMITTED BY LAW, YOU AND THEMIS EACH WAIVE ANY RIGHT TO PARTICIPATE IN A CLASS OR REPRESENTATIVE ACTION. Either party may instead bring a qualifying individual claim in the Hong Kong Small Claims Tribunal or in the small-claims forum (or equivalent) of your place of residence. Either party may seek interim or injunctive relief from the Hong Kong courts, and nothing in this section deprives a consumer of mandatory protections of the law of their place of residence.

Regardless of any statute of limitations to the contrary, any claim must be filed within one (1) year after it arose, or it is permanently barred, where permitted by law.

15. General

  • Changes. We may update these Terms; the updated version applies from posting (or a later stated date). For material changes we will provide reasonable notice (for example a site banner). Continued use after the effective date is acceptance. Material changes do not apply retroactively to a paid engagement already in progress.
  • Entire agreement. These Terms, together with any separate written engagement agreement, are the entire agreement between us regarding the Service. The Privacy Notice describes how we handle data and is not part of this contract.
  • Severability; waiver. If a provision is unenforceable, the rest remains in effect; the provision will be enforced to the maximum extent permissible. Failure to enforce a provision is not a waiver.
  • Assignment. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or asset sale.
  • Force majeure. We are not liable for delays or failures caused by events beyond our reasonable control, including blockchain network failures, RPC or infrastructure outages, and acts of governments.
  • Export and sanctions. You may not use the Service in violation of export-control or sanctions laws.
  • Contact. Questions about these Terms: [email protected].

Themis Security Labs Limited
The L. Plaza, 367 - 375 Queen's Road Central, Sheung Wan, Hong Kong