Terms of Service

1. Agreement

These terms are a contract between you and Kenjin Labs LLC (Kenjin Labs合同会社) (“Kenjin Labs”, “we”) for the use of ZeroKai. If you use ZeroKai for a company or other organization, you confirm that you have authority to bind it, and “you” includes that organization.

By creating an account, signing in, submitting a domain, sending a contact message, or otherwise using ZeroKai, you agree to these terms and to the Privacy Policy. If you do not agree, do not use the service.

2. The service

ZeroKai is attack surface intelligence for security teams. It assesses the external attack surface from public sources and shows exposed assets, security weaknesses, and what to handle first, with the evidence and the time it was observed. It does not contact the server being assessed. It does not scan ports, load pages, or exploit vulnerabilities.

ZeroKai is an information tool. It is not a penetration test, a vulnerability scan of the target, an incident-response retainer, a certification, a legal opinion, or a statement that a system is secure or compliant. A finding describes public data at a point in time. “Not covered” means a source failed, or the product does not perform that check. It does not mean the item is safe.

We may change, suspend, or withdraw a feature. A description of future work is not a promise to build it.

3. Who may use ZeroKai

ZeroKai is offered for business use, to organizations and to people acting for them. You must be at least 18 and able to form a contract under Japanese law. We may refuse the service, or close an account, where we reasonably believe these conditions are not met.

4. Accounts

You must give accurate account information and keep it current. You are responsible for activity under your account and for keeping the password confidential. Tell us promptly, through the contact form, if you believe an account has been compromised.

An organization owner controls membership. You are responsible for the people you invite and the roles you give them. We may limit assessments and other actions according to the plan on the account.

5. Acceptable use

You may submit a domain to see what public sources show. Detailed assets, evidence, and finding details are shown only after your organization verifies control of that domain, by a matching work-email domain or a DNS TXT record. A summary of a domain you do not control is not an authorized assessment of that organization. You must not present it as one, and you must not present it as a statement by Kenjin Labs.

You must not:

• Use ZeroKai, or any output from it, to gain access to a system, account, or data without authorization, or to attack, disrupt, or surveil a system, or to harass a person.
• Bypass an ownership check, access another organization’s data, or probe ZeroKai except through the vulnerability process below.
• Submit information you do not have a right to provide, including another person’s secrets or credentials.
• Copy, resell, or build a competing dataset or product from the service, or scrape it beyond ordinary use of the interface.
• Remove attribution we are required to show for third-party data, including “Data from Shodan (shodan.io)”, when you copy that data.
• Interfere with the service, with other users, or with our providers, or use the service in violation of law, including laws on unauthorized computer access.

We may suspend or cancel an assessment or an account that we reasonably believe breaks these rules, and we may keep the records needed to investigate.

6. Your decisions

You decide what to do with a result. You are solely responsible for checking a finding before you rely on it, for remediation, and for any notice you give to a customer, a regulator, or anyone else. Public data can be stale or incomplete.

Kenjin Labs does not undertake to watch a domain continuously, or to notify you of a change, unless a written agreement says so.

7. Intellectual property and your content

You keep your rights in the account information and the messages you submit. You give us a license to host, process, and display that information only to provide and protect the service, and as the Privacy Policy describes.

The software, design, text, and the ZeroKai name belong to Kenjin Labs or its licensors. These terms give you only the right to use the service while they are in effect. You may not copy the product, or use the ZeroKai name so that it looks as if we endorse you. You may not reverse engineer the service except where Japanese law does not allow us to prohibit it.

Observations come from third parties. We do not transfer ownership of registry data, certificate logs, Shodan data, or other public-source material to you. Your right to use that material is limited to your use of the service and is subject to the source’s terms.

If you send a suggestion about the product, we may use it without payment and without a duty of confidentiality. This does not apply to a vulnerability report, which is covered below, or to a privacy request.

8. Third-party data

Assessments depend on third parties, including public DNS, Certificate Transparency logs, RDAP and JPRS, RIPEstat, published cloud IP ranges, Shodan, CISA, JVN, and NVD. Those sources can change, fail, or limit our use. We do not control them, and we are not responsible for their accuracy, availability, or terms. Where a source requires attribution, we show it, and you must keep it if you copy the data.

Shodan data, when shown, is credited as “Data from Shodan (shodan.io)” and is included only for a domain your organization has verified. Where NVD data is shown, the product states that it uses the NVD API and is not endorsed or certified by the NVD.

9. No warranty

The service is provided “as is” and “as available”. To the maximum extent permitted by Japanese law, Kenjin Labs disclaims all warranties, express, implied, or statutory, including accuracy, completeness, merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation.

We do not warrant that an assessment will find every exposure, that a clear result means a system is secure, or that use of ZeroKai will satisfy a customer, an insurer, an auditor, or a regulator.

10. Limitation of liability

To the maximum extent permitted by Japanese law, Kenjin Labs and its officers, employees, and contractors are not liable for indirect, incidental, special, consequential, or punitive loss, or for lost profits, lost data, business interruption, harm to reputation, or a security incident, whether or not we were advised it might happen.

Our total liability arising out of the service in any twelve-month period is limited to the amount you paid us for ZeroKai in that period. If you paid nothing, the limit is 10,000 yen.

These limits do not apply to liability that Japanese law does not allow us to limit, including liability for willful misconduct or gross negligence. If you are a consumer, nothing in these terms excludes a right that the Consumer Contract Act (消費者契約法) does not allow us to exclude. ZeroKai is offered for business use. To the extent you use it as a business, you agree that the Consumer Contract Act does not apply to that use.

11. Indemnity

You will indemnify Kenjin Labs and its officers, employees, and contractors against claims, damages, losses, and reasonable legal costs arising out of your use of the service, a domain you submit, your breach of these terms, your violation of law, or a dispute between you and a third party about an assessment or its results. We may control the defense of a claim covered by this section, and you will cooperate reasonably.

This section does not require you to indemnify us for our own willful misconduct or gross negligence.

12. Suspension and ending

You may stop using the service at any time. An organization owner may ask us, through the contact form, to close the organization.

We may suspend or end access, or refuse an assessment, if you break these terms, if we reasonably need to protect the service or a third party, if a provider requires it, or if we discontinue the service. Where it is reasonable and lawful, we will tell you.

The sections that by their nature should continue, including your responsibility for decisions, intellectual property, disclaimers, limitation of liability, indemnity, confidentiality, governing law, and this sentence, continue after the terms end.

13. Confidentiality

We treat non-public account content and detailed assessment results as confidential, and we use them only to provide and protect the service and as the Privacy Policy describes. Information that is already public, including data taken from public sources, is not confidential only because it appears in a result.

You will treat non-public information about how the service works, including an unpublished vulnerability, as confidential.

14. Fees

Some or all of the service may be offered without charge. If we introduce a fee, we will show the price, what it covers, and when it is due before you incur it. A fee that has been earned is not refundable, except where Japanese law requires a refund. If you do not pay a fee you agreed to, we may suspend the service.

15. Changes

We may change these terms. We will post the new version on this page and change the effective date. If a change is material, we will give notice that is reasonable in the circumstances, such as a notice in the service or an email to the account address, before the change takes effect.

If you keep using ZeroKai after the effective date, you agree to the new terms. If you do not agree, stop using the service before that date.

16. Governing law

These terms are governed by the laws of Japan, excluding rules on conflict of laws. The Kyoto District Court (京都地方裁判所) has exclusive jurisdiction, as the court of first instance, over a dispute arising out of these terms or the service, except where Japanese law does not allow that dispute to be confined to that court.

17. Other terms

If part of these terms is held invalid, the rest remains in effect. A delay in enforcing a term is not a waiver. You may not assign these terms without our written consent. We may assign them to an affiliate or to a successor of the business.

These terms and the Privacy Policy are the entire agreement for the use of ZeroKai. They do not create rights for any other person. Notices to us may be sent through the contact form. Notices to you may be sent to the email address on the account.

If the Japanese and English versions differ, the Japanese version controls.

18. Reporting a vulnerability

If you believe you have found a vulnerability in ZeroKai, use the contact form and choose Report a vulnerability. Describe the impact. Do not include exploit code, credentials, or another person’s personal information in the form. Do not access data that is not yours, do not disrupt the service, and do not publicly disclose the issue before we have had a reasonable time to investigate. We ask for at least 90 days from a report that gives us enough detail to reproduce the issue, unless the law requires earlier disclosure.

We will use the report to investigate and to fix the issue, and we treat the non-public details as confidential. We do not promise a payment, a bounty, or a public acknowledgement.

19. Contact

Kenjin Labs LLC (Kenjin Labs合同会社). Corporate number 2130003011137. Registered office: Private Booth 103, 23-7 Umetsu Nishiuramachi, Ukyo-ku, Kyoto 615-0917, Japan. https://kenjinlabs.com/. Contact is through the form on this website.