PRAE / Commercial review
Platform terms.
1. Provider and agreement
PRAE, the Null Security Platform, is provided by Null Ventures LLC, a Delaware limited liability company operating in Chicago, Illinois. These proposed terms cover the Platform software, hosted account workspace and associated MCP services. Field Kit and other Null Ventures products have separate terms.
The final agreement will include this versioned license, the order's plan and quantity, renewal disclosures and the applicable privacy notice. The final legal notice address and any signed team order form must be completed before paid launch. Contact: Null Security product support.
2. Named people and registered projects
The individual annual plan is US$399 for one named person and one registered application. One application includes its directly related repositories and development, test, staging and production environments. A separate product, unrelated customer application or unrelated codebase is a separate project.
The Team annual plan is US$1,999 for five named people and five registered applications across the workspace, including the owner and any viewers. Larger teams require a scoped order. Each person must use their own verified identity. An owner or administrator assigns projects and roles; an invitation reserves a seat until accepted, revoked or expired. Multiple approved MCP clients do not create extra seats, but each connection remains subject to credential and request limits.
Credentials, seats and receipts may not be pooled, resold, sublicensed or circulated to avoid these limits. The same person may use their assigned project on their own approved machines. A personal subscription cannot be shared among a team. Project or personal-license transfers require a recorded support decision; renaming a different application does not transfer a license.
3. Software rights and retained evidence
During an active paid term, the proposed license permits the assigned people to install and use the released software for their registered projects, subject to the order and these terms. Third-party components remain subject to their own licenses. Null Ventures retains its software, rules and documentation rights; customers retain rights in their applications, inputs and assessment evidence.
The signed offline receipt binds one assigned person, one project and one release. It expires within seven days or at the end of paid access, whichever comes first. New licensed work requires a current receipt. Expiry does not delete the customer's local evidence or remove the ability to read retained findings, reports, journal records and backups.
A locally controlled program cannot guarantee that copies are impossible. The service may apply rate limits, credential limits and proportionate review to suspected misuse. It will not represent these measures as tamper-proof DRM.
4. Annual billing, renewal and cancellation
Proposed model: an annual subscription that renews automatically unless canceled before renewal. Before payment, checkout must show the plan, annual amount, tax treatment, renewal timing and terms. The customer must expressly accept the applicable version. Price changes apply prospectively with the notice required by law and the final renewal policy.
Cancel future renewal through the account's billing portal. Cancellation at term end preserves otherwise-valid access through the paid period. The service does not grant paid access based solely on a checkout redirect, an unpaid invoice or a trial status.
Prices exclude applicable tax, which will be calculated and shown before payment. The final offer will identify the merchant of record, applicable payment terms and supported markets after provider eligibility and software classification are confirmed. No Field Kit payment policy is silently applied to this software subscription.
5. Refunds and disputed payments
Proposed initial-purchase policy: a 14-day window to request a refund, subject to the selected merchant's terms and mandatory rights. The final policy must distinguish initial purchases, annual renewals, partial refunds, billing errors and service failures.
Failed or incomplete payment does not establish entitlement. Current implementation withholds new access while a refund or dispute requires review; partial refunds currently require an operator decision. This is a provisional access rule, not the final customer refund policy. Applicable consumer rights cannot be waived by this draft.
6. Authorized use and agent boundaries
Customers must have permission to assess each target, repository, cloud resource and test environment. Only approved scope may be collected. Customers must review test plans, synthetic fixtures, credentials and target restrictions before enabling active tests. Do not use the Platform for unauthorized access, exploitation, credential theft or disruption.
MCP tools cannot expand the startup scope or approve their own risk decisions. The hosted review interface reads approved shared metadata; it is not a remote shell or deployment service. Corrections, risk acceptance, finding closure and production changes remain subject to the customer's human and organizational approval process.
7. Findings and limitations
Assessment results describe supported checks over identified inputs and evidence, within their stated scope and freshness. An untested control is not a passing control. A source pattern is not runtime proof. A vulnerability match is not proof of compromise, and a generated correction plan is not a deployed fix.
The Platform does not provide certification, a legal opinion, a security guarantee or universal discovery of every service and data journey. Coverage, supported adapters, platform requirements and known limitations must accompany each release. Runtime interception and enforcement are a separately gated capability, not a promise of the current assessment release.
8. Customer information and confidentiality
The service processes account, access and billing records to operate the subscription. The runner retains its raw assessment workspace locally unless the customer explicitly exports or shares an approved artifact. Shared maps and metadata can be confidential and must be reviewed before upload or disclosure to an agent host.
Null Ventures receives only the rights reasonably needed to host and deliver the material the customer chooses to share, maintain security, support the account and comply with applicable obligations. Model-host processing is governed by the customer's chosen provider. A data-processing agreement, subprocessor terms and appropriate transfer terms must be completed when required for the intended customer use.
9. Support, updates and recovery
Proposed launch support covers account access, billing coordination and supported installation problems through the product contact route. Response targets, staffed hours and escalation details remain subject to approval; this draft promises no service-level agreement.
Customers should retain private backups, preserve their fingerprint key and verify a restored workspace and signed upgrade before replacing a working installation. Release trust and rollback policies govern supported versions. Local data loss is not remedied by a subscription receipt.
10. Suspension and termination
Access may be suspended for nonpayment, revoked membership, a compromised credential, unlawful use or a material breach. Review and remediation should be proportionate to the issue, with notice when lawful and practicable. Evidence is not deleted as a billing enforcement action.
Cancellation, account deletion, refund and security suspension are distinct operations. The final policy must explain retained billing and security records, export options, account deletion and any rights that survive termination.
11. Warranty, liability and disputes
Proposed allocation for legal review: except for express commitments in the final order and rights that cannot lawfully be excluded, provide the service on an as-available basis; exclude indirect losses to the extent permitted; and cap ordinary contractual liability at fees paid for the affected service during the preceding twelve months, with expressly reviewed exceptions.
No final liability cap, indemnity, governing-law clause, venue selection, arbitration requirement or consumer waiver is adopted by this draft. Those choices require legal review for the intended markets and customer types.
12. Changes and acceptance records
The service retains the terms version accepted for an order. Later text does not silently rewrite an existing receipt. Material changes, renewal notices and new prices must follow the final policy and applicable law. Any final contract will identify its effective date and the precedence of a signed team order.