KloofBack to kloof.dev

Terms of Service

Last updated October 2026 · RADS Enterprises, LLC

These terms govern your use of Kloof, a security-evidence service operated by RADS Enterprises, LLC ("RADS", "we"). By booking an engagement, uploading a report, or signing in to the console, you agree to them. Questions: hello@kloof.dev.

1. What Kloof is, and what it is not

Kloof runs an automated battery of checks against a Supabase stack and produces a dated, human-reviewed evidence report. Kloof is not a penetration test, and not a SOC 2, HIPAA, or ISO certification. A report describes what the battery observed within a stated scope at a stated point in time. It does not certify that your system is secure, and it is not a substitute for your own security program, legal advice, or a regulator's audit.

Findings carry confidence tiers. A CONFIG finding is an inference from source. A VERIFIED finding is a probe that ran in a named staging environment. A REVIEW item is surfaced for human judgement and is excluded from the coverage score. An EXTERNAL finding comes from a named third-party tool and is never counted as Kloof's. "Not detected in scope" means the risky pattern was not found in what the scan read — it is not a confirmation of safety.

2. The engagement

  • You book a call. A $750 deposit starts the engagement and is credited against the fee.
  • If you do not provide source access within 14 days of paying, the deposit is refunded in full.
  • You provide access as either a read-only GitHub App installation on one repository, or a zip of the source. Staging tenants are in scope only if you purchased the staging add-on.
  • Delivery is 5 business days from the day usable source is received, or 7 business days when staging probes are included.
  • Every report is reviewed and signed by a named Kloof reviewer. A deliverable is produced only from a signed run. Re-opening a run voids its signature, and the record of that is permanent.

3. Access and credentials

The console stores and reviews reports; it never runs a scan and never asks for production credentials. Staging database credentials stay on your infrastructure or on the reviewer's runner and are not stored in the console. You are responsible for making sure the environment you nominate for probes is a staging environment containing no live personal data.

Console access is invite-only. You will keep credentials confidential, register a passkey where required, and tell us promptly if you believe an account has been compromised. You will not attempt to access another tenant's data, probe the console outside a written authorisation, or resell console access.

4. Ownership

RADS Enterprises, LLC owns the Kloof engine, the check battery, the console, the report format, and all related intellectual property. You own your source code and your data. You receive a perpetual, non-exclusive licence to use the report we deliver for your own internal and investor or customer diligence purposes, including sharing it with your counterparties. You may not remove tier labels, disclaimers, or provenance from a delivered report, or present a Kloof report as a certification.

5. Fees and refunds

Fees are quoted per engagement. The deposit is refundable only under the 14-day condition above. Once a signed report has been delivered, fees are non-refundable.

6. Warranty disclaimer and liability

The service and every report are provided "as is". We do not warrant that a report identifies every vulnerability, or that acting on it will prevent a breach. To the fullest extent permitted by law, RADS Enterprises, LLC's total liability arising out of or relating to the service is limited to the fees you paid for the engagement giving rise to the claim, and we are not liable for indirect, incidental, special or consequential damages.

6A. Open-source engine and self-run use (AS IS / do your own research)

The open-source Kloof engine, CLI and any public repositories published by RADS Enterprises, LLC are licensed under AGPL-3.0-or-later and provided strictly "AS IS" and "AS AVAILABLE", without warranty of any kind, express or implied, including merchantability, fitness for a particular purpose, accuracy, completeness of coverage, and non-infringement. This section applies whether you obtain the engine from this site, GitHub, or anywhere else.

  • You run the engine entirely at your own risk. You alone are responsible for how and where you run it, for verifying every result, and for securing your own systems. Do your own research.
  • Self-run output is unreviewed, unsigned and uncertified. It is not an audit, penetration test, compliance certification, or legal or security advice, and using the engine creates no client, advisory or fiduciary relationship with RADS Enterprises, LLC or its owners.
  • A result that shows no failure does not mean your system is secure. Checks may miss issues, produce false positives, or behave differently on modified code.
  • Only run the engine against systems you own or are authorised in writing to test. You are solely responsible for any unauthorised use.
  • You may not describe self-run output as a Kloof Report, as "Kloof certified" or "Kloof verified", or use Kloof names or marks to imply our review or endorsement.
  • To the fullest extent permitted by law, RADS Enterprises, LLC, its owners and contributors are not liable for any breach, missed vulnerability, data loss, downtime, or direct, indirect, incidental, special or consequential damages arising from use of, reliance on, or modification of the open-source engine. You agree to indemnify RADS Enterprises, LLC against claims arising from your self-run use.

7. Termination

Either party may end an engagement in writing. We may suspend console access immediately for suspected abuse, credential sharing, or attempts to reach another tenant's data. Delivered reports remain yours.

8. Governing law

These terms are governed by the laws of the State of Texas, without regard to conflict-of-laws rules. The exclusive venue for any dispute is the state or federal courts located in Texas, and both parties consent to that jurisdiction.

9. Changes

We may update these terms. Material changes will be noted by the "last updated" date above and, for active engagements, sent to your engagement contact.