These Terms of Service ("Terms") govern access to and use of Adversary X, a tabletop exercise platform for cyber incident, crisis and operational-resilience training, operated by Canary Zero Ltd, a company registered in England and Wales under company number 14664394 with its registered office at 71-75 Shelton Street, London, WC2H 9JQ ("Canary Zero", "we", "us").
Adversary X is provided to businesses and other organisations only, not to consumers. By signing an order form, creating an account, or using the platform, you confirm that you are acting on behalf of an organisation ("Customer", "you") and that you have authority to bind that organisation to these Terms.
Adversary X provides AI-driven tabletop exercise simulations covering cyber incidents, crisis events, and third-party and operational-resilience scenarios, together with debriefs, scoring, reports and related features. The platform is intended for use by security, risk, resilience and leadership teams seeking to improve their incident and crisis response capabilities.
All scenarios, threat actor profiles, injects, debriefs and other exercise content are provided for training and educational purposes only. Nothing on the platform constitutes legal, security, regulatory, financial or other professional advice, and references to laws, regulations or regulatory expectations are illustrative and may not reflect the current position for your organisation.
Access is provisioned to an organisation. The individual who accepts these Terms or administers the organisation's account ("Account Administrator") is responsible for managing users within the organisation, for ensuring that all users comply with these Terms, and for all activity that takes place under the organisation's account.
Where a managed service provider or other partner ("MSP Partner") is granted an Enterprise account to run exercises for its own clients, the MSP Partner: (a) warrants that it has the authority and any consents required to run exercises on behalf of each client and to submit that client's information to the platform; (b) is responsible for its clients' use of the platform as if it were its own; and (c) remains our sole contracting party in respect of those client tenants unless we agree otherwise in writing.
You must keep account credentials confidential and must not share them with anyone outside your organisation. Notify us promptly at support@adversary-x.com if you become aware of any unauthorised use of your account.
You agree to use Adversary X only for lawful purposes and only in accordance with these Terms. You must not use the platform:
Adversary X is sold on a subscription basis with a minimum term of twelve (12) months, invoiced in advance. Fees, the applicable plan, the number of users or client tenants, and any agreed variations to these Terms are set out in the order form, proposal or invoice agreed between you and us ("Order Form"). Prices shown on our website are indicative only; the Order Form prevails.
All fees are quoted in GBP and are exclusive of VAT and any other applicable taxes, which will be added at the prevailing rate. Invoices are payable within thirty (30) days of the invoice date. We may charge interest on overdue amounts at the rate set out in the Late Payment of Commercial Debts (Interest) Act 1998, and we may suspend access to the platform on not less than ten (10) days' written notice if any undisputed invoice remains unpaid after its due date.
Fees are non-refundable, and no refund or credit is given for partial subscription periods, unused users or unused exercises, except where these Terms or the Order Form expressly say otherwise.
The subscription begins on the start date stated in the Order Form (or, if none, the date access is first provisioned) and continues for the initial term of twelve (12) months or such longer period as the Order Form specifies.
At the end of the initial term and of each renewal term, the subscription will automatically renew for a further twelve (12) months unless either party gives the other written notice of non-renewal at least sixty (60) days before the end of the then-current term. We may adjust the fees for a renewal term by giving you written notice at least ninety (90) days before the renewal date; if you do not accept the adjusted fees you may give notice of non-renewal in accordance with this section.
Trials or pilots are offered only where agreed with us in writing, on the terms set out in that agreement.
Adversary X, including its software, scenario library, threat actor profiles, exercise mechanics, scoring methodology, report templates, branding and all other platform content ("Platform Content"), is owned by Canary Zero or its licensors and is protected by copyright and other intellectual property laws. Your subscription grants you a limited, non-exclusive, non-transferable licence, for the subscription term, to use the platform and Platform Content for your organisation's internal training purposes (and, for an MSP Partner, for delivering training to its clients).
Reports, debriefs and other outputs generated for you by the platform ("Outputs") may be used by you for your internal purposes, including sharing with your board, auditors, insurers and regulators. Platform Content embedded in Outputs remains ours; you may not extract it for use outside the Outputs.
If you provide us with feedback or suggestions about the platform, we may use them without obligation to you.
You retain ownership of all information you submit to the platform, including custom scenarios, descriptions of your environment and technology estate, attendee names and roles, and the decisions and responses recorded during exercises ("Customer Content"). You grant us a non-exclusive, worldwide licence to host, process, transmit and display Customer Content solely to provide the service to you, to maintain and secure the platform, and as otherwise permitted by these Terms.
We will treat Customer Content as confidential, will not disclose it to third parties except to the service providers listed in section 8 or as required by law, and will protect it using appropriate technical and organisational measures. You are responsible for ensuring that you have the right to submit Customer Content and that it does not contain information you are not permitted to share with us, such as another party's confidential data or credentials.
Each party will keep confidential any non-public information disclosed by the other in connection with these Terms (including, on our side, pricing and Order Form terms, and on your side, Customer Content), will use it only for the purposes of these Terms, and will not disclose it except to its personnel, advisers and, in our case, the sub-processors in section 8, each bound by equivalent obligations. This does not apply to information that is or becomes public through no fault of the recipient, was already lawfully known to the recipient, is independently developed, or must be disclosed by law, provided the disclosing party is given reasonable notice where lawful.
We may use exercise results in aggregated, anonymised form — from which neither you, your users, your clients nor any individual can be identified — to produce industry benchmarks, to improve scenarios and scoring, and to develop the platform. We do not use Customer Content to train, fine-tune or otherwise improve any artificial-intelligence model, whether our own or a third party's.
We process personal data in accordance with our Privacy Policy and applicable UK and EU data protection law. In respect of account and billing data we act as a controller. In respect of personal data contained in Customer Content we act as your processor, and a data processing agreement is available on request and forms part of these Terms where signed.
The platform and its databases are hosted in the United Kingdom. Alternative hosting regions may be available for Enterprise customers by agreement in the Order Form.
We use the following sub-processors to deliver the service: Anthropic (AI exercise engine — exercise content and your responses are sent to Anthropic's API to generate scenario turns and debriefs), Clerk (authentication), Supabase (database hosting), Vercel (application hosting), Cloudflare (DNS and traffic routing) and Resend (transactional email). Anthropic processes data in the United States; this transfer is made under the UK International Data Transfer Addendum and EU Standard Contractual Clauses incorporated in Anthropic's data processing terms, and exercise content is not retained by Anthropic for model training. We will notify you of changes to this list as described in the data processing agreement. We do not sell personal data.
Scenario narratives, injects, adversary behaviour, scoring commentary and debriefs are generated by artificial-intelligence models. Such content may be incomplete, inaccurate or inconsistent with real-world events, controls or regulatory requirements, and it does not describe any actual attack against your organisation. You are responsible for evaluating Outputs and for any decisions, remediation or investment made in reliance on them. Outputs are not a substitute for professional incident response, legal or regulatory advice, nor for a formal assessment of your organisation's security posture.
The Real World Attacks library contains scenarios based on publicly reported cyber incidents. These scenarios are for training purposes only. Canary Zero has no affiliation with the organisations referenced, does not claim access to non-public incident details, and makes no representation about the accuracy of the underlying public reporting. All such scenario content is derived from publicly available information and may be dramatised for training effect.
We aim to maintain high availability of the platform but do not guarantee uninterrupted or error-free access. We may carry out maintenance, updates or modifications at any time and will endeavour to give advance notice of planned downtime where reasonably practicable. Support is provided at the level stated in your Order Form. Standard support is provided by email at support@adversary-x.com during UK business hours (Monday to Friday, 09:00–17:30 UK time, excluding English public holidays). Extended support, where included in your plan or Order Form, is provided by telephone and email during the same hours. Enterprise customers are additionally assigned a named account manager as their primary point of contact for service, renewal and escalation matters.
We warrant that we will provide the platform with reasonable skill and care. Except as expressly set out in these Terms, the platform is provided "as is" and all other warranties, conditions and terms, whether express or implied, are excluded to the fullest extent permitted by law. We make no warranty that use of the platform will improve your organisation's security posture, satisfy any regulatory or contractual requirement, or prepare you for any specific incident.
Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded by law.
Subject to the paragraph above, neither party shall be liable to the other for any indirect, incidental, special, consequential or punitive loss, or for any loss of profit, revenue, business, anticipated savings, goodwill or data, arising out of or in connection with these Terms, however caused.
Subject to the two paragraphs above, our total aggregate liability to you arising out of or in connection with these Terms and your use of the platform, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed the total fees paid by you under the relevant Order Form in the twelve (12) months immediately preceding the event giving rise to the claim.
You will indemnify us against any losses, liabilities, costs and expenses (including reasonable legal fees) arising from a third-party claim caused by your or your users' (or, for an MSP Partner, its clients') use of the platform in breach of these Terms, by Customer Content you submit, or by your breach of applicable law.
We may suspend or terminate your access to the platform with immediate effect on written notice if you materially breach these Terms (including the acceptable use rules in section 3) and, where the breach is capable of remedy, fail to remedy it within fourteen (14) days of being asked to; or if you become insolvent or cease trading. Non-payment is dealt with in section 4.
Either party may end the subscription by giving notice of non-renewal under section 5. You may also stop using the platform at any time, but fees for the current term remain payable and are not refunded.
On termination or expiry, your access to the platform ceases at the end of the then-current term (or immediately, where we terminate for breach). For thirty (30) days after that date you may request an export of your Customer Content and Outputs. Thirty (30) days after the termination or expiry date we will permanently delete all Customer Content and Outputs held in your organisation's account, including — for an MSP Partner — all data held in every client tenant under that account. This deletion is automatic and irreversible; it is your responsibility, and an MSP Partner's responsibility towards its clients, to export any data you wish to keep before that date. We may retain limited records (such as invoices, audit logs and aggregated, anonymised statistics) where required by law or as described in our Privacy Policy.
Sections 6, 7, 8, 12, 13, 15 and 16 survive termination.
We may improve, change or discontinue features of the platform from time to time, provided that we do not materially reduce the core functionality you have paid for during the current term.
We may update these Terms from time to time. We will notify you of material changes by email to the Account Administrator or by a notice on the platform at least thirty (30) days before they take effect. If a change materially reduces your rights you may give notice of non-renewal; otherwise your continued use of the platform after the change takes effect constitutes acceptance of the revised Terms. Where an Order Form or signed agreement conflicts with these Terms, the Order Form or signed agreement prevails.
You may not use the platform if doing so would breach any applicable export-control or sanctions law, and you warrant that neither you nor any of your users is a sanctioned person or located in a sanctioned territory.
Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, other than payment obligations. These Terms, together with the Order Form, the Privacy Policy and any signed data processing agreement, form the entire agreement between us relating to the platform and supersede any prior representations or agreements on the same subject. You may not assign or transfer these Terms without our prior written consent; we may assign them to a successor to our business on notice to you. If any provision is found to be unenforceable, the remainder continues in force. A failure or delay by either party to enforce a right under these Terms is not a waiver of it. Nothing in these Terms creates a partnership, joint venture or agency between the parties. No third party has any right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.
Notices under these Terms must be in writing. Notices to us go to support@adversary-x.com, and notices of legal proceedings to our registered office. Notices to you go to the email address of your Account Administrator and are deemed received 24 hours after sending.
These Terms are governed by the laws of England and Wales. Before starting court proceedings, the parties will attempt in good faith to resolve any dispute by negotiation between senior representatives and, if unresolved within thirty (30) days, by mediation with a mutually agreed mediator; nothing prevents either party from seeking urgent injunctive relief. Subject to that, any dispute arising out of or in connection with these Terms or your use of the platform shall be subject to the exclusive jurisdiction of the courts of England and Wales.
If you have any questions about these Terms, please contact us at support@adversary-x.com or in writing to Canary Zero Ltd, 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom.
Adversary X is a product of Canary Zero Ltd, company number 14664394, registered in England and Wales.