These Terms of Service ("Terms") govern access to and use of Adversary X, a tabletop exercise platform for cyber incident, crisis and operational-resilience training, operated by Canary Zero Ltd, a company registered in England and Wales under company number 14664394 with its registered office at 71-75 Shelton Street, London, WC2H 9JQ ("Canary Zero", "we", "us").
Adversary X is provided to businesses and other organisations only, not to consumers. By signing an order form, creating an account, or using the platform, you confirm that you are acting on behalf of an organisation ("Customer", "you") and that you have authority to bind that organisation to these Terms.
Adversary X provides AI-driven tabletop exercise simulations covering cyber incidents, crisis events, and third-party and operational-resilience scenarios, together with debriefs, scoring, reports and related features. The platform is intended for use by security, risk, resilience and leadership teams seeking to improve their incident and crisis response capabilities.
All scenarios, threat actor profiles, injects, debriefs and other exercise content are provided for training and educational purposes only. Nothing on the platform constitutes legal, security, regulatory, financial or other professional advice, and references to laws, regulations or regulatory expectations are illustrative and may not reflect the current position for your organisation.
Access is provisioned to an organisation. The individual who accepts these Terms or administers the organisation's account ("Account Administrator") is responsible for managing users within the organisation, for ensuring that all users comply with these Terms, and for all activity that takes place under the organisation's account.
Where a business is granted a partner account under the Adversary X Partners programme to run exercises for its own clients (for example a managed service provider, security operations or incident response provider, consultancy, insurer or broker, law firm or personal security firm) (a "Partner"), the Partner: (a) warrants that it has the authority and any consents required to run exercises on behalf of each client and to submit that client's information to the platform; (b) is responsible for its clients' use of the platform as if it were its own; and (c) remains our sole contracting party in respect of those client tenants unless we agree otherwise in writing.
You must keep account credentials confidential and must not share them with anyone outside your organisation. Notify us promptly at support@adversary-x.com if you become aware of any unauthorised use of your account.
Every user must set up multi-factor authentication using an authenticator app before using the platform. A passkey can be used to sign in, but on its own it does not satisfy this requirement. To protect your organisation's data, each user can be signed in on only one device or browser at a time; signing in somewhere new ends that user's earlier session. Sessions currently end after eight (8) hours, and after thirty (30) minutes without activity whether or not the browser is left open, with a warning shown shortly before an inactive session ends. We may strengthen these controls at any time; we will not weaken them in a way that materially reduces the protection of your account without notice under section 14.
You agree to use Adversary X only for lawful purposes and only in accordance with these Terms. You must not use the platform:
Adversary X is sold on a subscription basis with a minimum term of twelve (12) months, invoiced in advance. Fees, the applicable plan, the number of users or client tenants, and any agreed variations to these Terms are set out in the order form, proposal or invoice agreed between you and us ("Order Form"). Prices shown on our website are indicative only; the Order Form prevails.
All fees are quoted in GBP and are exclusive of VAT and any other applicable taxes, which will be added at the prevailing rate. Invoices are payable within thirty (30) days of the invoice date. We may charge interest on overdue amounts at the rate set out in the Late Payment of Commercial Debts (Interest) Act 1998, and we may suspend access to the platform on not less than ten (10) days' written notice if any undisputed invoice remains unpaid after its due date.
Fees are non-refundable, and no refund or credit is given for partial subscription periods, unused users or unused exercises, except where these Terms or the Order Form expressly say otherwise.
The subscription begins on the start date stated in the Order Form (or, if none, the date access is first provisioned) and continues for the initial term of twelve (12) months or such longer period as the Order Form specifies.
At the end of the initial term and of each renewal term, the subscription will automatically renew for a further twelve (12) months unless either party gives the other written notice of non-renewal at least sixty (60) days before the end of the then-current term. We may adjust the fees for a renewal term by giving you written notice at least ninety (90) days before the renewal date; if you do not accept the adjusted fees you may give notice of non-renewal in accordance with this section.
Trials or pilots are offered only where agreed with us in writing, on the terms set out in that agreement.
Adversary X, including its software, scenario library, threat actor profiles, exercise mechanics, scoring methodology, report templates, branding and all other platform content ("Platform Content"), is owned by Canary Zero or its licensors and is protected by copyright and other intellectual property laws. Your subscription grants you a limited, non-exclusive, non-transferable licence, for the subscription term, to use the platform and Platform Content for your organisation's internal training purposes (and, for a Partner, for delivering training to its clients).
Reports, debriefs and other outputs generated for you by the platform ("Outputs") may be used by you for your internal purposes, including sharing with your board, auditors, insurers and regulators. Platform Content embedded in Outputs remains ours; you may not extract it for use outside the Outputs.
If you provide us with feedback or suggestions about the platform, we may use them without obligation to you.
You retain ownership of all information you submit to the platform, including custom scenarios, descriptions of your environment and technology estate, attendee names and roles, and the decisions and responses recorded during exercises ("Customer Content"). You grant us a non-exclusive, worldwide licence to host, process, transmit and display Customer Content solely to provide the service to you, to maintain and secure the platform, and as otherwise permitted by these Terms.
We will treat Customer Content as confidential, will not disclose it to third parties except to the service providers listed in section 8 or as required by law, and will protect it using appropriate technical and organisational measures. You are responsible for ensuring that you have the right to submit Customer Content and that it does not contain information you are not permitted to share with us, such as another party's confidential data or credentials.
Each party will keep confidential any non-public information disclosed by the other in connection with these Terms (including, on our side, pricing and Order Form terms, and on your side, Customer Content), will use it only for the purposes of these Terms, and will not disclose it except to its personnel, advisers and, in our case, the sub-processors in section 8, each bound by equivalent obligations. This does not apply to information that is or becomes public through no fault of the recipient, was already lawfully known to the recipient, is independently developed, or must be disclosed by law, provided the disclosing party is given reasonable notice where lawful.
We may use exercise results in aggregated, anonymised form (from which neither you, your users, your clients nor any individual can be identified) to produce industry benchmarks, to improve scenarios and scoring, and to develop the platform. We do not use Customer Content to train, fine-tune or otherwise improve any artificial-intelligence model, whether our own or a third party's.
We process personal data in accordance with our Privacy Policy and applicable UK and EU data protection law. In respect of account and billing data we act as a controller. In respect of personal data contained in Customer Content we act as your processor, and our Data Processing Agreement forms part of these Terms for every customer. If you have signed a Data Processing Agreement with us, the signed version applies instead.
The platform and its databases are hosted in the United Kingdom. Alternative hosting regions may be available for Enterprise customers by agreement in the Order Form.
We use the following sub-processors to deliver the service: Anthropic (AI exercise engine: exercise content and your responses are sent to Anthropic's API to generate scenario turns and debriefs), Clerk (authentication), Supabase (database hosting), Vercel (application hosting), Cloudflare (DNS and traffic routing) and Resend (transactional email). Anthropic processes data in the United States; this transfer is made under the UK International Data Transfer Addendum and EU Standard Contractual Clauses incorporated in Anthropic's data processing terms, and exercise content is not retained by Anthropic for model training. We will notify you of changes to this list as described in the data processing agreement. We do not sell personal data.
Scenario narratives, injects, adversary behaviour, scoring commentary and debriefs are generated by artificial-intelligence models. Such content may be incomplete, inaccurate or inconsistent with real-world events, controls or regulatory requirements, and it does not describe any actual attack against your organisation. You are responsible for evaluating Outputs and for any decisions, remediation or investment made in reliance on them. Outputs are not a substitute for professional incident response, legal or regulatory advice, nor for a formal assessment of your organisation's security posture.
The Real World Attacks library contains scenarios based on publicly reported cyber incidents. These scenarios are for training purposes only. Canary Zero has no affiliation with the organisations referenced, does not claim access to non-public incident details, and makes no representation about the accuracy of the underlying public reporting. Where a scenario names a real organisation, the name is used only to identify the incident the scenario is based on and to set the basis of the exercise; during the exercise, participants act for a fictional organisation. The scenario is not a statement about the named organisation, its security, its people or its operations, or about how it actually responded to the incident. The attack timeline follows the publicly reported incident; how the exercise then develops depends on the decisions participants make, so events and outcomes may differ from what actually happened.
We aim to maintain high availability of the platform but do not guarantee uninterrupted or error-free access. We may carry out maintenance, updates or modifications at any time and will endeavour to give advance notice of planned downtime where reasonably practicable. Support is provided at the level stated in your Order Form. Standard support is provided by email at support@adversary-x.com during UK business hours (Monday to Friday, 09:00–17:30 UK time, excluding English public holidays). Extended support, where included in your plan or Order Form, is provided by telephone and email during the same hours. Enterprise customers are additionally assigned a named account manager as their primary point of contact for service, renewal and escalation matters.
We warrant that we will provide the platform with reasonable skill and care. Except as expressly set out in these Terms, the platform is provided "as is" and all other warranties, conditions and terms, whether express or implied, are excluded to the fullest extent permitted by law. We make no warranty that use of the platform will improve your organisation's security posture, satisfy any regulatory or contractual requirement, or prepare you for any specific incident.
Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded by law.
Subject to the paragraph above, neither party shall be liable to the other for any indirect, incidental, special, consequential or punitive loss, or for any loss of profit, revenue, business, anticipated savings, goodwill or data, arising out of or in connection with these Terms, however caused.
Subject to the two paragraphs above, each party's total aggregate liability to the other arising out of or in connection with these Terms and the use of the platform, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed the total fees invoiced to you under these Terms and any Order Form in the twelve (12) months immediately preceding the event giving rise to the claim. This limit applies to all claims, including claims under our Data Processing Agreement and under the indemnity below. It does not limit your obligation to pay fees properly due.
You will indemnify us against any losses, liabilities, costs and expenses (including reasonable legal fees) arising from a third-party claim caused by your or your users' (or, for a Partner, its clients') use of the platform in breach of these Terms, by Customer Content you submit, or by your breach of applicable law.
We may suspend or terminate your access to the platform with immediate effect on written notice if you materially breach these Terms (including the acceptable use rules in section 3) and, where the breach is capable of remedy, fail to remedy it within fourteen (14) days of being asked to; or if you become insolvent or cease trading. Non-payment is dealt with in section 4.
Either party may end the subscription by giving notice of non-renewal under section 5. You may also stop using the platform at any time, but fees for the current term remain payable and are not refunded.
On termination or expiry, your access to the platform ceases at the end of the then-current term (or immediately, where we terminate for breach). For thirty (30) days after that date you may request an export of your Customer Content and Outputs. Thirty (30) days after the termination or expiry date we will delete all Customer Content and Outputs held in your organisation's account from our production systems, including, for a Partner, all data held in every client tenant under that account. Deleted data may remain in encrypted backups for up to a further thirty (30) days until those backups are cycled out, and will not be restored except to recover from a system failure. Our identity and email providers may keep residual copies for up to ninety (90) days after deletion under their own data processing terms. Deletion is automatic and cannot be reversed at your request; it is your responsibility, and a Partner's responsibility towards its clients, to export any data you wish to keep before that date. We may retain limited records (such as invoices, audit logs and aggregated, anonymised statistics) where required by law or as described in our Privacy Policy.
Sections 6, 7, 8, 12, 13, 15 and 16 survive termination.
We may improve, change or discontinue features of the platform from time to time, provided that we do not materially reduce the core functionality you have paid for during the current term.
We may update these Terms from time to time. We will notify you of material changes by email to the Account Administrator or by a notice on the platform at least thirty (30) days before they take effect. If a change materially reduces your rights you may give notice of non-renewal; otherwise your continued use of the platform after the change takes effect constitutes acceptance of the revised Terms. Where an Order Form or signed agreement conflicts with these Terms, the Order Form or signed agreement prevails.
You may not use the platform if doing so would breach any applicable export-control or sanctions law, and you warrant that neither you nor any of your users is a sanctioned person or located in a sanctioned territory.
Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, other than payment obligations. These Terms, together with the Order Form, the Privacy Policy and any signed data processing agreement, form the entire agreement between us relating to the platform and supersede any prior representations or agreements on the same subject. You may not assign or transfer these Terms without our prior written consent; we may assign them to a successor to our business on notice to you. If any provision is found to be unenforceable, the remainder continues in force. A failure or delay by either party to enforce a right under these Terms is not a waiver of it. Nothing in these Terms creates a partnership, joint venture or agency between the parties. No third party has any right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.
Notices under these Terms must be in writing. Notices to us go to support@adversary-x.com, and notices of legal proceedings to our registered office. Notices to you go to the email address of your Account Administrator and are deemed received 24 hours after sending.
These Terms are governed by the laws of England and Wales. Before starting court proceedings, the parties will attempt in good faith to resolve any dispute by negotiation between senior representatives and, if unresolved within thirty (30) days, by mediation with a mutually agreed mediator; nothing prevents either party from seeking urgent injunctive relief. Subject to that, any dispute arising out of or in connection with these Terms or your use of the platform shall be subject to the exclusive jurisdiction of the courts of England and Wales.
If you have any questions about these Terms, please contact us at support@adversary-x.com or in writing to Canary Zero Ltd, 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom.
Adversary X is a product of Canary Zero Ltd, company number 14664394, registered in England and Wales.