Terms and Conditions

"Platform" means the AirOverflow Arena web application, application programming interfaces, virtualised laboratory environments, containerised challenge instances, the Outpost virtual workstation, the Showdown competitive module, the learning management modules, and all associated infrastructure operated by or on behalf of the Company. "Content" means any data, text, code, configuration, submission, writeup, comment or other material transmitted to or generated on the Platform. "Laboratory Environment" means any ephemeral or persistent virtual machine, container, network segment or virtual private network endpoint provisioned to a User. "Organisation" means a corporate or institutional tenant under whose administration a User account is placed. "Administrator" means a person holding elevated privileges over the Platform or over an Organisation. Headings are for convenience only and do not affect construction. References to the singular include the plural and vice versa.

You represent and warrant that you are at least eighteen (18) years of age, or the age of legal majority in your jurisdiction of residence if higher, and that you possess the legal capacity to enter into a binding contract. Where you access the Platform on behalf of an Organisation, you represent and warrant that you are duly authorised to bind that Organisation, and references to "you" include that Organisation jointly and severally. The Company reserves the right to require documentary evidence of identity, age, authority or professional standing as a condition of continued access.

You shall provide accurate, current and complete registration information and shall maintain it as such. You are solely responsible for safeguarding your authentication credentials, including any single sign on assertion, multi factor authentication device or issued access token, and you are liable for all activity occurring under your account, whether or not authorised by you, save to the extent such activity results directly from the Company's proven failure to implement reasonable technical security measures. You shall notify the Company without undue delay, and in any event within twenty four (24) hours, upon becoming aware of any unauthorised access to or use of your account.

Subject to your continuing compliance with these Terms and, where applicable, to payment of all sums due, the Company grants you a limited, revocable, personal, non exclusive, non transferable and non sublicensable licence to access and use the Platform solely for lawful training, assessment, research and educational purposes. All rights not expressly granted are reserved to the Company and its licensors.

The Platform provides offensive security tooling and deliberately vulnerable target systems for instructional purposes. Such capability is licensed to you strictly within the boundaries set out in this clause. You shall not, and shall not permit any third party to:

(a) direct any scanning, enumeration, exploitation, denial of service, interception, credential attack or other offensive technique at any host, network, account, service or data other than the Laboratory Environment expressly allocated to you for that purpose, and in particular not at the Platform's own control plane, orchestration layer, storage services, payment infrastructure or the environments allocated to other Users;

(b) attempt to escape, subvert or circumvent the isolation boundary of any Laboratory Environment, including by mounting host devices or sockets, abusing privileged container capabilities, tampering with hypervisor or orchestrator interfaces, or pivoting to any network the Company has not expressly designated as in scope;

(c) exfiltrate, publish, sell or otherwise disseminate challenge flags, solutions, proprietary challenge source material or assessment content, or otherwise undermine the integrity of any assessment, interview, competition or certification conducted on the Platform;

(d) use the Platform to develop, stage, host, distribute or command any malware, ransomware, botnet, command and control infrastructure, phishing apparatus or credential harvesting facility directed at any person or system outside the Laboratory Environment allocated to you;

(e) misrepresent your identity, impersonate any person, share, resell or otherwise transfer account access, or operate multiple accounts for the purpose of evading rate limits, resource quotas, competitive ranking mechanisms or enforcement action;

(f) interfere with the availability, integrity or performance of the Platform, including by circumventing quotas, throttles, session limits or billing controls, or by consuming computational, storage or network resources in a manner disproportionate to bona fide training use; or

(g) use the Platform in violation of any applicable law, including the Prevention of Electronic Crimes Act 2016 and any successor or analogous computer misuse, export control, sanctions or data protection legislation applicable to you.

Conduct falling within this clause may be referred to law enforcement authorities. The Company may preserve and disclose relevant records for that purpose.

You acknowledge and expressly agree that the Platform records operational and security telemetry, that Laboratory Environment sessions may be recorded, and that where you are enrolled under an Organisation or participate in a supervised assessment, an Administrator may initiate a monitoring session over your Outpost which may capture the screen output, filesystem state and keystroke input of that environment.

Where such monitoring is initiated, the Platform will display a notice to you before capture commences, identifying the categories of data to be captured, and will require your affirmative response. If you decline, capture does not commence and your Outpost session is terminated; the fact of your refusal is recorded in the audit log together with the identity of the requesting Administrator. Capture continues only for the duration of the monitoring session and ceases when that session is stopped or when consent is withdrawn. Material captured under this clause is processed in accordance with the Privacy Policy and is accessible only to authorised Administrators of the Platform or of your Organisation.

You shall not enter personal credentials, personal correspondence or other private material unrelated to your training or assessment into a Laboratory Environment, and you accept that any material so entered may be captured by the mechanisms described in this clause.

As between the parties, the Company and its licensors retain all right, title and interest in and to the Platform, including all software, challenge material, courseware, trademarks and know how. You retain ownership of Content you originate and grant the Company a worldwide, royalty free, non exclusive, sublicensable licence to host, reproduce, adapt, transmit and display such Content solely to the extent necessary to operate, secure, moderate and improve the Platform and to comply with legal obligations. Where you publish a writeup, comment or submitted challenge for the benefit of other Users, you additionally grant the Company a licence to display that material to those Users. You warrant that Content you submit does not infringe the rights of any third party.

Where the Company operates a linked community channel on a third party service, a question you post to the public community area, together with your Platform username, may be republished to that channel so that other Users may answer it. This applies only to questions posted to the public community area, including a question attached to a specific challenge. A question you mark as visible only to Users who have solved that challenge is never republished. The Company will indicate on the relevant form when this applies before you submit. Republication does not transfer ownership of your Content, and the third party service processes that material under its own terms and privacy policy, over which the Company has no control. You may ask the Company to remove republished material by writing to the address in clause 17.

Certain functionality is made available on a subscription basis or by one time purchase. Payment is processed by a third party payment provider, and by initiating a transaction you additionally agree to that provider's terms. Fees are stated exclusive of applicable taxes, duties and levies, which are your responsibility. Subscriptions renew automatically for successive periods at the then prevailing rate until cancelled in accordance with clause 9. Access to purchased material is granted upon the Company's receipt of confirmation of settled payment from the payment provider and not upon your browser being redirected.

You may cancel a subscription at any time with effect from the end of the then current billing period, and you will retain access until that date. Except where a non waivable statutory right of withdrawal applies, or where the Company has materially failed to provide the service, fees already paid are non refundable, including in respect of periods during which you did not access the Platform. One time purchases of course material are non refundable once the material has been accessed, save where the material is materially not as described.

The Company may suspend or terminate your access with immediate effect and without notice where it reasonably suspects a breach of clause 5, where required by law, where necessary to protect the security, integrity or availability of the Platform or of other Users, or where payment is overdue. The Company may otherwise terminate for convenience on thirty (30) days notice, in which case it shall refund the unused portion of any prepaid fee calculated on a pro rata basis. Upon termination your licence ends immediately, Laboratory Environments are destroyed, and the Company may delete associated data subject to the retention periods stated in the Privacy Policy. Clauses 5, 7, 11, 12, 13, 14 and 16 survive termination.

To the maximum extent permitted by applicable law, the Platform is provided on an "as is" and "as available" basis. The Company disclaims all warranties, conditions and representations of any kind, whether express, implied or statutory, including any implied warranty of merchantability, satisfactory quality, fitness for a particular purpose, accuracy, or non infringement. The Company does not warrant that the Platform will be uninterrupted, timely, secure or error free, that any Laboratory Environment will remain available for any minimum period, or that any particular training outcome, examination result or employment outcome will be achieved.

To the maximum extent permitted by applicable law, neither party shall be liable for any indirect, incidental, special, consequential, exemplary or punitive loss, nor for any loss of profit, revenue, goodwill, anticipated saving, business opportunity or data, howsoever arising and whether in contract, tort including negligence, breach of statutory duty or otherwise, even if advised of the possibility of such loss. The aggregate liability of the Company arising out of or in connection with these Terms shall not exceed the greater of the total fees actually paid by you to the Company in the twelve (12) months immediately preceding the event giving rise to the claim, or fifty United States Dollars (USD 50). Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability which may not lawfully be excluded or limited.

You shall indemnify, defend and hold harmless the Company, its affiliates, and their respective officers, directors, employees and agents from and against all claims, proceedings, damages, liabilities, penalties, costs and expenses, including reasonable legal fees, arising out of or in connection with your breach of these Terms, your Content, or any use of the Platform by you in contravention of clause 5 or of applicable law.

These Terms and any non contractual obligations arising out of or in connection with them are governed by the laws of the Islamic Republic of Pakistan, without regard to conflict of laws principles. The parties submit to the exclusive jurisdiction of the courts at Islamabad. Prior to commencing proceedings, the parties shall attempt in good faith to resolve any dispute by negotiation between senior representatives for a period of thirty (30) days from written notice of the dispute. Nothing in this clause prevents either party from seeking urgent injunctive or other interim relief in any court of competent jurisdiction.

The Company may amend these Terms from time to time. Material amendments will be notified by electronic mail to the address associated with your account or by prominent notice within the Platform not less than fourteen (14) days before they take effect. Continued use after the effective date constitutes acceptance. If you do not accept an amendment, your sole remedy is to cease use and terminate your account, in which case clause 10 applies to any prepaid fee.

If any provision is held invalid, illegal or unenforceable, it shall be severed and the remainder shall continue in full force. No failure or delay in exercising a right constitutes a waiver of it. You may not assign or novate these Terms without the Company's prior written consent; the Company may assign to an affiliate or in connection with a merger, reorganisation or sale of assets. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship. Neither party is liable for failure to perform caused by an event beyond its reasonable control, including infrastructure provider failure, network outage, industrial action, or act of state. These Terms, together with the Privacy Policy and any order form, constitute the entire agreement between the parties and supersede all prior representations. A person who is not a party has no right to enforce any term.

Notices under these Terms shall be sent to AirOverflow (Private) Limited, Office B5, Workzone, E11/4, Islamabad, 44000, Pakistan, and by electronic mail to cc@airoverflow.com.