Terms of service

1. The service

Xyla analyses source code you connect and returns security and compliance findings, each accompanied by the evidence supporting it and a statement of what was not established.

2. No certification

Xyla is not a certification body. The platform does not issue certifications, does not return a verdict of “compliant”, and no function permits it to sign its own evidence. Output is intended to be supplied to an auditor or assessor, who reaches the conclusion.

Nothing produced by the platform is legal advice.

3. Authorised testing only

Dynamic testing runs only against targets you have enrolled and approved. Scope is taken from a reviewed manifest — an exact origin, an allowlist of path prefixes, a request ceiling and an expiry — and a caller cannot widen it. Probes outside that scope are dropped rather than sent.

You are responsible for holding the authority to authorise testing against any target you enrol.

4. Your content

You retain all rights in the code and configuration you connect. We use it to operate the service for you and do not use customer code to train models for other customers.

5. Accuracy and limits

Static analysis proves that a path exists; it does not by itself prove exploitability. Findings carry a confidence bucket, a reachability state and, where applicable, a self-reported caveat. Some findings will be wrong, and coverage is stated as a count with its denominator rather than as a score.

The service is provided without warranty that it will identify every vulnerability or compliance gap in a codebase.

6. Acceptable use

You may not use the platform to test systems you are not authorised to test, to attempt to circumvent its scope controls, or to breach applicable law.

7. Governing law

These terms are governed by the laws of India, with jurisdiction as specified in your order form or agreement with Vclabs Enterprise Private Limited.