1. The service and these terms
STAIPH is operated by Kapriel Talatinian. Use the contact form for questions about the service or these terms. Contact STAIPH.
STAIPH Security lets you run catalogue-based tests against a selected AI model or compatible endpoint, read the resulting reports and, with valid Pro access, evaluate application traces after integration. These terms apply to this self-service security journey and the associated STAIPH API.
The service is intended for professional evaluation of systems you are entitled to test. Separate accompanied annotation and expert projects remain subject to their agreed order, client terms and expert terms; they are not included in a security subscription. Accompanied client services (French).
2. What each offer includes
Free: a first preview
The free preview runs 30 distinct attacks from the existing catalogue, with a private report and PDF. It can be started without an account or card. Guest report access lasts 24 hours after the first opening, within 30 days of the run. Technical and abuse-prevention limits still apply.
€49: one full security analysis
The one-off purchase unlocks one full analysis of the current 571-attack catalogue, its PDF report and 12 months of private report access. Start with the free preview, purchase from that report and enter your provider key again once payment is confirmed to launch the full analysis. The full result replaces the preview at the same private link. This purchase does not activate a subscription, recurring scans or monitoring.
Pro: €99 excluding tax per month
Valid Pro access includes repeated full-catalogue scans, generated reports, account history and monitoring features. Monitoring includes 5,000 successful evaluations per monthly period across up to 3 systems. It requires the integration of your application with the STAIPH API; subscribing alone does not connect production traffic.
At the monitoring allowance, new evaluations stop rather than generating automatic paid overages. Catalogue scans have separate technical limits. Any eligible 3-day trial, renewal date and payment requirements are shown during checkout. Taxes, currency and the total amount payable are confirmed before payment.
Provider model calls are billed separately by your model provider, including during a free scan or Pro trial. A STAIPH purchase does not include that provider’s API usage.
3. Payment, activation and cancellation
Security-product payments and subscriptions are processed through Polar. Paid rights are activated following verified payment or subscription confirmation, not merely because a browser returns to a success page. A short processing delay may separate payment from the updated access shown in your account.
Pro renews according to the period and terms confirmed at checkout. Manage cancellation in the billing portal available from your account. The portal shows the effective end of paid access and the applicable billing dates. A one-off report purchase has no monthly renewal.
For a failed activation, duplicate charge, billing dispute or a request concerning cancellation, withdrawal or refund rights, contact us with the order reference. Do not send card details. Mandatory statutory rights remain applicable; these terms do not exclude them. Contact billing support.
5. Accounts, keys and private links
Provide accurate account and delivery information. Keep your password, STAIPH API keys and private report links confidential. A valid guest link can permit access to its report. If you suspect exposure, revoke the relevant API key or contact support promptly.
A provider key is temporarily encrypted while a scan runs and removed on completion, failure or expiry. Each new analysis requires it again. The provider key used for scans is different from the STAIPH API key used by a backend to submit monitoring traces.
6. API and monitoring use
Use authenticated requests and permissions appropriate to your account. Store STAIPH API keys on a trusted backend, outside public client code. Send only the fields needed for an evaluation and remove unnecessary personal data, production secrets and payment information before transmission.
Respect the documented schemas, system limit, usage allowance and rate limits. Rejected, unavailable or unassessed evaluations must not be interpreted as successful security checks. Monitor ingestion errors and allowance status. A period with no alerts may also reflect missing integration, a stopped subscription or an exhausted quota.
7. What a result means
The report describes the responses obtained from the configured target, selected attacks and actual evaluation coverage. A direct call to a provider model does not test your application’s retrieval, tools, instructions or access controls unless your tested endpoint includes them.
Automated classification can produce false positives and false negatives. Review the attack, model response, processed counts and assessed coverage before drawing conclusions. Any selected ARES evaluation applies only to the responses actually evaluated, not automatically to every catalogue item.
A score is not a probability of breach, a compliance opinion or a security certification. Passing a scan does not prove that every attack, future model version or production scenario is safe. Human review, configuration controls and ongoing testing remain necessary.
8. Data and intellectual property
You retain the rights you hold in the content you submit and warrant that its submission and processing are authorised. STAIPH uses it to provide the requested service. The catalogue, software and evaluation methods remain subject to their respective intellectual-property and licence rights.
Personal-data handling, technical providers, temporary keys and applicable retention criteria are described in the privacy policy. Where you need a data-processing agreement, residency guarantees or specific retention, establish them with STAIPH before sending the affected data. Read the privacy policy.
9. Availability and service changes
Execution depends on the availability and limits of STAIPH, its infrastructure and the provider or endpoint you select. A timeout, invalid model, provider refusal or insufficient provider credit can prevent completion. An incomplete analysis must be identified as such and is not equivalent to a completed report.
The catalogue, technical limits and API can evolve. An availability guarantee, support deadline or specific service-level commitment applies only where expressly agreed for the relevant service. Report a paid execution failure through support so that the order and execution can be examined.
10. Responsibilities and disputes
You are responsible for the authorisations, selected configuration, provider account and operational decisions based on a report. STAIPH remains responsible for its service under applicable law and the relevant contractual commitments. These terms do not waive mandatory rights or extend the scan’s scope beyond the evidence actually produced.
French law governs these terms, subject to mandatory rules that apply to you. Contact us first so that an amicable solution can be sought. If no solution is reached, the dispute may be brought before the competent courts of Paris, subject to the mandatory jurisdiction rules that apply to you. Contact STAIPH.