Your AI.
Through an attacker's eyes.

These Terms of Service ("Terms") apply to the Hoqo website and to the services provided by Ryoya Kubo, a sole proprietor based in Japan, trading as Hoqo ("Hoqo", "we", "us"). By requesting a free check or ordering a plan, you agree to these Terms on behalf of yourself and the organization you represent ("you").

1. Our services

Hoqo tests AI agents and chatbots for security weaknesses ("red teaming"). We offer a free check and paid plans (Hoqo Scan, Scan Pro, Hoqo Guard and Guard Pro). For paid plans, the exact scope, deliverables, schedule and fees are set out in a written order or statement of work ("Order"). If an Order conflicts with these Terms, the Order applies.

Our testing focuses on how your AI agent can be manipulated through its inputs, such as chat messages and the content it reads. We do not directly test your application code, APIs or infrastructure for conventional security vulnerabilities. Our services complement, and do not replace, a conventional penetration test.

The free check is a short, limited review of a few key risks. It is not a full test, and you are under no obligation to buy anything afterwards. We may decline any request.

"Business day" means a weekday that is not a public holiday in Japan, based on Japan Standard Time.

2. Authorization and scope

You confirm that you own the AI system to be tested, or that you have the owner's permission to have it tested, and that you have the authority to agree to these Terms.

• We start testing only after the scope (which systems, accounts, techniques and time window) has been confirmed in writing, including by email.
• We test only within the agreed scope, and we stop as soon as you ask us to.
• You are responsible for any notice or approval your own providers require (for example, your hosting, cloud or AI model provider).
• We may pause or stop testing at any time if we have doubts about authorization.

3. Your responsibilities

• Provide the test accounts, environments and information we agree on.
• Use a test or staging environment and test data where possible, and keep backups of anything important.
• Tell us in advance about anything fragile, costly to run, or connected to real customers or payments.
• Apply fixes yourself. Hoqo recommends fixes but does not change your systems.

4. Testing risks

Security testing can cause unexpected behavior, errors, extra usage costs (for example, AI model or API fees) or temporary disruption. We take reasonable care to avoid this and to stay within the agreed scope, and you accept these risks for testing performed within that scope.

5. No guarantee

Testing is a point-in-time assessment of the agreed scope. A test that finds no issues does not mean your system is secure, and we cannot guarantee that every weakness will be found or that a fix will prevent future attacks. AI systems and attack techniques change over time.

6. Conversation review

Where a plan includes conversation review, it starts only after we agree in writing on the conversation data you will share and how it is handled, including a data processing agreement where required. You are responsible for having the right to share this data with us. Conversation review is a periodic review, not real-time monitoring, and it may not find every misuse or leak. If we find signs of a leak, we report what we can determine from the data you shared. We do not carry out legal or forensic investigations, and decisions about notifying your users, regulators or others remain yours. If we become aware of a breach affecting conversation data you shared with us, we will tell you without undue delay.

7. Confidentiality

We keep your confidential information, including your system details, data, findings and reports, confidential, and use it only to provide the services. We will sign an NDA on request before you share anything sensitive. We will not publish your findings or name you as a client without your written permission. Where we work with a native-speaking partner for a language, that partner is bound by a confidentiality agreement.

8. Fees and payment

• Fees are as shown on our website at the time of your Order, or in your Order, in US dollars, excluding applicable taxes.
• You pay only after we have agreed on the scope. We then send you a secure payment link to pay by card through our payment provider Stripe, or an invoice if you prefer. Testing starts once payment is received.
• Hoqo Scan and Scan Pro are one-time payments.
• Fees depend on the plan, the number of languages and tools that take actions and, for Guard Pro, the number of conversations per month, as shown on our website. Each agent can include up to 6 languages and 10 tools that take actions. Every tool your agent can use must be included in the scope. More languages, tools, conversations or agents are quoted separately.
• Hoqo Guard and Guard Pro start after a Hoqo Scan or Scan Pro, which is paid separately. They continue month to month until either party cancels with 30 days' written notice.
• Invoices are due within 14 days.
• For Hoqo Guard and Guard Pro, each month is billed in advance.
• For Guard Pro, the monthly fee is based on the expected number of conversations per month set out in the Order. If the actual number in any month exceeds it, each additional conversation is billed in arrears at the per-conversation rate for the range it falls in, as set out in the Order. We check the actual number every month. The fee is not reduced if the actual number is lower.
• The rates in your Order stay fixed for 12 months from the start date in the Order. After that, we may change them with at least 60 days' written notice, and you may cancel before the change takes effect.
• You may upgrade from Hoqo Scan to Scan Pro within one week of your Scan Order by paying the difference in price.

9. Intellectual property

You keep all rights to your systems and data. You may use our reports freely within your organization. We keep the rights to our own methods, tools and general know-how, including the attack techniques we develop during testing. We may keep and use those techniques, and results with anything that identifies you, your systems or your users removed, to improve our testing.

10. Limitation of liability

To the maximum extent permitted by law, our total liability arising from the services is limited to the fees you paid us in the 12 months before the claim, and we are not liable for indirect or consequential losses, such as lost profits or lost data. Nothing in these Terms limits liability that cannot be limited under applicable law, including liability for intentional misconduct or gross negligence.

11. Ending the services

Either party may end an Order if the other party seriously breaches these Terms and does not fix the breach within 14 days of notice. Sections 5, 6, 7, 9 and 10 continue to apply after the services end.

12. Independence

Hoqo is independent and is not affiliated with, endorsed by or certified by OWASP or MITRE. We refer to their frameworks only to describe and map our findings.

13. Governing law

These Terms are governed by the laws of Japan. The Fukuoka District Court has exclusive jurisdiction over any dispute, unless the Order says otherwise.

14. Changes to these Terms

We may update these Terms from time to time. The effective date at the top shows when they last changed. Changes do not affect an Order already signed unless both parties agree.

15. Contact

Ryoya Kubo (Hoqo)
15F Fukoku Seimei Building, 1-9-17 Tenjin, Chuo-ku, Fukuoka 810-0001, Japan
hello@hoqo.ai

END OF TERMS OF SERVICE

This Privacy Policy explains how Hoqo, operated by Ryoya Kubo, a sole proprietor based in Japan ("Hoqo", "we", "us"), collects and uses personal information when you visit our website, request a free check, or work with us.

1. Information we collect

• Information you give us: your name, work email, company website, details about your AI agent, the languages it supports, and anything else you write in our forms or emails.
• Information shared during an engagement: test accounts, system details, conversation logs and similar data needed to test your AI agent. This is also covered by your Order and any NDA.
• Business contact details from public sources: if we contact you about our services, we use your name, job title, work email and company details that you or your company have published, for example on your website, on LinkedIn, or in a case study by one of your vendors.
• Website usage data: pages visited, referring site, device and browser type, and approximate country, collected without cookies by Cloudflare Web Analytics.

Please do not send us passwords, API keys or customer data through our website forms. We agree on a safe way to share test access once the scope is confirmed.

2. How we use it

• To reply to your request and agree on the scope of testing.
• To perform the services, prepare reports and run retests.
• To send invoices and meet our legal and tax obligations.
• To contact businesses whose AI agents may benefit from our testing. If you reply "no" or ask us to stop, we stop.
• To keep our website working and understand how it is used.

We do not sell your personal information.

3. Personal information about your customers

Testing an AI agent can bring us into contact with personal information about your customers, such as names or email addresses that appear in test conversations. We protect it in the same way as your own information, and more strictly:

• We ask for test accounts and test data wherever possible, so real customer data is not needed.
• We use any customer personal information we see only to confirm and report a finding, or for conversation review as described below, and never for any other purpose.
• For conversation review, we use the conversation logs you share only to look for misuse of your agent and signs of a data leak, and to look into what we find. We process them on your behalf and only on your instructions, as set out in our agreement with you.
• We remove it before sending anything to an AI provider, and mask it in reports, for example j••••@•••••.com.
• We delete it, including any copies and excerpts, within 30 days after the engagement ends, and we never keep it in the attack techniques or anonymized results we retain.
• If we become aware of a breach affecting data you shared with us, we tell you without undue delay.

4. Legal bases

Where the EU or UK GDPR applies, we process personal information to take steps at your request before entering into a contract and to perform that contract, for our legitimate interests in running and improving our business, including contacting businesses about our services, and to comply with legal obligations.

5. Who we share it with

• Service providers that help us operate: email and workspace, website hosting and forms, email delivery, payments (Stripe; Hoqo does not receive or store your card details), and the AI model providers we use for testing. The AI providers are named on our Security & data handling page.
• Native-speaking partners, bound by a confidentiality agreement, when an engagement needs testing in a language they cover. They receive only what they need for that work.
• Authorities, when required by law.

Our service providers may use personal information only to provide their services to us. We share only what each of them needs, and we do not allow them to use it for their own purposes, including training AI models.

6. International transfers

Hoqo is based in Japan, and our service providers may process information in other countries. When we transfer personal information across borders, we take the steps required by Japan's Act on the Protection of Personal Information and, where applicable, the GDPR, such as standard contractual clauses.

7. How long we keep it

• Requests that do not lead to an engagement: up to 12 months.
• Business contact details we use for outreach: up to 12 months after our last contact. If you ask us to stop, we keep only your email address and company name, so that we don't contact you again.
• Data you share during an engagement, such as test accounts, logs and screenshots: deleted within 30 days after the engagement ends (after the final retest for Scan plans, or after cancellation for Guard plans), unless we agree otherwise.
• Attack techniques we develop, and results with anything that identifies you, your systems or your users removed: kept to improve our testing.
• Invoices and accounting records: as long as Japanese tax law requires.

8. Security

We use reasonable technical and organizational measures to protect personal information, such as full-disk encryption, two-factor authentication on all accounts, an encrypted password manager, and limiting access to the people who need it.

9. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict how we use it, to receive a copy of it, and to withdraw consent. To make a request, email hello@hoqo.ai. You can also complain to your local data protection authority or, in Japan, to the Personal Information Protection Commission.

10. Cookies

We do not use cookies for advertising or tracking. We measure visits with Cloudflare Web Analytics, which does not use cookies or collect personal identifiers. To protect our forms from spam, we use Cloudflare Turnstile.

11. Children

Our services are for businesses and are not directed at children.

12. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it last changed.

13. Contact

Ryoya Kubo (Hoqo)
15F Fukoku Seimei Building, 1-9-17 Tenjin, Chuo-ku, Fukuoka 810-0001, Japan
hello@hoqo.ai

END OF PRIVACY POLICY

Testing an AI agent means handling sensitive things: access to your systems, conversation logs and, sometimes, the weaknesses we find. This page explains how Hoqo handles them. Your Order or NDA can add stricter terms, and when it does, those apply.

1. Before testing

• We test only systems you own or have the owner's permission to test, and only after the scope is confirmed in writing.
• We sign an NDA on request before you share anything sensitive.
• We ask only for the access the agreed tests need.

2. Where we test

In order of preference: your test environment, a copy or preview of your bot, or, if neither is possible, your live agent with extra safeguards: test accounts, a set time window, a spending limit, and no irreversible actions such as real refunds, payments or emails to your customers.

3. Test accounts and credentials

• Please use accounts created for testing, with test data, not real customer accounts.
• Share credentials through a Bitwarden Send link or another method we agree on, never through our website forms or plain email.
• We store credentials only in an encrypted Bitwarden vault and ask you to revoke them when testing ends.

4. What we never do

• Test anything outside the agreed scope.
• Run load tests or attacks meant to take your service down.
• Target your staff or customers with phishing or other social engineering.
• Keep copies of real customer data. If a test exposes real personal data, we stop that test, tell you right away, and delete what we saw.

5. AI tools we use

We use automated attack scripts and AI models to generate attacks and review responses. When we send your agent's replies to an AI provider, we use the provider's business API, not consumer chat apps, under terms that do not use the data for model training. We share the current list of providers on request and name them in each Order.

Before anything is sent to an AI provider, we remove personal information about you and your customers wherever possible. Real customer data that appears during testing is never sent on to train or improve any AI model.

6. Findings and reports

• Findings, attack prompts and reports are shared only with the contacts you name.
• Reports are shared through Google Drive links that only the people you name can open, with an expiry date, and are never published.
• Confirmed critical findings are reported to you on the same business day, without waiting for the final report.
• Native-speaking partners, when used, see only what they need and are bound by a confidentiality agreement.

7. Retention and deletion

• Data you share with us, such as test accounts, logs and screenshots, is deleted within 30 days after the engagement ends: after the final retest for Scan plans, or after cancellation for Guard plans.
• During Guard, we keep the attacks that worked so we can rerun them each month. Please still revoke test credentials after each test.
• We keep the attack techniques we develop, and results with anything that identifies you, your systems or your users removed, to improve our testing. Your NDA or Order can limit this.
• On request, we confirm deletion in writing.
• Invoices are kept as Japanese tax law requires.

8. How we protect our own systems

Our devices use full-disk encryption, and every account we use for Hoqo has two-factor authentication turned on. Hoqo is a one-person business, so the number of people with access to your data is small by design.

9. Questions or concerns

If you have a security question, or think something went wrong, email hello@hoqo.ai. You will hear back within one business day.

END OF SECURITY & DATA HANDLING