AIの弱点を
攻撃者より先に

These Terms of Service ("Terms") apply to the Hoqo website and to the services provided by Ryoya Kubo, a sole proprietor based in Japan, trading as Hoqo ("Hoqo", "we", "us"). By requesting a free check or ordering a plan, you agree to these Terms on behalf of yourself and the organization you represent ("you").

1. Our services

Hoqo tests AI agents and chatbots for security weaknesses ("red teaming"). We offer a free check and paid plans (Hoqo Scan, Scan Pro, Hoqo Guard and Guard Pro). For paid plans, the exact scope, deliverables, schedule and fees are set out in a written order or statement of work ("Order"). If an Order conflicts with these Terms, the Order applies.

The free check is a short, limited review of a few key risks. It is not a full test, and you are under no obligation to buy anything afterwards. We may decline any request.

"Business day" means a weekday that is not a public holiday in Japan, based on Japan Standard Time.

2. Authorization and scope

You confirm that you own the AI system to be tested, or that you have the owner's permission to have it tested, and that you have the authority to agree to these Terms.

• We start testing only after the scope (which systems, accounts, techniques and time window) has been confirmed in writing, including by email.
• We test only within the agreed scope, and we stop as soon as you ask us to.
• You are responsible for any notice or approval your own providers require (for example, your hosting, cloud or AI model provider).
• We may pause or stop testing at any time if we have doubts about authorization.

3. Your responsibilities

• Provide the test accounts, environments and information we agree on.
• Use a test or staging environment and test data where possible, and keep backups of anything important.
• Tell us in advance about anything fragile, costly to run, or connected to real customers or payments.
• Apply fixes yourself. Hoqo recommends fixes but does not change your systems.

4. Testing risks

Security testing can cause unexpected behavior, errors, extra usage costs (for example, AI model or API fees) or temporary disruption. We take reasonable care to avoid this and to stay within the agreed scope, and you accept these risks for testing performed within that scope.

5. No guarantee

Testing is a point-in-time assessment of the agreed scope. A test that finds no issues does not mean your system is secure, and we cannot guarantee that every weakness will be found or that a fix will prevent future attacks. AI systems and attack techniques change over time.

6. Confidentiality

We keep your confidential information, including your system details, data, findings and reports, confidential, and use it only to provide the services. We will sign an NDA on request before you share anything sensitive. We will not publish your findings or name you as a client without your written permission. Where we work with a native-speaking partner for a language, that partner is bound by a confidentiality agreement.

7. Fees and payment

• Fees are as shown on our website or in your Order, in US dollars, excluding applicable taxes.
• You pay only after we have agreed on the scope. We then send you a secure payment link to pay by card through our payment provider Stripe, or an invoice if you prefer. Testing starts once payment is received.
• Hoqo Scan and Scan Pro are one-time payments.
• Each plan includes a set number of languages and tools. Additional languages are charged as shown on our website, up to 6 languages per agent. Hoqo Scan and Hoqo Guard cover up to 3 tools, and Scan Pro and Guard Pro up to 10. More languages, tools or agents are quoted separately.
• Hoqo Guard and Guard Pro have a minimum term of 3 months and then continue month to month until either party cancels with 30 days' written notice.
• Invoices are due within 14 days.
• For Hoqo Guard and Guard Pro, the first 3 months are paid in advance once the scope is agreed. After that, each month is billed in advance.
• You may upgrade from Hoqo Scan to Scan Pro within one week of your Scan Order by paying the difference in price. If you start Hoqo Guard or Guard Pro after a Scan, one month's fee is waived.

8. Intellectual property

You keep all rights to your systems and data. You may use our reports freely within your organization. We keep the rights to our own methods, tools and general know-how, including the attack techniques we develop during testing. We may keep and use those techniques, and results with anything that identifies you, your systems or your users removed, to improve our testing.

9. Limitation of liability

To the maximum extent permitted by law, our total liability arising from the services is limited to the fees you paid us in the 12 months before the claim, and we are not liable for indirect or consequential losses, such as lost profits or lost data. Nothing in these Terms limits liability that cannot be limited under applicable law, including liability for intentional misconduct or gross negligence.

10. Ending the services

Either party may end an Order if the other party seriously breaches these Terms and does not fix the breach within 14 days of notice. Sections 5, 6, 8 and 9 continue to apply after the services end.

11. Independence

Hoqo is independent and is not affiliated with, endorsed by or certified by OWASP or MITRE. We refer to their frameworks only to describe and map our findings.

12. Governing law

These Terms are governed by the laws of Japan. The Fukuoka District Court has exclusive jurisdiction over any dispute, unless the Order says otherwise.

13. Changes to these Terms

We may update these Terms from time to time. The effective date at the top shows when they last changed. Changes do not affect an Order already signed unless both parties agree.

14. Contact

Ryoya Kubo (Hoqo)
1-8-23 Akasaka, Chuo-ku, Fukuoka 810-0042, Japan
hello@hoqo.ai

END OF TERMS OF SERVICE

This Privacy Policy explains how Hoqo, operated by Ryoya Kubo, a sole proprietor based in Japan ("Hoqo", "we", "us"), collects and uses personal information when you visit our website, request a free check, or work with us.

1. Information we collect

• Information you give us: your name, work email, company website, details about your AI agent, the languages it supports, and anything else you write in our forms or emails.
• Information shared during an engagement: test accounts, system details, conversation logs and similar data needed to test your AI agent. This is also covered by your Order and any NDA.
• Website usage data: pages visited, referring site, device and browser type, and approximate country, collected without cookies by Cloudflare Web Analytics.

Please do not send us passwords, API keys or customer data through our website forms. We agree on a safe way to share test access once the scope is confirmed.

2. How we use it

• To reply to your request and agree on the scope of testing.
• To perform the services, prepare reports and run retests.
• To send invoices and meet our legal and tax obligations.
• To keep our website working and understand how it is used.

We do not sell your personal information.

3. Personal information about your customers

Testing an AI agent can bring us into contact with personal information about your customers, such as names or email addresses that appear in test conversations. We protect it in the same way as your own information, and more strictly:

• We ask for test accounts and test data wherever possible, so real customer data is not needed.
• We use any customer personal information we see only to confirm and report a finding, and never for any other purpose.
• We remove it before sending anything to an AI provider, and mask it in reports, for example j••••@•••••.com.
• We delete it within 30 days after the engagement ends, and we never keep it in the attack techniques or anonymized results we retain.

4. Legal bases

Where the EU or UK GDPR applies, we process personal information to take steps at your request before entering into a contract and to perform that contract, for our legitimate interests in running and improving our business, and to comply with legal obligations.

5. Who we share it with

• Service providers that help us operate: email and workspace, website hosting and forms, email delivery, payments (Stripe; Hoqo does not receive or store your card details), and the AI model providers we use for testing. The AI providers are named on our Security & data handling page.
• Native-speaking partners, bound by a confidentiality agreement, when an engagement needs testing in a language they cover. They receive only what they need for that work.
• Authorities, when required by law.

Our service providers may use personal information only to provide their services to us. We share only what each of them needs, and we do not allow them to use it for their own purposes, including training AI models.

6. International transfers

Hoqo is based in Japan, and our service providers may process information in other countries. When we transfer personal information across borders, we take the steps required by Japan's Act on the Protection of Personal Information and, where applicable, the GDPR, such as standard contractual clauses.

7. How long we keep it

• Requests that do not lead to an engagement: up to 12 months.
• Data you share during an engagement, such as test accounts, logs and screenshots: deleted within 30 days after the engagement ends (after the final retest for Scan plans, or after cancellation for Guard plans), unless we agree otherwise.
• Attack techniques we develop, and results with anything that identifies you, your systems or your users removed: kept to improve our testing.
• Invoices and accounting records: as long as Japanese tax law requires.

8. Security

We use reasonable technical and organizational measures to protect personal information, such as full-disk encryption, two-factor authentication on all accounts, an encrypted password manager, and limiting access to the people who need it.

9. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict how we use it, to receive a copy of it, and to withdraw consent. To make a request, email hello@hoqo.ai. You can also complain to your local data protection authority or, in Japan, to the Personal Information Protection Commission.

10. Cookies

We do not use cookies for advertising or tracking. We measure visits with Cloudflare Web Analytics, which does not use cookies or collect personal identifiers. To protect our forms from spam, we use Cloudflare Turnstile.

11. Children

Our services are for businesses and are not directed at children.

12. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it last changed.

13. Contact

Ryoya Kubo (Hoqo)
1-8-23 Akasaka, Chuo-ku, Fukuoka 810-0042, Japan
hello@hoqo.ai

END OF PRIVACY POLICY

Testing an AI agent means handling sensitive things: access to your systems, conversation logs and, sometimes, the weaknesses we find. This page explains how Hoqo handles them. Your Order or NDA can add stricter terms, and when it does, those apply.

1. Before testing

• We test only systems you own or have the owner's permission to test, and only after the scope is confirmed in writing.
• We sign an NDA on request before you share anything sensitive.
• We ask only for the access the agreed tests need.

2. Where we test

In order of preference: your test environment, a copy or preview of your bot, or, if neither is possible, your live agent with extra safeguards: test accounts, a set time window, a spending limit, and no irreversible actions such as real refunds, payments or emails to your customers.

3. Test accounts and credentials

• Please use accounts created for testing, with test data, not real customer accounts.
• Share credentials through a Bitwarden Send link or another method we agree on, never through our website forms or plain email.
• We store credentials only in an encrypted Bitwarden vault and ask you to revoke them when testing ends.

4. What we never do

• Test anything outside the agreed scope.
• Run load tests or attacks meant to take your service down.
• Target your staff or customers with phishing or other social engineering.
• Keep copies of real customer data. If a test exposes real personal data, we stop that test, tell you right away, and delete what we saw.

5. AI tools we use

We use automated attack scripts and AI models to generate attacks and review responses. When we send your agent's replies to an AI provider, we use the provider's business API, not consumer chat apps, under terms that do not use the data for model training. We share the current list of providers on request and name them in each Order.

Before anything is sent to an AI provider, we remove personal information about you and your customers wherever possible. Real customer data that appears during testing is never sent on to train or improve any AI model.

6. Findings and reports

• Findings, attack prompts and reports are shared only with the contacts you name.
• Reports are shared through Google Drive links that only the people you name can open, with an expiry date, and are never published.
• Confirmed critical findings are reported to you on the same business day, without waiting for the final report.
• Native-speaking partners, when used, see only what they need and are bound by a confidentiality agreement.

7. Retention and deletion

• Data you share with us, such as test accounts, logs and screenshots, is deleted within 30 days after the engagement ends: after the final retest for Scan plans, or after cancellation for Guard plans.
• During Guard, we keep the attacks that worked so we can rerun them each month. Please still revoke test credentials after each test.
• We keep the attack techniques we develop, and results with anything that identifies you, your systems or your users removed, to improve our testing. Your NDA or Order can limit this.
• On request, we confirm deletion in writing.
• Invoices are kept as Japanese tax law requires.

8. How we protect our own systems

Our devices use full-disk encryption, and every account we use for Hoqo has two-factor authentication turned on. Hoqo is a one-person business, so the number of people with access to your data is small by design.

9. Questions or concerns

If you have a security question, or think something went wrong, email hello@hoqo.ai. You will hear back within one business day.

END OF SECURITY & DATA HANDLING