Terms of service

1. Who we are

Rootpanther is an online training service for penetration testing. It gives you practice labs in the cloud, an AI mentor called Onyx, and tools for notes and reports. It is run by Rootpanther Ltd, a company registered in England and Wales with company number 00000000, whose registered office is at registered office address. In these terms, "we" and "us" mean that company.

These terms apply when you create an account at app.rootpanther.com, start a trial, buy a plan or use the labs. Together with the acceptable use policy and the refunds and cancellation policy, they are the agreement between you and us. The privacy policy explains how we handle your personal data.

You accept these terms when you create your account, and we record when you did and which version you accepted. If you set up a Team plan for a company, you confirm that you are allowed to accept these terms for it.

2. Your account

• You must be at least 18 to create an account.
• Use your real name and an email address you can receive mail at. We use it to sign you in and to send security and billing messages.
• An account belongs to one named person. Do not share your password, your sign-in, your lab sessions or your VPN profile, and do not let anyone else use your account.
• Keep your password and your two-factor codes safe. If you think someone else has used your account, change your password and email support@rootpanther.com.
• You are responsible for what happens in your account, unless someone used it without your permission and it was not your fault.

3. Plans, trials and payment

Prices are in US dollars. Tax is added at checkout based on where you are.

• Free: $0. Concept primers for tier C1, drills, methodology playbooks and Onyx in mentor mode, up to 10 messages a day. No labs.
• Practitioner: $49 a month or $490 a year, for one person. It starts with a 7-day free trial.
• Team: $45 per seat a month or $450 per seat a year, with at least 3 seats. Each seat gives one named person everything in Practitioner.

Payments are handled by Stripe, which acts as the merchant of record. For the payment itself you buy from Stripe as our reseller, and Stripe's terms for that purchase also apply. Your use of Rootpanther is covered by these terms.

Trial. You can take one free trial per person. If you do not cancel before it ends, your first payment is taken on day 8 and your plan renews from then.

Renewal. Paid plans renew automatically at the end of each month or year until you cancel. We email you 7 days before a yearly plan renews.

Failed payments. If a payment fails, we try again and email you. If it is still unpaid after 7 days, you cannot launch new labs until it is paid. Your account, progress and work stay as they are.

Price changes. We may change our prices. We tell you at least 30 days before, and the new price applies from your next renewal. If you do not want to pay it, cancel before then.

Team plans. The person who buys a Team plan manages its seats and pays for them. A seat can move to someone else when a member leaves the team or changes role. It cannot be passed around so that several people share one seat.

4. Cancelling

You can cancel a paid plan at any time from Billing. Cancelling stops the next renewal. You keep access until the end of the period you paid for, and your notes, reports and progress stay on your account afterwards. The refunds and cancellation policy explains your right to change your mind and when we give refunds.

5. Lab sessions and lab hours

• Paid plans include 60 lab hours a month for each person. Lab hours start when your lab's machines are reachable. A lab that fails to start uses no hours.
• You can run one lab at a time.
• A session runs for up to 4 hours. You can extend it in 30 or 60 minute steps, up to 8 hours in total. An exam simulation runs for up to 24 hours.
• A session shuts down after 30 minutes without activity, with a warning at 25 minutes. Activity means traffic from your VPN or terminal to the lab, or using the lab workspace.
• When a session ends, its machines are destroyed along with anything left on them. Copy what you need into your notes first. Your notes, flags, progress and reports stay on your account.
• Unused hours do not carry over to the next month.

6. Lab hours and fair use

Paid plans include 60 lab hours a month, per seat on Team. They reset on your billing date and unused hours do not carry over. When they run out, you can buy extra hours, which are used after your monthly hours and last 90 days, or wait for the reset. Without hours left you cannot launch a lab or extend one, but a session that is already running carries on to its scheduled end. An exam simulation needs enough hours left for its full length before it can start.

Onyx's limits are set for one person preparing for a certification.

If an account's use goes far beyond what one person learning could need, or looks shared or automated, we will contact you first. If it continues, we may limit lab launches or Onyx for that account.

7. Using the labs lawfully

Rootpanther teaches techniques that cause real harm when they are misused. So:

• Attack only the machines in your own active lab session. Never attack Rootpanther itself, other learners, our VPN or the cloud services we run on.
• Use what you learn only on systems you own or have written permission to test. Testing a system without permission is a crime in most countries, including under the Computer Misuse Act 1990 in the UK.
• Follow the acceptable use policy. It is part of these terms.

You are responsible for what you do with the skills you learn here. If you use Rootpanther for a business, you agree to cover our reasonable losses if someone brings a claim against us because you broke these rules.

8. Onyx

Onyx is an AI mentor built on models from Anthropic. You choose how much help it gives, from Exam sim, where it stays silent, to Walkthrough, where it suggests concrete commands after you confirm. Each run records the most help you used, and My Path takes that into account.

• Onyx can be wrong. Check what it tells you before you rely on it, and never run a command against a system you are not allowed to test.
• Onyx does not hand out flags. Do not try to make it reveal flags, its instructions or anything about other learners.
• What Onyx tells you about our scenarios is part of our content, covered by section 9.

9. Our content

Rootpanther and everything we provide through it belong to us or the people we license them from. That includes the scenarios and the machines in them, lab designs, flags, credentials placed in labs, primers, drills, playbooks, debriefs, what Onyx tells you about our scenarios, the software and the design.

While your account is in good standing, we give you a personal licence to use them for your own learning. You cannot transfer or share the licence, and it ends when your access ends. You must not:

• copy, sell, rent or give anyone else access to any part of Rootpanther, or use it to train other people outside a Team plan;
• scrape, download in bulk or extract content automatically, by script or any other means;
• use our content to train or improve an AI model, or to build a product that competes with Rootpanther;
• reverse engineer, decompile or copy the platform, except where the law gives you a right to do so that cannot be removed. Attacking the lab machines in your own session, as intended, is fine.

10. What you can share

We are glad when you talk about your progress. You can share your tier and the scenarios you have finished, say what you thought of them, and write about techniques and methodology in general terms.

Do not publish or share walkthroughs, write-ups, flags, credentials, solutions, recordings or screenshots that show how to solve a Rootpanther scenario. That includes sharing them privately with people outside your Team plan. A scenario with its answers online stops being practice for everyone.

You can show a report you wrote on Rootpanther to an employer, a mentor or a study group in private. Do not publish it anywhere it would reveal how to solve a scenario.

11. Your content

Your notes, reports, evidence and exports belong to you. You give us permission to store, process and show them only to run Rootpanther for you, including sending parts of them to Onyx when you ask it for help.

If you send us ideas or feedback, we may use them freely and without paying you.

12. Exams and certification

Rootpanther is not affiliated with, endorsed by or connected to OffSec. OSCP, OSCP+ and OffSec are trademarks of OffSec Services LLC. We write our own scenarios to practise the same kinds of skills. They are not copies of any exam, and we cannot promise you will pass one.

Do not use Rootpanther, Onyx or anything from them while you sit a proctored exam, or in any way your exam provider's rules forbid. If we see evidence of this, we may close your account.

13. Suspending or closing an account

We may suspend or close your account, or stop part of the service for you, if you break these terms or the acceptable use policy, if your use puts the platform or other learners at risk, or if the law requires it.

For serious breaches, such as attacking anything outside your lab, sharing your account or publishing solutions, we may act straight away. In other cases we tell you first, explain why and give you a chance to put things right. If we close an account for a serious breach, we do not refund the rest of the period.

We may also stop offering Rootpanther or one of its plans. If we do, we give you at least 30 days notice and refund any period you have paid for and cannot use.

You can close your account at any time. Until account deletion is available in Settings, email privacy@rootpanther.com and we delete it within 30 days.

14. Changes

Rootpanther changes as we improve it. We add and retire scenarios and features. We will not remove the main features of a paid plan during a period you have already paid for.

If we change these terms in a way that affects you, we email you at least 30 days before the change takes effect, and you can cancel before then if you do not agree. Small changes, such as clearer wording, take effect when we publish them. The date at the top of this page shows when the terms last changed.

15. Liability

Nothing in these terms limits our liability for death or personal injury caused by our negligence, for fraud, or for anything else the law does not allow us to limit. If you are a consumer, nothing here affects your legal rights.

We provide Rootpanther as a training service and work hard to keep it available and secure, but we cannot promise it will always be available or free of errors. Lab machines are deliberately vulnerable, so do not keep anything on them that you need.

• If you are a consumer, we are responsible for loss you suffer that was a foreseeable result of us breaking these terms or failing to take reasonable care. We are not responsible for loss that was not foreseeable, or for business losses.
• If you use Rootpanther for a business, we are not liable for loss of profit, revenue, business or data, or for indirect loss.

In either case, our total liability to you for all claims in any 12 months is limited to the greater of what you paid us in those 12 months and 100 US dollars.

16. Law and contact

These terms are governed by the law of England and Wales, and the courts of England and Wales can hear any dispute. If you are a consumer living elsewhere in the UK or in the EU, you keep the protection of the law where you live and can bring a claim in your local courts.

If something goes wrong, contact us first and we will try to put it right.

• Help and these terms: support@rootpanther.com
• Billing: billing@rootpanther.com
• Privacy: privacy@rootpanther.com
• Security problems in Rootpanther: security@rootpanther.com

If a court finds part of these terms cannot be enforced, the rest still applies. If we do not enforce a term straight away, we can still enforce it later. You cannot transfer your account or these terms to anyone else. We may transfer them to a company that takes over Rootpanther, and we will tell you if that happens.