Terms of service

Last updated: 15 October 2026.

These terms describe use of Sonar, the attack surface management service offered under the Tohou name. Contact [email protected] with questions about the service.

Accounts and authority

You must be legally able to enter into this agreement. If you use Sonar for an organization, you must have authority to do so. Authentication is provided through Discord. You are responsible for securing your Discord account and any API keys or invitations you create.

Authorized use only

You may submit infrastructure only when you own it or hold explicit permission for the checks you request. A verification challenge demonstrates technical control; it does not replace permission from an asset owner or hosting provider. Do not use the service for unauthorized access, disruption, credential theft, harassment, or evasion of limits. The scanning policy forms part of these terms.

Workspace data and access

You retain rights in the data you submit. You permit Tohou to process it to provide, maintain and secure Sonar. Workspace owners manage team access. Members can access data according to their role. Do not submit data that you are not entitled to process or share.

Limits and availability

Free workspaces have enforced asset, scan and API limits shown in the console. Limits and features may change. The operator may stop scans or restrict access to address abuse, capacity, provider restrictions or security issues. No uptime service-level agreement is offered for free access. Billing is not enabled and no payment is collected through this version of the service.

Interpreting results

Findings describe observations, not a guarantee of compromise or complete vulnerability coverage. You are responsible for reviewing evidence, assessing business impact and validating changes. External sources can be incomplete or unavailable. AI assistance, when configured, may be inaccurate and requires review.

Deletion and termination

You can request account deletion in the console. Deletion is scheduled 24 hours after the request and can be cancelled before that deadline. It removes your account and workspaces you own, including their shared data. Operational outages can delay the purge until the worker resumes. Data belonging to other organizations is not deleted merely because you were a member. The privacy policy explains retention.

Responsibility

The service is provided as available without a promise of uninterrupted operation, exhaustive detection, or fitness for a particular purpose. To the extent permitted by applicable law, Tohou is not responsible for indirect losses resulting from reliance on findings or service interruption. Nothing in these terms excludes rights or liabilities that cannot lawfully be excluded.

Changes and contact

Material changes to these terms will be reflected on this page. Questions and complaints may be sent to [email protected]; suspected misuse should be sent to [email protected].