Refund Policy

1. Overview

This policy explains when you are entitled to a refund from XHack, how a refund is calculated, and how to request one. It covers both our digital products (subscription plans and platform access) and our professional security services (penetration testing, security assessments, and consulting), which are treated differently because they are delivered differently.

This policy forms part of, and should be read together with, our Terms of Service. Where this policy and the Terms of Service address the same subject, this policy governs refunds.

2. Digital Products (Subscription Plans)

XHack offers subscription plans for security researchers and organisations. These plans provide access to our SOC dashboard, vulnerability assessment scanners, AI Probe, GitGuard, AI chat, and other platform features.

2.1 No Free Trial

XHack does not offer a free trial, a free tier, or evaluation access. Because our platform provides unrestricted offensive security capability, access is granted only to users who have paid for a plan and passed the verification process described in Section 4 of our Terms of Service. Releasing that capability to unverified, unpaid accounts is not compatible with our access-control model.

The pro-rata refund right in Section 2.3 exists in place of a trial. It is intended to give you a genuine opportunity to evaluate the platform after purchase without being locked into the remainder of a billing period you do not use. Before purchasing, we encourage you to review our documentation, pricing, and feature pages, or to contact us with questions.

2.2 Refund Eligibility

You are eligible for a pro-rata refund of a digital subscription where all of the following are satisfied:

• Payment method. The subscription was paid by credit card or debit card. Card payments can be refunded to the original card through our payment processor, which is what makes a pro-rata refund operationally possible.
• Account in good standing. Your account has not been suspended, locked, or terminated for cause under our Terms of Service, including enforcement triggered by our runtime guardrails, unauthorized or out-of-scope testing, credential sharing, or falsified verification materials.
• Request within the billing period. The request is made while the subscription period you are seeking a refund for is still running. Once a billing period has ended, that period has been fully delivered and there is no unused portion left to refund.
• Genuine use.The account has not been used in a manner indicating abuse of this policy, such as repeated purchase-and-refund cycles, or consuming a substantial share of a plan's allowance before requesting a refund.

Payments made by other methods. Where a subscription was paid by bank or wire transfer, cryptocurrency, invoice, or through a reseller, a pro-rata refund under this Section is not automatically available, because those methods cannot be reliably reversed to the original payer. This does not remove any refund you are entitled to by law: where a refund is legally required, we will honour it and agree an alternative settlement route with you.

Verification declined. If you pay for a plan and we decline your verification, or you withdraw before verification completes, and you have not been granted access to the platform or the XHack AI agent, you receive a full refund of the amount paid. No pro-rata deduction applies, because no service was delivered.

2.3 How a Pro-Rata Refund Is Calculated

A digital subscription is delivered continuously across a billing period. A refund therefore returns the value of the portion you have not used, and retains the value of the portion already delivered to you. The calculation is:

• Step 1, unused time. The amount paid for the current billing period is divided by the number of days in that period, then multiplied by the number of whole days remaining after the date we receive your request.
• Step 2, metered consumption.Any metered resources you consumed beyond the share allocated to the days you actually used are deducted at the plan's standard rate. Metered resources include AI tokens, vulnerability assessment scans, SOC events ingested, and API calls.
• Step 3, pass-through costs. Non-recoverable third-party costs incurred specifically for you (for example external scanning infrastructure or cloud resources provisioned on your behalf) are deducted.

Worked example. You pay $100 for a 30-day plan and request a refund on day 10. Twenty days remain, so the unused-time value is $100 ÷ 30 × 20 = $66.67. If your consumption during those first 10 days stayed within the share allocated to them, you are refunded $66.67. If you consumed metered resources worth $16.67 more than that share, the refund is $50.00.

• Annual plans are calculated the same way, using the days remaining in the annual term.
• Where a calculated refund is below $1.00 USD, no refund is issued, as the processing cost exceeds the amount.
• We will provide the calculation in writing with your refund decision, so you can see exactly how the figure was reached.

2.4 Effect of a Refund

A pro-rata refund ends the subscription it relates to. On approval, your plan is cancelled, access to the platform and to the XHack AI agent ends, and any remaining plan allowances are forfeited. A refund is not a pause or a credit; if you wish to return later, you purchase a new subscription. Verification already completed generally remains valid, subject to the re-verification provisions in our Terms of Service.

2.5 Your Statutory Rights

Nothing in this policy limits or excludes any right you have under mandatory consumer protection law in your country of residence, and nothing here is intended to override such rights.

If you are a consumer in the United Kingdom, the European Union, or another jurisdiction granting a statutory cancellation or withdrawal period for digital content, please note that by purchasing a subscription and asking us to begin providing access, you request immediate performance of the contract. Under those regimes the withdrawal right may be lost once supply has begun with your consent. The pro-rata refund offered in Section 2.3 is provided voluntarily and is, in most circumstances, more favourable than the statutory position after supply has begun. Purchases made by a business, rather than by a consumer, are governed by this policy and the Terms of Service rather than by consumer withdrawal rules.

2.6 Refund Process

To request a refund for a digital product subscription:

1. Send an email to support@xhack.io with the subject line "Refund Request".
2. Include your registered email address, tenant name, plan name, and the reason for your request.
3. We review the request and respond within 5 business days, including the pro-rata calculation and the amount to be returned.
4. Approved refunds are issued to the original credit or debit card within 10 business days of approval. Your bank or card issuer may take a further 5 to 10 business days to post the funds to your statement; that timing is controlled by them, not by us.

2.7 Non-Refundable Items

The following are not eligible for a refund under this policy, subject always to Section 2.5:

• Billing periods that have already ended, since the service for that period was delivered in full.
• Accounts suspended, locked, or terminated for cause, including enforcement by our runtime guardrails, unauthorized or out-of-scope testing, sharing access with an unverified person, or supplying falsified verification materials.
• Metered resources already consumed, including AI tokens, scans, SOC events, and API calls.
• One-time setup, onboarding, or custom configuration fees, where applicable.
• Non-recoverable third-party costs incurred on your behalf, such as external scanning infrastructure or cloud hosting.
• Professional services that have commenced, which are governed by Section 3 rather than by this Section.

3. Professional Services (Security Testing and Consulting)

XHack provides professional cybersecurity services including web application penetration testing, mobile application security assessments, API security testing, red team operations, cloud security audits, and security consulting. These services are governed by individually signed agreements and are subject to different refund terms than digital products.

3.1 No Refund Policy for Professional Services

All professional security services are non-refundable once the engagement has commenced. This policy exists for the following reasons:

• Confidential knowledge transfer. Security assessments require the client to share sensitive information including system architecture, source code, credentials, internal network details, and business logic. Once this information is disclosed to our team, the service delivery has materially begun and cannot be reversed.
• Non-Disclosure Agreements. All engagements are conducted under signed NDAs and service agreements that define the scope, timeline, and deliverables. These agreements are legally binding and represent mutual commitments from both parties.
• Resource allocation and scheduling. Our security researchers dedicate time exclusively to your engagement. This includes preparation, environment setup, tool configuration, and scheduling that begins before active testing starts. Cancellation after commencement results in lost capacity that cannot be recovered.
• Intellectual effort and expertise. Penetration testing and security assessments are knowledge-intensive services. Our team invests significant intellectual effort in understanding your systems, identifying attack surfaces, developing custom test cases, and producing findings. This effort is expended regardless of the number of vulnerabilities discovered.
• Partial deliverables still hold value. Even if a client wishes to cancel midway through an engagement, the work completed up to that point (reconnaissance, vulnerability discovery, partial reports) represents genuine value that has already been delivered.
• Industry standard practice. Non-refundable terms for professional cybersecurity services are standard across the industry due to the sensitive, time-intensive, and specialized nature of the work.

3.2 Pre-Engagement Cancellation

If you wish to cancel a professional service engagement before any work has commenced (before the signed agreement start date and before any sensitive information has been exchanged), please contact us at support@xhack.io. Pre-engagement cancellations are reviewed on a case-by-case basis, and a partial or full refund may be offered at our discretion, minus any administrative or preparation costs already incurred.

3.3 Dispute Resolution

If you believe the delivered service did not meet the scope defined in your signed agreement, you may raise a formal dispute within 7 days of receiving the final deliverables. Disputes are reviewed by our management team. If the review determines that we failed to deliver on the agreed scope, we will offer either:

• Completion of the outstanding work at no additional cost, or
• A partial credit toward a future engagement.

Cash refunds for professional services are not offered under any circumstances once the engagement has started, unless required by applicable law.

4. Researcher Plans

Researcher subscription plans (Starter, Professional, Elite) follow the same refund policy as digital products outlined in Section 2. These plans provide AI token allowances for autonomous security research, bug hunting, and vulnerability analysis. Usage is measured in AI tokens consumed, and refund calculations account for tokens used during the active subscription period.

5. Organisation Plans

Organisation plans (Starter, Premium, Elite) follow the same refund policy as digital products outlined in Section 2. These plans include SOC event log quotas, vulnerability assessment scan limits, team member seats, and API key allowances. Refund calculations account for all resource usage during the active period, including SOC events ingested, VA scans run, and AI tokens consumed.

6. General Terms

6.1 Currency and Payment Method

All refunds are issued in USD to the original credit or debit card used for the purchase. We cannot redirect a refund to a different card, account, or person. If the original card has expired or been closed, contact your issuer first, most will forward a refund to the replacement card on the same account. Where that is not possible, contact us and we will agree an alternative route.

Refunds are calculated and issued in USD. If your card is denominated in another currency, the amount you receive may differ from the amount you originally paid because of exchange rate movement between the two dates. Currency conversion charges, cross-border fees, or other banking charges applied by your card issuer are set by them and are not covered or reimbursed by XHack.

6.2 Chargebacks

We encourage you to contact our support team before initiating a chargeback with your bank or payment provider. Filing a chargeback without first attempting to resolve the issue directly with us may result in your account being suspended and may delay the resolution process.

6.3 Changes to This Policy

We reserve the right to update this refund policy at any time. Changes will be posted on this page with an updated "Last Updated" date. Continued use of XHack services after changes are posted constitutes acceptance of the updated policy.

7. Contact Us

If you have questions about this refund policy or need to submit a refund request, please contact us:

• Email: support@xhack.io
• WhatsApp: +92 314 606 0703 (urgent inquiries for company clients)
• Website: xhack.io/contact