Refund Policy

1. Overview

This policy explains when you are entitled to a refund from XHack, how a refund is calculated, and how to request one. It covers both our digital products (subscription plans and platform access) and our professional security services (penetration testing, security assessments, and consulting), which are treated differently because they are delivered differently.

This policy forms part of, and should be read together with, our Terms of Service. Where this policy and the Terms of Service address the same subject, this policy governs refunds.

2. Digital Products (Subscription Plans)

XHack offers subscription plans for security researchers and organisations. These plans provide access to our SOC dashboard, vulnerability assessment scanners, AI Probe, GitGuard, AI chat, and other platform features.

2.1 Free Trial

XHack offers a time-limited free trial to users who meet our eligibility requirements at the time (see Sections 4.7 and 12.3 of our Terms of Service). While identity verification is required, it must be approved before you receive full access, and no card is needed to start a trial. While it is not required, you start with limited access and must link a valid credit or debit card to claim a trial. Full offensive capability is released only to verified accounts, whether paid or not. A trial is limited to one per person.

Whether a payment method is needed depends on our current requirements. Where no payment method is required, no charge arises, the trial ends automatically at the end of its term, and it does not convert into a paid subscription. Where a payment method is required, we state at sign-up whether the trial converts, the price, and the date of the first charge; no charge is made during the trial itself, and by starting it you authorize the first charge on that date unless you cancel before the trial ends. Because nothing is charged for the trial period, no refund can arise in respect of the trial itself. A charge made after a trial converts is a subscription payment and is treated under Section 2.2 (card) or Section 2.8 (cryptocurrency).

The trial does not replace the pro-rata refund right in Section 2.3, which continues to apply to paid subscriptions. We also do not guarantee that a trial will remain available: we may change its terms, or withdraw it entirely, at any time and without notice. A trial already in progress when it is withdrawn will run to the end of its term.

2.2 Refund Eligibility

You are eligible for a pro-rata refund of a digital subscription where all of the following are satisfied:

• Payment method. The subscription was paid by credit card or debit card. Card payments can be refunded to the original card through our payment processor, which is what makes a pro-rata refund operationally possible. Subscriptions paid by cryptocurrency are not eligible (Section 2.8).
• Account in good standing. Your account has not been suspended, locked, or terminated for cause under our Terms of Service, including enforcement triggered by our runtime guardrails, unauthorized or out-of-scope testing, credential sharing, or falsified verification materials. This does not apply where we confirm that an enforcement action was made in error (see Section 9.3 of the Terms of Service).
• Request within the billing period. The request is made while the subscription period you are seeking a refund for is still running. Once a billing period has ended, that period has been fully delivered and there is no unused portion left to refund.
• Genuine use. The account has not been used in a manner indicating abuse of this policy, such as repeated purchase-and-refund cycles, or consuming a substantial share of a plan's allowance before requesting a refund.

Payments made by other methods. Where a subscription was paid by bank or wire transfer, invoice, or through a reseller, a pro-rata refund under this Section is not automatically available, because those methods cannot be reliably reversed to the original payer. Cryptocurrency is dealt with in Section 2.8 and is not refundable. None of this removes any refund you are entitled to by law: where a refund is legally required, we will honour it and agree an alternative settlement route with you.

Verification declined. Where we require verification before you can use the Service, and we decline it or you withdraw before you have been given any access, you receive a full refund of the amount paid by card. Where we let you start with limited access and we then decline your verification, you may cancel and receive a pro-rata refund under Section 2.3 for a card payment. Cryptocurrency payments and AI API credits are not refundable, as set out in Sections 2.8 and 2.9.

2.3 How a Pro-Rata Refund Is Calculated

A digital subscription is delivered continuously across a billing period. A refund therefore returns the value of the portion you have not used, and retains the value of the portion already delivered to you. The calculation is:

• Step 1, unused time. The amount paid for the current billing period is divided by the number of days in that period, then multiplied by the number of whole days remaining after the date we receive your request.
• Step 2, metered consumption. Any metered resources you consumed beyond the share allocated to the days you actually used are deducted at the plan's standard rate. Metered resources include AI tokens, vulnerability assessment scans, SOC events ingested, and API calls.
• Step 3, pass-through costs. Non-recoverable third-party costs incurred specifically for you (for example external scanning infrastructure or cloud resources provisioned on your behalf) are deducted.

Worked example. You pay $100 for a 30-day plan and request a refund on day 10. Twenty days remain, so the unused-time value is $100 ÷ 30 × 20 = $66.67. If your consumption during those first 10 days stayed within the share allocated to them, you are refunded $66.67. If you consumed metered resources worth $16.67 more than that share, the refund is $50.00.

• Annual plans are calculated the same way, using the days remaining in the annual term.
• Where a calculated refund is below $1.00 USD, no refund is issued, as the processing cost exceeds the amount.
• We will provide the calculation in writing with your refund decision, so you can see exactly how the figure was reached.

2.4 Effect of a Refund

A pro-rata refund ends the subscription it relates to. On approval, your plan is cancelled, access to the platform and to the XHack AI agent ends, and any remaining plan allowances are forfeited. A refund is not a pause or a credit; if you wish to return later, you purchase a new subscription. Verification already completed generally remains valid, subject to the re-verification provisions in our Terms of Service.

2.5 Your Statutory Rights

Nothing in this policy limits or excludes any right you have under mandatory consumer protection law in your country of residence, and nothing here is intended to override such rights.

If you are a consumer in the United Kingdom, the European Union, or another jurisdiction granting a statutory cancellation or withdrawal period for digital content, please note that by purchasing a subscription and asking us to begin providing access, you request immediate performance of the contract. Under those regimes the withdrawal right may be lost once supply has begun with your consent. The pro-rata refund offered in Section 2.3 is provided voluntarily and is, in most circumstances, more favourable than the statutory position after supply has begun. Purchases made by a business, rather than by a consumer, are governed by this policy and the Terms of Service rather than by consumer withdrawal rules.

2.6 Refund Process

To request a refund for a digital product subscription:

1. Send an email to support@xhack.io with the subject line "Refund Request".
2. Include your registered email address, tenant name, plan name, and the reason for your request.
3. We review the request and respond within 5 business days, including the pro-rata calculation and the amount to be returned.
4. Approved refunds are issued to the original credit or debit card within 10 business days of approval. Your bank or card issuer may take a further 5 to 10 business days to post the funds to your statement; that timing is controlled by them, not by us.

2.7 Non-Refundable Items

The following are not eligible for a refund under this policy, subject always to Section 2.5 and to any refund we owe where we confirm that an enforcement action was made in error (Section 9.3 of the Terms of Service):

• Billing periods that have already ended, since the service for that period was delivered in full.
• Any payment made in cryptocurrency (Section 2.8).
• Any purchase of AI API credits, including an unused balance (Section 2.9).
• Accounts suspended, locked, or terminated for cause, including enforcement by our runtime guardrails, unauthorized or out-of-scope testing, sharing access with an unverified person, or supplying falsified verification materials.
• Metered resources already consumed, including AI tokens, scans, SOC events, and API calls.
• One-time setup, onboarding, or custom configuration fees, where applicable.
• Non-recoverable third-party costs incurred on your behalf, such as external scanning infrastructure or cloud hosting.
• Professional services that have commenced, which are governed by Section 3 rather than by this Section.

2.8 Cryptocurrency Payments: No Refunds

Payments made in cryptocurrency are final and are not refundable, in whole or in part. This applies to subscriptions, plan upgrades, add-ons and AI API credits, and whether you cancel, downgrade, stop using the service, or your access ends for any reason, including termination for cause. No pro-rata refund or credit is available.

• Acceptance before payment. You must accept our Terms of Service and this Refund Policy before paying in cryptocurrency, and we may decline to process the payment until you do. Making the payment confirms your acceptance.
• Irreversible by nature. Blockchain transactions cannot be reversed or recalled. You are responsible for sending the correct asset, on the correct network, to the correct address, in the correct amount. Funds sent incorrectly are not refundable and we are not obliged to recover them.
• Market movement and fees. Prices are set in USD and converted at the rate quoted at checkout. We do not compensate for later changes in the value of the asset, and you bear all network and exchange fees.
• Overpayment. We are not obliged to return an overpayment; at our discretion we may credit it toward future fees or return it, less network and processing costs.
• Compliance. We may refuse, hold or reject a payment, and are not obliged to return funds, where we suspect sanctions exposure or funds of unlawful origin, except where the law requires otherwise.

2.9 AI API Credits: No Refunds

The purchase of AI API credits is final and non-refundable, whether paid by card or by cryptocurrency. This includes any unused balance, closure or termination of your account, a change or cancellation of a plan, and ceasing to use the API. Refunding a subscription does not refund credits.

• You must accept our Terms of Service and this Refund Policy before purchasing credits.
• Credits are drawn down by usage at the rates shown in your dashboard, and are consumed automatically where you have enabled fallback to credits when a plan limit is reached.
• Credits have no cash value, cannot be transferred or redeemed for money, and may be forfeited on termination for cause or expire where an expiry was disclosed at purchase or in your dashboard.
• Where usage is wrongly charged because of a fault in our platform, we may, at our discretion, restore the affected credits. That is not a refund.

3. Professional Services (Security Testing and Consulting)

XHack provides professional cybersecurity services including web application penetration testing, mobile application security assessments, API security testing, red team operations, cloud security audits, and security consulting. These services are governed by individually signed agreements and are subject to different refund terms than digital products.

3.1 No Refund Policy for Professional Services

All professional security services are non-refundable once the engagement has commenced. This policy exists for the following reasons:

• Confidential knowledge transfer. Security assessments require the client to share sensitive information including system architecture, source code, credentials, internal network details, and business logic. Once this information is disclosed to our team, the service delivery has materially begun and cannot be reversed.
• Non-Disclosure Agreements. All engagements are conducted under signed NDAs and service agreements that define the scope, timeline, and deliverables. These agreements are legally binding and represent mutual commitments from both parties.
• Resource allocation and scheduling. Our security researchers dedicate time exclusively to your engagement. This includes preparation, environment setup, tool configuration, and scheduling that begins before active testing starts. Cancellation after commencement results in lost capacity that cannot be recovered.
• Intellectual effort and expertise. Penetration testing and security assessments are knowledge-intensive services. Our team invests significant intellectual effort in understanding your systems, identifying attack surfaces, developing custom test cases, and producing findings. This effort is expended regardless of the number of vulnerabilities discovered.
• Partial deliverables still hold value. Even if a client wishes to cancel midway through an engagement, the work completed up to that point (reconnaissance, vulnerability discovery, partial reports) represents genuine value that has already been delivered.
• Industry standard practice. Non-refundable terms for professional cybersecurity services are standard across the industry due to the sensitive, time-intensive, and specialized nature of the work.

3.2 Pre-Engagement Cancellation

If you wish to cancel a professional service engagement before any work has commenced (before the signed agreement start date and before any sensitive information has been exchanged), please contact us at support@xhack.io. Pre-engagement cancellations are reviewed on a case-by-case basis, and a partial or full refund may be offered at our discretion, minus any administrative or preparation costs already incurred.

3.3 Dispute Resolution

If you believe the delivered service did not meet the scope defined in your signed agreement, you may raise a formal dispute within 7 days of receiving the final deliverables. Disputes are reviewed by our management team. If the review determines that we failed to deliver on the agreed scope, we will offer either:

• Completion of the outstanding work at no additional cost, or
• A partial credit toward a future engagement.

Cash refunds for professional services are not offered under any circumstances once the engagement has started, unless required by applicable law.

4. Researcher Plans

Researcher subscription plans (Starter, Professional, Elite) follow the same refund policy as digital products outlined in Section 2. These plans provide AI token allowances for autonomous security research, bug hunting, and vulnerability analysis. Usage is measured in AI tokens consumed, and refund calculations account for tokens used during the active subscription period. Refunds are available only where the plan was paid by credit or debit card; cryptocurrency payments and AI API credit purchases are not refundable.

5. Organisation Plans

Organisation plans (Starter, Premium, Elite) follow the same refund policy as digital products outlined in Section 2. These plans include SOC event log quotas, vulnerability assessment scan limits, team member seats, and API key allowances. Refund calculations account for all resource usage during the active period, including SOC events ingested, VA scans run, and AI tokens consumed.

6. General Terms

6.1 Currency and Payment Method

Refunds are available only for payments made by credit or debit card, and are issued in USD to the original card used for the purchase. We cannot redirect a refund to a different card, account, or person. If the original card has expired or been closed, contact your issuer first, most will forward a refund to the replacement card on the same account. Where that is not possible, contact us and we will agree an alternative route.

Refunds are calculated and issued in USD. If your card is denominated in another currency, the amount you receive may differ from the amount you originally paid because of exchange rate movement between the two dates. Currency conversion charges, cross-border fees, or other banking charges applied by your card issuer are set by them and are not covered or reimbursed by XHack.

6.2 Chargebacks

We encourage you to contact our support team before initiating a chargeback with your bank or payment provider. Filing a chargeback without first attempting to resolve the issue directly with us may result in your account being suspended and may delay the resolution process. We may contest a chargeback using the record of your acceptance of our Terms of Service and this policy.

6.3 Changes to This Policy

We reserve the right to update this refund policy at any time. Changes will be posted on this page with an updated "Last Updated" date. Continued use of XHack services after changes are posted constitutes acceptance of the updated policy.

7. Contact Us

If you have questions about this refund policy or need to submit a refund request, please contact us:

• Email: support@xhack.io
• WhatsApp: +92 314 606 0703 (urgent inquiries for company clients)
• Website: xhack.io/contact