License, privacy, payments, and authorized use.

Product license

RedTeamKit is a digital implementation kit containing a local-first assessment workspace, playbooks, structured test cases, workbooks, templates, examples, and versioned updates. It is not a certification, accreditation, compliance attestation, legal opinion, or guarantee of security.

Individual License

One named user may use and modify the product for personal work, portfolio development, and individual internal assessments. Organizational sharing, client delivery, redistribution, resale, or public publication of source files is not permitted.

Consultant License

One named consultant or professional-services practitioner may use and customize the product during explicitly authorized paid engagements and may deliver completed client-specific reports. The source files, complete attack library, and editable templates may not be resold, sublicensed, or transferred to clients.

Team License

Up to ten named users within one legal organization may use the product internally. Affiliates, contractors, external clients, training programs, and managed-service delivery require separate written rights.

Enterprise use

More than ten users, multiple subsidiaries, government-wide deployment, white labeling, training-provider use, or managed-service use requires a separate agreement.

Updates

Unless otherwise stated at checkout, twelve months of v1.x updates are included. Tarique Smith may change the scope, format, schedule, and delivery method for updates.

Restrictions

• Do not redistribute, publish, resell, sublicense, or upload the source assets.
• Do not remove copyright, attribution, license, or safety notices.
• Do not represent the product as certification, accreditation, compliance proof, or a warranty.
• Do not use the product to facilitate unlawful access, fraud, harm, surveillance, or disruption.

Authorized use and ethics

Before any test, document named approvers, exact in-scope systems, out-of-scope systems, test windows, rate and cost limits, approved accounts, prohibited actions, evidence handling, emergency contacts, and stop conditions.

Required safeguards

• Explicit written authorization and named approvers.
• Staging or sandbox environments wherever practical.
• Synthetic or expressly approved data.
• Least-privilege accounts and transaction-level authorization.
• Monitoring, rollback capability, cost limits, and emergency stop procedures.
• Evidence minimization, redaction, encryption, retention, and deletion rules.
• Responsible escalation and disclosure.

Stop immediately when

• Testing affects an out-of-scope system.
• Real customer, regulated, or unapproved sensitive data is accessed.
• A live service becomes unstable or degraded.
• A real compromise or unrelated incident is discovered.
• The approved cost, rate, or action boundary is exceeded.

Local-first workspace

The v1 workspace stores assessment state in browser local storage. Users are responsible for endpoint security, exports and backups, appropriate redaction, and avoiding unapproved secrets or regulated records. Clearing browser data may delete workspace records.

Payments, tax, and delivery

Stripe processes checkout, payment credentials, billing information, receipts, and transaction records. Tarique Smith does not receive or store complete payment-card numbers.

Tarique Smith is the seller of RedTeamKit. Stripe is the payment processor for this implementation and is not acting as merchant of record. Tarique Smith remains responsible for product delivery, customer support, refund decisions, tax registrations, filings, and other seller obligations.

When enabled, Stripe Tax may calculate and collect applicable transaction taxes using information provided during checkout. Tax calculations do not constitute legal or tax advice and do not remove Tarique Smith's registration or filing obligations.

After Stripe confirms payment, the purchased license tier is delivered to the email address used during checkout. Customers are responsible for entering a valid email address and safeguarding private delivery links.

Privacy notice

Information you provide

The website may collect information submitted through forms, including name, work email, company, role, product interest, and messages. Stripe separately processes payment, billing, tax, and transaction information under Stripe's privacy terms.

Transaction fulfillment

Tarique Smith receives limited transaction data needed to fulfill and support an order, which may include name, email, purchased license, amount, payment status, Stripe Checkout Session identifiers, tax information, and timestamps. Transactional delivery may be sent through an email service provider.

Analytics, cookies, and device information

The hosted RedTeamKit website uses Google Analytics 4 and Vercel Web Analytics to understand page views, referral sources, device and browser characteristics, approximate location, performance, and conversion events. These providers may use cookies or similar identifiers according to their own terms. The downloadable local-first workspace excludes hosted analytics scripts. Visitors may limit analytics through browser privacy controls, content blockers, or provider opt-out tools where available.

How information is used

• Deliver requested samples, purchases, and product updates.
• Process purchases and provide customer support.
• Respond to licensing, government, and enterprise inquiries.
• Measure product interest and improve the experience.
• Prevent misuse, fraud, and security incidents.

Workspace data

Tarique Smith does not receive local workspace data unless a customer deliberately exports and sends it for support or services. Do not send secrets, personal data, or regulated evidence through general support email.

Providers and retention

Hosting, Stripe, email, analytics, CRM, and support providers may process information according to their own terms. Information is retained only as needed for the stated purpose, legal obligations, disputes, accounting, tax, fraud prevention, and security. Marketing messages must include an unsubscribe method.

Digital product refunds

RedTeamKit is delivered as immediately accessible proprietary digital files. Tarique Smith's terms displayed at purchase govern the product and license; Stripe's terms govern payment processing.

Except where mandatory consumer rights require otherwise, digital purchases are generally final after files have been delivered, downloaded, or accessed. Duplicate purchases, delivery failures, or incorrect license-tier purchases should be reported within 14 days.

Approved refunds are processed to the original payment method through Stripe. Processing time after approval depends on the payment method and financial institutions involved.

Email support@tarique.io with the order email, Stripe receipt or Checkout Session reference, selected tier, and issue. Never send payment-card details.

Disclaimer and limitation

The product is provided “as is.” AI systems are probabilistic, architectures and frameworks change, and no test library or assessment can identify every vulnerability or prove a system secure. Users remain responsible for authorization, test design, evidence handling, legal compliance, remediation, release decisions, and residual-risk acceptance.

Questions may be sent to support@tarique.io.