Legal / Terms
Last updated: August 2026
These Terms of Service ("Terms") govern your access to and use of the ThreatDoc website and documentation service (the "Service"), operated by ThreatDoc LLC, a Florida limited liability company ("ThreatDoc", "we", "us", "our"). By creating an account or using the Service, you agree to be bound by these Terms.
If you do not agree to these Terms, you must not use the Service.
ThreatDoc is a documentation tool designed for penetration testers, security consultants, and any one wanting documentation privacy. Documents are created and edited in the ThreatDoc desktop application; the website (the "Service", alongside the desktop application) provides:
The Service is a software tool only. It does not constitute legal, security, compliance, or professional advice. You are solely responsible for the accuracy, completeness, and quality of any documents you produce using the Service.
Encryption of cloud-synced documents
Any document you sync to the cloud is encrypted on your device before it reaches us, using an account key (or, for a document added to a team, a shared team key) generated in the desktop application and shown to you once. ThreatDoc does not store this key and cannot recover it. If it is lost, the encrypted content of the affected documents is permanently inaccessible to you and to us. Managing and retaining your account and team keys, and rotating them when appropriate, is solely your responsibility.
By using the Service, you represent and warrant that:
Registration
To access the Service you must create an account using a valid email address and password. You agree to provide accurate, current, and complete information and to keep it updated.
Credential security
You are responsible for maintaining the confidentiality of your login credentials. You must not share your credentials with others. Notify us immediately at support@threatdoc.com if you suspect unauthorized access to your account. You are responsible for all activity carried out under your account.
You agree to use the Service lawfully and responsibly. You must not:
Responsible disclosure
If you discover a security vulnerability in ThreatDoc, please report it to security@threatdoc.com before public disclosure. We ask that you do not access, modify, or exfiltrate other users' data during any security research, and that you give us reasonable time to address confirmed issues.
ThreatDoc's rights
The Service, including its design, software, user interface, documentation, and all related content, is protected by applicable intellectual property laws. Subject to your compliance with these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable license to access and use the Service for your internal professional or personal needs.
You may not copy, modify, distribute, sell, or create derivative works of any part of the Service without our prior written consent.
Your content
You retain full ownership of all documents, artifacts, notes, evidence images, and other content you create in the desktop application or upload to the Service ("User Content"). By using the Service, you grant ThreatDoc a limited, non-exclusive, worldwide license to host, store, and process your User Content solely as necessary to provide the Service to you.
We do not use your document content for training, marketing, or any purpose beyond operating the Service. We will not share your User Content with third parties except as required to provide the Service (e.g., storage providers) or as required by law.
You represent that you have all necessary rights to submit your User Content and that it does not violate the rights of any third party.
Feedback
If you send us suggestions, feature requests, or other feedback about the Service, you grant ThreatDoc a perpetual, irrevocable, royalty-free license to use that feedback for any purpose, including improving the Service, without any obligation or compensation to you.
ThreatDoc respects the intellectual property rights of others and expects users of the Service to do the same. If you believe content stored or shared through the Service (including content accessible via a share link) infringes your copyright, you may submit a notice under the Digital Millennium Copyright Act (17 U.S.C. § 512) to our designated agent at dmca@threatdoc.com.
Your notice should include: (1) a physical or electronic signature of the copyright owner or authorized representative; (2) identification of the copyrighted work claimed to be infringed; (3) identification of the material claimed to be infringing and information reasonably sufficient to permit us to locate it (e.g., the share link ); (4) your contact information; (5) a statement that you have a good-faith belief the use is not authorized; and (6) a statement, under penalty of perjury, that the notice is accurate and that you are authorized to act on behalf of the copyright owner.
Upon receipt of a valid notice, we will remove or disable access to the identified material and notify the affected user, who may submit a counter-notice as provided under Section 512(g). We reserve the right to terminate accounts of repeat infringers.
Free
The desktop application is free and unlimited for local use, with no credit card required. A free account is required to sign in — this is a local access check, not a cloud requirement — and documents you never sync to the cloud do not count toward any storage limit.
Basic
A paid monthly plan providing 1 GB of encrypted cloud storage for your own, non-team documents, billed in advance via Stripe. Storage covers document and artifact text, evidence images, and generated PDFs for documents you choose to sync.
Pro
A paid monthly plan for teams, providing 5 GB of encrypted cloud storage per active team member, pooled across every document the team owns rather than allocated per person. Includes team creation, member management, and document hand-off between members. Billed in advance via Stripe.
Storage limits
If a sync or upload would exceed your plan's storage limit, it is declined and you are shown your current usage. No previously synced content is deleted for being over a limit; you may free up room by removing evidence you no longer need, or upgrade your plan.
Cancellation
You may cancel a subscription at any time through the billing portal; cancellation takes effect at the end of the current billing period and you retain access until then. Documents that exceed the storage available on a downgraded or cancelled plan remain intact but may become read-only for further cloud sync until they fit within your new limit.
Team seats
A Pro subscriber may lead a team and invite other members. If an invited member does not already have their own Pro plan, accepting the invite adds a recurring per-seat charge to the team leader's subscription for as long as that member remains active on the team; the leader is responsible for this charge, not the sponsored member. Removing a sponsored member, or cancelling the leader's subscription entirely, ends that member's Pro access and stops the associated charge going forward. Transferring leadership to another member, or dissolving the team, releases every sponsored seat and its associated charge the same way; whoever leads next starts fresh and may sponsor members again against their own subscription.
Payment processing
All payments are processed by Stripe, Inc. We never store your card details. By subscribing, you agree to Stripe's terms of service.
Refunds
For billing errors or exceptional circumstances, contact us at support@threatdoc.com within 7 days and we will review your request.
Where enabled, ThreatDoc allows you to share a generated PDF with a client via a unique time-limited link. When using this feature:
We make reasonable efforts to keep the Service available and functioning. However, we do not guarantee any specific uptime or service level. The Service may be temporarily unavailable due to:
We will make reasonable efforts to communicate planned maintenance that significantly impacts availability. We may modify, update, or discontinue features of the Service at any time.
Your use of the Service is also governed by our Privacy Policy, which is incorporated into these Terms by reference. The Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal data.
Duration
These Terms apply from the moment you access or use the Service and remain in effect for as long as you maintain an account.
Termination by you
You may delete your account at any time from Account Settings in the Service. Deletion is immediate and permanent: your account, the documents you currently hold, and their artifacts and evidence are deleted right away, subject to any legal retention obligations (see our Privacy Policy). There is no recovery window once you confirm deletion, so be certain before you do. If you'd rather have us handle it, you can instead email support@threatdoc.com.
If you lead a team, you must transfer leadership or dissolve the team first, self-service options are available from the Team page. Account deletion is blocked while you lead a team.
Closing your account does not entitle you to a refund of unused credit packs or remaining subscription time, except where required by applicable law.
Termination by ThreatDoc
We may suspend or terminate your access to the Service, with or without notice, if you:
In the event of termination for breach, we may immediately deactivate your account and block access to your data.
The Service is provided "as is" and "as available" without warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement.
ThreatDoc does not warrant that the Service will be error-free, uninterrupted, or free of security vulnerabilities. You use the Service at your own risk.
ThreatDoc is a documentation tool. We make no representations about the quality, accuracy, completeness, or fitness of any document produced using the Service. You are solely responsible for the content, accuracy, and appropriateness of your documents and artifacts.
ThreatDoc provides document generation software only. It is not a certification authority, accreditation body, or qualified assessor, and it does not review, validate, or endorse the content of any report created using the Service. Any report generated with ThreatDoc reflects information entered by its author and does not represent a certification, attestation, audit opinion, or statement of compliance with any regulatory, legal, or industry standard. Official certification or attestation under any framework must be obtained through the appropriate certifying agency or accredited body following that framework's required process.
To the maximum extent permitted by applicable law, ThreatDoc and its operators will not be liable for:
In no event shall ThreatDoc's total aggregate liability exceed the amount you paid to ThreatDoc in the three months preceding the event giving rise to the claim.
Some jurisdictions do not allow the exclusion of certain warranties or limitation of liability. In such cases, the above limitations apply to the fullest extent permitted by law.
You agree to indemnify, defend, and hold harmless ThreatDoc, its officers, employees, and agents from and against any claims, damages, losses, liabilities, and expenses (including reasonable attorneys' fees) arising out of or related to:
We reserve the right to assume the exclusive defense of any matter otherwise subject to indemnification by you, in which case you agree to cooperate with our defense of the claim.
We may update these Terms from time to time to reflect changes to the Service, legal requirements, or our business practices. When we make significant changes, we will notify you by email or in-app notice before the changes take effect.
Your continued use of the Service after the effective date of the updated Terms constitutes your acceptance of the changes. If you do not agree to the updated Terms, you must stop using the Service and close your account.
These Terms are governed by the laws of the State of Florida, USA, without regard to conflict of law principles. Any disputes arising from these Terms or your use of the Service shall be resolved through good-faith negotiation where possible.
If you have a dispute that cannot be resolved informally, please contact us at support@threatdoc.com before initiating any formal proceedings.
Severability
If any provision of these Terms is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will remain in full force and effect.
Entire agreement
These Terms, together with our Privacy Policy, constitute the entire agreement between you and ThreatDoc regarding the Service and supersede any prior agreements or understandings, written or oral.
No waiver
Our failure to enforce any right or provision of these Terms will not be considered a waiver of that right or provision.
Assignment
You may not assign or transfer these Terms without our prior written consent. We may assign these Terms without restriction, including in connection with a merger, acquisition, or sale of assets.
For questions about these Terms, your account, or the Service:
For security issues or vulnerability reports: