Terms of service

Last updated: 16 October 2026.

These terms describe use of Sonar, the attack surface management service offered under the Tohou name. Contact [email protected] with questions about the service.

Accounts and authority

You must be legally able to enter into this agreement. If you use Sonar for an organization, you must have authority to do so. Authentication is provided through Discord. You are responsible for securing your Discord account and any API keys (console or Index), webhooks or invitations you create.

Authorized use only

You may submit infrastructure only when you own it or hold explicit permission for the checks you request. A verification challenge demonstrates technical control; it does not replace permission from an asset owner or hosting provider. Do not use the service for unauthorized access, disruption, credential theft, harassment, or evasion of limits. Checks are limited to connection probes on the ports listed in the scanning policy, version probes only on ports already found open, single UDP probes to DNS, NTP and SNMP, standard web requests including one latest-only screenshot of your web services, and one request to a hosting provider's own endpoint to confirm an unclaimed subdomain. Public Index lookups may add a bounded direct observation (short connection attempts on common service ports, one HTTP(S) request and a TLS certificate read) only for targets inside the requesting account's own verified scope; all other lookups are served from third-party public records without sending traffic to the target. No exploitation, password attacks or denial-of-service testing is performed. The scanning policy forms part of these terms.

Workspace data and access

You retain rights in the data you submit. You permit Tohou to process it to provide, maintain and secure Sonar. Workspace owners manage team access. Members can access data according to their role. Do not submit data that you are not entitled to process or share.

Limits and availability

Free workspaces have enforced asset, scan and API limits shown in the console. Index API keys share the account's daily lookup budget. Scan schedules are bounded by each workspace's daily run allowance. Limits and features may change. The operator may stop scans or restrict access to address abuse, capacity, provider restrictions or security issues. No uptime service-level agreement is offered for free access. Billing is not enabled and no payment is collected through this version of the service.

Screenshots and captures

Screenshots are taken only from services inside your verified scope and are visible only to your workspace members. They are kept as a single latest image per host and deleted with the asset. You are responsible for ensuring captured pages do not expose content your team should not retain.

Interpreting results

Findings describe observations, not a guarantee of compromise or complete vulnerability coverage. You are responsible for reviewing evidence, assessing business impact and validating changes. External sources can be incomplete or unavailable. AI assistance, when configured, may be inaccurate and requires review.

Deletion and termination

You can request account deletion in the console. Deletion is scheduled 24 hours after the request and can be cancelled before that deadline. It removes your account and workspaces you own, including their shared data. Operational outages can delay the purge until the worker resumes. Data belonging to other organizations is not deleted merely because you were a member. The privacy policy explains retention.

Responsibility

The service is provided as available without a promise of uninterrupted operation, exhaustive detection, or fitness for a particular purpose. To the extent permitted by applicable law, Tohou is not responsible for indirect losses resulting from reliance on findings or service interruption. Nothing in these terms excludes rights or liabilities that cannot lawfully be excluded.

Changes and contact

Material changes to these terms will be reflected on this page. Questions and complaints may be sent to [email protected]; suspected misuse should be sent to [email protected].