User agreement

This is the contract between you and Pebble Security Labs LLC, which operates Pebble Labs. Please read it. It sets out who we are, what the service is, what you may and may not do with it, and the limits of what we are responsible for.

How this agreement works

Three documents govern your relationship with us. Each does a different job, and all three apply.

• This user agreement. Who we are, what the service is, how you get access and pay for it, who owns what, and liability.
• The acceptable use policy. The rules for using the labs: what is in scope for attack, what is not, and what happens if you cross the line.
• The privacy policy. What personal data we collect, why, and who processes it for us.

The refund and cancellation policy governs refunds and sits under the payment section below. Where this agreement and another document conflict on a subject that other document covers specifically, the specific one wins for that subject.

Who we are

Pebble Security Labs LLC, a Rhode Island limited liability company, at 700 Narragansett Park Drive, Suite 100, Pawtucket, RI 02861, United States. In this document “we”, “us” and “our” mean that company, and “you” means the person using the service or browsing the site.

Agreeing to this contract

Before we let you use the service, we show you this agreement, the acceptable use policy and the privacy policy, and ask you to accept them. You accept by ticking the boxes on that screen and continuing. Until you do, your account exists but nothing in the product will work: you cannot deploy a lab, enroll in a course, or open a lesson.

When you accept, we record which version you accepted, the date, and the network address the acceptance came from. Your account page shows that record back to you.

If we change these agreements in substance, we ask you to accept the new version the same way, and we say so when we do. Older acceptances stay on record against the version they were given for.

If you do not agree, do not accept. Nothing happens to your account, and you can close it whenever you like. You can also end this contract at any time by closing your account.

Eligibility

To use the service, all of the following must be true.

Age

You are at least 18. If you are under 18, a parent or guardian who is at least 18 must accept this agreement for you and takes responsibility for your use of the service and your compliance with the acceptable use policy.

We set the bar at 18 rather than at the data protection minimum because a subscription is a contract, and in most places a minor can walk away from one while we stay bound to it. We do not verify your age. This is a term you are accepting rather than a check we run, and telling us a false age is itself a breach of this agreement.

Sanctions and restrictions

You are not barred from using the service where you live, and you are not resident in, a national of, or personally subject to sanctions imposed by the United States, the United Kingdom, the European Union, or the United Nations. This is a training platform for offensive security technique, so this is not boilerplate.

Accuracy

The account details you give us are accurate, and you keep them that way. We may ask you to verify your identity, and may suspend an account that will not.

If your employer is paying

You may be here because a company put you here. If you use the service for an employer or a client, or on their instruction, you are accepting this agreement for them as well as for yourself, and you are telling us you are allowed to do that. The account is still yours and still personal to you: we do not sell seats, and an employer cannot take the account over or ask us for what you did in it.

Your account

One account per person

Your account is for you alone. Do not share it, and do not let another person work labs under your subscription. You are responsible for everything done under your account unless you tell us it has been taken over.

Security

We hold no password for you. You sign in with a third-party account or a link we email you, so whoever controls that account or that mailbox controls your access here. Keep it secure, and tell us as soon as you suspect anything has gone wrong with it.

Closing your account

You can close your account at any time by writing to hello@pebblelabs.org. We may suspend or close an account for breach of this agreement or the acceptable use policy, for non-payment, or where the law requires it.

What the service is, and how labs live and die

The service

Pebble Labs is training. You pick a lab, we build a private network of virtual machines for you in our cloud account, and you attack it over your own VPN connection. Some labs are free. The rest need an active subscription or a one-time course purchase.

Everything here is for education and skills assessment inside environments we own and have authorised you to attack. What you learn is yours to use lawfully. Using it against a system you do not own or have written permission to test is your responsibility alone, and nothing in this agreement authorises it.

Availability

We do not promise the service will be available without interruption. Labs run on third-party cloud infrastructure, provisioning takes minutes rather than seconds, and both can fail. We do not offer a service level agreement.

Lab lifecycle

Lab environments are temporary by design and the platform reclaims them on its own. Treat anything inside a lab as disposable.

• Each lab runs on a session timer. It starts with an hour on the clock. You can add or remove an hour at a time, up to a maximum held at once, and when the clock runs out the lab is suspended. Its disks, your progress, and your VPN profile survive, and you can resume it in one click for a fresh hour.
• A lab with no VPN traffic for two hours is suspended ahead of its clock, the same way and just as recoverable.
• A lab left untouched for long enough after that is torn down completely. What was on those machines is gone and cannot be recovered.
• A lab may also be suspended when your subscription lapses, or by us for operational reasons. The lab page says which of these happened.
• There is a limit on how many labs you can run at once. Deploying another may require tearing one down.

Payment and subscriptions

Price and access

The price and the billing period are shown before you order, and the amount you will be charged appears again on the checkout page. Prices are in US dollars and exclude any tax we must collect. Because the service is digital, access starts as soon as payment succeeds.

Automatic renewal

Subscriptions renew automatically at the end of each period, monthly or yearly depending on the plan, and you authorise us to charge your payment method at the start of each new one. Your renewal date is shown in the billing portal, which you can open from your account page at any time. We will tell you at least 30 days before any price increase takes effect, and a price change never affects a period you have already paid for.

Cancelling

Cancel at any time from your account page, which opens the billing portal. Cancelling stops the next renewal and leaves your access running to the end of the period you have paid for. Refunds are governed by the refund and cancellation policy.

Suspension for non-payment or breach

We may suspend access to paid features if a fee goes unpaid, if you breach this agreement or the acceptable use policy, if your use breaks the law, or if we believe in good faith that the service is under attack or otherwise at immediate risk. Free features may be limited or withdrawn at any time.

Who owns what

Our content

The labs, courses, machine images, network designs, written material, and the platform itself belong to us. Your subscription is a personal, non-transferable, revocable permission to use them for your own training while it is active. It grants nothing else.

What you must not do with it

You must not:

• copy, republish, redistribute, or make our content available to anyone else, whether modified or not;
• extract, export, or reverse-engineer the machine images or the provisioning system;
• resell access, or run the labs as a service for other people;
• use our labs, courses, or anything derived from them to teach other people, whether that is a class, a bootcamp, a workshop, an internship, or paid mentoring, and whether or not you charge for it. Training a team on Pebble Labs is something we are glad to arrange, and it needs a written agreement with us rather than a personal subscription;
• use our content to build or improve a competing product, or to benchmark one;
• scrape, crawl, or bulk-download our content by any automated means, whatever you intend to do with the result; or
• use our content to train, fine-tune, distil, evaluate, or benchmark any machine learning model, or to build or contribute to a dataset for that purpose, or help anyone else do so. All of it counts: the labs and their topologies, the machine images, the courses, our walkthroughs, and the material a lab generates as you work it.

That last one is about feeding our work into a model, not about using a model while you work. Ask an AI assistant for help on a lab if that is how you think, paste an error into one, and use the hosted model a lab gives a machine where a lab gives you one. What you may not do is harvest what we have built in order to train something on it.

These restrictions apply however the content was obtained and whether or not the use is commercial.

They are subject to the permissions the acceptable use policy gives. Making and publishing your own content about the labs, and about any course the catalogue marks Free, is allowed there, and nothing in this section takes that back.

Your work

What you produce while working a lab, your notes, your scripts, and your write-ups within the limits of the acceptable use policy, is yours. If you send us feedback or a suggestion, we may act on it without owing you anything for it.

Third-party content and links

We do not control third-party sites we link to and are not responsible for them. A link is not an endorsement, and your use of a linked site is governed by that site's own terms.

Warranties

The service is provided as it is. To the extent the law allows, we exclude all warranties and conditions, whether express, implied, or statutory. In particular we do not warrant that a lab is free of defects, that it models any real system correctly, that it will be available without interruption, or that working it will produce any particular outcome for your career or your competence.

Limitation of liability

Indirect loss

To the extent the law allows, we are not liable for indirect or consequential loss, including lost profits, lost opportunity, lost reputation, or lost data. That includes data on a lab machine that was suspended, reset, or torn down, whether by you, by us, or automatically.

Cap

Where we are liable, our total liability arising from the service or this agreement, on any cause of action including negligence, is capped at the greater of what you paid us in the twelve months before the claim, or one hundred US dollars.

What is never limited

Nothing here limits liability that cannot be limited by law, including for fraud or for death or personal injury caused by our negligence.

Changes

To the service

We may change, add to, or withdraw parts of the service. Where a change materially affects a paid feature during a period you have paid for, we will give reasonable notice and may refund the unused part.

To this agreement

We may update this agreement. Changes are never retroactive.

When any of these documents changes in substance, the date at the bottom of the page moves, and that date is the version you accepted. So a change means we ask you to accept the new version before you carry on, in the same way you accepted this one: you are asked the next time you use the product, and until you accept, nothing in it will work for you. Correcting a typo or reformatting a page is not a change in substance and does not move the date.

If you do not want to accept a new version, do not. Close your account instead, and we will refund the unused part of any period you have paid for. Your earlier acceptance stays on record against the version it was given for, and we do not treat carrying on using the service as agreement to something you were never shown.

Termination

By you

Close your account at any time. Your right to use the service ends with it, and running labs are torn down.

By us

We may suspend or close your account and end this agreement if you breach it or the acceptable use policy, if your use breaks the law, or if you misuse the service. Where there is an immediate risk to the platform or to other customers, we may act first and tell you afterwards.

Survival

Ending this agreement does not affect rights or obligations either of us had already accrued. The sections on ownership, limitation of liability, and governing law continue to apply afterwards.

General

Assignment

You may not transfer your rights or obligations under this agreement without our written consent. We may transfer ours to another business, and will tell you if we do.

Severability and waiver

If any part of this agreement is found unenforceable, the rest continues to apply. If we do not act immediately on a breach, we keep the right to act on it later.

Events beyond our control

Neither of us is liable for a failure caused by something outside our reasonable control, including cloud provider outages, network failures, cyberattacks on infrastructure we do not operate, government action, or natural disaster. Where such an event materially affects a paid feature for more than 30 consecutive days, either of us may end the affected subscription and we will refund the unused part.

Notices

Notices to us go to legal@pebblelabs.org. Notices to you go to the email address on your account. Keep it current.

Entire agreement

This agreement, together with the documents named in section 1, is the whole agreement between us about the service and replaces anything said before it.

Law and jurisdiction

This agreement and any dispute arising from it are governed by the law of the State of Rhode Island, whose courts have exclusive jurisdiction. If consumer protection law where you live gives you stronger rights, those rights still apply.

Contact

Legal notices: legal@pebblelabs.org. Privacy: privacy@pebblelabs.org. Security reports: security@pebblelabs.org. Everything else: hello@pebblelabs.org.