Terms & data

Short rules and an honest description of what the service does and which data it stores. Qorgan is in beta.

What the service does

Qorgan sends harmless test prompts (checks based on the OWASP Top 10 for LLM) to the chatbot you specify and analyses the replies. The score is a guide for developers, not a security certificate: the judge can be wrong, and no findings do not guarantee no vulnerabilities.

Acceptable use

Scan only your own bots or bots you have the owner's permission to test. The service blocks internal network addresses and limits the number of scans per day.

Data we store

Stored: email and password hash, scan parameters, test prompts and bot replies (to show you the report), canary strings you enter, feedback and anonymous usage events. Not stored: API keys, authorization headers and the system prompt — they live in memory during the scan only.

Third-party services

When the rules cannot judge a reply unambiguously, the attack and bot reply text is sent to an external LLM service (DeepSeek) for analysis. Do not use the service for bots whose replies may contain real personal data.

Data deletion

To delete your account and all scans, contact the project team (contacts were given to you with the beta invitation).