Terms of Service
The agreement between you and Vantuz.

These Terms of Service (the "Terms") are a binding agreement between Vantuz Ltd, a company registered in England and Wales (company no. 17270048), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ ("Vantuz", "we", "us"), and the organisation that creates an account or uses the service (the "Customer", "you").

Please read Sections 3, 4, 5, 11 and 12 carefully. They say what the service does not do, what you are responsible for, and they limit our liability to you.

Key points in plain English

This summary is part of how we bring the important terms to your attention. If it differs from the full Terms, the full Terms apply.

• Vantuz reduces risk; it does not guarantee security. The absence of a finding or alert does not mean you are safe (Section 3).
• You decide and you act. Our findings and fixes are advice. You choose what to change, and you remain responsible for your own security and incident response (Sections 3 and 4).
• Only cover what is yours. You may only point Vantuz at domains, accounts and systems you are entitled to have checked. If you point it elsewhere, you are responsible and you indemnify us (Sections 5 and 6).
• Containment is off unless you turn it on. It then does what you configured (Section 5.4).
• Our liability is limited.
  • We are not liable for indirect and certain other losses, or for attacks carried out by others.
  • Otherwise our total liability each year is capped at the greater of the fees you paid in the previous 12 months and £100.
  • We do not limit what the law does not allow us to limit (Section 12).
• You keep your data. You can export it, including for 30 days after you leave (Section 7.5).
• Changes need your agreement. Material changes to these Terms apply to you only after you accept them. If you do not accept, you can leave with a refund of the unused period (Section 14).
• English law and English courts (Section 16).

1. Acceptance and who may use the service

1.1 You accept these Terms by ticking the acceptance box, which is never pre-ticked, when you create an account or when we ask you to accept a new version (Section 14). We record:

• the date;
• the version and a fingerprint of its exact text;
• the account and workspace that accepted;
• the network address it was accepted from.

1.2 Business use only. The service is provided only to organisations and to individuals acting for the purposes of their trade, business or profession. It is not offered to consumers. By accepting you confirm that you are not acting as a consumer.

1.3 Authority. The person who accepts these Terms confirms that they are authorised to bind the Customer. If they are not, they accept these Terms personally.

1.4 A copy of these Terms, in a form you can download and keep, is available at vantuz.co/terms at all times, and each version we have used is kept available.

2. The service

2.1 Detection by deception. You place decoy assets ("honeytokens") in environments you control. Vantuz alerts you, investigates and, on supported plans and only if you enable it, helps contain access to them.

2.2 Exposure Sonar. Where you enable it, the Exposure Sonar checks what your organisation exposes. It:

• sends read-only requests to hosts under domains you have proven you control;
• can read, read-only, accounts you connect;
• reports weaknesses with recommended fixes;
• lets you place tripwires.

2.3 Features and limits depend on your plan (vantuz.co/pricing). Features marked beta, preview or early access are provided as they are, may change or stop, and are excluded from any service commitment.

2.4 We may improve and change the service. We will not remove a core feature of a paid plan during your paid term without notice under Section 14 and, if the change is materially adverse to you, a right to terminate and a pro-rata refund of prepaid fees for the unused period.

3. What the service is not

3.1 No guarantee of protection. Vantuz is one layer of security. It is not a complete security solution and it is not a penetration test. We do not promise that the service will detect, prevent, contain or remediate every, or any particular, attack, intrusion, misuse, exposure or weakness, or that your systems, data or accounts will be or stay secure. No security product can make that promise.

3.2 The service only sees what it is pointed at.

• Honeytokens only observe activity that touches the decoys you deploy and the integrations you connect.
• The Exposure Sonar only reports what its checks can observe, on the assets you verified and the accounts you connected, at the time the checks ran.

The service does not detect, among other things:

• social engineering and phishing;
• misuse of legitimate credentials;
• insider threats;
• weaknesses in systems that are not covered;
• zero-day or previously unknown techniques;
• supply-chain compromise;
• denial of service;
• physical attacks.

3.3 The absence of an alert or finding is not a statement that you are safe. The coverage report states what was checked and what was not.

3.4 Advisory only. Alerts, scores, narratives, findings, recommended fixes and remediation steps are information to help you decide. You decide whether and how to act. You should test any change before applying it to production systems and keep backups.

3.5 Alerts are best effort. We do not guarantee that an alert or notice will be generated, delivered, delivered on time, or read, including where email or other delivery fails for reasons outside our control. You are responsible for monitoring the service and responding within a time appropriate to your own risk.

4. Your responsibilities

4.1 You are responsible for:

• your overall security posture, including patching, access management, backups, logging, monitoring and staff training;
• where, how many and how you deploy decoys and tripwires;
• the configuration of containment;
• your own incident response and any regulatory or breach-notification duties.

4.2 You are responsible for your users, for keeping credentials secure, and for all activity under your account. We strongly recommend two-factor authentication.

4.3 You are responsible for the lawfulness of your use in every jurisdiction where you operate. That includes:

• notices to, and where required consultation with, your staff or their representatives (for example a works council) before enabling checks that involve them;
• any assessment your law requires.

4.4 You must keep the information you give us accurate, including the domains, accounts and assets you ask us to cover.

5. Authorisation for checks, tripwires and containment

5.1 You authorise us. By verifying a domain, connecting an account, deploying a honeytoken, accepting a tripwire or enabling containment, you authorise Vantuz to carry out, on your behalf and on your instruction, the corresponding activity against those assets. That means:

• non-destructive, read-only checks;
• reading the connected account read-only;
• monitoring decoys;
• the containment actions you configured.

This authorisation lasts until you revoke it in the product.

5.2 You warrant that, for every domain, host, account and system you ask us to cover:

• (a) you own it or are entitled to control access to it, and have authority to give this authorisation;
• (b) the terms of any hosting, cloud or platform provider involved allow the activity;
• (c) it does not belong to a third party who has not authorised it. This includes shared hosting, CDN or third-party software services that sit behind your domain but that you do not control.

5.3 Prohibited. You must not:

• verify a domain, or connect an account, that you are not entitled to have assessed;
• try to use the service to probe, test or monitor systems of others;
• use findings about another organisation's systems;
• use the service to entrap, surveil, profile, evaluate or discipline individuals rather than to protect systems;
• deploy decoys in systems you do not control;
• attempt to breach the service, other customers' data or our infrastructure;
• use the service in breach of any law, including computer-misuse, privacy, employment and export laws.

5.4 Containment is off by default. It acts only on your connected provider accounts, only on rules and thresholds you configure, and every action is logged. The intended effects of an action you configured are not a failure of the service. Such effects include a revoked key, a blocked address, a disabled account and any resulting downtime.

5.5 Our safeguards do not shift your responsibility. We verify domain control, limit the rate and kind of requests, and refuse hosts outside what you verified. These are safeguards; they do not replace your warranty in Section 5.2.

5.6 Staff checks. Checks that involve your personnel do not run until you confirm that you have informed them. We provide wording you can use. You must not use findings about individuals to monitor, evaluate or discipline them; use them only to secure their accounts.

5.7 Revocation. You can revoke authorisation at any time in the product. Checks that have not started then do not run.

5.8 Not a penetration test. The Exposure Sonar does not attempt to exploit anything. It cannot find everything an attacker could.

6. Indemnity by you

You will indemnify Vantuz against losses, damages, fines, costs and reasonable legal fees arising from a third-party claim or regulatory action to the extent it results from:

• (a) a breach of your warranties in Section 5.2 or your obligations in Section 5.3;
• (b) activity you instructed or configured against assets or accounts you were not entitled to have covered; or
• (c) your unlawful use of the service or of its output.

This indemnity does not cover losses to the extent caused by Vantuz's own breach of these Terms or its negligence. Vantuz will notify you promptly of a claim, let you control the defence where the law allows, and cooperate reasonably at your cost.

7. Data, privacy and confidentiality

7.1 Our Privacy Policy describes how we process personal data. Where we process personal data on your behalf, the Data Processing Agreement (DPA) forms part of these Terms. If they conflict, the DPA prevails for data protection matters.

7.2 Your data stays yours. Your data is the data you or your systems provide to the service and the results produced from it. You grant us a licence to process it only to provide, secure and support the service, and as described in the Privacy Policy and DPA.

7.3 Aggregated statistics. We may use aggregated information that does not identify you, your users or your assets to operate and improve the service, as described in the Privacy Policy.

7.4 Confidentiality. Each party will keep the other's non-public information confidential and use it only for this agreement. This does not apply to information that is public through no fault of the recipient, already known to it, independently developed, or required to be disclosed by law.

7.5 Export and deletion on exit.

What you can export. You can export your data in a structured, commonly used, machine-readable format. That covers:

• honeytokens and their configuration;
• incidents and alerts;
• Exposure Sonar findings, their history and coverage reports;
• tripwires and suppressions;
• the access and audit logs relating to your workspace.

The export does not include our software, checks and recipes (Section 9), or raw evidence that has already reached its retention ceiling.

After termination. For 30 days after termination we will make your data available for export on request, at no charge. After that we delete it as described in the Privacy Policy and DPA, unless the law requires us to keep it.

7A. Availability

We aim for high availability but do not promise uninterrupted service unless a separate service level is agreed in writing. We may carry out maintenance and will use reasonable efforts to minimise disruption and to give notice of planned downtime.

8. Fees and payment

8.1 Paid plans are billed in advance at the prices in effect. Fees exclude taxes, which you pay.

8.2 Fees are non-refundable except where these Terms provide a refund or the law requires one.

8.3 We may change prices with at least 30 days' notice; a change applies from your next renewal. If you do not accept it, you may cancel before the renewal.

8.4 If payment is overdue by more than 14 days after we notify you, we may suspend paid features until it is paid. We may also charge interest under the Late Payment of Commercial Debts (Interest) Act 1998.

9. Our intellectual property

The service, its software, checks, recipes, content and documentation belong to Vantuz and its licensors. You receive a non-exclusive, non-transferable right to use the service during your subscription for your internal business purposes. You must not copy, resell, reverse engineer (except where the law allows), or use the service to build a competing product. Feedback you give us may be used without obligation.

10. Suspension and termination

10.1 You may cancel at any time. Cancellation takes effect at the end of the current billing period, and future billing stops.

10.2 We may suspend the service, or the affected part of it, immediately where reasonably necessary:

• (a) to protect the service, other customers or third parties from a security threat;
• (b) if you breach Section 5; or
• (c) if the law requires it.

We may also suspend under Section 8.4. We will tell you why and restore access when the reason ends.

10.3 Either party may terminate by written notice:

• if the other materially breaches these Terms and does not remedy the breach within 30 days of notice; or
• immediately, if the other becomes insolvent.

10.4 On termination your right to use the service ends. Sections 3, 5.2, 6, 7, 11, 12, 13, 15 and 16 survive.

10.5 Nothing in these Terms limits your right to terminate for our material breach.

11. Warranties and disclaimers

11.1 We will provide the service with reasonable care and skill.

11.2 Except as stated in these Terms, and to the extent the law allows, the service is provided "as is" and "as available". We exclude all other warranties, conditions and terms, whether express or implied by statute, common law or otherwise, including those of satisfactory quality, fitness for a particular purpose, and uninterrupted or error-free operation.

11.3 No reliance on other statements. You confirm that in accepting these Terms you have not relied on any statement, representation or assurance that is not set out in them. Examples include sales material, a demo or a conversation. Nothing in this Section limits liability for fraudulent misrepresentation.

12. Limitation of liability

12.1 What we do not limit. Nothing in these Terms excludes or limits any liability that cannot lawfully be excluded or limited, including liability for:

• (a) death or personal injury caused by negligence;
• (b) fraud or fraudulent misrepresentation;
• (c) Gross Negligence or wilful misconduct;
• (d) your obligation to pay fees, or your indemnity in Section 6.

"Gross Negligence" means a serious and flagrant disregard of an obvious risk, going well beyond a failure to exercise reasonable care.

12.2 Losses we are not liable for. Subject to Section 12.1, Vantuz is not liable, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any:

• (a) loss of profits, revenue, business, contracts or anticipated savings;
• (b) loss of goodwill or reputation;
• (c) wasted expenditure or management time;
• (d) loss or corruption of data. This exclusion does not apply to our obligation to restore data from our own backups where we caused the loss, or to our obligations on the security, export and deletion of your data. Liability for those remains subject to the cap in Section 12.4;
• (e) business interruption or downtime;
• (f) regulatory fines or penalties imposed on you;
• (g) costs of procuring substitute services;
• (h) indirect, special or consequential loss.

Each item in this list is a separate exclusion, whether or not the loss was foreseeable.

12.3 Security events. Subject to Section 12.1, Vantuz is not liable for losses caused by an attack, intrusion, unauthorised access, malware, ransomware, fraud or data theft carried out by a third party against you. That holds whether or not the service detected, alerted on, scored or attempted to contain the activity, and whether or not the activity was within the scope of the service. This does not exclude liability for our own breach of Section 11.1 that caused that loss, which is subject to the cap in Section 12.4.

12.4 Cap. Subject to Section 12.1, Vantuz's total aggregate liability arising out of or in connection with these Terms, the DPA and the service, in each contract year, is limited to the greater of:

• (a) the fees paid and payable by you for the service in the 12 months before the first event giving rise to liability; and
• (b) £100.

How the cap works:

• The cap covers all claims on any basis, including negligence.
• It applies to all claims together, not to each claim.
• It applies after taking into account any sums already paid by us.
• A "contract year" is each 12-month period starting on the date you first accepted these Terms.

12.5 Why these limits are fair. The fees reflect this allocation of risk, and Vantuz would not provide the service at these prices without it. You can insure against your own business losses, which you are better placed to value. A higher cap is available by separate written agreement.

12.6 Time limit for claims. Subject to Section 12.1, any claim must be notified to us in writing within 12 months after you became aware, or ought reasonably to have become aware, of the facts giving rise to it.

12.7 Data protection. These limits apply to claims between you and Vantuz, including under the DPA. They do not limit any right an individual has directly under data protection law.

13. Events outside our control

Neither party is liable for delay or failure caused by events beyond its reasonable control. Examples include failures of internet, cloud or email providers, attacks on shared infrastructure, acts of government, and natural events. Payment obligations are not covered. If such an event lasts more than 60 days, either party may terminate by notice.

14. Changes to these Terms

14.1 We may update these Terms. We will give at least 30 days' notice of a material change by email and in the product.

14.2 A material change applies to you only once you accept it by ticking the acceptance box for the new version. Until then, the version you accepted continues to apply until your next renewal or, on a free plan, until 30 days after our notice. From that point, access to the service may require accepting the current version.

14.3 If you do not accept a material change, you may terminate before it would apply to you. You are then entitled to a pro-rata refund of prepaid fees for the unused period.

14.4 Changes that are not material take effect when published. Examples include corrections, clarifications and new optional features.

15. General

15.1 Entire agreement. These Terms, the DPA, the Privacy Policy and any order form are the entire agreement between us about the service.

15.2 Order of precedence. If there is a conflict, the order is: a signed order form, then the DPA (for data protection matters), then these Terms, then the Privacy Policy.

15.3 Severability. If any provision is held invalid or unenforceable, the rest remains in force. The affected provision applies to the maximum extent permitted.

15.4 No waiver. A delay in exercising a right is not a waiver of it.

15.5 Assignment and subcontracting.

• You may not assign these Terms without our consent, which we will not unreasonably withhold.
• We may assign them to a successor to our business, with notice.
• We may use subcontractors and sub-processors. Those that process personal data are listed in the Privacy Policy and DPA. We remain responsible for them under these Terms.

15.6 Third parties. No one other than you and Vantuz has any right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.

15.7 Notices. We send notices to the account owner's email address and in the product. You send notices to legal@vantuz.co.

15.8 Interpretation. Headings do not affect meaning. "Including" means "including without limitation". Neither party has an exclusive right to interpret these Terms.

16. Governing law and jurisdiction

These Terms, and any dispute or claim arising out of or in connection with them (including non-contractual disputes), are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction for both parties. This does not affect any right that cannot be excluded by the law that applies to you.

Contact: legal@vantuz.co.