Terms of Service

1. Agreement and order of precedence

These Terms of Service ("Terms") form a contract between you (the customer organization named on the order, "Customer") and Eresus Security Ltd. Şti. ("we", "us", "our"). By requesting access, accepting an order, or using the hosted Workbench, Customer accepts these Terms.

Where documents conflict, the following order of precedence applies: (1) a signed order form or master agreement; (2) a signed Data Processing Addendum; (3) these Terms; (4) the Acceptable Use Policy and Support and Service Levels pages; (5) online documentation. Entitlement descriptions on the website are informative and do not expand an order.

2. Eligibility, workspaces, and administrator responsibility

• The service is offered to organizations and their authorized users, not to consumers. Customer confirms it has authority to bind its users to these Terms.
• Customer administrators are responsible for provisioning users, assigning roles, reviewing access, and removing users who leave the organization.
• Customer is responsible for the accuracy of the account information it supplies and for keeping credentials, API keys, and integration secrets confidential. Credentials must not be shared between individuals.
• We may refuse, suspend, or close a workspace request that cannot be verified, that appears fraudulent, or that would breach the Acceptable Use Policy.

3. Access grant

Subject to payment of the applicable fees and to these Terms, we grant Customer a limited, non-exclusive, non-transferable, revocable right to access and use the hosted Workbench during the subscription term, for Customer’s internal business purposes and for assessments on systems Customer is authorized to assess.

• Customer may allow its affiliates to use the service under the order, provided Customer remains responsible for their use and for any target they assess.
• An MSSP plan permits use on behalf of managed customers, but only where that customer has authorized the assessment in writing and the MSSP holds that authorization before a scan starts.
• Customer may not resell, sublicense, time-share, or provide the service as a standalone offering to third parties outside the MSSP model.
• Customer may not copy, modify, translate, reverse engineer, or attempt to derive the source code, module logic, detection signatures, or model configuration of the service, except to the extent a restriction is prohibited by applicable law.

4. Authorized use is a condition of the service

Every assessment must stay inside a scope Customer owns or is expressly authorized to test. This condition is part of the contract, not advice.

• Before a scan starts, Customer confirms that it holds permission from the owner of each target, including for any third-party, hosted, or shared infrastructure the target depends on.
• Customer is responsible for defining scope, approved identities, test windows, exclusions, and rate or availability constraints, and for complying with applicable law and any contract that governs the target.
• We may ask for evidence of authorization for a target. If we cannot obtain it, we may suspend the relevant assessment or workspace.
• Authentication material, session tokens, and customer secrets supplied to the Workbench stay Customer’s responsibility. Customer must not upload credentials it is not authorized to use.

5. Acceptable use

The Acceptable Use Policy is incorporated into these Terms and lists prohibited conduct, including unauthorized scanning, service disruption, malware delivery, data exfiltration, control evasion, and abuse of the platform or its support channels.

We may remove content, throttle traffic, disable a module, or suspend a workspace to prevent harm to a third party, to the service, or to other customers. Where the situation allows, we notify Customer and give a chance to correct the conduct.

6. Offensive and agent-assisted features

• Active testing modules send real requests to the targets Customer authorizes. They do not extend Customer’s authority over those targets.
• Agent-assisted follow-up runs inside the authorized project, under the scope and rate limits the operator sets. Operators review results before a finding is promoted or acted on.
• The service is not designed for persistence, lateral movement outside scope, or exploitation of systems Customer does not control. Using it that way breaches these Terms.
• Output is advisory. Findings, severity ratings, exploit confirmations, and AI-generated summaries are inputs to a human decision, not a substitute for it.

7. Packages, quotas, and fair use

Professional, Business, Enterprise, and MSSP plans gate features by entitlement. Scan volume, concurrency, storage, user seats, retention, and integration limits are set by the order and may be enforced by the platform.

We may apply rate limits, quotas, and abuse controls to protect shared infrastructure. Repeated or deliberate circumvention of a limit is a breach of these Terms.

8. Fees, invoicing, and taxes

• Fees are quote-based and stated in the order. Unless the order says otherwise, invoices are payable within 30 days of the invoice date, in the currency shown on the invoice.
• Fees are exclusive of taxes, duties, and withholding. Customer pays applicable taxes other than taxes on our net income, and bears any bank or transfer charges.
• Overdue amounts may accrue interest at the lower of 1.5% per month or the maximum permitted by law, and may lead to suspension after notice.
• Fees are non-refundable except where these Terms or applicable law require a refund. Renewal pricing may change; we give notice before the renewal date.
• Customer may not withhold or set off payment for a disputed amount without a documented, good-faith dispute raised before the due date.

9. Term, renewal, suspension, and termination

• The subscription term, renewal behavior, and notice period are stated in the order. Where the order is silent, the term is twelve months and renews for successive twelve-month terms unless either party gives notice of non-renewal at least 30 days before the renewal date.
• Either party may terminate for material breach if the breach is not cured within 30 days of written notice, or immediately on insolvency, liquidation, or a comparable event.
• We may suspend access immediately where needed to address a security risk, an AUP violation, a legal requirement, or non-payment, and we will restore access once the cause is resolved.
• On termination, access ends. Customer may export findings and evidence for 30 days after the effective date unless the order provides otherwise, after which data is deleted under the DPA and our retention practice.
• Sections that by their nature should survive termination do survive, including fees owed, confidentiality, intellectual property, disclaimers, indemnities, liability limits, and governing law.

10. Customer data and ownership

• Customer owns the targets, source, configuration, findings, HTTP records, OAST interactions, and other assessment evidence it places in the service.
• Customer grants us a limited licence to host, process, transmit, and display that content only as needed to provide and secure the service, to support Customer, and to comply with law.
• We do not use Customer assessment content to train models, to build a public dataset, or to serve other customers. Any aggregated or statistical output we produce is de-identified so it cannot reasonably identify Customer or a target.
• Customer is responsible for the lawfulness of the content it uploads and for the notices and consents required for any personal data inside it.
• If Customer sends feedback or suggestions, we may use them without restriction or obligation.

11. Our intellectual property

We and our licensors own the service, the module library, detection and signature logic, the Workbench interface, documentation, and our marks. No rights are granted except the access right described in these Terms. Customer may not use our marks without prior written permission, other than truthful references to the product.

12. Third-party services, integrations, and open source

• Integrations with issue trackers, source hosts, chat tools, SIEM, or identity providers send data to those providers under Customer’s configuration and their own terms.
• We are not responsible for a third-party service’s availability, security, or data practice. Customer is responsible for having the right to connect each integration.
• The service includes open-source components. Where a licence requires notice, that notice is available on request and in the documentation package.

13. Confidentiality

Each party protects the other’s confidential information with at least the care it uses for its own, and uses it only to perform the contract. Standard exclusions apply for information that is public without breach, independently developed, received without a duty of confidence, or required to be disclosed by law. On termination, confidential information is returned or destroyed, except where retention is required by law or by a records policy.

Assessment findings, evidence, and any vulnerability detail about Customer systems are Customer confidential information, and our security, support, and AI-assisted functions are bound by this section.

14. Data protection

For assessment content that contains personal data, Customer is the controller and we are the processor: we process that content on Customer’s documented instructions and for the purposes set out in these Terms and the DPA. For account administration, support communication, website access requests, and security telemetry, we act as a controller.

The Data Processing Addendum describes the processor obligations, the technical and organizational measures, subprocessors, transfers, and assistance with data-subject requests and impact assessments. The current subprocessor list is published on the Subprocessors page.

Customer is responsible for the lawfulness of the processing it instructs, for providing notices to data subjects, and for ensuring it has a valid legal basis for any personal data inside the targets, source, or findings it submits.

15. Security

We maintain administrative, technical, and organizational measures proportionate to the risk, described in the Data Controls and Security pages. No service can be guaranteed free of vulnerabilities, and Customer remains responsible for the security of its own systems, identity provider, network, and endpoints.

We operate a coordinated disclosure channel for reports about our own service. Testing our service is permitted only within the boundaries published on the Security page.

16. Support and service levels

Support channels, severity definitions, response targets, and maintenance practice are described on the Support and Service Levels page. Unless an order states otherwise, the service is provided without a contractual uptime percentage, and any availability figure on the website is illustrative.

17. Warranties and disclaimers

We warrant that we will provide the service with reasonable skill and care, and that we will not materially reduce the core functionality of a paid entitlement during its term.

Except for that warranty, the service is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.

We do not warrant that an assessment will find every weakness, that findings are free of false positives or false negatives, that a clean result means a system is secure, or that output satisfies a specific compliance, audit, or regulatory requirement. Output is not legal advice, and it is not a substitute for professional judgement or for a penetration test with defined assurance scope.

18. Automated analysis and AI features

• AI-assisted features produce probabilistic output. They can be incomplete, incorrect, or inconsistent between runs on the same input.
• Output must be reviewed by a qualified person before it is used for a security, disclosure, remediation, or compliance decision.
• AI features do not make decisions with legal or similarly significant effect about any individual, and they impose no automatic consequence on Customer systems.
• Customer is responsible for what it submits to an AI-assisted feature, and for any obligation that applies to that content.

19. Compliance, sanctions, and export

• Each party complies with the laws that apply to it, including anti-bribery, anti-corruption, and data-protection law.
• Customer represents that it is not subject to sanctions that would prohibit the service, is not located in an embargoed territory, and will not use the service for a prohibited end use.
• Customer will not export, re-export, or transfer service technology in breach of export-control or sanctions rules.
• The service is intended for authorized security assessment, defensive security work, and research conducted with legal authorization.

20. Indemnification

• Customer will defend and indemnify us against third-party claims arising from: a target Customer was not authorized to assess; content Customer uploaded; a breach of the Acceptable Use Policy or of the authorized-use condition; or Customer’s breach of applicable law.
• We will defend and indemnify Customer against a third-party claim that the service, used as permitted, infringes a patent, copyright, or trade secret. If such a claim is made, we may procure a right to continue use, modify the service, or terminate the affected entitlement and refund prepaid fees for the unused term.
• The intellectual-property indemnity does not apply where the claim results from Customer content, a modification, an unsupported combination, or continued use after we have notified Customer to stop.
• The indemnified party must give prompt notice, allow the indemnifying party to control the defence, and provide reasonable assistance. A settlement that imposes an obligation on the indemnified party requires its consent.

21. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, lost business, loss of anticipated savings, loss or corruption of data, cost of substitute services, or business interruption, however caused and whether or not foreseeable.

Each party’s total aggregate liability arising out of or relating to the contract is limited to the fees paid or payable by Customer in the twelve months immediately before the event giving rise to the claim. Where the claim relates to a specific entitlement, the cap is the fees for that entitlement in the same period.

These limits do not apply to: fraud or wilful misconduct; death or personal injury caused by negligence; breach of confidentiality; Customer’s payment obligations; the indemnities in section 20; or any liability that applicable law does not allow to be limited. Nothing in these Terms excludes liability that cannot lawfully be excluded.

Each limitation is independent, survives termination, and applies whether the claim sounds in contract, tort, statute, or otherwise.

22. Force majeure

Neither party is liable for delay or failure caused by an event beyond its reasonable control, including natural disaster, war, civil disorder, labour action, epidemic, utility or network failure, or an act of government. The affected party gives prompt notice. If the event continues for more than 30 days, either party may terminate the affected order without penalty.

23. Notices, assignment, and general

• Notices to us go to contact@eresussec.com. Notices to Customer go to the administrator address on the order. Operational notices may be sent in-product.
• Neither party may assign the contract without the other’s consent, except to an affiliate or in a merger, acquisition, or sale of substantially all relevant assets, provided the assignee assumes the obligations.
• We may use subcontractors to deliver the service and remain responsible for them.
• No third party has rights under this contract. A waiver is effective only in writing and for the instance given. If a provision is unenforceable, the rest remains in force and the provision is narrowed to the minimum extent needed.
• These Terms, the order, and the documents referenced in section 1 are the entire agreement and supersede prior discussions on their subject matter.
• We may update these Terms for a new release or for a legal or security reason. Material changes take effect at the next renewal or after 30 days’ notice, whichever is later. Continued use after the effective date accepts the updated Terms.
• The English version of these Terms governs. A translated version, including the Turkish KVKK notice, is provided for transparency and is not a separate contract.

24. Governing law and disputes

These Terms are governed by the laws of the Republic of Türkiye. The parties submit to the exclusive jurisdiction of the competent courts of the Republic of Türkiye at the forum named in the order; failing that, the courts that have jurisdiction under Turkish law, after first attempting to resolve the dispute in good faith through senior representatives for at least 30 days.

Nothing in this section prevents either party from seeking urgent injunctive or equitable relief to protect its intellectual property, confidential information, or the security of the service.

If we contract in the future through a different legal entity or a branch in another jurisdiction, the order will name that entity and may state a different governing law for that order.

25. Contact

Questions about these Terms, an order, or a procurement review can be sent to contact@eresussec.com. Security reports go to security@eresussec.com.