Platform Terms and Electronic Services Regulations

1. Provider and scope

These Platform Terms and Electronic Services Regulations (“Platform Terms”) govern business access to and use of CyfroSec accounts, free trials, online services, APIs and associated software where no separately signed agreement provides otherwise.

The service provider is CYFROSEC PROSTA SPÓŁKA AKCYJNA, with its registered office at ul. Józefa Marcika 6, 30-443 Kraków, Poland, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register under KRS 0001250469, NIP 6793369771. Share capital: PLN 100.00. Contact: contact@cyfrosec.com.

The services are offered for business and professional use. They are not offered to consumers unless CyfroSec expressly agrees otherwise in writing.

2. Contract documents and precedence

If a customer has accepted an Order Form, Software License and Services Agreement or other written agreement with CyfroSec, that agreement and its incorporated schedules govern the relevant services and prevail over these Platform Terms to the extent of any conflict.

These Platform Terms incorporate the Acceptable Use Policy, Privacy Policy, Cookie Policy, AI Transparency Notice and Data Retention, Export, Switching and Deletion Notice to the extent relevant to the service used.

3. Electronic services

CyfroSec may provide the following electronically supplied services:

• account registration, authentication and account administration;
• access to hosted cybersecurity dashboards, reports and documentation;
• asset, endpoint, network, service and vulnerability discovery functions;
• code-security analysis, dependency analysis, findings and remediation drafting;
• security-evidence normalisation, correlation, topology and prioritisation;
• AI-assisted explanations, investigation support and proposed remediation;
• integrations, APIs, exports and downloadable reports;
• customer support and incident-reporting channels; and
• free-trial, beta or evaluation functionality expressly enabled by CyfroSec.

The exact service scope, limits, deployment model and support package are shown in the applicable account, registration flow, Order Form or other written confirmation.

4. Technical requirements and risks

To use hosted services, you need a supported modern web browser with JavaScript, TLS and strictly necessary cookies enabled, a stable internet connection and an active business email address. Integrations may require supported API access, repository permissions, network connectivity, tokens, agents, containers or other customer-controlled configuration described in the Documentation.

Customer-deployed components may require Linux, Docker, Kubernetes, network permissions, filesystem access or other technical prerequisites described in the Documentation. The customer is responsible for its environment, connectivity, backups, access approvals and configuration.

Internet and cybersecurity services involve risks including service interruption, malicious traffic, false positives, false negatives, incomplete vulnerability information, credential exposure, configuration errors and reliance on third-party services. Customers must review scope, permissions and output, protect credentials and maintain appropriate independent security, backup, patch-management and incident-response processes.

5. Registration and authority

You must provide accurate registration information and use a business email address unless CyfroSec expressly permits otherwise. If you register or use an account for an organisation, you represent that you are authorised to act for that organisation and to accept these Platform Terms.

The customer must designate at least one account administrator and is responsible for approving authorised users, assigning least-privilege permissions, maintaining accurate user information and disabling access that is no longer required.

6. Accounts and credentials

Accounts are individual and must not be shared, except for a documented non-personal service account expressly supported for an integration. You must protect passwords, authentication devices, tokens and credentials and promptly report suspected compromise to safety@cyfrosec.com and support@cyfrosec.com.

The customer is responsible for activity conducted through its accounts except to the extent caused by CyfroSec’s breach of its obligations.

7. Access right and software licence

Subject to applicable payment, usage limits and compliance with the contract, CyfroSec grants the customer a limited, non-exclusive, non-transferable and non-sublicensable right during the applicable service term to access and use the hosted services for its internal business purposes and permit authorised users to do so.

Where CyfroSec supplies an agent or other software component for installation in the customer environment, CyfroSec grants a limited licence during the service term to install and run that component solely for the customer’s internal business purposes and within the authorised scope. No source code is licensed unless expressly agreed in writing.

8. Authorised scope

The customer may use scanning, testing, code-analysis and discovery functions only for systems, networks, endpoints, repositories, accounts and data that it owns, controls or is expressly authorised to assess. The customer must define and maintain evidence of the authorised scope and provide reasonable confirmation of authority if requested in response to a material risk.

The customer must comply with the Acceptable Use Policy at https://www.cyfrosec.com/acceptable-use/.

9. Repositories and approval-controlled actions

The customer is responsible for authorising repository connections, limiting permissions and reviewing proposed code modifications. Unless expressly configured and authorised, CyfroSec will not merge, deploy or publish a change to a customer repository.

Findings, patches, commands, configuration changes and remediation proposals must be reviewed, tested and approved by appropriately qualified personnel before implementation. The customer remains responsible for deployment and use of output in its environment.

10. AI-assisted features

AI-assisted output may contain errors, omit context, reproduce insecure patterns, be non-unique or resemble third-party material. It is decision-support material and is not legal advice, a compliance certification, a guarantee of security or a substitute for qualified human judgment.

The customer must not use AI features for prohibited decisions about individuals, unlawful inference of sensitive traits, unauthorised access, malware, harmful automation or a high-risk or safety-critical context that has not been expressly approved in writing.

Further information is available in the AI Transparency Notice at https://www.cyfrosec.com/ai-transparency/.

11. Customer Data

The customer retains its rights in Customer Data. The customer grants CyfroSec and its authorised processors the limited right to host, copy, transmit, analyse and otherwise process Customer Data only as necessary to provide, secure, support and comply with the services and applicable law.

The customer is responsible for the lawfulness, accuracy and quality of Customer Data and for providing required notices and obtaining required rights, permissions and authorisations. The customer must avoid submitting unnecessary personal data, credentials, secrets or specially protected data.

12. Data protection

CyfroSec acts as an independent controller for business-contact, billing, account-administration, service-security, compliance and website information for which it determines purposes and means. CyfroSec ordinarily acts as processor for Customer Personal Data processed on the customer’s behalf.

Controller processing is described in the Privacy Policy. Processor obligations are governed by the applicable Data Processing Addendum.

13. Security and diagnostic access

CyfroSec applies technical and organisational safeguards appropriate to the service and risk. The customer must implement security controls within its own environment, protect access credentials and promptly notify CyfroSec of suspected compromise.

Where support requires diagnostic access, access will be limited to authorised personnel, the necessary purpose and the period reasonably required. The customer should not provide unrelated credentials, secrets or personal data in a support request.

14. Support and service objectives

Support requests may be submitted to support@cyfrosec.com or through the authenticated support portal. Security and vulnerability reports should be sent to safety@cyfrosec.com.

Unless a signed Order Form states otherwise, response and availability figures are operational objectives, not guarantees, and do not create service credits, refunds or an independent termination right. Priority or 24/7 support applies only where purchased or expressly confirmed.

15. Free trials and beta functionality

Unless otherwise stated in the registration flow, a free trial lasts 14 days and expires without paid conversion. A trial converts to a paid subscription only where the customer expressly selects and accepts the applicable plan, price and conversion date.

Free-trial, beta and evaluation functionality may be limited, changed or withdrawn and has no availability objective. Trial data is handled as described in the Privacy Policy, AI Transparency Notice and Data Retention, Export, Switching and Deletion Notice.

16. Fees and payment

Paid services are subject to the price, billing period, taxes and payment terms accepted in the applicable ordering process or Order Form. CyfroSec will not impose an unlisted charge without prior notice or an agreed pricing mechanism.

Unless otherwise agreed, subscription fees are invoiced in advance, usage-based fees in arrears and correctly issued invoices are payable within 30 days. A good-faith invoice dispute must be raised within 14 days of receipt, and undisputed amounts remain payable when due.

17. Term, suspension and termination

The service term is shown in the ordering process or Order Form. Paid subscriptions renew only as stated in the accepted commercial terms. Where automatic renewal applies, either party may prevent renewal by giving at least 30 days’ notice before the end of the then-current term.

Either party may terminate for a material breach not cured within 30 days after written notice. CyfroSec may suspend only the affected use where reasonably necessary to prevent ongoing unlawful activity, unauthorised access or a material security threat, comply with a binding legal requirement, or address overdue undisputed payment after the applicable additional payment period.

Where practicable, CyfroSec will provide notice, limit suspension to what is necessary and restore access after the cause is resolved.

18. Export and deletion

Available Customer Data may be exported during the service term and applicable retrieval period in supported formats. Paid customers ordinarily have 30 calendar days after termination or expiry to retrieve available Customer Data. Paid-subscription Customer Data is scheduled for permanent deletion 90 calendar days after termination or expiry, subject to legal holds, mandatory retention and backup ageing. Free-trial data is scheduled for deletion 120 calendar days after trial expiry unless the trial is converted to a paid subscription.

Further information is available at https://www.cyfrosec.com/data-retention/.

19. Intellectual property and output

CyfroSec retains all rights in the services, software, Documentation, models, rules, methods, templates, interfaces and improvements. The customer retains its rights in Customer Data and may use customer-specific reports, findings, summaries, remediation recommendations and patch drafts for its internal business purposes, subject to third-party and open-source rights.

No exclusive right in AI-generated output is guaranteed.

20. Confidentiality

Each party must protect non-public information disclosed by the other party using at least reasonable care and use it only for the relevant business relationship. This obligation does not apply to information that is lawfully public, already known without restriction, independently developed or lawfully received from another source.

A party may disclose confidential information where legally required after providing notice where legally permitted.

21. Service limitations

CyfroSec will provide paid services with reasonable skill and care and materially in accordance with applicable Documentation. Cybersecurity services depend on available evidence, configured scope, third-party data and changing threats. CyfroSec does not guarantee detection of every vulnerability, threat, misconfiguration, credential or incident.

The services do not replace the customer’s governance, risk assessment, backups, patch management, testing or incident-response process.

22. Liability

Where a separately signed agreement applies, its liability provisions govern. Otherwise, to the maximum extent permitted by law, neither party is liable for indirect or consequential loss, loss of anticipated profit, revenue, business opportunity, goodwill or reputation, or punitive damages.

Subject to liability that cannot lawfully be limited, each party’s total aggregate liability arising from these Platform Terms will not exceed the fees paid or payable for the affected service during the 12 months preceding the event giving rise to liability. Nothing excludes liability for intentional misconduct, gross negligence, fraud, death or personal injury where liability cannot lawfully be excluded, unpaid fees or other liability that cannot be limited under mandatory law.

23. Complaints

A complaint concerning an electronically supplied service may be sent to support@cyfrosec.com and should identify the customer or account, describe the issue, state when it occurred and include information reasonably necessary to investigate it. Do not include unnecessary passwords, secret keys or personal data.

CyfroSec will acknowledge the complaint without undue delay and aims to respond within 30 days. If additional information is required, the response period may run from receipt of the necessary information. This complaints process does not limit rights under a signed agreement or mandatory law.

24. Changes to online terms

CyfroSec may update these Platform Terms for future use to reflect changes in services, risk, law or operations. Material changes affecting an active online subscription will be notified in advance where required. Changes do not alter a signed Order Form or Software License and Services Agreement unless the signed agreement permits the change or the parties agree in the required form.

25. Governing law and disputes

These Platform Terms are governed by the law of the Republic of Poland. The parties will first attempt in good faith to resolve a dispute. Any unresolved business dispute will be submitted to the competent courts of the Republic of Poland having jurisdiction over CyfroSec’s registered office, except where mandatory law requires otherwise.

26. Contact

General: contact@cyfrosec.com
Legal: legal@cyfrosec.com
Support: support@cyfrosec.com
Security: safety@cyfrosec.com
Privacy: privacy@cyfrosec.com