Terms of Service

These Terms of Service (the "Terms") are a legally binding agreement between Cyber Crime Guards Ltd, a company registered in England & Wales under number 17245515 ("we", "us", "our", the "Company"), and the person or organisation that opens an account or orders any Service ("you", the "Customer"). Together with any Order, our Acceptable Use Policy and Privacy Policy, they form the entire agreement between us (the "Agreement").

1. Agreement & acceptance

By creating an account, placing an Order, or using any part of the Services, you confirm that you have read, understood and agree to be bound by these Terms. If you are entering into this Agreement on behalf of a company or other legal entity, you represent that you have authority to bind that entity, in which case "you" and "Customer" refer to that entity. If you do not agree, you must not use the Services.

2. Definitions

• "Services" — any service we make available, including managed detection and response, security monitoring, managed antivirus and endpoint protection, infrastructure protection, penetration testing and security audits, proxy and IP-access services, security-awareness and anti-fraud training, and incident response.
• "Order" — an accepted request for Services, including any online checkout, quote, statement of work or subscription you agree to.
• "Account" — the account through which you access and manage the Services.
• "Customer Systems" — the networks, devices, applications, cloud environments, accounts and data that you ask us to protect, monitor, test or respond to.
• "Customer Content" — any data, software, materials or communications you store, transmit or process using, or make available to us in connection with, the Services.
• "AUP" — our Acceptable Use Policy, as updated from time to time.
• "Fees" — the charges payable for the Services.
• "SLA" — a service-level agreement applicable to a Service.

3. Changes to these terms

We may update these Terms to reflect changes in our Services, in law, or in our business practices. We will post the revised Terms with an updated "last updated" date and, where changes are material, take reasonable steps to notify you (for example by email or an account notice). Changes take effect from the stated date; your continued use of the Services after that date constitutes acceptance. If you do not accept a material change, your remedy is to stop using and cancel the affected Services before the change takes effect.

4. Eligibility & account registration

To use the Services you must be at least 18 years old and able to form a legally binding contract. You agree to provide accurate, current and complete information and to keep it up to date. You are responsible for maintaining the confidentiality of your Account credentials and for all activity that occurs under your Account. You must notify us promptly of any unauthorised use or suspected security breach. We are not liable for any loss arising from unauthorised use of your Account where you have failed to keep credentials secure.

5. Identity verification (KYC / AML)

To prevent fraud and abuse and to meet legal obligations, we may require you to verify your identity or that of your organisation and beneficial owners before or during the provision of Services ("KYC" checks). We may decline, suspend or terminate Services where verification is not completed, where information provided is inaccurate, or where we reasonably suspect unlawful activity. You authorise us to make enquiries we consider necessary to verify your identity and assess risk.

6. The Services

We provide the Services with reasonable skill and care and substantially as described in the applicable Order and on our website. Specific features, resources, capacities and service levels are those set out in your Order or the relevant product documentation. We may enhance, modify or discontinue features from time to time; where a change would materially reduce a core feature of a paid Service, we will give you reasonable notice and, if applicable, a pro-rata refund for the unused period.

Proxy & IP-access services

Where your Order includes proxy or IP-access services (residential, ISP, datacentre or mobile), we grant you a limited, non-exclusive, non-transferable and revocable licence to route your own lawful traffic through the network for the subscription term and volume purchased. You must complete identity verification before access is issued; you are responsible for all traffic sent through the IPs or endpoints allocated to you and for your end users' compliance; and you must use the service only in accordance with our Acceptable Use Policy, the terms and rate limits of the destinations you access, and applicable law. You must not resell, sub-licence or share proxy access or credentials without our prior written consent. Proxy allocations, IP counts, bandwidth and concurrency are as stated in your Order; availability of any specific IP, location or subnet is not guaranteed, and we may rotate or replace IPs. We may log and monitor for abuse to the extent permitted by law, and will suspend or terminate access immediately, without refund, for any breach of the AUP or unlawful use.

7. Monitoring, detection & antivirus

Where we provide managed detection and response, security monitoring, or managed antivirus and endpoint protection:

• You authorise us to deploy monitoring agents, antivirus and endpoint-detection software, log collectors and similar tools on the Customer Systems, and to collect, process and analyse security telemetry (including logs, alerts, file and process metadata and network events) for the purpose of detecting and responding to threats.
• You confirm that you own the Customer Systems or are otherwise authorised to have them monitored and protected, and that doing so will not breach any third-party right, licence or law. You are responsible for obtaining any employee or user notices or consents required for monitoring.
• Managed antivirus and EDR rely on third-party software; your use of it may be subject to the vendor's terms. You must permit installation and updates and must not disable, remove or tamper with the tools we deploy.
• We monitor on a 24/7 basis and aim to triage and escalate alerts within the timeframes set out in the applicable SLA. Where you engage a monitor-only service, containment and remediation actions remain your responsibility unless a response service is also purchased.
• No monitoring, antivirus or detection service can identify or prevent every threat. We provide the Services with reasonable skill and care but do not warrant that all attacks, malware or intrusions will be detected or blocked, or that the Customer Systems will be free of compromise.

8. Infrastructure protection

Where we provide infrastructure hardening, firewall management, DDoS mitigation or secure-configuration services:

• We will configure, tune and manage protective controls (such as firewalls, filtering, rate-limiting and mitigation) on a commercially reasonable, best-efforts basis, as scoped in your Order.
• Changes to production systems carry inherent risk. You are responsible for maintaining current backups and a rollback position before we make changes, and for agreeing maintenance windows where a change may cause disruption.
• DDoS mitigation and similar protective measures reduce risk but cannot guarantee protection against every attack, volume or technique. Absolute availability or invulnerability is not warranted.
• You remain responsible for the day-to-day operation, licensing and lawful use of your own infrastructure except to the extent expressly placed under our management in an Order.
• We may recommend configuration or architectural changes; implementing recommendations that fall outside the agreed scope, and the consequences of declining to implement them, remain your responsibility.

9. Testing & audits

Where we provide penetration testing, vulnerability assessment, red-teaming or security audits:

• Authorisation is a condition of testing. We will only test systems, applications, networks or accounts that are within a scope you have authorised in writing. You warrant that you own the in-scope targets or have the full right and authority to authorise testing of them, and that our authorised activity will not breach any third-party right or law.
• You must obtain any consents or permissions required from third parties (for example hosting, cloud or SaaS providers) before testing begins. You will indemnify us against claims arising from your failure to hold or obtain the necessary authority.
• Testing may involve techniques that carry a risk of disruption, degradation or data loss. You are responsible for taking backups and agreeing testing windows and rules of engagement beforehand. We will use reasonable skill and care to limit impact.
• A test reflects the systems, configuration and threats as they exist at the time of testing. A "clean" result is not a guarantee of security and does not certify the absence of all vulnerabilities.
• Findings, reports and any exploit or proof-of-concept material are confidential and provided for your internal security purposes only. You are responsible for prioritising and remediating the issues we identify.

10. Training & incident response

Where we provide security-awareness or anti-fraud training, phishing simulations, or incident-response services:

• Training, briefings and simulated phishing are provided for your organisation's internal security education. You are responsible for informing and, where required, obtaining consents from participating staff, and for how you act on the results.
• Incident-response services are provided on a best-efforts basis to help you contain, investigate and recover from security incidents. Outcomes depend on factors outside our control, including the nature of the attack, the state and availability of your systems and backups, and the speed and completeness of the information and access you provide.
• Where response is provided on a retainer, response targets, included hours and out-of-scope rates are set out in your Order. Emergency response requested without a retainer is subject to availability and our then-current rates.
• We do not warrant that any incident can be fully contained or that data, systems or funds can be recovered. We may advise on notifications to regulators, insurers or law enforcement, but you remain the decision-maker and the party responsible for meeting your own legal and regulatory obligations.
• You authorise us to take the containment and remediation actions reasonably necessary during an engagement; where practical we will act on your instructions, but urgent action may be taken to limit harm.

11. Acceptable use

Your use of all Services is subject to our Acceptable Use Policy, which forms part of this Agreement. The AUP prohibits, among other things, unlawful content and activity, network abuse, credential attacks (such as brute-forcing and credential stuffing), malware, spam, phishing, intellectual-property infringement, misuse of proxy and IP services, and interference with third parties. Breach of the AUP is a breach of these Terms and may result in immediate suspension or termination.

12. Customer content & responsibilities

You retain ownership of your Customer Content. You are solely responsible for its legality, accuracy and for having all necessary rights and consents. You grant us the limited, non-exclusive right to host, transmit, cache and process Customer Content only as necessary to provide and support the Services. You must not use the Services in a way that infringes third-party rights or breaches applicable law. We do not routinely monitor Customer Content but may remove or disable access to content that we reasonably believe breaches this Agreement or the law, or in response to a valid legal request.

13. Partners & managed service providers

If you resell or deliver the Services to your own clients (for example as a managed security service provider), you remain fully responsible under this Agreement for all use of the Services by those clients, and you must impose terms on them at least as protective as these Terms and the AUP — including the requirement that testing, monitoring and protection only ever cover systems the client is authorised to have tested, monitored or protected. You are responsible for first-line support to your clients, for verifying their identity and authority where appropriate, and for ensuring their compliance. We may require you to cease providing Services to any client who breaches the AUP.

14. Fees, billing & taxes

• You agree to pay all Fees for the Services as set out in your Order. Unless stated otherwise, Fees are payable in advance and are exclusive of VAT and other applicable taxes, which you are responsible for paying.
• You authorise us (and our payment processors) to charge your chosen payment method for all Fees, including recurring and renewal Fees, until the Service is cancelled in accordance with these Terms.
• If any payment fails or is overdue, we may charge interest on overdue amounts at the statutory rate under the Late Payment of Commercial Debts (Interest) Act 1998, and may suspend or terminate Services after notice.
• You must keep your billing information accurate and current. If you dispute a charge, you must notify us within 30 days of the invoice date; charges not disputed within that period are deemed accepted.
• We may revise Fees for renewal periods by giving you reasonable notice before the renewal date.

15. Renewals & auto-renewal

Subscription Services and domains renew automatically for successive periods equal to the initial term unless you cancel before the renewal date, or unless your Order states otherwise. We will attempt to collect the applicable Fee using your payment method. You may disable auto-renewal or cancel through your Account or by contacting us via the website before the renewal date. It remains your responsibility to manage renewals; we are not liable for interruption or loss (including domain loss) resulting from non-renewal.

16. Refunds & cancellation

• You may cancel a Service at any time through your Account or via our website. Cancellation stops future renewals; it does not entitle you to a refund of Fees already paid for the current period except as set out below or as required by law.
• Certain Fees are non-refundable once the Service period has begun or work has been performed — in particular set-up and onboarding Fees, third-party software and licence Fees already incurred on your behalf, completed testing or audit engagements, and usage-based or emergency-response charges already incurred.
• Where we withdraw a Service for our convenience (other than for your breach), we will refund Fees for the unused portion of the paid period on a pro-rata basis.
• No refunds are given where Services are suspended or terminated for your breach of these Terms or the AUP.

17. Service levels & support

We provide monitoring and support as described for each Service, and aim to provide 24/7 monitoring with a first-response target of under one hour for critical incidents. Availability commitments, measurement methods, exclusions and any service credits are set out in the applicable SLA. Where an SLA provides credits, they are your sole and exclusive financial remedy for the relevant failure. Support is provided for the Services themselves and does not extend to development, debugging or administration of your Customer Content unless expressly agreed.

18. Suspension & termination

We may suspend or terminate all or part of the Services, with immediate effect where appropriate:

• if you materially breach this Agreement or the AUP and (where the breach is capable of remedy) fail to remedy it within a reasonable period after notice;
• for non-payment of Fees;
• to protect the security, integrity or availability of our network or other customers;
• where required by law, a court or a competent authority;
• where we reasonably believe the Services are being used for fraud, abuse or unlawful activity.

Either party may terminate for convenience by giving the notice period stated in the applicable Order (or, if none, 30 days' written notice). We will use reasonable efforts to limit any suspension to the affected Service.

19. Effect of termination & data handling

On termination, your right to use the affected Services ends and any outstanding Fees become immediately due. We may delete Customer Content associated with the terminated Services after a reasonable period. Where practicable, and provided your account is in good standing, we will make Customer Content available for export for a limited period following termination; after that period, data may be permanently deleted. You are responsible for retrieving your data before the end of that period. Provisions that by their nature should survive termination (including fees due, liability, indemnities, confidentiality and governing law) will survive.

20. Intellectual property

All intellectual-property rights in the Services, our website, software, systems, documentation and brand remain the property of the Company or its licensors. We grant you a limited, non-exclusive, non-transferable right to use the Services for their intended purpose during the term. You must not copy, resell (except as expressly permitted), reverse-engineer, or create derivative works from our proprietary materials. You retain all rights in your Customer Content.

21. Data protection

Each party will comply with applicable data-protection law, including the UK GDPR and the Data Protection Act 2018. Our processing of personal data in connection with the Services is described in our Privacy Policy. Where we process personal data on your behalf as a processor (for example when we collect and analyse security logs and telemetry from your systems, or handle data during an incident response), we will do so only on your documented instructions and will apply appropriate technical and organisational measures; where required, the parties will enter into a data-processing agreement that governs such processing.

22. Third-party providers

The Services rely on third parties such as antivirus, EDR and security-tooling vendors, cloud and datacentre providers, threat-intelligence sources and payment processors. Your use of the Services may be subject to those third parties' terms and policies, and their acts, omissions or changes may affect the Services. We are not responsible for third-party services outside our reasonable control, but we will use reasonable efforts to select reputable providers and manage these relationships on your behalf.

23. Warranties & disclaimers

We warrant that we will provide the Services with reasonable skill and care. Except as expressly stated in this Agreement, and to the fullest extent permitted by law, the Services are provided "as is" and "as available", and we exclude all other warranties, conditions and terms whether express or implied, including any implied warranties of satisfactory quality, fitness for a particular purpose and non-infringement. We do not warrant that the Services will be uninterrupted, error-free, or entirely secure, or that they will meet requirements not expressly agreed in an Order.

24. Limitation of liability

Nothing in this Agreement limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited or excluded.

Subject to the paragraph above, and to the fullest extent permitted by law:

• we will not be liable for loss of profits, revenue, business, goodwill, anticipated savings, or for loss or corruption of data, or for any indirect, special or consequential loss, however arising, whether in contract, tort (including negligence) or otherwise, even if foreseeable;
• our total aggregate liability arising out of or in connection with this Agreement in any 12-month period is limited to the total Fees paid by you for the affected Service in the 12 months immediately preceding the event giving rise to the claim.

You are responsible for maintaining your own backups and for putting in place appropriate insurance and contingency measures for your business.

25. Indemnification

You agree to indemnify and hold harmless the Company, its officers, employees and suppliers from and against any claims, liabilities, damages, losses and reasonable costs (including legal fees) arising out of or in connection with: (a) your use of the Services; (b) your Customer Content; (c) your breach of this Agreement or the AUP; or (d) your violation of any law or the rights of a third party. We will notify you of any such claim, allow you to control the defence (with our reasonable cooperation) and not settle without your consent where it admits fault on your part.

26. Confidentiality

Each party may receive information that is confidential to the other. Each party will keep the other's confidential information secret, use it only for the purposes of this Agreement, and protect it with reasonable measures. This does not apply to information that is or becomes public through no fault of the receiving party, is independently developed, or must be disclosed by law or a competent authority.

27. Force majeure

Neither party is liable for any failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including acts of God, war, terrorism, civil unrest, epidemics, strikes, failures of upstream providers or utilities, large-scale attacks on infrastructure, or governmental action. The affected party will use reasonable efforts to mitigate the effect. If such an event continues for more than 30 days, either party may terminate the affected Service.

28. Assignment & subcontracting

You may not assign or transfer this Agreement without our prior written consent. We may assign or transfer this Agreement to an affiliate or in connection with a merger, acquisition or sale of assets, and may use subcontractors to provide the Services, remaining responsible for their performance.

29. Notices

We will send notices to you by email to the address on your Account or by posting to your Account or our website. You must send notices to us through the contact channels published on our website. Notices are deemed received when sent by email (unless a delivery failure is received) or when posted to the Account.

30. Complaints & dispute resolution

If you have a complaint, please contact us first through the contact form on our website so we can try to resolve it. The parties will attempt in good faith to resolve any dispute through discussion before commencing proceedings. Nothing in this clause prevents either party from seeking urgent injunctive relief.

31. General

• Entire agreement. This Agreement is the entire agreement between the parties regarding the Services and supersedes prior discussions. Each party confirms it has not relied on any representation not set out in the Agreement.
• Severability. If any provision is found invalid or unenforceable, the remaining provisions continue in force, and the invalid provision will be modified to the minimum extent necessary.
• Waiver. A failure to enforce a right is not a waiver of it.
• No partnership. Nothing in the Agreement creates a partnership, agency or employment relationship between the parties.
• Third-party rights. A person who is not a party has no rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term.

32. Governing law & jurisdiction

This Agreement, and any dispute or claim (including non-contractual disputes) arising out of or in connection with it, is governed by and construed in accordance with the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales, except that we may bring proceedings for injunctive relief in any competent jurisdiction to protect our rights or network.

33. Contact

Questions about these Terms can be raised through the contact form on our website. Our registered details are: Cyber Crime Guards Ltd, a company registered in England & Wales (No. 17245515), registered office 11 Radnor Mews, London, W2 2SA, United Kingdom.