Terms of Service

1. Preamble and acceptance

These Terms of Service ("Terms") are a binding agreement between Ianura Ltd ("Ianura", "we", "us", "our"), a company registered in England and Wales, and the Customer (as identified in the Order).

By clicking "I accept", by creating a user account, by making payment for a subscription, or by using Vigilia (the "Software"), the Customer accepts these Terms on behalf of the legal entity it represents. The individual accepting these Terms warrants that they have the authority to bind that entity. If the Customer does not agree to these Terms, it must not use the Software.

These Terms take effect on the earliest of: account creation, first payment, or first use of the Software (the "Effective Date").

2. Definitions

"Software" — Vigilia, the web application for structural coverage analysis of security control stacks, including its underlying engine, rule packs, user interface, APIs, reports, documentation, and any updates.
"Customer Data" — all data submitted by, or on behalf of, the Customer to the Software, including rule sets ingested, analyses run, and any outputs derived from the Customer's inputs.
"Customer Rule Set" — the set of rules, controls, policies, or compliance frameworks submitted by the Customer for structural analysis.
"Findings" — outputs produced by the Software in respect of the Customer Rule Set, including coverage gaps, control-interaction gaps, remediation suggestions, and reports.
"Order" — the subscription order placed by the Customer, via self-serve checkout or a signed order form, identifying the tier, quantity, term, and price.
"Acceptable Use Policy" or "AUP" — the acceptable use policy published at https://ianura.com/acceptable-use, as updated from time to time.
"Authorised Users" — individuals authorised by the Customer to access the Software on the Customer's behalf, including employees, contractors, secondees, and agency workers engaged by the Customer.
"Fees" — the subscription fees and any other charges set out in the Order.
"Term" — the term of this agreement as set out in §12.
"Confidential Information" — any information disclosed by one Party (the "Discloser") to the other (the "Recipient") in connection with these Terms that (i) is marked or identified as confidential at the time of disclosure, (ii) would reasonably be understood to be confidential given its nature or the circumstances of disclosure, or (iii) comprises Customer Data, Findings, the Software's non-public features or architecture, security controls or vulnerabilities, pricing, or the commercial terms of the Order. Confidential Information does not include information that (a) is or becomes public other than through breach of these Terms, (b) was lawfully in the Recipient's possession without restriction before disclosure, (c) is lawfully obtained from a third party without restriction, or (d) is independently developed by the Recipient without reference to the Discloser's Confidential Information.
"Sub-processor" — any third party engaged by Ianura to process Customer Data on Ianura's behalf in the course of providing the Software.

3. Licence grant

Subject to the Customer's compliance with these Terms and payment of the Fees, Ianura grants the Customer a non-exclusive, non-transferable, non-sublicensable, worldwide licence during the Term to:

access and use the Software for the Customer's internal business purposes;
permit Authorised Users to access and use the Software on the Customer's behalf; and
download and use Findings for the Customer's internal audit, compliance, and remediation purposes.

The Customer shall not, and shall not permit any third party to:

reverse engineer, decompile, or attempt to derive the source code of the Software, except to the extent such restriction is prohibited by applicable law;
resell, sublicense, rent, lease, or otherwise make the Software available to any third party;
use the Software, Findings, or any other information derived from the Software to build a competing product or service, or for benchmarking purposes;
remove, alter, or obscure any proprietary notices on the Software; or
use the Software in breach of the scope clause in §4 or the Acceptable Use Policy.

4. Scope of use

This is the critical clause of these Terms. Any breach of this §4 is a material breach of these Terms.

4.1 The Customer shall use the Software only to analyse rules, controls, policies, and compliance frameworks:

(a) owned or operated by the Customer; or
(b) for which the Customer has express written authorisation from the owner or operator to perform structural analysis; or
(c) that are published as part of public standards, legislation, or public regulatory guidance, where such analysis is permitted under applicable law and is consistent with the Acceptable Use Policy.

4.2 The Customer shall not use Findings produced by the Software to:

exploit, circumvent, or derive advantage from gaps in systems, rule sets, or frameworks other than those falling within §4.1(a) or §4.1(b);
prepare, plan, or carry out any act that would constitute an offence under the Computer Misuse Act 1990, the Data Protection Act 2018, the UK GDPR, the Investigatory Powers Act 2016, or any other law applicable to the Customer, Ianura, or the jurisdiction in which the Software is used, including any unauthorised access to, or impairment of, computer material; or
conduct competitive intelligence, adversarial analysis, or due-diligence investigation of any entity other than the Customer itself, except within the scope of a written mandate from that entity.

4.3 The Customer acknowledges that Vigilia is a structural coverage analysis tool for the Customer's own security control stack. It is not a penetration testing tool, a vulnerability scanner, or an offensive cyber capability. Vigilia may complement an internal security-testing function (including red-team or purple-team activity conducted on the Customer's own systems by the Customer's own personnel, or by authorised contractors acting under a written mandate from the Customer that includes authorisation for the purposes of section 17(5) of the Computer Misuse Act 1990). The Software is not authorised for use by external penetration-testing firms, consultancies, or service providers in respect of third-party client systems, except where that third party is the Customer under these Terms and the firm is acting as an Authorised User on the Customer's behalf.

4.4 The Customer shall comply at all times with the Acceptable Use Policy, which is incorporated by reference into these Terms. In the event of conflict between §4 and the AUP, §4 prevails.

4.5 Any breach of this §4 constitutes a material breach of these Terms and entitles Ianura to suspend or terminate the Customer's access to the Software immediately on notice, without refund. Ianura reserves the right to report credible evidence of use of the Software to facilitate unlawful activity to the National Crime Agency, the National Cyber Security Centre, the Information Commissioner's Office, the relevant police authority, or any other competent authority, and to cooperate with any investigation by such authority. Ianura's right to report under this clause is subject to Ianura acting in good faith, on reasonable grounds, and disclosing only information strictly necessary for the report. Ianura shall notify the Customer of any such report unless prohibited by law or by the receiving authority.

5. User obligations

The Customer shall:

ensure that all information it provides to Ianura, including in the Order and at account creation, is accurate, current, and complete;
ensure that Authorised Users comply with these Terms and the AUP, and the Customer remains responsible for the acts and omissions of its Authorised Users as if they were its own;
maintain the security of credentials issued to it, and promptly notify Ianura of any suspected unauthorised access;
attest, at the point of first ingestion of any Customer Rule Set, that it has authority under §4.1 to submit that Rule Set for analysis;
not attempt to circumvent the authorisation, billing, or usage controls of the Software;
comply with all applicable laws in its use of the Software, including data protection, computer misuse, export control, sanctions, and other regulatory regimes applicable to the Customer's business; and
pay the Fees when due.

The Customer acknowledges that account creation requires organisation identification, verified business-email domain, and (for UK customers claiming regulated status) verification against public regulatory registers. The Customer warrants that all identifying information provided is accurate and current.

6. Vendor obligations

Ianura shall:

make the Software available substantially as described in the product documentation, subject to any service level agreement set out in the Order, scheduled maintenance, and events beyond Ianura's reasonable control;
use commercially reasonable efforts to maintain the security of the Software, including appropriate technical and organisational measures to protect Customer Data;
not access Customer Data except as necessary to provide, maintain, or improve the Software, to comply with law, or at the Customer's request;
comply with applicable data protection law in respect of any personal data processed in connection with the Software (see §9 and the separate Privacy Policy and Data Processing Addendum); and
provide support through the channels identified in the product documentation, at a level appropriate to the Customer's subscription tier.

7. Data ownership and processing

7.1 The Customer retains all right, title, and interest in and to Customer Data, including Customer Rule Sets and Findings.

7.2 The Customer grants Ianura a non-exclusive, worldwide, royalty-free licence to process Customer Data solely to the extent necessary to provide the Software, maintain and improve its security, reliability, and performance, comply with applicable law, and enforce these Terms.

7.3 Ianura shall not:

use Customer Data to train any machine learning or artificial intelligence model (whether Ianura's own or any third party's);
share Customer Data with competitors of the Customer; or
disclose Customer Data except as required by law or as expressly permitted by the Customer.

7.4 Ianura may engage Sub-processors to process Customer Data, provided that Ianura (a) imposes contractual obligations on each Sub-processor that are materially no less protective than those set out in these Terms and the Data Processing Addendum, (b) remains responsible to the Customer for the acts and omissions of its Sub-processors, and (c) maintains a current list of Sub-processors available to the Customer on request. Ianura shall give the Customer reasonable prior notice of any new Sub-processor that processes personal data.

7.5 On termination of these Terms, the Customer may export Customer Data through the Software's export functionality for a period of thirty (30) days following the effective date of termination, after which Ianura shall delete Customer Data in accordance with its data retention policy, save to the extent Ianura is required by law to retain it.

8. Confidentiality

8.1 Each Party (as Recipient) shall:

hold the Discloser's Confidential Information in strict confidence;
use the Confidential Information only for the purpose of performing or exercising its rights under these Terms;
limit access to those of its employees, contractors, professional advisers, and (in Ianura's case) Sub-processors who have a need to know, and who are bound by obligations of confidentiality materially no less protective than this §8; and
protect the Confidential Information using at least the same degree of care it uses to protect its own confidential information of a similar nature, and in no case less than a reasonable standard of care.

8.2 The Recipient may disclose Confidential Information to the extent required by law, by a court of competent jurisdiction, or by a regulatory or governmental authority, provided that (where lawfully permitted) the Recipient gives the Discloser prompt written notice and reasonable opportunity to seek protective measures.

8.3 The obligations in this §8 continue for five (5) years after termination of these Terms, save that in respect of information that constitutes a trade secret under applicable law, or that comprises security-sensitive information concerning either Party's systems or controls, the obligations continue for as long as the information retains that sensitivity.

9. Privacy and data protection

Processing of personal data in connection with the Software is governed by the Ianura Privacy Policy and, where Ianura acts as a processor of personal data on behalf of the Customer under UK GDPR Article 28 or equivalent legislation, by the Ianura Data Processing Addendum ("DPA"). The Privacy Policy and DPA are each incorporated by reference into these Terms. In the event of conflict between these Terms and the DPA in respect of personal data processing, the DPA prevails.

10. Fees, invoicing, and taxes

10.1 The Customer shall pay the Fees set out in the Order, in the currency and on the schedule specified.

10.2 Unless stated otherwise in the Order, Fees are payable in advance, non-refundable, and exclusive of VAT and other applicable taxes, which the Customer shall pay in addition where applicable.

10.3 Ianura may increase the Fees on renewal with not less than sixty (60) days' written notice before the start of the renewal term. Any increase shall not exceed the greater of (a) 10% or (b) the percentage increase in the UK Consumer Prices Index (CPI) during the immediately preceding Initial Term or Renewal Term. The Customer may decline the increase by giving notice of non-renewal not less than thirty (30) days before the start of the renewal term.

10.4 Without prejudice to any other right or remedy, overdue amounts bear interest at the rate of eight per cent (8%) per annum above the Bank of England base rate, accruing daily from the due date until paid, together with any reasonable recovery costs and statutory compensation under the Late Payment of Commercial Debts (Interest) Act 1998.

11. Warranties and disclaimers

11.1 Each Party warrants to the other that it has the right and authority to enter into these Terms.

11.2 Ianura warrants that, during the Term, the Software will perform substantially in accordance with the documentation, and that Ianura has used commercially reasonable efforts to make the Software free from material defects and malicious code. The Customer's sole and exclusive remedy, and Ianura's sole and exclusive liability, for breach of this warranty is for Ianura to use commercially reasonable efforts to correct the defect or, if it is unable to do so within a reasonable period, to refund Fees paid by the Customer in respect of the affected period.

11.3 Except as expressly set out in these Terms, the Software is provided "as is" and Ianura disclaims all other warranties, whether express, implied, or statutory, to the maximum extent permitted by law, including warranties of merchantability, fitness for a particular purpose, and non-infringement.

11.4 The Software is a structural coverage analysis tool. Findings are not legal advice, not regulatory determinations, and not a substitute for the Customer's own information security, compliance, legal, and risk-management processes. The Software does not detect active threats, vulnerabilities in deployed systems, or ongoing intrusions, and is not a substitute for penetration testing, vulnerability scanning, managed detection and response, or any other operational security capability. The Customer is responsible for its own security posture and compliance decisions.

12. Term and termination

12.1 These Terms commence on the Effective Date and continue for the initial subscription term specified in the Order (the "Initial Term"). They automatically renew for successive periods of twelve (12) months (each a "Renewal Term"), unless either Party gives written notice of non-renewal at least thirty (30) days before the end of the then-current term.

12.2 Either Party may terminate these Terms immediately by written notice if the other Party:

commits a material breach of these Terms which, if remediable, is not remedied within thirty (30) days of written notice; or
becomes insolvent, is unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986, enters into administration, enters into a company voluntary arrangement or composition with creditors, has a receiver or administrator appointed over any of its assets, has a winding-up petition presented against it (other than a petition that is dismissed or withdrawn within fourteen (14) days), passes a resolution for winding-up, or ceases or threatens to cease to carry on business.

12.3 Ianura may suspend or terminate the Customer's access to the Software immediately, without notice and without refund, if the Customer breaches §4.

12.4 On termination: all licences granted under these Terms cease; the Customer shall pay all Fees accrued up to the effective date of termination; the Customer may export Customer Data in accordance with §7.5; and each Party shall return or destroy the Confidential Information of the other, save to the extent retention is required by law or by reasonable backup and archival practices (in which case the obligations in §8 continue to apply to any such retained Confidential Information).

12.5 The following provisions survive termination: §§2 (Definitions, to the extent required for interpretation of surviving clauses), 3 (to the extent it imposes restrictions on the Customer), 4, 7, 8, 9, 10 (in respect of accrued amounts), 11, 13, 14, 15, this §12.5, and any other provision that by its nature is intended to survive.

13. Liability

13.1 Nothing in these Terms limits or excludes a Party's liability for:

death or personal injury caused by its negligence;
fraud or fraudulent misrepresentation;
any other liability that cannot be limited or excluded as a matter of law.

13.2 Subject to §13.1, and subject to §13.4, neither Party shall be liable to the other for loss of profits, loss of revenue, loss of business, loss of goodwill, or loss of anticipated savings (in each case whether direct or indirect), or any indirect, special, or consequential loss.

13.3 Subject to §13.1 and §13.4, each Party's total aggregate liability arising out of or in connection with these Terms, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, shall not exceed an amount equal to the Fees paid or payable by the Customer to Ianura in the twelve (12) months immediately preceding the event giving rise to the claim, or, if the claim arises within the first twelve (12) months of the Term, the annualised value of the Fees under the Order.

13.4 A higher cap equal to two (2) times the amount specified in §13.3 applies to liability arising from:

the Customer's breach of §4 (Scope of use) or §5 (User obligations, in respect of sub-paragraphs relating to unauthorised use);
the Customer's indemnity obligations under §14.1;
Ianura's indemnity obligations under §14.2; and
breach by either Party of §8 (Confidentiality), save that loss or unauthorised disclosure of Customer Data by Ianura shall be subject to the cap in §13.3 and shall not be treated as indirect or consequential loss for the purposes of §13.2.

14. Indemnities

14.1 The Customer shall indemnify Ianura, and keep Ianura indemnified, against all reasonable losses, damages, costs (including reasonable legal costs), liabilities, claims, and proceedings arising out of or in connection with:

the Customer's breach of §4 or the AUP;
the Customer's use of Findings to take any act that constitutes an offence under any applicable law, including the Computer Misuse Act 1990; or
any claim by a third party that the Customer's use of the Software involved unauthorised analysis of, or unauthorised access to, that third party's systems, rule sets, or frameworks.

The Customer's obligations under this §14.1 are subject to: (a) Ianura promptly notifying the Customer of the claim, (b) Ianura permitting the Customer to control the defence and any settlement (provided the Customer does not settle in a way that admits liability on Ianura's part or imposes non-monetary obligations on Ianura without Ianura's prior written consent), and (c) Ianura cooperating reasonably with the Customer in the defence.

14.2 Ianura shall indemnify the Customer against any third-party claim that the Software, used in accordance with these Terms, infringes a third party's intellectual property rights, provided the Customer promptly notifies Ianura of the claim, permits Ianura to control the defence and any settlement, and cooperates reasonably with Ianura. If the Software is, or in Ianura's reasonable opinion is likely to be, the subject of an infringement claim, Ianura may (at its option and expense) procure the right for the Customer to continue using the Software, modify the Software to be non-infringing without material loss of functionality, or, if neither is commercially reasonable, terminate the affected Order and refund any prepaid Fees covering the unused remainder of the Term. This §14.2 is the Customer's sole and exclusive remedy in respect of any infringement claim.

14.3 The indemnities in this §14 do not apply to the extent the claim arises from the indemnified Party's own breach of these Terms, gross negligence, or wilful misconduct, or from modifications or combinations made without the indemnifying Party's authorisation.

15. General

15.1 Governing law. These Terms are governed by the law of England and Wales.

15.2 Jurisdiction. The courts of England and Wales have exclusive jurisdiction to settle any dispute arising out of or in connection with these Terms, save that either Party may seek injunctive or equivalent relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information, and save that Ianura may seek such relief to enforce §4.

15.3 Notices. Notices under these Terms shall be in writing and given by email to legal@ianura.com (to Ianura) or the email address identified in the Order (to the Customer), with confirmation of receipt. Notices of termination or material breach shall additionally be sent by recorded or tracked delivery to the registered office of the receiving Party.

15.4 Entire agreement. These Terms, the Order, the AUP, the Privacy Policy, and the DPA constitute the entire agreement between the Parties in respect of their subject matter and supersede all prior agreements, representations, and understandings. Each Party acknowledges that, in entering into these Terms, it has not relied on any statement, representation, assurance, or warranty other than those expressly set out in these Terms. Nothing in this clause limits or excludes liability for fraud or fraudulent misrepresentation.

15.5 Variation. Ianura may vary these Terms by giving the Customer not less than thirty (30) days' written notice. Continued use of the Software after the effective date of variation constitutes acceptance. If the Customer does not agree to a variation, it may terminate the Terms in accordance with §12. Variations that materially increase the Customer's obligations, materially reduce Ianura's obligations, materially change the scope of use permitted under §4, or materially change the liability, indemnity, or data-protection provisions, require the Customer's express acceptance and do not take effect until accepted.

15.6 Assignment. The Customer may not assign, novate, or transfer these Terms without Ianura's prior written consent (such consent not to be unreasonably withheld or delayed). Ianura may assign or novate these Terms to an affiliate or to a successor in connection with a corporate reorganisation, merger, or sale of substantially all its assets, on written notice to the Customer.

15.7 Severability. If any provision of these Terms is held to be invalid or unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, or if that is not possible, severed, without affecting the remainder of these Terms.

15.8 Third-party rights. A person who is not a party to these Terms has no rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term.

15.9 Force majeure. Neither Party is liable for failure to perform any obligation (other than any obligation to pay money) to the extent that failure is caused by circumstances beyond its reasonable control, including acts of God, war, terrorism, civil unrest, pandemic, industrial action (other than involving the affected Party's own workforce), failure of utilities or telecommunications networks not within the affected Party's control, cyber-attack on third-party infrastructure not within the affected Party's control, or acts of government (a "Force Majeure Event"). The affected Party shall (i) promptly notify the other Party of the Force Majeure Event and its likely duration, (ii) use reasonable efforts to mitigate its effects, and (iii) resume performance as soon as reasonably practicable. If a Force Majeure Event continues for more than sixty (60) consecutive days, the Party not claiming Force Majeure may terminate these Terms on written notice, in which case Ianura shall refund any prepaid Fees covering the unused remainder of the Term.

15.10 Publicity. Neither Party may use the other's name, logo, or trade marks in any public statement without the other's prior written consent, save that Ianura may identify the Customer as a customer in customer lists and on its website once the Customer has been a paying customer for not less than ninety (90) days, unless the Customer has notified Ianura in writing that it objects.

15.11 No partnership. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between the Parties.

15.12 Counterparts. These Terms, and any Order executed by signature, may be executed in counterparts, each of which is an original and which together constitute one instrument. Electronic signatures are binding.

Contact

legal@ianura.com