Terms of Service

The Service is operated by SecurityTrackr ApS, a company registered in Denmark under CVR no. 46602846 (“we”, “us”, “our”). Contact: support@securitytrackr.com.

By creating an account or using SecurityTrackr (“the Service”), you agree to be bound by these Terms of Service (“Terms”) and our Privacy Policy. If you do not agree, do not use the Service.

The Service is offered for business use only. By accepting these Terms you represent that you are using the Service in the course of a trade, business, craft, or profession, and not as a consumer.

SecurityTrackr is a security observation and risk register platform that allows organisations to document, track, manage, and discuss cybersecurity findings; attach evidence files with automated malware-reputation checks; enrich findings with third-party OSINT exposure data; generate reports; and collaborate within the organisation. The Service supports both email-and-password sign-in with two-factor authentication and Single Sign-On through your organisation's identity provider.

The Service includes optional AI-assisted drafting features. Depending on your plan and settings, these are powered, in order of preference, by (i) Bring Your Own Key (BYOK) — an AI provider key you supply; (ii) Advanced AI — included with paid plans, where we hold the provider key on your behalf; or (iii) a built-in AI — provided through our hosting provider as the fallback for Free-plan organisations that have configured neither BYOK nor Advanced AI. See section 6 for further detail.

The Service is provided on an evolving basis. Features may be added, changed, or removed at any time. We will give reasonable notice of materially adverse changes.

• You must provide accurate and complete information when registering.
• You are responsible for maintaining the security of your credentials.
• Email-and-password accounts currently require app-based two-factor authentication, set up at first sign-in. Accounts that use Single Sign-On rely instead on the sign-in and multi-factor policies enforced by your organisation's identity provider. Specific security features may change over time as the Service evolves.
• You represent that you are at least 18 years old and authorised to accept these Terms on behalf of your organisation.
• Accounts are personal — invite team members through the in-app invitation system rather than sharing credentials.
• You are responsible for all activity under your account.

You agree not to, and not to permit any user of your organisation to:

• Use the Service for any unlawful purpose or in violation of applicable law
• Upload content you do not have the right to share, or that infringes the intellectual property, privacy, or other rights of any third party
• Upload, store, or transmit malware, viruses, ransomware, phishing material, or any code or content intended to harm any system or person
• Use the Service to send unsolicited commercial communications, spam, or harassment
• Post comments, observation content, or other user-generated material that harasses, defames, threatens, or unlawfully targets another member of your organisation or any third party
• Use the Service to store classified government information, regulated health data (e.g. HIPAA-regulated PHI), payment card data subject to PCI-DSS, or other categories of data for which the Service is not designed
• Attempt to access other users' data, the underlying infrastructure, or any non-public area of the Service without written authorisation
• Conduct security testing, penetration testing, vulnerability scanning, or load testing against the Service without prior written authorisation from us
• Reverse-engineer, decompile, or attempt to extract the source code of the Service
• Use automated tools to scrape, mirror, or bulk-export data beyond ordinary in-product use
• Interfere with the integrity, security, or availability of the Service
• Use the Service or its output to develop, train, or improve any product that competes with the Service, including any AI model
• Resell, sublicense, or otherwise commercially exploit the Service without our prior written consent

AI features and defensive use. The Service exists to help you govern the security of your own environment. You agree not to use the AI features, or any content you submit to them, to plan, support, or carry out offensive cyber operations against systems you are not authorised to test; to develop, refine, or obfuscate malware, exploits, or intrusion tooling; or to profile, target, or attack any third party. Asking for help hardening, assessing, or documenting a system you are responsible for is expressly permitted; the same request aimed at a system you do not control is not.

Authorisation warranty. You represent and warrant that you own, or are authorised by the owner to record and assess, every system, domain, hostname, and IP range you register in the Service, and that any OSINT enrichment or exposure lookup you trigger targets such a system. Obtaining that authorisation before you enter the target, and keeping it current, is your responsibility.

We may suspend or restrict access immediately if we reasonably believe you are in breach of this section, with or without prior notice depending on the severity of the breach. For serious abuse — including the offensive use and unauthorised targeting described above — suspension is immediate and may be followed by termination under section 13 without an opportunity to cure. Our AI providers impose equivalent restrictions on us, so we may also be required to restrict or report abusive use of the AI features.

You own your data. All observations, organisation information, and uploaded files you create remain your property. We do not claim any ownership over your content (“Customer Content”).

You grant us a worldwide, non-exclusive, royalty-free licence to host, store, transmit, display, and otherwise process Customer Content solely as necessary to provide the Service to you, to support you, to enforce these Terms, and to comply with applicable law. This licence terminates when you delete the Customer Content or close your account, except for backup copies retained as described in our Privacy Policy.

You are responsible for the accuracy, legality, and appropriateness of the data you enter into the Service. You are responsible for maintaining your own backups of any Customer Content you cannot afford to lose. The Service's in-product export functionality is provided as-is and is not a substitute for your own backup strategy.

Data Processing Agreement. Where your organisation invites multiple users, you are the controller of those users' data within your organisation and we act as a processor on your behalf. That processing is governed by our Data Processing Agreement (“DPA”), which is incorporated into these Terms by reference and forms part of them. The DPA sets out our obligations under Article 28 GDPR, together with the details of the processing, our technical and organisational security measures, and our sub-processor list.

The DPA takes effect when you accept these Terms and applies to your organisation automatically — no signature is required for it to be binding on us. We will provide a copy on request before or at any time after acceptance, and will execute a counterpart at no charge where your procurement or regulatory processes require an executed document; signing changes nothing about the terms that already apply. Request either at support@securitytrackr.com. In the event of a conflict between the DPA and the rest of these Terms, the DPA prevails in respect of the processing of personal data — except that section 11 (limitation of liability) continues to apply to claims under the DPA, which are subject to the same single aggregate cap and do not create an additional or separate one.

The Service includes optional AI-assisted features. Three tiers are offered, resolved in the following order of precedence for each request:

• Bring Your Own Key (BYOK) — you supply an API key from your own account with a supported third-party AI provider (currently OpenAI, Anthropic, or Mistral), and your requests route to that provider. Your use of that API is governed by your own agreement with the provider, including their terms, acceptable-use policy, and pricing; we are not a party to that relationship.
• Advanced AI — included with paid plans. We hold the AI provider key on your behalf, so no API key configuration is required. Requests are processed by Anthropic, PBC (United States) by default; organisations that require EU processing can switch Advanced AI to Mistral AI (France) in Account settings. Either way the processing is covered by our agreement with that provider.
• Built-in AI — Cloudflare Workers AI, run by our hosting provider, used as the fallback for Free-plan organisations that have configured neither BYOK nor Advanced AI. This processing is covered by our agreement with Cloudflare.

One feature sits outside this order of precedence. Semantic matching — which finds related and duplicate observations by meaning — converts observation text into numerical embeddings, and those are produced by Mistral AI (France) under a key we hold, whichever tier above serves your organisation's drafting. It is available on every plan, with its derived provider cost absorbed by us, and can be switched off per organisation in Account settings.

Sub-processors, locations, and transfer mechanisms for all three tiers, and for semantic matching, are set out in our Privacy Policy.

By using any AI feature you acknowledge and agree that:

• To fulfil an AI request we send the selected provider the content of the item you are working on (for example an observation's title, description, affected systems, and mitigating controls, plus the instruction or question you supply), together with limited context from your organisation profile (name, industry, country, and the regulatory frameworks you selected during setup). Some features send more than a single record: duplicate detection compares your draft against a short list of your existing observations, and report generation sends the observations and aggregated figures within the scope of the report you ask us to build. We do not send evidence file contents or audit log entries to AI providers. You are responsible for ensuring this transmission is appropriate given the sensitivity of the data.
• AI-generated output is unreliable. It may be factually incorrect, incomplete, biased, or misleading. You must independently verify all AI-generated content before use. The Service is a drafting aid, not a source of authoritative security advice.
• We do not warrant the accuracy, completeness, fitness, or appropriateness of any AI-generated output, regardless of which tier produced it.
• Where AI is operated under BYOK, we are not responsible for costs you incur through your use of third-party AI APIs.
• Where AI is operated as Advanced AI or the built-in AI, our liability is governed by section 11 of these Terms.

• The Service offers a Free plan, a Pro subscription, and, where enabled, a Pay-per-use plan. Limits and features for each plan are displayed within the Service and may be updated from time to time.
• The Free plan is provided at no charge and may be modified, restricted, or discontinued with reasonable notice.
• Pro and Pay-per-use pricing is published in the Service. Pay-per-use has no recurring base fee; each successful priced action is billed in arrears, subject to the finite monthly cap you select. Payments are processed by our billing partner identified in the Privacy Policy, and applicable tax may be added.
• We reserve the right to change pricing with at least 30 days' notice to existing subscribers, taking effect at the next renewal.
• Where you fail to pay fees due, your subscription may be downgraded to the Free plan or your access may be suspended without further notice, subject to any retry or dunning window operated by our billing partner.

The SecurityTrackr name, logo, software, prompt templates, AI integration design, user interface, documentation, and all related materials are our property or that of our licensors. These Terms grant you only a limited, revocable, non-exclusive, non-transferable right to use the Service as described — no other intellectual property rights are transferred.

If you provide us with feedback, ideas, or suggestions, you grant us a perpetual, irrevocable, royalty-free licence to use them without obligation to you.

The Service is provided “as is” and “as available”, without warranties of any kind, whether express, implied, or statutory. To the fullest extent permitted by law, we disclaim all warranties including, without limitation, the implied warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, completeness, and uninterrupted or error-free operation.

We do not warrant that the Service will meet your requirements, that defects will be corrected, that the Service will be available at any particular time or location, or that the Service will be free of viruses or other harmful components.

SecurityTrackr is a documentation and tracking tool. It is not a security guarantee, a compliance certification, a vulnerability scanner, or protection against cyberattacks. Use of the Service does not by itself make your organisation secure or compliant with any standard or regulation. You remain solely responsible for the security and compliance posture of your organisation.

No advice or information, whether oral or written, obtained by you from us or through the Service shall create any warranty not expressly stated in these Terms.

You agree to defend, indemnify, and hold harmless SecurityTrackr, its officers, employees, contractors, and agents from and against any third-party claim, loss, liability, damage, or expense (including reasonable legal fees) arising out of or relating to:

• Customer Content, including any allegation that it infringes intellectual property, violates privacy, defames, or is unlawful;
• Your use of the Service in breach of these Terms or applicable law;
• Your violation of any third-party right;
• A dispute between you and another user of your organisation, or between you and any third party arising from your use of the Service.

We will give you prompt written notice of any claim and reasonable cooperation in the defence. You may not settle any claim that imposes any obligation on us without our prior written consent.

Excluded losses. To the fullest extent permitted by law, we are not liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, nor for any loss of profits, revenue, business, goodwill, anticipated savings, data, or cost of substitute services, however caused and under any theory of liability, even if we have been advised of the possibility of such damages.

Aggregate cap. Our total aggregate liability for any and all claims arising out of or relating to these Terms or the Service shall not exceed the greater of (a) the fees you paid us for the Service in the twelve (12) months preceding the event giving rise to the claim, or (b) EUR 100.

AI output. Without limiting the above, we are not liable for any decision, action, or omission you take in reliance on AI-generated content, nor for any loss arising from inaccurate, incomplete, or biased AI output.

Mandatory law. Nothing in these Terms excludes or limits any liability that cannot be excluded or limited under applicable law (for example, liability for fraud, gross negligence, or wilful misconduct, where such limits are prohibited).

We are not liable for any failure or delay in performing our obligations under these Terms to the extent caused by an event outside our reasonable control, including without limitation: outages, failures, or degradation of services provided by our hosting provider, our email provider, our billing provider, AI providers, or other sub-processors; internet or telecommunications failures; denial-of-service attacks; acts of government; pandemic; war; civil unrest; natural disaster; or changes in law that prevent performance.

By you. You may delete your account at any time from the Account settings page. The deletion is permanent and irreversible: in the same request, Customer Content tied to your account — and, if you are the sole remaining member of your organisation, to your organisation — is removed from the live application database and the associated evidence files are deleted from object storage. If you are the last administrator and other team members exist, you must promote another member to administrator or remove the other members through team management before deleting your own account. You are responsible for exporting any data you wish to retain before deletion. Database point-in-time recovery snapshots roll forward and age out as described in the Privacy Policy.

By us. We may suspend or terminate your account immediately for material breach of these Terms (including any breach of section 4), for non-payment of fees, or where required by law. For other reasons we will give at least 30 days' written notice. If we discontinue the Service entirely we will give at least 30 days' notice and reasonable time to export your data.

Effect of termination. On termination your right to use the Service ends. We will delete Customer Content as described in our Privacy Policy. Sections that by their nature should survive termination — including sections 5 (your data, in respect of accrued obligations), 8 (intellectual property), 9 (disclaimer), 10 (indemnification), 11 (liability cap), 16 (governing law), and this section — survive termination.

We may update these Terms from time to time. We will notify you by email at least 14 days before material changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Terms. If you do not agree to the updated Terms, your remedy is to stop using the Service and delete your account.

Legal notices to you may be sent by email to the address associated with your account or by posting in the Service. You are responsible for keeping your account email up to date. Routine transactional emails (email verification, password reset, team invitations, billing notifications) are sent from noreply@securitytrackr.com and are not monitored for inbound replies. Legal notices and any rights requests to us must be sent to support@securitytrackr.com.

These Terms are governed by the laws of Denmark, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods. Any dispute arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of the Danish courts, with the City Court of Copenhagen as the court of first instance.

If, despite section 1, any user of the Service is determined to be a consumer in an EU/EEA jurisdiction, that user retains the benefit of any mandatory consumer protection rules of their country of habitual residence that cannot be derogated from by agreement.

• Severability. If any provision of these Terms is held invalid or unenforceable, the remaining provisions remain in full force and effect.
• No waiver. Our failure to enforce any right or provision of these Terms is not a waiver of that right or provision.
• Assignment. You may not assign or transfer these Terms or any rights under them without our prior written consent. We may assign these Terms in connection with a merger, acquisition, reorganisation, or sale of substantially all of our assets, on notice to you.
• Entire agreement. These Terms, together with the Privacy Policy and any Data Processing Addendum we have signed with you, constitute the entire agreement between you and us regarding the Service and supersede all prior or contemporaneous understandings.
• No agency. Nothing in these Terms creates any partnership, joint venture, agency, or employment relationship between you and us.
• Third-party rights. No person other than you and us has any right to enforce these Terms.

For questions about these Terms, contact us at support@securitytrackr.com.