Terms of Service

These Terms of Service (“Terms”) govern access to and use of BreachDetect, including the website at breachdetect.net, the public demo, the customer dashboard and the BreachDetect API (together, the “Service”). They are a binding agreement between BreachDetect (“BreachDetect”, “we”, “us” or “our”) and the business that uses the Service (“Customer” or “you”).

You accept these Terms when you sign or otherwise agree to an Order Form that refers to them, create an account, or first use the Service, whichever happens first. If you accept on behalf of a company or other organization, you confirm that you have authority to bind it, and “you” means that organization.

If an Order Form conflicts with these Terms, the Order Form controls, but only for the subscription it covers and only where it expressly says it overrides these Terms. Otherwise, these Terms control.

Our Privacy Policy explains how we handle personal data. It forms part of these Terms.

If you do not agree to these Terms, you must not use the Service.

BreachDetect is sold to businesses only. The Service is not offered to consumers and must not be used for personal, family or household purposes.

To use the Service, you must be a company, partnership, public body, nonprofit or other lawfully constituted organization, and each Authorized User must be at least 18 years old.

You must not use the Service if you, or any person that owns or controls you, are the target of sanctions administered by the United Nations, the European Union, the United Kingdom or the United States, or are located in a country or territory subject to a comprehensive embargo by any of them. You must not make the Service or any Results available to any such person.

We may ask for information to confirm your identity, your organization and your connection to the domains you want to monitor. We may decline to provide the Service to anyone at our discretion. Workspaces are switched on by our staff once a subscription is in place; creating an account does not by itself give access to search.

Each Authorized User needs their own account, registered with a work email address. Accounts are personal and must not be shared.

You are responsible for the accuracy of the information in your accounts, for keeping passwords, verification codes and API keys secure, and for all activity in your Workspace. We strongly recommend that every Authorized User turns on two-step verification.

You decide who joins your Workspace. You must remove access promptly when someone leaves your organization or no longer needs it.

You must tell us without undue delay if you suspect that an account, password or API key in your Workspace has been compromised or used without authorization.

When an Authorized User deletes their account, their login is removed. The Workspace and its data stay in place for the rest of your team.

Your Order Form sets the scope of your subscription. This may include the number of Monitored Domains, a daily search allowance, the search types available, whether passwords are shown in full or masked, wildcard search, and API access.

The daily search allowance is shared by everyone in your Workspace, including searches made through the API, and resets at 00:00 UTC. A search counts toward the allowance when it runs. A search that fails because of a problem on our side does not count. Unused searches do not carry over to the next day.

You may ask to add Monitored Domains or raise your limits at any time during the Subscription Term. A change takes effect when we apply it to your Workspace. Unless the Order Form says otherwise, any resulting change in fees is settled at renewal.

There is no free plan or trial. The public demo described in Section 11 is the only part of the Service available without a subscription.

Fees are set out in your Order Form. Unless the Order Form says otherwise, they are billed yearly in advance by invoice.

Invoices are payable in the currency shown on the invoice within 30 days of the invoice date, unless the Order Form sets a different period.

Fees do not include taxes. You are responsible for all sales, use, value added, goods and services, withholding and similar taxes, except taxes on our net income. If the law requires you to withhold tax from a payment, you will increase the payment so that we receive the amount we would have received without the withholding.

If an undisputed invoice remains unpaid 15 days after we notify you that it is overdue, we may suspend the Service until it is paid in full.

If you dispute an invoice in good faith, you must tell us in writing before it falls due and pay any undisputed part on time. We will work with you to resolve the dispute promptly.

Except as stated in Section 17.5 or Section 18.2, or where the law requires otherwise, fees are non-cancellable and non-refundable.

You may use the Service and Results only to protect your own organization: to identify, investigate, prevent and remediate the compromise of accounts, systems, devices and data that belong to you, your affiliates, your Authorized Users, or your customers and users (the “Permitted Purpose”). Examples include resetting exposed passwords, revoking sessions, isolating infected devices, asking affected customers to secure their accounts, and preventing fraud.

You may search only for domains, email addresses, usernames, IP addresses and other identifiers that you own or administer, or that you are otherwise legally entitled to investigate for the Permitted Purpose. Each Monitored Domain must be a domain that you own or are authorized to protect.

If you are a managed security provider, incident responder or consultant, you may use the Service on behalf of a client only where your Order Form allows it and the client has authorized you in writing. Your use on the client’s behalf remains subject to these Terms, and you are responsible for it.

You are responsible for making sure that your use of the Service and Results complies with every law that applies to you, including laws on data protection, employment, computer misuse and electronic communications.

You must not, and must not allow or help anyone else to:

1. (a)use any password, session cookie, token or other credential in the Results to sign in to, or try to access, any account, system or service that you do not own or administer, or that you are not otherwise authorized to access;
2. (b)use the Service or Results to identify, locate, track, profile, harass, threaten, extort, embarrass or discriminate against any person;
3. (c)use the Service or Results to decide whether any individual is eligible for employment, credit, insurance, housing or a similar benefit, or as a consumer report under the US Fair Credit Reporting Act or any similar law;
4. (d)sell, resell, license, publish or otherwise disclose Results or Threat Data to anyone, except to notify the person or account owner affected, or to share with your professional advisers, insurers, law enforcement or regulators to the extent the Permitted Purpose requires;
5. (e)use the Service or Results to build, enrich or train a database, product, model or service that competes with the Service or that makes compromised data available to others;
6. (f)scrape, crawl, bulk-download or systematically extract data from the Service, other than through the API and within your limits;
7. (g)circumvent, or try to circumvent, usage limits, rate limits, bot checks, access controls or redaction, including by opening several accounts or Workspaces;
8. (h)share an account or API key with anyone who is not an Authorized User;
9. (i)probe, scan or test the security of the Service, or bypass its authentication or security measures, without our prior written permission;
10. (j)decompile, reverse engineer or disassemble any part of the Service, except to the extent the law allows this despite this restriction;
11. (k)interfere with or disrupt the integrity or performance of the Service, or introduce malware into it; or
12. (l)use the Service in breach of any law or third-party right, or in support of any criminal activity.

Threat Data comes from third parties: operators of information-stealing malware, breached services, criminal markets and channels, and others who have published or traded it. We do not create it, and we cannot verify that every record is genuine, complete, current or correctly attributed.

A search that returns no Results means only that no matching records were found in the Threat Data at the time of the search. It is not a statement that your organization, accounts or systems have not been compromised. New Threat Data is added every day, so a search with no Results today may return Results later.

Results contain personal data and may contain working credentials. You must:

1. (a)protect Results with at least the care you use for your own most sensitive security information, and never less than reasonable care;
2. (b)limit access to Results to people who need it for the Permitted Purpose; and
3. (c)keep copies of Results outside the Service only for as long as the Permitted Purpose requires, then delete them securely.

If your plan shows passwords in full, you decide who in your organization may see them. If your security policy requires it, we can set your Workspace to mask passwords instead.

The actions you take based on Results, such as resetting credentials, disabling accounts or notifying individuals, are your decisions. You are responsible for treating the people affected fairly and in line with the law.

If your plan includes API access, Authorized Users can create API keys in your Workspace. Each key is shown in full once, when it is created. We keep only a cryptographic hash of it and cannot recover a lost key.

API keys are confidential credentials. Keep them out of source code repositories, browser code and shared documents, and revoke any key you believe has been exposed. Searches made with an API key count toward your Workspace’s daily allowance and appear in its activity log.

We may change, version or retire API endpoints. Where a change is likely to break a working integration, we will give you reasonable notice in advance, unless the change is needed sooner to address a security risk or a legal requirement.

Anyone may use the demo at breachdetect.net/demo to check a company domain without an account. The demo shows summary figures and a small sample of matching records with logins partly masked. It does not show passwords.

Demo results are stored by domain and reused for up to 24 hours. Anyone who checks the same domain, or opens a shared link to its report, sees the same summary.

The demo is limited per network and across the site as a whole, and uses an automated check to keep out bots. We may change, limit or withdraw the demo at any time.

Section 8 applies to the demo in the same way as it applies to the rest of the Service.

The demo is free of charge and is provided as is, with no commitment as to its availability or accuracy.

As between you and us, you own Customer Data. You grant us a worldwide, non-exclusive, royalty-free license to host, copy, process and use Customer Data as needed to provide, secure and support the Service, to prevent abuse, and as described in our Privacy Policy.

You are responsible for having all rights and permissions needed to submit Customer Data, including any personal data contained in your search queries.

We may collect and use information about how the Service is used, such as search volumes, result counts, feature use and performance, to operate, secure and improve the Service. We will only share that information outside BreachDetect in aggregated or de-identified form that does not identify you or any individual.

We and our licensors own the Service, our compilation and indexing of the Threat Data, our software, the BreachDetect name and logo, and all related intellectual property rights. Except for the limited rights expressly granted in these Terms, nothing in them transfers any rights to you.

Subject to these Terms and to payment of the fees, we grant you a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to access and use the Service, and to use Results, for the Permitted Purpose only. After the Subscription Term ends, you may keep records of the action you took in response to Results, such as incident tickets that refer to an exposed account, as long as you continue to protect them under Section 9.3.

If you give us suggestions or other feedback about the Service, we may use it without restriction and without any obligation to you.

“Confidential Information” means non-public information that one party (the “discloser”) shares with the other (the “recipient”) in connection with the Service, and that is marked as confidential or that a reasonable person would understand to be confidential. Your Confidential Information includes Customer Data, your Monitored Domains and your search activity. Our Confidential Information includes the non-public parts of the Service, our pricing and the Results.

Confidential Information does not include information that the recipient can show:

1. (a)is or becomes public through no fault of the recipient;
2. (b)the recipient already knew before receiving it, without any duty of confidentiality;
3. (c)the recipient received from a third party who owed no duty of confidentiality; or
4. (d)the recipient developed independently, without using the discloser’s Confidential Information.

The recipient will use the discloser’s Confidential Information only to exercise its rights and perform its obligations under these Terms, will protect it with at least reasonable care, and will disclose it only to its employees, contractors and professional advisers who need to know it and who are bound by confidentiality obligations at least as protective as these.

The recipient may disclose Confidential Information where the law or a court requires it. Where the law permits, the recipient will first give the discloser reasonable notice so that it can seek protection.

We will not name you as a customer, or use your name or logo, without your prior written permission.

We maintain administrative, technical and organizational measures designed to protect the Service and Customer Data against unauthorized access, loss and alteration, appropriate to the nature of the data. These include encryption of data in transit, access to production systems restricted to authorized staff, hashing of API keys, and a record of every search run in each Workspace.

If we become aware of unauthorized access to Customer Data in our systems, we will notify you without undue delay, tell you what we know, and take reasonable steps to contain it and prevent it from happening again.

You are responsible for the security of your own devices, networks and accounts, and for how you store and handle Results once they leave the Service.

We may suspend all or part of the Service for a Workspace, an Authorized User or an API key if:

1. (a)we reasonably believe the Service is being used in breach of Section 7 or Section 8;
2. (b)an account or key appears to be compromised;
3. (c)suspension is needed to prevent harm to the Service, to other customers or to anyone else;
4. (d)payment is overdue as described in Section 6.4; or
5. (e)the law requires us to.

Where practicable, we will tell you before suspending, or promptly afterwards, and explain why. We will limit any suspension to what is necessary and restore access once the cause has been resolved.

These Terms apply from the moment you first accept them until every subscription has ended and you have stopped using the Service.

Each subscription runs for the Subscription Term stated in its Order Form and renews only as that Order Form provides.

Either party may terminate a subscription by written notice if the other party materially breaches these Terms and does not cure the breach within 30 days after receiving notice describing it. We may terminate immediately by notice if you breach Section 8 in a way that cannot be cured, or if Section 3.3 applies to you.

Either party may terminate by notice if the other becomes insolvent, makes an arrangement with its creditors, or becomes subject to bankruptcy, administration, liquidation or similar proceedings that are not dismissed within 60 days.

If you terminate a subscription because of our uncured material breach, we will refund any prepaid fees for the part of the Subscription Term remaining after termination.

When a subscription ends:

1. (a)your access to search and to the API ends;
2. (b)you must stop using Results and delete any copies you hold, except as permitted by Section 13.2 or where the law requires you to keep them;
3. (c)you must pay all fees due for the period before termination; and
4. (d)we will delete or de-identify the Customer Data in your Workspace within 90 days, unless we need to keep it longer to comply with the law, to investigate security incidents or abuse, or for our financial records.

Any provision that by its nature is intended to survive termination will survive it, including Section 6 (for amounts owed), Sections 8, 9.3, 12.3, 13, 14, 17.6, 18, 19, 20 and 22.

Each party represents that it has the authority to enter into these Terms. You represent that your use of the Service will comply with Section 7 and Section 8.

We warrant that, during the Subscription Term, the Service will perform materially as described on our website and in your Order Form. If it does not, tell us, and we will use reasonable efforts to correct the problem. If we cannot correct it within 30 days, you may terminate the affected subscription and receive a refund under Section 17.5. This is your sole remedy for breach of this warranty.

The Service is one source of information for your security program. It does not replace your own security controls, monitoring, incident response or professional advice.

You will defend BreachDetect and its affiliates, officers, employees and agents against any claim, demand, suit or proceeding brought by a third party, including a regulator, that arises from your use of the Service or Results in breach of Section 7, Section 8 or Section 9.3, or from Customer Data. You will pay any damages, fines, penalties and reasonable legal fees finally awarded, and any settlement you agree to, in connection with such a claim.

We will defend you against any third-party claim alleging that the Service, as we provide it and used in accordance with these Terms, infringes that third party’s patent, copyright or trademark or misappropriates its trade secret. We will pay any damages and reasonable legal fees finally awarded, and any settlement we agree to, in connection with such a claim. This does not apply to claims arising from Threat Data, Results or Customer Data, from your combination of the Service with anything we did not provide, or from your breach of these Terms.

If the Service becomes, or in our opinion is likely to become, the subject of a claim described in Section 19.2, we may modify it so that it no longer infringes, obtain the right for you to keep using it, or, if neither is commercially reasonable, end the affected subscription and refund the prepaid fees for the rest of its Subscription Term.

The party seeking defense must notify the other party of the claim promptly, give it sole control of the defense and any settlement, and cooperate with it reasonably at its expense. No settlement may impose any obligation on, or admit fault on behalf of, the defended party without its consent.

This Section 19 states each party’s entire liability, and the other party’s sole remedy, for the third-party claims it covers.

Where you use only the public demo, or an account without a paid subscription, our total liability to you is limited to US$100.

The limits in Sections 20.1 to 20.3 do not apply to your obligation to pay fees, to either party’s obligations under Section 19, to your breach of Section 8, to liability for fraud, gross negligence or willful misconduct, or to any liability that cannot be limited or excluded by law.

These limits apply even if a limited remedy fails of its essential purpose. They reflect a deliberate allocation of risk between the parties, which is reflected in our fees.

We regularly improve the Service and may add, change or remove features. We will not make a change during your Subscription Term that materially reduces the core functionality of your subscription. The contents of the Threat Data change as sources are added and removed, and that is not a reduction in functionality.

We may update these Terms. For material changes, we will give at least 30 days’ notice before they take effect, by email to your Workspace’s administrators or through the Service. A change will not apply to a subscription during its current Subscription Term unless you agree to it, it is required by law, or it concerns a new feature. The date at the top of this page shows when these Terms last changed.

Governing law and courts. These Terms, and any dispute arising out of or in connection with them, are governed by the law named in your Order Form, and the courts named there have exclusive jurisdiction. If no Order Form names a governing law, the laws of the jurisdiction in which BreachDetect is incorporated apply, excluding its conflict-of-law rules, and the courts of that jurisdiction have exclusive jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Either party may seek urgent injunctive relief in any competent court to protect its intellectual property or Confidential Information.

Notices. We will send notices to the email address in your Order Form or to your Workspace’s administrators. You must send notices to us at legal@breachdetect.net. A notice is effective on the next business day after it is sent, unless the sender receives a delivery failure. Notices of breach, termination or a claim under Section 19 must say so clearly in the subject line.

Assignment. Neither party may assign or transfer these Terms without the other’s prior written consent, which will not be unreasonably withheld. Either party may, however, assign them without consent to an affiliate, or to a successor in a merger, acquisition or sale of all or substantially all of the business or assets to which they relate, by giving notice. Any other attempted assignment is void.

Events beyond reasonable control. Neither party is liable for any delay or failure to perform, other than a payment obligation, caused by events beyond its reasonable control, including natural disasters, epidemics, war, terrorism, civil unrest, labor disputes, government action, failures of public networks, utilities or hosting providers, and denial-of-service attacks.

Subcontractors. We may use subcontractors and service providers to provide the Service. We remain responsible for their performance under these Terms.

Relationship. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship. There are no third-party beneficiaries of these Terms.

Export and anti-corruption. Each party will comply with the export control, sanctions and anti-corruption laws that apply to it. Neither party has offered or received any bribe or improper payment in connection with these Terms.

Entire agreement. These Terms, the Privacy Policy and any Order Forms are the entire agreement between the parties on their subject and replace any earlier agreements or understandings on it. Terms in a purchase order or vendor portal of yours do not apply, even if we accept or sign it. Except as stated in Section 21, these Terms may only be changed in writing agreed by both parties.

Severability and waiver. If any provision is found unenforceable, it will be enforced to the maximum extent possible and the rest of these Terms will remain in effect. A failure or delay in enforcing a provision is not a waiver of it.

Language. These Terms are written in English. If they are translated, the English version controls.