Terms of service

These terms govern the use of Secrook, the software, the licence and the services that come with it. By entering a licence key, starting a trial, signing in to a hosted workspace or paying an invoice, the customer agrees to them. If you accept them for a company, you confirm that you may do so on its behalf.

Definitions

• Service: the Secrook software, any hosted workspace we run for the customer, updates, documentation and support.
• Customer: the company or person that holds the licence.
• Licence key: the code that activates the Service for a plan and a period.
• Plan: Normal, Pro or Max, with the limits and features shown on the pricing page on the date of purchase.
• Term: the period between the start date and the end date of the licence.
• Users: people the Customer allows to sign in.

The service

Secrook monitors public vulnerability sources and matches new findings to the products and versions that the Customer lists. It then assigns the findings to teams, tracks them and sends emails and reports.

The Service is a monitoring aid. It does not scan networks or devices, and it does not fix anything. It depends on data published by third parties and on the accuracy of the product list that the Customer enters.

Licence

We grant the Customer a limited, non-exclusive, non-transferable licence to use the Service during the Term, for its own internal business, within the limits of the Plan.

The Customer may not:

• copy, sell, rent, lease or sublicense the Service, or offer it to third parties as a service;
• share a licence key outside the Customer's organisation, or use one key beyond the number of installations the licence allows;
• remove, bypass or tamper with the licence check, the licence signature, the limits of the Plan or any notice in the Service;
• reverse engineer or decompile the Service, except where the law allows it despite this clause.

Plans, limits and trials

Each Plan has limits on monitored products, users and teams, and a set of features. The Customer may upgrade at any time. A downgrade takes effect at the next renewal, and the Customer must first reduce its use to the limits of the lower Plan.

A trial lasts 7 days, includes the features of the Plan that was requested and needs no payment details. Each company may have one trial. At the end of the trial the licence stops at once, with no grace period, unless the Customer buys a Plan. Data entered during the trial is kept for the Customer's use if it buys a Plan.

Optional AI mode, where offered, has a monthly usage limit that depends on the Plan. When the limit is reached it pauses until the next month. The rule-based Assistant is not affected.

Fees and payment

Prices are in US dollars or New Israeli Shekels as stated on the pricing page or in our offer, and exclude VAT, which is added at the rate set by law. Max is priced per company in a written offer.

We issue a tax invoice. Payment is by bank transfer or a payment link, within the payment terms on the invoice. A yearly Plan is invoiced once for the whole year and a monthly Plan once a month.

If an invoice is not paid on time we may suspend the licence after written notice. We may change prices for a new Term. A change never applies to a Term that has already been paid for.

Term, renewal and what happens when a licence ends

A licence starts on the date stated in the invoice or in the trial email and ends on the end date shown in the Service. A licence does not renew by itself. For terms longer than one month we send a reminder by email about 30 days before the end date.

After the end date the Service continues as follows:

• 7 days of grace, with a warning and full use;
• then 30 days of read-only use: the Customer can view and export its data but cannot add or change anything, and alert emails stop;
• then the Service is blocked until a new licence key is entered.

The Customer's data stays in the Customer's own database. Entering a new key restores full use with the data as it was.

Cancellation and refunds

The Customer may stop using the Service at any time by not renewing. Fees for a Term that has started are not refunded, except where the law requires it or where we agree in writing.

If we end the Service without cause during a paid Term, we refund the unused part of that Term.

Customer responsibilities

• The Customer decides where to install the Service and is responsible for the security, updates and backups of that environment, including the server, the database and the mail relay.
• The Customer is responsible for the accuracy of the product list, the versions and the team assignments, and for acting on the findings.
• The Customer is responsible for its Users, for keeping accounts and passwords secure and for turning on two-step sign-in where it is offered.
• The Customer must keep its contact email current so that notices reach it.

Acceptable use

The Customer will not use the Service to break the law, to attack or probe systems it does not own, to send unsolicited email, or to overload or disrupt our servers. We may suspend access that puts the Service or other customers at risk.

Third-party data and AI mode

The Service uses data published by third parties, such as public vulnerability databases, exploitation scores and vendor advisories. We do not control that data. It can be late, incomplete or wrong, and its publishers may change or stop it. The Service uses data from the NVD API but is not endorsed or certified by the NVD.

Product and vendor names are trademarks of their owners and are used only to identify the software the Customer monitors.

AI mode, where offered, sends the question and the facts needed to answer it to an AI provider through our server. AI answers can be wrong and must be checked before the Customer acts on them. See the privacy policy for details.

Support

Support is by email. The reply commitment for each Plan is shown on the pricing page. Support covers the use and installation of the Service. It does not cover the Customer's own servers, network or third-party software.

We may release updates and fixes. Using the current version is part of getting support.

Intellectual property

The Service, its code, design, texts and documentation, and the names and logos of Secrook, belong to us or to our licensors. The licence does not transfer any ownership. The Customer keeps all rights in its own data, and gives us only the permission needed to provide the Service.

If the Customer sends us feedback or ideas, we may use them freely without payment or credit.

Confidentiality

Each side will keep the other's non-public business and technical information confidential, use it only for this agreement and protect it with reasonable care. This does not apply to information that is public, that the receiving side already knew or learned lawfully from others, or that the law requires it to disclose.

Disclaimer

The Service is provided as is and as available. We work to keep it accurate and available, but we do not promise that it will find every vulnerability, that every match will be correct, that it will be uninterrupted or error free, or that it will meet every requirement of the Customer. The Service does not replace the Customer's own security processes, and a finding that is missing from the Service does not mean that a vulnerability does not exist.

Limits on liability

To the extent the law allows, we are not liable for indirect, special or consequential damage, loss of profit, loss of data, loss of business or a security incident, even if we were told it could happen.

Our total liability for all claims about the Service is limited to the fees the Customer paid for the Term in which the event happened, or for the 12 months before it, whichever is lower. Nothing here limits liability that cannot be limited by law.

Suspension and termination

Either side may end the agreement with written notice if the other side materially breaches it and does not fix the breach within 14 days of notice. We may suspend or end a licence at once if it is used in breach of the Licence or Acceptable use clauses, or if a licence key is shared or sold.

Clauses that by their nature should continue, such as payment, intellectual property, confidentiality, disclaimer, liability and governing law, continue after the agreement ends.

Changes to these terms

We may update these terms. We will publish the new version with its date and, for a material change, notify the Customer by email. A change applies from the next Term, or earlier if the law or security requires it.

Service levels and availability

The hosted Service is provided on a reasonable-efforts basis. Unless a signed order states a service level in writing, we do not promise a specific uptime, response time or fix time. We may carry out planned maintenance, and we will try to give notice when it is likely to interrupt the Service.

The Service depends on public sources, such as the NVD, and on infrastructure providers. An outage, delay or change at those sources or providers is outside our control.

Accuracy of vulnerability information

The Service matches published vulnerability records to the product names and versions the Customer enters. Matching can produce false positives (a finding that does not apply) and false negatives (a missing finding), for example when a vendor names a product differently from the Customer or publishes a record late. The Service is a tool to support the Customer's security work. It does not replace patching, scanning, monitoring, vendor advisories or professional judgement, and the Customer stays responsible for every decision it takes.

"CVE" is a registered trademark of The MITRE Corporation. Secrook is not affiliated with, endorsed by or sponsored by MITRE, NIST, any vendor or any other third party whose names or data appear in the Service.

Customer data, backups and deletion

The Customer keeps all rights in the data it puts into the Service, such as its product list, teams, users, notes and settings. We use that data only to provide, secure and support the Service, and as these terms and the privacy policy describe.

The Customer can export its data from the Service while its licence is active and during any read-only period, and should export what it needs on a regular basis. Backup arrangements for the hosted Service are described in the order or on request, and the Customer should not treat a backup as the only copy of its data.

After the licence ends and the read-only period is over, we delete or anonymise the Customer's hosted workspace within a reasonable time, normally within 90 days, except for copies in routine backups that expire in the ordinary course, and information we must keep by law, for example invoices.

Data protection roles

For the personal data that the Customer puts into the hosted Service, for example the names and email addresses of its users, the Customer is the controller and we act as its processor. We process that data only on the Customer's documented instructions, which are these terms, the order and the use of the Service. Our staff who can reach the data are bound by confidentiality.

We use sub-processors, such as hosting and email delivery providers, under written terms that give a level of protection suited to the data. A current list is available on request. We apply technical and organisational security measures suited to the risk, we help the Customer to answer requests from the people whose data it is, and we tell the Customer without undue delay after we become aware of a security incident that affects its data.

The Customer is responsible for having a lawful basis and giving the notices that the law requires towards its own users. If the Customer needs a separate data processing agreement, it can ask us for one.

Security of accounts

The Customer is responsible for keeping its usernames, passwords, authenticator devices, recovery codes and licence keys safe, for choosing who gets access, and for removing access when people leave. We recommend turning on authenticator-app sign-in for every user. We are not responsible for access that happens because the Customer's credentials were shared, stolen or guessed, unless we caused it.

Installed (on-premises) edition

Where the Service is installed on the Customer's own server, the Customer is responsible for the server, the operating system, the network, the database, backups, updates of those components and the security of the environment. The installed copy contacts our licence service from time to time to check the status of the licence. That exchange carries the licence identifier and technical details such as the version, and does not carry the Customer's vulnerability data, product lists, users or emails.

The Customer will install updates that we mark as security fixes within a reasonable time. We may ask for reasonable evidence that the Service is used within the number of installations that the licence allows.

Beta and planned features

Features described as beta, coming or planned may change, be delayed or be removed, and are not a promise. A plan includes only the features that are available when the Customer orders it, unless the order says otherwise.

Feedback and third-party components

If the Customer gives us ideas or suggestions about the Service, we may use them without payment or duty to the Customer. We will not publish the Customer's name or logo, or describe it as a customer, without its written permission.

The Service contains third-party and open-source components that are licensed under their own terms. Those terms apply to those components and do not widen or narrow the Customer's rights to the rest of the Service.

Reporting a security issue

If you find a security problem in the Service, please report it to support@secrook.com with enough detail to reproduce it. Please give us a reasonable time to fix it before you share it publicly, do not access data that is not yours and do not disrupt the Service. We will not take legal action against good-faith research that follows these rules.

Indemnity

The Customer will compensate us for third-party claims, and the reasonable costs of handling them, that arise from the Customer's unlawful use of the Service, its breach of the acceptable use clause, or data it put into the Service without the right to do so. We will tell the Customer about the claim promptly and let it help to defend it.

Laws, force majeure and general

The Customer will not use the Service in breach of export control or sanctions laws that apply to it, and confirms that it is not a person or entity that is prohibited from receiving the Service under those laws.

Neither side is liable for a delay or failure caused by events outside its reasonable control, such as war, terror, natural disaster, power or network outage, a failure of a public cloud or internet provider, or an order of an authority. This does not excuse a payment that is already due.

We may transfer our rights and duties under these terms to a company that takes over our business. The Customer may transfer them only with our written consent. We may send notices to the contact email that the Customer gave us, and the Customer may send notices to support@secrook.com.

These terms exist in English and Hebrew. If the two versions differ, the English version decides how the terms are read, unless the order says otherwise.

Governing law and disputes

These terms are governed by the laws of the State of Israel. The competent courts in Israel have exclusive jurisdiction. Before starting proceedings the sides will try in good faith to settle the matter by talking.

If part of these terms is found invalid, the rest stays in force. A side that does not enforce a right has not given it up. These terms, with the order or offer and the invoice, are the whole agreement.

Contact

Questions about these terms: support@secrook.com. Sales and pricing: sales@secrook.com.