Security Services Addendum
DRAFT — NOT YET IN FORCE. This addendum plus a signed Data Processing Agreement is what enterprise buyers will ask for during procurement. Counsel review required. Items marked
[VERIFY]need a business decision.
This addendum applies in addition to our Terms of Service (plain text) when you use any of our security products, including PasswordRoast, BetterPhish, DarkThreat, ThreatDefense, LLMSecurity, BetterSpam, MailBlocks, and VeriBits.
Where this addendum conflicts with the Terms of Service, this addendum wins for those products.
1. Why this exists
Our security products differ from ordinary software in two ways that matter legally.
They can cause harm if misused. Tools that find weaknesses can be used to exploit them.
The people whose data you upload did not agree to anything with us. When you submit your organisation's credentials, email samples, or scan targets, the individuals involved are your employees or your users. They have a relationship with you, not with us. That makes you the controller and us your processor, and it changes our obligations to you and yours to them.
2. Authorisation — your responsibility
You represent and warrant that, for every system you test, scan, or submit data about, you either own it or hold documented authorisation from its owner.
You must keep evidence of that authorisation for as long as you use the service and for 12 months afterwards, and produce it to us within 5 business days of a reasonable request.
We may suspend access immediately, without notice, where we reasonably believe a product is being used against a system without authorisation. We may report apparent unlawful use to the relevant authority.
3. Controller and processor
For Customer Security Data — the data you submit about your own systems and people — you are the controller and we are the processor.
We will:
- process it only on your documented instructions
- not use it for our own purposes, including product improvement or model training, unless it has been irreversibly aggregated so no individual or customer can be identified
- ensure staff with access are bound by confidentiality
- apply the technical and organisational measures in section 6
- engage subprocessors only as listed in Subprocessors (plain text), and give notice before adding one
- assist you with data subject requests, impact assessments, and regulator consultations, taking into account the nature of the processing
- delete or return the data at the end of the service, at your choice
- make available the information needed to demonstrate compliance and allow audits under section 8
For Account Data — your name, email, billing details, and how you use the service — we are the controller and our Privacy Policy (plain text) applies.
A signed Data Processing Agreement is required before you submit Customer
Security Data. Request one at privacy@afterdarksys.com.
[VERIFY: DPA template still to be drafted.]
4. Breach and credential data
Some products check whether credentials appear in known breach corpora.
- Where possible we use k-anonymity, so a full credential never leaves your
environment and we never receive one.
[VERIFY: confirm which products actually implement k-anonymity range queries and which transmit full values. This claim must be exactly true per product or removed.] - We do not retain submitted credentials after a check completes.
[VERIFY: confirm against the running services.] - We do not use breach data to contact affected individuals.
5. Findings and reports
Findings we generate about your systems belong to you. We may retain them for the retention period in section 7 so you can access your history.
We may publish aggregate statistics and threat research only where it cannot identify you, your organisation, your systems, or any individual.
6. Security measures
[VERIFY: this section must describe measures actually in place. Every line here is a contractual commitment enforceable by your customers.]
- Encryption in transit using current TLS
- Encryption at rest for Customer Security Data
- Single sign-on through Authentik with multi-factor and passkey support
- Role-based access control, access limited to what a role requires
- Segregation of customer data
- Logging of administrative access
- Regular patching of infrastructure
Our practices are informed by ISO/IEC 27001 and the NIST Cybersecurity Framework. We are not certified against either, and we do not claim to be.
7. Retention
| Data | Retention |
|---|---|
| Submitted samples and scan inputs | deleted on completion, or [VERIFY: 30 days?] if retained for re-analysis |
| Findings and reports | life of the account, then 90 days |
| Credentials submitted for breach checking | not retained |
| Audit logs of your use | 12 months |
You may request earlier deletion at any time.
8. Audit
Once per year, or after a personal data breach affecting your data, you may audit our compliance with this addendum. We will first offer our current security documentation and any third-party assessment. If that is not enough for your regulator, we will accommodate a reasonable on-site or remote audit at your cost, on 30 days' notice, under confidentiality.
9. Breach notification
We will tell you without undue delay, and in any event within
[VERIFY: 48 or 72 hours?] of becoming aware, of any personal data breach
affecting Customer Security Data, with the nature of the breach, categories and
approximate numbers affected, likely consequences, and the measures we are
taking.
10. Prohibited uses
In addition to the acceptable use rules in the Terms of Service, you may not use these products to:
- test systems you do not own without documented authorisation
- develop or distribute malware outside a controlled environment
- gather credentials for unauthorised access
- support stalking, harassment, or surveillance of individuals
- evade lawful process
11. Contact
- Security: security@afterdarksys.com
- Vulnerability disclosure: security.txt
- Data protection: privacy@afterdarksys.com