Legal Shielding

01 Purpose and status of this page

This page is a binding part of our contractual framework. Every policy below is incorporated by reference into the Terms and Conditions. Where a signed Order or master services agreement addresses the same subject, that document prevails.

These statements are written to be read, not to be skipped. They tell you plainly where our responsibility ends and yours begins, which is the only honest basis on which a security provider can operate.

02 Security services disclaimer

Security is a probabilistic discipline. Our Services reduce risk; they do not eliminate it. In particular, you should understand that:

• Detection is bounded by visibility. We can only detect activity present in the telemetry you make available to us. Unmonitored systems, disabled agents, unshipped logs, encrypted traffic we cannot inspect and shadow IT are invisible to us.
• Novel attacks may evade detection. Zero-day exploits, previously unseen tooling and sophisticated adversaries who deliberately blend into normal activity may not generate an alert.
• False positives and false negatives are inherent. Tuning reduces both but cannot eliminate either. A quiet console is not proof of safety.
• Response depends on you. Where a containment action requires your approval or must be executed inside your environment, the time you take to act is outside our control and outside any service level target.
• Assessments are point-in-time. A penetration test, posture review or maturity assessment describes what we found, under the conditions and scope agreed, on the dates it was performed. It is not a certificate of security and its conclusions decay as your environment changes.
• Remediation is advisory. We identify issues and recommend fixes. Deciding whether, when and how to apply them, and validating the result, remains your responsibility.

Our Services supplement, and do not replace, your own security programme, insurance arrangements, backups and business continuity planning. Retaining Hansec does not transfer your legal or regulatory accountability for the security of your systems and data.

03 Artificial intelligence and automated output

The Nova platform uses machine learning and large language models to prioritise alerts, summarise investigations, correlate signals and propose response actions. This section explains the limits of that automation.

• AI output is a decision aid, not a decision. Risk scores, summaries, correlations and recommendations are generated from statistical inference over your data. They are probabilistic, may be incomplete, and may occasionally be wrong in ways that appear confident.
• Human oversight is built in and required. No material containment or response action is executed by Nova without a human approval step, in accordance with the role-based controls configured for your tenancy. You must not disable or bypass those controls and then rely on the result.
• You remain accountable for actions you approve. Approving a proposed playbook is your decision. Verify the recommendation against your own knowledge of your environment before authorising anything that affects production systems.
• Not a substitute for professional judgement. AI-generated narrative must not be treated as legal, regulatory, forensic or expert opinion, and should not be filed with a regulator or court as such without independent review.
• Models change. We update models, prompts and detection content to improve accuracy. Output for identical input may therefore differ over time, and historical output should not be treated as reproducible.
• Training data. We do not use your Customer Data to train models that serve other customers. Aggregated, de-identified threat intelligence may inform detection content as described in the Terms.

04 No legal, compliance or financial advice

Everything we publish or deliver — website content, threat research, blog posts, assessment reports, compliance mappings, gap analyses and this page itself — is provided for general information and operational security purposes.

It is not legal advice, regulatory advice, audit opinion, certification, actuarial or financial advice, and it does not create an attorney-client or auditor-client relationship. Mapping a control to a framework such as ISO 27001, SOC 2, PCI DSS or a national standard indicates our technical view of alignment; it is not an attestation of compliance and cannot be presented to an auditor or regulator as one.

Consult qualified legal, regulatory and financial professionals in your jurisdiction before acting on anything we provide, particularly where a breach notification obligation, contractual duty or regulatory filing may be engaged.

05 Third-party content and integrations

The Services connect to third-party systems — cloud providers, identity providers, endpoint agents, ticketing tools, threat intelligence feeds — and the Website links to third-party resources.

We do not control those systems. We are not responsible for their availability, accuracy, security, pricing or terms, and a link or integration is not an endorsement. Your use of a third-party product is governed by that provider's agreement with you. If a provider changes or withdraws an API, an integration may degrade or stop working; we will make reasonable efforts to adapt but cannot guarantee continuity.

Open-source components used in the Platform are licensed under their respective licences, which prevail over these Terms in respect of that component. A current inventory is available on request.

06 Availability, beta and pre-release features

We aim for continuous availability of the Platform and 24x7 coverage for managed services. Where an Order includes a service level agreement, the availability commitment and any service credit are set out there; service credits are your sole and exclusive remedy for failing to meet an availability target.

Planned maintenance is notified in advance where practicable and scheduled to minimise disruption. Emergency maintenance to address a security issue may be performed without notice.

Beta, preview and early access

Features labelled beta, preview, early access or experimental — including Nova capabilities offered before general availability — are provided "as is", without any warranty or service level commitment, may change or be withdrawn at any time, and must not be relied on in production or for compliance purposes. Feedback on beta features is governed by the feedback licence in the Terms. Our liability in connection with beta features is limited as set out in the limitation of liability section.

07 Refund policy

This policy applies to purchases made directly from Hansec. Purchases through a reseller or marketplace are governed by that channel's policy.

What is refundable

• Prepaid, unconsumed services. If we terminate for convenience, or you terminate for our uncured material breach, we refund fees prepaid for the period after the effective termination date, calculated pro rata by day.
• Duplicate or erroneous charges. Refunded in full once verified, normally within 10 business days.
• Cancellation within the initial window. For a first subscription purchased online, you may cancel within 30 days of the start date and receive a refund of fees paid, less the value of services actually consumed in that period.
• Professional services not yet delivered. Refunded in full where the engagement has not commenced and no scheduling costs have been incurred.

What is not refundable

• services already performed, including monitoring coverage already provided and assessment work already delivered;
• onboarding, implementation, integration and training fees once that work has begun;
• fees for a term you committed to, where you simply stop using the Services;
• third-party licences, hardware or pass-through costs we procured on your behalf and cannot recover;
• amounts owed where we terminated for your material breach of the acceptable use provisions;
• expired service credits, promotional credits and discounts.

How to request a refund

1. Submit our support form with the topic "Billing and contracts", from the billing contact on the account, stating "Refund request".
2. Include the invoice number, the amount, and the reason.
3. We acknowledge within 3 business days and give a decision within 15 business days.
4. Approved refunds are issued to the original payment method within 15 business days of the decision. Bank processing times are outside our control.

Refunds are made in the currency of the original invoice. We do not compensate for exchange-rate movement or bank fees. Nothing in this policy limits any non-waivable statutory right you may have as a consumer under the law of your country of residence.

08 Cancellation policy

Subscriptions

Subscriptions renew automatically. To prevent renewal, give written notice through our support form at least 30 days before the current term ends. Cancellation takes effect at the end of the paid term — you keep access until then, and no further invoice is raised.

Cancelling mid-term does not entitle you to a refund of the remaining committed term unless the Refund Policy provides otherwise. Where the Order includes a minimum commitment, early termination charges stated in the Order apply.

Professional services and scheduled engagements

These charges cover reserved analyst capacity that cannot be reallocated at short notice. We waive them where cancellation results from an active security incident in your environment that we are engaged to help resolve.

Cancellation by us

We may cancel or decline an engagement where we discover we lack the authorisation described in the Terms, where performing it would breach law or sanctions, or where a conflict of interest arises. In those cases we refund prepaid, unconsumed fees in full.

Data after cancellation

Customer Data is available for export for 30 days after the Services end. After that it is deleted in line with our retention schedule. Request an export before your access ends.

09 Accessibility statement

Hansec is committed to making this website and the Nova platform usable by everyone, including people who rely on assistive technology.

Conformance target

We aim to meet WCAG 2.1 Level AA. This website is partially conformant — most of it meets the standard, and we are working on the exceptions listed below.

Measures we have taken

• semantic HTML with a single H1 per page and a logical heading order;
• full keyboard operability, with a visible focus indicator on every interactive element;
• text contrast meeting or exceeding 4.5:1 in both the light and dark themes;
• text alternatives for meaningful images, and aria-hidden on decorative graphics;
• form fields with programmatically associated labels and errors announced to screen readers;
• respect for the prefers-reduced-motion setting — animations are suppressed when you have asked your system to reduce motion;
• a responsive layout that reflows to 320 pixels without loss of content or horizontal scrolling, and supports 200% text zoom;
• language of the page declared, and switched correctly between English and Spanish.

Known limitations

• Some decorative canvas and particle backgrounds are not exposed to assistive technology. They carry no information, and reduced-motion preferences disable their movement.
• Complex data visualisations inside Nova may lack a full text equivalent. A tabular alternative is available on request while we build one in.
• Third-party embedded content may not meet the same standard. We raise defects with those providers.

Feedback and enforcement

If you encounter a barrier, tell us through our support form, selecting the topic "Accessibility". Describe the page and what happened. We aim to acknowledge within 2 business days and to give a remediation plan within 10 business days. If we cannot fix an issue quickly, we will provide the information or function through an accessible alternative.

This statement was last reviewed on August 8, 2026. It is based on our own evaluation, using automated testing and manual keyboard and screen-reader review.

10 Cookie consent and preferences

We ask for your consent before setting any cookie that is not strictly necessary, and nothing optional is set until you accept. The full inventory of cookies, their purposes and durations is in the Privacy Policy.

You can change your mind at any time using the control below. Withdrawing consent is as easy as giving it, and takes effect immediately.

We also honour the Global Privacy Control browser signal, and we do not use cookie walls — refusing optional cookies does not restrict your access to any part of this site.

11 Intellectual property complaints

We respect intellectual property rights and expect our users to do the same. If you believe content on helpdesk.hansec.co infringes your rights, send a notice through our support form including:

1. identification of the protected work and the material you say infringes it, with a URL;
2. your contact details;
3. a statement that you have a good-faith belief the use is not authorised by the rights holder, its agent or the law;
4. a statement, under penalty of perjury, that the information is accurate and that you are the rights holder or authorised to act for them;
5. your physical or electronic signature.

We investigate every complete notice, remove or disable access to infringing material where appropriate, and will forward the notice to the person who supplied the material so they may respond. Repeat infringers lose access to the Services.

Submitting a knowingly false notice may make you liable for damages.

12 Responsible vulnerability disclosure

We welcome reports of security vulnerabilities in helpdesk.hansec.co and the Nova platform. Report them through our vulnerability report form. If you need an encrypted channel, say so in the form and we will send you one.

Safe harbour

If you make a good-faith effort to comply with this policy, we will treat your research as authorised, will not pursue or support legal action against you in relation to it, and will work with you to resolve the issue quickly. If a third party brings action against you for activity conducted in compliance with this policy, we will make that authorisation known.

Rules

• test only against assets we own — do not test customer tenancies or customer environments;
• do not access, modify, exfiltrate or destroy data that is not yours; stop as soon as you have confirmed a vulnerability exists;
• no denial of service, resource exhaustion, spam, physical attacks or social engineering of our personnel or customers;
• give us a reasonable period to remediate — we ask for 90 days — before any public disclosure, and coordinate the timing with us;
• comply with applicable law.

What to expect

Acknowledgement within 2 business days, a triage assessment within 5 business days, and regular updates until resolution. We are glad to credit you publicly when the issue is fixed, if you would like that. We do not currently operate a paid bounty programme.

13 Export control, sanctions and lawful use

The Services may be subject to export control and economic sanctions laws, including those of Mexico, the United States and the European Union. You represent and warrant that you:

• are not located in, organised under the laws of, or ordinarily resident in a country or territory subject to comprehensive sanctions;
• are not a person or entity on any applicable restricted-party or denied-persons list, and are not majority-owned or controlled by such a person;
• will not export, re-export or make the Services available in breach of applicable export control or sanctions law;
• will not use the Services in connection with the development of weapons of mass destruction, or for unlawful surveillance of individuals.

We may suspend or terminate the Services immediately, without liability, where we determine that continuing would breach these laws.

14 Contact

Use the address that matches your subject so we can route it correctly. All of them reach us; a specific subject line gets a faster answer.

Legal, refunds, cancellation

Support form — Billing and contracts

Privacy and data rights

Support form — Privacy

Security vulnerabilities

Support form — Vulnerability report

Accessibility and support

Support form — Technical support