Terms and Conditions

01 Acceptance of these Terms

If you accept these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" refers to that entity. If you lack that authority, you must not accept these Terms or use the Services.

These Terms take effect on the date you first use the Services and remain in force for as long as you use them. Where you and Hansec have signed a separate master services agreement, order form or statement of work, that document prevails over these Terms to the extent of any conflict, and these Terms fill any gap it leaves.

You must be at least 18 years old and legally capable of entering into a binding contract.

02 Definitions

"Hansec", "we", "us"

The provider of the Services, established in Mexico.

"You", "Customer"

The individual or entity accessing the Website or receiving the Services.

"Website"

helpdesk.hansec.co and its subdomains.

"Platform"

The Nova security operations platform, including its interfaces, APIs, documentation and any update to it.

"Services"

Collectively, the Website, the Platform, and all advisory, managed detection and response, threat intelligence, posture and incident response services we provide.

"Customer Data"

Data, logs, telemetry, configurations and content you or your environment supply to, or generate within, the Services.

"Output"

Alerts, risk scores, summaries, reports, recommendations and other results the Services generate from Customer Data.

"Order"

A signed order form, statement of work, proposal or online sign-up describing the Services, term and fees.

03 Scope of the Services

We provide the Services described in your Order. Unless an Order says otherwise:

• managed detection and response is delivered on a 24x7 basis according to the severity-based response targets in the applicable service level agreement;
• Platform access is provided as a hosted, multi-tenant service with logical isolation between tenants;
• advisory and assessment work produces the deliverables named in the statement of work and nothing beyond them;
• we may modify, improve or replace features of the Platform provided we do not materially reduce the functionality you have paid for during your current term.

Content on the Website — including threat research, architecture descriptions and product roadmaps — is provided for general information. Forward-looking statements about Nova describe our current intentions and are not commitments to deliver any feature by any date.

The Services are business tools sold to organisations. They are not consumer products, and they are not designed for use in circumstances where failure could lead to death, personal injury, or severe environmental damage.

04 Accounts, credentials and access

To use the Platform you must create an account with accurate, current and complete information, and keep it up to date.

You are responsible for all activity under your account. You must:

• keep credentials confidential and never share them between individuals;
• enable and maintain multi-factor authentication on every account we make it available for;
• grant each user the minimum role required for their job and remove access promptly when a user leaves;
• notify us immediately through our support form, or by calling the 24x7 line, on discovering any unauthorised access or suspected compromise of your account.

We may suspend an account immediately, without prior notice, where we reasonably believe it has been compromised, is being used to attack our infrastructure or another tenant, or where continued access presents an imminent security risk. We will tell you why as soon as it is safe to do so.

05 Acceptable use

You must not, and must not permit anyone to:

• use the Services to conduct, facilitate or conceal unlawful activity;
• access, scan, test or attack any system you are not authorised in writing to assess;
• upload malware, or use the Services to develop, host or distribute offensive tooling except within an engagement we have expressly agreed to in writing;
• reverse engineer, decompile or attempt to derive the source code, models, detection logic or underlying structure of the Platform, except to the extent that restriction is prohibited by applicable law;
• resell, sublicense, rent, timeshare or provide the Services to a third party as a service bureau, unless your Order authorises it;
• benchmark or publish performance results about the Platform without our prior written consent;
• circumvent usage limits, tenant isolation, rate limits or authentication controls;
• submit data you have no lawful right to provide, or that infringes a third party's rights;
• interfere with the integrity or performance of the Services or the data of another tenant;
• use the Services to build a competing product, or to train a machine learning model on our Output, detection content or documentation.

Breach of this section is a material breach. We may suspend or terminate the Services for it, and you indemnify us for any resulting claim.

06 Your responsibilities

Security outcomes depend on both parties. You are responsible for:

• Authorisation. Confirming you own or are lawfully authorised to have us monitor, assess or respond within every system, account and network in scope. You will provide written authorisation where we request it.
• Data supply. Deploying and maintaining the agents, connectors and log sources required for detection to work, and telling us when they change. We cannot detect what we cannot see.
• Lawful basis. Ensuring you have a lawful basis to provide Customer Data to us, including any notice to or consent from your own personnel where local law requires it.
• Response decisions. Reviewing and approving containment actions that require your authorisation, and executing remediation within your own environment.
• Contacts. Maintaining a current escalation contact list reachable 24x7, and responding to critical escalations without undue delay.
• Your own controls. Maintaining backups, patching, endpoint hygiene and business continuity arrangements. Our Services supplement your security programme; they do not replace it.

Where a delay or failure on your side prevents us from performing, our obligations are suspended to that extent and any related service level target does not apply.

07 Fees, invoicing and taxes

Fees, currency, billing frequency and term are set out in your Order. Unless stated otherwise there:

• subscription fees are invoiced in advance and are based on the entitlement you committed to, not on actual usage;
• invoices are payable within 30 days of the invoice date;
• overdue amounts accrue interest at the lesser of 1.5% per month or the maximum permitted by law, and we may suspend the Services after 15 days' written notice of non-payment;
• fees are exclusive of VAT, IVA, withholding and any other tax, which you pay in addition. If law requires you to withhold, you will gross up so we receive the full invoiced amount;
• we may increase fees at renewal on at least 60 days' notice before the current term ends;
• exceeding your committed entitlement — data volume, endpoints, assets or users — is billed at the overage rate in the Order.

Refunds and cancellation are governed by our Refund Policy and Cancellation Policy, which form part of these Terms.

08 Term, suspension and termination

Each subscription runs for the initial term in the Order and renews automatically for successive periods of the same length unless either party gives written notice at least 30 days before the current term ends.

Either party may terminate for cause with 30 days' written notice if the other commits a material breach and fails to cure it within that period. Either party may terminate immediately if the other becomes insolvent, enters liquidation or ceases to trade.

We may suspend the Services immediately for the reasons set out in Accounts and Acceptable use, or where required by law.

On termination

• your right to access the Services ends immediately;
• you must pay all amounts accrued up to the effective date of termination;
• we make Customer Data available for export for 30 days, after which we delete it in accordance with our retention schedule, unless a legal hold or statutory obligation requires longer;
• sections on intellectual property, confidentiality, disclaimers, liability, indemnity and governing law survive.

09 Intellectual property

Ours

Hansec and its licensors own all right, title and interest in the Website, the Nova Platform, its source code, models, detection content, playbooks, methodologies, documentation, trade marks, logos and any derivative of them. Nothing in these Terms transfers ownership. We grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Services during your term, solely for your internal business purposes and subject to these Terms.

Yours

You retain all right, title and interest in Customer Data. You grant us a non-exclusive, worldwide licence to host, process, transmit, display and analyse Customer Data strictly as necessary to provide, secure and support the Services, and to comply with law.

Output and derived intelligence

You own the Output generated from your Customer Data and may use it freely within your organisation. We may create and retain aggregated, de-identified statistics and threat intelligence derived from operating the Services — for example indicators of compromise, attack patterns and detection efficacy metrics — and use them to improve the Services and protect all customers. Such material will never identify you, your personnel or your environment, and cannot be reverse engineered to do so.

Feedback

If you send us suggestions or feedback about the Services, you grant us a perpetual, irrevocable, royalty-free licence to use it without obligation or attribution. You will not be entitled to compensation, and we are free to develop similar ideas independently.

10 Confidentiality

Each party may receive information the other marks confidential or that a reasonable person would understand to be confidential — including Customer Data, security findings, detection logic, pricing and unreleased product plans.

The receiving party will use confidential information only to perform under these Terms, protect it with at least the care it applies to its own confidential information and no less than reasonable care, and disclose it only to personnel and advisers who need it and are bound by equivalent obligations.

These obligations do not apply to information that is or becomes public without breach, was already lawfully known, is independently developed, or is lawfully received from a third party. Where disclosure is legally compelled, the receiving party will give prompt notice — unless prohibited — and disclose only what is required.

Confidentiality survives termination for five years, and indefinitely for trade secrets and personal data.

11 Data protection

Our processing of personal data is described in the Privacy Policy, which is incorporated into these Terms by reference.

Where we process personal data on your behalf, we act as processor and you as controller. On request we will enter into a data processing addendum containing the terms required by Article 28 GDPR and the equivalent obligations of the Mexican LFPDPPP, including our commitments on sub-processors, security, breach notification, assistance with data subject requests and deletion or return of data on termination.

You warrant that you have a lawful basis for the personal data you make available to us, that you have given any notice and obtained any consent required from your personnel, and that our processing under these Terms will not put you in breach of applicable data protection law.

12 Warranties and disclaimers

We warrant that we will provide the Services with reasonable skill and care, using appropriately qualified personnel, and in a manner consistent with recognised industry practice for security operations.

We specifically do not warrant that:

• the Services will detect, prevent or remediate every threat, vulnerability or attack;
• the Services will be uninterrupted, timely, error free or free of harmful components;
• Output will be complete, accurate or free of false positives or false negatives;
• use of the Services will make you compliant with any law, standard or certification.

Additional disclaimers, including those covering AI-generated Output, beta features and third-party integrations, are set out in Legal Shielding and form part of these Terms.

13 Limitation of liability

Nothing in these Terms limits or excludes liability that cannot lawfully be limited or excluded — including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for gross negligence or wilful misconduct.

Excluded losses

Subject to the paragraph above, neither party is liable to the other for any indirect, incidental, special, consequential or punitive loss, or for loss of profit, revenue, goodwill, anticipated savings, business opportunity or data, however arising and whether or not the possibility of such loss was known.

Liability cap

Subject to the first paragraph of this section, each party's total aggregate liability arising out of or in connection with these Terms — whether in contract, tort including negligence, statute or otherwise — is limited to the total fees paid or payable by you to Hansec in the twelve months immediately preceding the event giving rise to the claim.

Where no fees have been paid — for example, use of the Website alone, a free trial or a beta programme — our total aggregate liability is limited to USD 100.

Allocation of risk

You acknowledge that the fees reflect this allocation of risk, that the limitations are a fundamental basis of the bargain between us, and that we would not provide the Services on these commercial terms without them. These limitations apply even if a limited remedy fails of its essential purpose.

Any claim must be brought within one year of the date the claiming party knew or ought reasonably to have known of the facts giving rise to it, except where a longer period is mandatory under applicable law.

14 Indemnities

By us. We will defend you against any third-party claim alleging that the Platform, used in accordance with these Terms, infringes that third party's intellectual property rights, and will pay damages finally awarded or agreed in settlement. If the Platform becomes, or we believe it may become, the subject of such a claim, we may at our option procure the right to continue using it, modify it so it is no longer infringing, or terminate the affected Services and refund prepaid, unused fees. This indemnity does not apply where the claim arises from Customer Data, from your modification of the Platform, or from use combined with anything we did not supply.

By you. You will defend and indemnify us against any third-party claim arising from Customer Data, from your breach of Acceptable use, from your failure to hold the authorisations described in Your responsibilities, or from your violation of applicable law.

The indemnified party must give prompt written notice of the claim, allow the indemnifying party to control the defence, and provide reasonable cooperation. No settlement that imposes a non-monetary obligation on the indemnified party may be made without its consent.

15 Force majeure

Neither party is liable for failure or delay in performance caused by events beyond its reasonable control, including natural disaster, epidemic, war, terrorism, civil unrest, government action, labour dispute, nationwide internet or power failure, or a large-scale cyber attack on infrastructure it does not control. The affected party will notify the other promptly and use reasonable efforts to resume performance. Payment obligations are not excused. If the event continues for more than 60 days, either party may terminate the affected Services without liability.

16 Changes to these Terms

We may update these Terms to reflect changes in the Services, our business or the law. The last-updated date appears at the top of this page.

For material changes affecting an active subscription we will give at least 30 days' notice by email to your registered contact or by prominent notice in the Platform. If you object to a material change, you may terminate the affected Services before it takes effect and receive a pro-rata refund of prepaid, unused fees. Continued use after the effective date constitutes acceptance.

Non-material changes — corrections, clarifications, updated contact details — take effect on publication.

17 Governing law and dispute resolution

These Terms and any dispute arising out of them, including non-contractual disputes, are governed by the laws of the United Mexican States, without regard to conflict-of-law rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Escalation first

Before commencing proceedings, the parties will attempt to resolve the dispute in good faith. The complaining party sends written notice describing the dispute to our registered address, with a copy submitted through our support form; senior representatives of both parties will then confer within 30 days. Either party may seek urgent injunctive relief at any time to protect confidential information or intellectual property.

Jurisdiction

If the dispute is not resolved within 60 days of that notice, the parties submit to the exclusive jurisdiction of the competent courts of Mexico City, Mexico, expressly waiving any other jurisdiction that may correspond to them by reason of present or future domicile.

Nothing in this section deprives a consumer of the protection of mandatory provisions of the law of their country of habitual residence.

Disputes are resolved individually. To the extent permitted by law, you and Hansec each waive any right to bring or participate in a class, collective or representative action.

18 General provisions

Entire agreement

These Terms, the Privacy Policy, the Legal Shielding page and your Order form the entire agreement between us and supersede all prior discussions. Neither party relies on any statement not set out in them.

Order of precedence

A signed Order or master services agreement, then these Terms, then any policy incorporated by reference.

Severability

If any provision is held unenforceable, it is modified to the minimum extent necessary to be enforceable, or severed, and the remainder continues in force.

No waiver

Failure to enforce a provision is not a waiver of the right to enforce it later.

Assignment

You may not assign these Terms without our written consent. We may assign to an affiliate or to a successor in a merger, acquisition or sale of substantially all assets.

Independent contractors

The parties are independent contractors. Nothing creates a partnership, joint venture, agency or employment relationship.

No third-party rights

Except as stated in the indemnity section, no person who is not a party has any right to enforce these Terms.

Notices

Formal legal notices to us must be delivered to our registered address; a copy may also be submitted through our support form. Notices to you go to the contact details in your Order or account.

Publicity

Neither party may use the other's name or marks in publicity without prior written consent, except that we may list you in a factual customer list where you have agreed in the Order.

Language

These Terms are published in English and Spanish. In the event of any inconsistency, the Spanish version prevails for matters governed by Mexican law.

19 Contact

Questions about these Terms: