Terms of Service

These Terms of Service (the “Terms”) form a binding agreement between 9DSEMBER SOFTWARE PRIVATE LIMITED, a private limited company incorporated in India that operates the SecurityRing service (“SecurityRing,” “we,” “us,” or “our”), and the customer that accesses or uses the Service (“Customer,” “you,” or “your”). An applicable Order Form may include additional contracting details but does not change the identity of SecurityRing unless it expressly names another contracting entity.

By accepting an Order Form, creating or using an administrative account, or otherwise using the Service on behalf of an organization, you agree to these Terms and represent that you have authority to bind that organization. If you lack that authority or do not agree, do not use the Service. The Service is offered for organizational use and not as a consumer service.

Individuals who receive a Customer-authorized simulation or training experience are not required to create a SecurityRing account. Our handling of their personal data is described in the Privacy Policy; the Customer’s own workforce or privacy notices may also apply.

• Authorized Users must be at least 18 years old and legally able to enter contracts for Customer.
• Customer must provide accurate account and workspace information, keep it current, and promptly remove access for anyone who is no longer authorized.
• Customer is responsible for activity under its accounts and for protecting authentication sessions, devices, API credentials, sender credentials, and integration secrets. Credentials may not be shared between users.
• Customer must promptly notify SecurityRing at neha@securityring.ai of suspected unauthorized access or misuse.
• SecurityRing may rely on Customer’s identity provider and workspace-domain controls. Customer is responsible for enforcing appropriate multi-factor authentication and access policies in that identity provider.

Subject to the agreement, SecurityRing grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the applicable subscription or evaluation period to access and use the Service for Customer’s internal security-awareness, training, testing, risk-management, and compliance purposes.

The Service may allow Customer to:

• import and manage authorized workforce records and organizational attributes;
• create, approve, schedule, pace, and deliver controlled security simulations;
• use email, landing pages, quizzes, training videos, attachments, QR codes, OAuth-consent or device-code scenarios, and other supported educational interactions;
• generate or edit campaign content and recommendations with AI-assisted tools;
• request or configure sender, landing, tracking, mailbox, and domain resources;
• measure delivery and Recipient interactions and produce reports or remediation recommendations; and
• send operational notifications, test messages, approvals, reminders, and periodic reports.

Specific functionality, limits, support, regions, providers, and service levels may vary by Order Form, configuration, deployment stage, and third-party availability. SecurityRing may improve the Service and may replace functionality with materially equivalent functionality. Material reductions to purchased core functionality will not take effect during a paid subscription without reasonable notice, except where required for security, law, or third-party-provider changes.

Customer determines the purpose, scope, audience, timing, lawful basis, and employment context of each simulation. Customer is solely responsible for obtaining and maintaining the organizational approvals and legal authority necessary for its use of the Service.

Before using the Service, and throughout use, Customer must:

1. ensure that it has a lawful basis and all rights needed to provide Customer Content and Recipient data to SecurityRing and to instruct the processing described in the agreement;
2. provide all notices and obtain all consents or authorizations required by privacy, employment, labor, electronic-communications, monitoring, anti-spam, intellectual-property, and other applicable laws;
3. consult workers, representatives, works councils, unions, data protection officers, or regulators where required, and complete any required legitimate-interest assessment or data protection impact assessment;
4. limit campaigns to Recipients with whom Customer has an appropriate relationship and to systems, domains, brands, and infrastructure that Customer owns or is authorized to test;
5. configure targeting, sender identities, domains, allowlisting, pacing, approvals, training, and reporting in a proportionate manner that minimizes harm and unnecessary collection;
6. conduct human review of campaign content, AI Output, risk indicators, and reports before launch or use;
7. maintain a process for Recipient questions, complaints, accommodations, and privacy requests; and
8. ensure that simulation results are used for security education and proportionate risk management, not as the sole basis for termination, discipline, compensation, promotion, hiring, or another decision producing legal or similarly significant effects.

Customer remains responsible for Authorized Users, Customer Content, Recipient selection, and instructions provided to SecurityRing, including actions performed through integrations or administrator-approved workflows.

Customer and Authorized Users must not use or enable use of the Service to:

• conduct real phishing, fraud, extortion, identity theft, credential theft, or unauthorized impersonation;
• collect, retain, transmit, or solicit actual passwords, authentication codes, private keys, financial account details, government identifiers, health data, or other unnecessary sensitive information;
• deliver malware, executable payloads, destructive files, unauthorized tracking technology, or code intended to compromise, disrupt, or gain access to a device, account, network, or service;
• send unsolicited commercial messages, purchased-list campaigns, cold outreach, or messages to the public or to people outside Customer’s authorized scope;
• evade suppression lists, provider restrictions, rate limits, security controls, sender-verification controls, abuse detection, or campaign approval gates;
• harass, discriminate against, shame, threaten, or target a person based on a protected characteristic or vulnerability, or create unreasonable risk of physical, psychological, financial, or reputational harm;
• misrepresent a simulation as an instruction from law enforcement, emergency services, a regulator, or a financial institution in a way that is unlawful or likely to harm a third party;
• infringe intellectual-property, privacy, publicity, confidentiality, contractual, or other rights, including by using a person’s voice, face, likeness, or identity without sufficient authorization;
• reverse engineer, probe, scan, copy, resell, sublicense, benchmark for competitive publication, or interfere with the Service except to the extent a restriction is prohibited by law; or
• use the Service in violation of sanctions, export controls, court orders, or applicable law.

Customer may conduct good-faith security testing of its own configured experience only with SecurityRing’s written authorization and within an agreed test scope. Reports of suspected misuse may be sent to abuse@securityring.ai.

Subscription scope, usage limits, fees, currency, taxes, invoicing, and payment terms are stated in the Order Form. Except as expressly stated, fees are non-cancellable and non-refundable. Customer must pay undisputed invoices when due and notify SecurityRing of a good-faith dispute before the due date. Overdue undisputed amounts may accrue the lesser of 1.5% per month or the maximum lawful rate, plus reasonable collection costs.

Fees exclude taxes. Customer is responsible for applicable sales, use, goods and services, value-added, withholding, and similar taxes, excluding taxes based on SecurityRing’s net income. If Customer must withhold, it will provide valid documentation and cooperate to reduce withholding lawfully.

Trials, previews, betas, or evaluations are provided for the period and limits stated by SecurityRing and may be modified or ended at any time. Unless an Order Form states otherwise, they are provided without service levels, warranties, indemnities, or support commitments.

SecurityRing may immediately suspend or limit access, a campaign, sender, domain, integration, or other resource when reasonably necessary to:

• stop suspected fraud, phishing, abuse, unlawful monitoring, or other prohibited activity;
• protect Recipients, third parties, the Service, sending reputation, or provider infrastructure;
• respond to a complaint, legal demand, provider directive, security incident, or credible rights claim;
• prevent material harm, unauthorized access, or excessive load; or
• address undisputed fees more than 15 days overdue after notice.

Where practicable, SecurityRing will give notice and an opportunity to cure and will limit the suspension to the affected activity. SecurityRing may preserve relevant records where reasonably necessary for investigation, legal compliance, or dispute resolution.

These Terms begin when Customer first accepts them or uses the Service and continue while any Order Form or authorized use remains active. Subscription renewal and notice periods are stated in the Order Form.

Either party may terminate an Order Form for an uncured material breach if the breaching party does not cure within 30 days after written notice, or within 10 days for non-payment. Either party may terminate immediately if the other becomes insolvent, ceases business without a successor, or enters a proceeding not dismissed within 60 days. SecurityRing may terminate immediately for material or repeated Acceptable Use violations where cure is impossible or continued access presents material risk.

On termination, Customer’s access ends and Customer must stop using Service materials except exported reports lawfully retained. At Customer’s written request made before termination or within 30 days after it, SecurityRing will provide a reasonable export of available Customer data where technically feasible. SecurityRing will delete or return Customer personal data as required by the DPA, subject to legal retention, security records, and backups that remain protected and are deleted through normal cycles.

Accrued payment obligations and provisions that by their nature should survive—including confidentiality, intellectual property, disclaimers, indemnities, liability limits, disputes, and general terms—survive termination.

Each party warrants that it has authority to enter the agreement. SecurityRing warrants that paid Service will materially conform to applicable Documentation under normal authorized use and that it will provide the Service with reasonable skill and care. Customer’s exclusive remedy for breach of this warranty is correction or re-performance; if SecurityRing cannot materially cure within a reasonable period, Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid unused fees for the terminated portion.

EXCEPT FOR THE EXPRESS WARRANTIES ABOVE AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE, AI OUTPUT, TEMPLATES, RECOMMENDATIONS, REPORTS, TRIALS, AND THIRD-PARTY SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.” SECURITYRING DISCLAIMS ALL IMPLIED OR STATUTORY WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE.

SECURITYRING DOES NOT WARRANT UNINTERRUPTED OR ERROR-FREE OPERATION, INBOX PLACEMENT, DETECTION OF EVERY HUMAN OR AUTOMATED INTERACTION, PREVENTION OF SECURITY INCIDENTS, OR ANY PARTICULAR COMPLIANCE, EMPLOYEE-BEHAVIOR, OR RISK OUTCOME. THE SERVICE SUPPORTS—BUT DOES NOT REPLACE—CUSTOMER’S LEGAL, EMPLOYMENT, SECURITY, AND HUMAN REVIEW.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THEIR POSSIBILITY.

EXCEPT FOR THE EXCLUSIONS BELOW, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER FOR THE SERVICE GIVING RISE TO THE CLAIM DURING THE 12 MONTHS BEFORE THE FIRST EVENT GIVING RISE TO LIABILITY. FOR FREE OR EVALUATION SERVICE, SECURITYRING’S TOTAL AGGREGATE LIABILITY WILL NOT EXCEED USD 100.

The exclusions and cap do not limit Customer’s payment obligations; either party’s fraud, willful misconduct, or liability that cannot lawfully be limited; Customer’s breach of Acceptable Use; or a party’s indemnity obligations. Liability for breach of confidentiality or data-protection obligations is capped at two times the general cap, except where a signed DPA or Order Form states a different cap.

These allocations apply regardless of the theory of liability and even if a remedy fails its essential purpose. Some jurisdictions do not allow certain limitations, so they apply only to the extent lawful.

The governing law and forum stated in the applicable Order Form control. If the Order Form is silent, the agreement is governed by the laws of India, without regard to conflict-of-laws rules, and the courts located in Gurugram, Haryana, India have exclusive jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Before filing a claim, each party will give written notice describing the dispute and allow senior representatives at least 30 days to attempt good-faith resolution. Either party may seek urgent injunctive or equitable relief to protect security, Confidential Information, intellectual property, or prevent unlawful use. Mandatory statutory rights and forums that cannot be waived remain unaffected.

• Assignment. Neither party may assign the agreement without the other’s consent, except to an affiliate or in connection with a merger, reorganization, or sale of substantially all relevant assets, provided the assignee assumes the obligations and is not a direct competitor of the non-assigning party. Unauthorized assignments are void.
• Subcontractors. SecurityRing may use subprocessors and subcontractors but remains responsible for their performance to the extent required by the agreement.
• Force majeure. Neither party is liable for delay caused by events beyond reasonable control, excluding payment obligations. The affected party will use reasonable efforts to mitigate and resume performance.
• Independent parties. The parties are independent contractors. The agreement creates no partnership, agency, fiduciary, employment, or franchise relationship.
• No third-party beneficiaries. The agreement benefits only the parties and permitted successors, except indemnified parties solely for applicable indemnity rights.
• Severability and waiver. An unenforceable provision will be modified to the minimum extent necessary and the remainder stays effective. Waiver must be in writing and is not a continuing waiver.
• Entire agreement. The agreement is the complete agreement about the Service and supersedes prior or contemporaneous discussions on that subject. Headings are for convenience; “including” means “including without limitation.” Electronic acceptance and signatures are valid.