Terms of Service

1. Agreement to these terms

These Terms of Service (the "Terms") govern your access to and use of the SurfaceLoop platform, websites, and related services (together, the "Service") operated by SurfaceLoop ("SurfaceLoop", "we", "us"). By creating an account, or by accessing or using the Service, you agree to be bound by these Terms. If you are entering into these Terms on behalf of an organisation, you represent that you have authority to bind that organisation, and "you" refers to that organisation.

2. The Service

SurfaceLoop is a multi-tenant External Attack Surface Management (EASM) platform. It continuously discovers, scans, and monitors internet-facing assets that you own or are authorised to assess, and reports exposures across our risk categories. Scanning is active: the Service performs network connections, service fingerprinting, TLS inspection, and vulnerability checks against the targets in your verified asset inventory. Because scanning is active, your use of the Service is subject at all times to our Acceptable Use Policy.

3. Accounts and eligibility

You must provide accurate account information and keep it current. You are responsible for safeguarding your credentials and for all activity that occurs under your account. Authentication is provided through our identity provider; you must notify us promptly of any unauthorised access. You must be at least 18 years old and legally able to enter into a contract to use the Service.

4. Asset ownership and authorisation

You may only add and scan assets that you own or are explicitly authorised to assess. Before scanning begins, SurfaceLoop requires you to confirm, for each asset, that you own it or are authorised by its owner to have it scanned. That confirmation — recorded against your user account and reviewed by SurfaceLoop staff — is the authorisation on which SurfaceLoop scans. You may additionally prove control of a domain via a DNS TXT record or an HTTPS file challenge; this is optional evidence and does not replace your confirmation. You warrant that every target you submit is within your authorised scope. Scanning infrastructure you do not own or control may be a criminal offence — see the Acceptable Use Policy for detail.

5. Subscriptions, fees and billing

• • Paid plans are billed in advance on a recurring basis (monthly or annually) according to the plan you select. Fees are stated exclusive of VAT and other applicable taxes, which you are responsible for paying.
• • Subscriptions renew automatically for successive periods unless cancelled before the end of the current period. You may cancel at any time; cancellation takes effect at the end of the current billing period.
• • Except where required by law, fees already paid are non-refundable. We may change our fees on renewal by giving you reasonable prior notice.
• • If payment fails, we may suspend or downgrade your access until the outstanding amount is settled.

6. Acceptable use

Your use of the Service must comply with our Acceptable Use Policy, which is incorporated into these Terms by reference. A breach of the Acceptable Use Policy is a breach of these Terms and may result in immediate suspension or termination.

7. Data protection and privacy

Our handling of personal data is described in our Privacy Policy. Scan result data and personal data are stored in the United Kingdom (AWS eu-west-2, London). You are responsible for ensuring you have a lawful basis to have SurfaceLoop process the assets and data you submit.

8. Intellectual property

SurfaceLoop and its licensors retain all right, title, and interest in the Service, including its software, detection content, and branding. We grant you a limited, non-exclusive, non-transferable right to access and use the Service during your subscription. You retain ownership of your asset inventory and scan results; you grant us the rights necessary to operate the Service and provide results to you.

9. Service availability

We aim to keep the Service available but do not guarantee uninterrupted or error-free operation. We may perform maintenance, update detection content, or modify features from time to time. Scan timing depends on external hosts, DNS propagation, and network conditions outside our control.

10. Disclaimers

The Service is provided "as is" and "as available". To the fullest extent permitted by law, we disclaim all warranties, whether express or implied, including fitness for a particular purpose and non-infringement. SurfaceLoop reports exposures based on automated detection and does not guarantee that it will identify every vulnerability or that your assets are secure. The Service is a security tool, not a substitute for your own security programme and professional judgement.

11. Limitation of liability

Nothing in these Terms limits liability that cannot be limited by law (including for death or personal injury caused by negligence, or for fraud). Subject to that, we are not liable for indirect, incidental, special, or consequential loss, or for loss of profits, revenue, data, or goodwill. Our total aggregate liability arising out of or relating to the Service will not exceed the fees you paid to us in the twelve months preceding the event giving rise to the claim.

12. Indemnity

You agree to indemnify and hold SurfaceLoop harmless against claims, losses, and expenses arising from your breach of these Terms or the Acceptable Use Policy, including any scanning of assets you were not authorised to assess.

13. Suspension and termination

You may stop using the Service and close your account at any time. We may suspend or terminate your access immediately if you breach these Terms or the Acceptable Use Policy, if required by law, or to protect the Service or third parties. On termination, your right to use the Service ends. You may request erasure of your data as described in the Privacy Policy.

14. Changes to these terms

We may update these Terms from time to time. If we make material changes, we will provide reasonable notice (for example by email or in-product notice) before they take effect. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Terms.

15. Governing law and jurisdiction

These Terms and any dispute arising out of or in connection with them are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, except that we may seek injunctive relief in any court of competent jurisdiction to protect our rights.

16. Contact

Questions about these Terms can be sent to [email protected] (placeholder contact).