Terms of Service

1.1 These Terms of Service ("Terms") are a binding agreement between Skeptiva and the legal entity identified as the customer in an Order Form or reseller purchase record ("Customer"). Together with the DPA and any Order Form they form the "Agreement".

1.2 No signature is required. The Terms are accepted on the earliest of: the Customer ticking an acceptance control; downloading or deploying the Software; accessing the dashboard; or executing an Order Form. Where a subscription is purchased through an authorised reseller, these Terms govern the Customer's use regardless of any separate terms agreed with that reseller.

1.3 The individual accepting represents that they are authorised to bind the Customer. Where acceptance occurs by deployment or use alone, the Customer is bound by the acts of any person using licence credentials issued to it.

1.4 Any deletion or revision made by the Customer to the text of these Terms is rejected and of no effect. Variations are agreed only in an Order Form that expressly identifies the provision varied. No purchase order, vendor portal terms or pre-printed customer terms have any effect, whether or not Skeptiva signs or acknowledges them.

1.5 The Software and dashboard are offered only to businesses, public bodies and other legal entities acting for purposes relating to their trade or profession, and not to consumers. The Customer confirms it is not acting as a consumer.

1.6 On conflict the order is: the DPA in respect of personal data; the Order Form; these Terms.

2.1 "Software" means the Skeptiva endpoint email security client for Microsoft Outlook on Windows, including its local analysis engine and any updates supplied by Skeptiva. "Services" means the Software together with the Skeptiva dashboard and licensing infrastructure.

2.2 "Seat" means an entitlement for one named individual to use the Software on devices controlled by the Customer. "User" means a person authorised by the Customer to use the Services.

2.3 "Order Form" means an order form, quotation or similar ordering document referencing these Terms, executed by hand, by electronic signature, or by email confirmation from an authorised representative of the Customer.

2.4 Terms defined in the DPA or at skeptiva.com/data have the same meaning here.

3.1 Subject to payment of applicable fees and compliance with the Agreement, Skeptiva grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence, for the subscription term, to install and run the Software on devices it owns or controls for its own internal security purposes, up to the number of Seats purchased, and to use the dashboard to administer licences, configure the Services and view analytics for its own organisation.

3.2 Each Seat entitles one named individual to use the Software. A Seat may be reassigned when a User leaves or changes role, but may not be shared or used concurrently. The Customer shall not exceed its purchased Seat count. Where the dashboard shows usage above the purchased count, Skeptiva may invoice the excess at the per-Seat rate in the Order Form, prorated to the remainder of the term.

3.3 The Customer shall not sell, resell, distribute, sublicense, rent, lease, assign or otherwise transfer the Software, the Services, any licence key or any Seat. This applies to the Customer's affiliates unless the Order Form provides otherwise.

3.4 Section 3.3 does not apply to an entity registered by Skeptiva as an authorised reseller under a written Skeptiva Reseller Agreement, and then only as that agreement permits. No reseller may vary these Terms or the DPA, or give any warranty, indemnity or service level on Skeptiva's behalf.

4.1 The Customer shall not, and shall not permit others to:

• (a) reverse engineer, decompile or disassemble the Software, or attempt to derive its source code, model weights, detection logic or training data, except where mandatory law permits and then only after requesting the necessary interoperability information from Skeptiva in writing and Skeptiva failing to supply it within thirty days;
• (b) modify, adapt or create derivative works of the Services;
• (c) remove or obscure any proprietary notice;
• (d) use the Services to develop, train, benchmark or market a competing product;
• (e) circumvent licensing, Seat metering or security controls;
• (f) share credentials, or permit access by anyone other than a User;
• (g) conduct penetration testing, vulnerability scanning or load testing against Skeptiva's hosted infrastructure without prior written consent, save that the Customer may test the Software within its own environment at any time; or
• (h) use the Report function to transmit content it has no lawful right to transmit.

5.1 Skeptiva and its licensors retain all right, title and interest in the Services, including all detection models, model weights, rule sets, threat intelligence and documentation, and in all improvements and derivative works, whether or not developed in connection with the Customer. The Services are licensed, not sold. All rights not expressly granted in Section 3.1 are reserved, and no licence arises by implication, estoppel or exhaustion.

5.2 As between the parties the Customer retains all right, title and interest in its own data, including email processed locally by the Software. Skeptiva's rights in data it receives are limited to those in the DPA.

5.3 If the Customer or a User provides suggestions, defect reports or other feedback, the Customer assigns to Skeptiva all rights in it, or where assignment is not permitted grants Skeptiva a perpetual, irrevocable, worldwide, royalty-free, sublicensable licence to use it for any purpose without obligation or attribution. Feedback is not Customer confidential information.

5.4 Neither party may use the other's name, logo or trade marks without prior written consent, save that Skeptiva may identify the Customer as a customer on its website and in its customer list unless the Customer objects in writing.

6.1 The Customer is responsible for its own IT environment, including operating systems, Outlook licensing, endpoint management and connectivity, and for meeting the system requirements notified by Skeptiva.

6.2 The Customer is responsible for the acts and omissions of its administrators, for the confidentiality of dashboard credentials, and for notifying Skeptiva promptly of any suspected unauthorised access.

6.3 The Customer is responsible for ensuring its deployment is lawful in each jurisdiction where it operates, including any employee information, consultation or co-determination obligations that apply, such as negotiation under the Swedish Co-Determination Act (lag (1976:580) om medbestämmande i arbetslivet).

6.4 Before deployment the Customer shall inform its Users that the Software analyses their email locally, that using the Report function transmits the reported message in full to Skeptiva, and that the data described at skeptiva.com/data is transmitted. The Customer's remaining obligations in respect of personal data are set out in the DPA.

7.1 The DPA governs all processing of personal data under the Agreement and prevails over these Terms on that subject matter. What is transmitted, in what role and for how long is set out at skeptiva.com/data; the security measures at skeptiva.com/security; the suppliers at skeptiva.com/subprocessors.

7.2 The Customer instructs Skeptiva to process reported messages for threat analysis and for the improvement of Skeptiva's detection capabilities, on the terms of the DPA.

8.1 Subscriptions are purchased by Order Form, by invoice arrangement, or through an authorised reseller. Each Order Form states the Seat count, term, fees and any agreed variations.

8.2 Fees are as stated in the Order Form and are exclusive of VAT and other taxes. Where the Customer is VAT-registered in another EU member state the reverse charge applies and the Customer shall supply a valid VAT number.

8.3 Unless the Order Form states otherwise, invoices are payable within twenty days of the invoice date. Fees are non-refundable except where these Terms or mandatory law provide otherwise.

8.4 Overdue amounts bear interest under the Swedish Interest Act (räntelagen (1975:635)). After fifteen days' written notice of non-payment Skeptiva may suspend the Services and deactivate licences until payment is received. Suspension does not relieve the Customer of payment obligations.

8.5 Subscriptions renew automatically for successive periods equal to the initial term unless either party gives written notice at least thirty days before the end of the current term. Skeptiva may adjust fees on renewal by giving at least sixty days' notice before the end of the current term; the Customer may then prevent renewal by notice before the term ends.

8.6 Where the Customer purchases through a reseller, payment is owed to that reseller. Skeptiva may suspend or terminate access if the reseller fails to pay Skeptiva, after giving the Customer at least fifteen days' notice and a reasonable opportunity to contract directly.

9.1 Skeptiva may make the Services available for trial, pilot or evaluation for a period it specifies. Trials are for evaluation only and not for production reliance. On expiry licences deactivate automatically unless a paid subscription is in place, and Skeptiva may delete trial data after thirty days.

9.2 During a trial the Services are provided without warranty and without service commitment, and Skeptiva's total aggregate liability arising from a trial shall not exceed one thousand (1,000) EUR, except for matters excluded from the caps under Section 12.4.

10.1 Skeptiva provides support on a commercially reasonable efforts basis during Swedish business hours, in English and Swedish, unless an Order Form provides otherwise.

10.2 Updates to the Software, including detection model and rule set updates, are included in the subscription. The Customer shall apply updates within a reasonable period, and Skeptiva is not responsible for degraded detection resulting from a failure to do so.

10.3 Skeptiva may modify the Services, including replacing the underlying detection models, provided no modification materially reduces the security, functionality or data protection posture of the Services during a paid term. Where a modification would materially reduce core functionality Skeptiva shall give thirty days' notice, and the Customer may terminate the affected subscription and receive a pro rata refund of prepaid fees for the unexpired term.

10.4 Where an Order Form incorporates a service level agreement, that document governs availability and remedies; otherwise the dashboard is provided on a commercially reasonable efforts basis. Unavailability of the dashboard does not interrupt local analysis by the Software.

11.1 Skeptiva warrants that the Software performs its analysis locally on the Customer's devices, that it transmits email content to Skeptiva only as described at skeptiva.com/data, and that it provides no facility by which Skeptiva personnel may access email held on Customer devices. This warranty survives and is not excluded by Section 11.2. Its breach is a material breach entitling the Customer to terminate under Section 14.2 and to a pro rata refund of prepaid fees.

11.2 Save for Section 11.1, and to the maximum extent permitted by law, the Services are provided "as is" and "as available", and Skeptiva disclaims all other warranties, express, implied or statutory, including merchantability, fitness for a particular purpose, non-infringement, accuracy and uninterrupted or error-free operation.

11.3 The Software is a decision-support tool. Skeptiva does not warrant that it will detect all phishing, malware or social engineering, or that it will not produce false positives or false negatives. The Customer remains solely responsible for its own information security, its security policies and training, and for verifying flagged and unflagged email. The Software is not a substitute for a complete security programme and is not designed for environments requiring fail-safe performance.

12.1 To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profit, revenue, anticipated savings, business, goodwill or reputation.

12.2 Each party's total aggregate liability arising out of or relating to the Agreement, whether in contract, tort or otherwise, shall not exceed the total fees paid or payable by the Customer for the twelve months preceding the first event giving rise to the claim. This is a single aggregate cap covering all claims under these Terms and the DPA taken together; multiple claims do not enlarge it.

12.3 For indemnity obligations under Section 13 and for breach of the DPA, the cap in Section 12.2 is replaced by the greater of 150% of those fees or twenty-five thousand (25,000) EUR. This enhanced cap is inclusive of, not additional to, the cap in Section 12.2 and applies as a single aggregate maximum.

12.4 Sections 12.1 to 12.3 do not limit liability for gross negligence (grov vårdslöshet) or wilful misconduct (uppsåt); death or personal injury caused by negligence; the Customer's payment obligations; the Customer's breach of Sections 3.3, 3.4 or 4; or any liability that cannot be limited under mandatory law, including fines under Article 83 GDPR and compensation owed directly to data subjects under Article 82 GDPR.

13.1 Skeptiva shall defend the Customer against any third-party claim that use of the Services in accordance with the Agreement infringes that party's patent, copyright or trade mark rights in the EU/EEA, Switzerland or the United Kingdom, and shall indemnify it against damages and costs finally awarded or agreed in settlement, subject to Section 12.3. Skeptiva may instead procure the right to continue use, modify the Services so they are non-infringing, or terminate the affected subscription and refund prepaid fees for the unexpired term. This indemnity does not cover claims arising from modification by the Customer, from combination with products not supplied by Skeptiva where the claim would not otherwise have arisen, or from use in breach of the Agreement.

13.2 The Customer shall indemnify Skeptiva against third-party claims arising from its breach of Section 3, 4 or 6.3, from content transmitted through the Report function that it had no lawful right to transmit, or from its failure to meet its obligations under Section 6.4.

13.3 The indemnified party shall give prompt written notice and grant the indemnifying party sole control of the defence and settlement, provided no settlement imposes non-indemnified liability or an admission of fault without consent, and shall cooperate reasonably at the indemnifying party's expense.

14.1 The Agreement begins on acceptance under Section 1.2 and continues until all subscriptions have expired or been terminated.

14.2 Either party may terminate the Agreement or an affected subscription on written notice if the other commits a material breach and, where capable of remedy, fails to remedy it within thirty days of notice, or if the other becomes insolvent, enters liquidation or ceases to carry on business.

14.3 Skeptiva may suspend the Services and deactivate licences immediately where the Customer breaches Section 3.3, 3.4 or 4, or where continued access presents a demonstrable security or legal risk. Skeptiva shall state the reason and restore access promptly once resolved.

14.4 On termination all licences end and the Customer shall cease use and uninstall the Software; the Customer shall pay all fees accrued to the effective date; the Customer may export its dashboard data for thirty days; and the deletion and return obligations in the DPA apply.

14.5 Where the Customer terminates for Skeptiva's material breach, or under Sections 10.3 or 11.1, Skeptiva shall refund prepaid fees for the unexpired term. Otherwise prepaid fees are non-refundable.

14.6 Sections 5, 8 in respect of accrued amounts, 11.2, 11.3, 12, 13, 14.4 to 14.6, 15 and 17 survive termination.

15.1 Each party shall protect the other's non-public information disclosed under the Agreement with at least the care it applies to its own, shall disclose it only to personnel and advisers who need to know and are bound by equivalent obligations, and shall use it only for purposes of the Agreement. These obligations survive for five years after termination, and indefinitely for trade secrets and personal data.

15.2 They do not apply to information that is or becomes public without breach, was lawfully known before disclosure, is independently developed, or is lawfully received from a third party. Either party may disclose where required by law or a competent authority, giving prior notice where legally permitted.

16.1 Each party shall comply with applicable export control, sanctions and dual-use legislation, including EU Regulation 2021/821, EU and Swedish sanctions measures, and where applicable United States export control and sanctions law. The Customer represents that it is not, and is not owned or controlled by, a sanctioned or restricted party. Skeptiva may suspend or terminate immediately where required to comply, without liability.

16.2 Skeptiva shall maintain, with a reputable insurer, general and product liability insurance, professional indemnity insurance covering pure financial loss arising from the provision of software and IT services, and cyber liability insurance covering data breach response and third-party claims. Skeptiva shall provide evidence of cover on reasonable request, no more than once in any twelve-month period.

17.1 The Agreement is governed by the substantive laws of Sweden, excluding its conflict of laws rules and the UN Convention on Contracts for the International Sale of Goods. Disputes shall be settled by the District Court of Stockholm (Stockholms tingsrätt) as court of first instance, unless an Order Form provides otherwise.

17.2 Where the Customer, or an affiliate permitted to use the Services under an Order Form, is established in the United States: each party waives any right to trial by jury; to the extent permitted by law all disputes shall be resolved solely on an individual basis and each party waives any right to participate in a class, collective or representative action; and the US state privacy laws annex to the DPA applies. Section 17.1 continues to govern law and venue unless an Order Form provides otherwise.

17.3 Skeptiva may amend these Terms. For amendments that materially and adversely affect the Customer, Skeptiva shall give at least thirty days' notice before they take effect, and the Customer may reject them by written notice before the effective date, in which case the version in force immediately beforehand continues until the end of the current subscription term. Other amendments take effect on publication. Amendments do not apply retrospectively.

17.4 Neither party may assign the Agreement without the other's prior written consent, save that either may assign it in its entirety on notice to a successor in a merger, acquisition or sale of substantially all assets. The Customer may not assign to a competitor of Skeptiva without consent. Skeptiva may assign its right to receive payment. Any purported assignment in breach is void.

17.5 Neither party is liable for failure or delay caused by events beyond its reasonable control, including natural disaster, armed conflict, failure of public telecommunications or power networks, or acts of government. This does not excuse payment. If the event continues beyond sixty days either party may terminate the affected subscription on notice.

17.6 Notices to Skeptiva go to info@skeptiva.com and to Skeptiva AB, Backgatan 3, 724 60 Västerås, Sweden. Notices to the Customer go to the address in the Order Form or the administrator email registered in the dashboard. Notices are deemed received the next business day if sent by email, or three business days after posting.

17.7 The Agreement confers no rights on any person other than the parties, save that Section 13.1 may be enforced by the Customer's affiliates identified in an Order Form.

17.8 If any provision is unenforceable it shall be modified to the minimum extent necessary to make it enforceable, and the remainder continues in force. Failure or delay in exercising a right does not waive it, and a waiver is effective only in writing.

17.9 The Agreement is the entire agreement between the parties on its subject matter and supersedes all prior proposals and representations. Neither party has relied on any statement not set out in it, save that nothing excludes liability for fraudulent misrepresentation.

17.10 The Agreement is made in English. Any translation is for convenience only and the English version prevails.