Terms of service
The agreement between you and us for using InfoSec247. We have tried to write it in plain English rather than hide the important parts in clause 27.
1. These terms
These terms form a binding agreement between Max Impact Services Limited T/A InfoSec247 (company number 09707999), which we call “we”, “us” or “InfoSec247”, and the organisation subscribing to the service, which we call “you” or the “Customer”.
By creating an account, starting a trial or using the service you accept these terms. If you are agreeing on behalf of an organisation, you confirm you have authority to bind it. If you do not accept them, do not use the service.
These terms, together with our privacy notice and any order form or data processing agreement we sign with you, are the whole agreement between us. Where a signed order form conflicts with these terms, the order form wins.
2. Definitions
Service
The InfoSec247 application, its external API and any documentation we provide.
Customer Data
Everything you or your users put into the Service: incident records, timeline entries, uploaded evidence, assets, clients, actions and root cause analyses.
User
An individual you authorise to access the Service under your subscription.
Subscription
Your chosen plan, its seat limit and any add-ons, for the billing period.
Add-on
An optional paid capability, currently AI Root Cause Analysis and Evidence AI.
3. Accounts and users
You must give accurate registration details and keep them current.
Each User needs their own named account. Accounts must not be shared — the audit trail is only meaningful if an action can be attributed to a person, which is rather the point of the product.
You are responsible for your Users’ activity, for keeping credentials confidential, and for telling us promptly at info@infosec247.co.uk if you suspect unauthorised access.
Your plan sets the number of active Users. You may reassign a seat when someone leaves; you may not rotate seats to evade the limit.
Your administrators control who has access and at what role. We act on their instructions.
4. Free trial
New organisations get a 14-day free trial. No card is required to start one.
The trial gives access to the standard product. Paid add-ons require an active paid subscription.
When the trial ends, access is restricted until you choose a plan. Your data is not deleted at that moment — it waits for you, subject to the retention periods in our privacy notice.
We may extend a trial at our discretion; just ask.
Trials are provided “as is”, without the availability commitments in section 10.
5. Plans, fees and add-ons
Current prices are on our pricing page. Fees are quoted in pounds sterling and exclude VAT, which is added where applicable.
Subscriptions are billed monthly in advance and renew automatically until cancelled.
Payments are processed by Stripe. By subscribing you authorise recurring charges to your payment method. We do not receive or store your card details.
Add-ons. You may enable or disable AI add-ons yourself at any time. Enabling one adds its charge to your subscription; disabling one stops the charge from the next billing period. Part-periods are not prorated.
AI credits. AI features consume credits included with your plan. Credits are allocated monthly and do not carry over. When they run out, AI features stop until the next period or you buy a top-up. The rest of the Service is unaffected.
Cancellation. Cancel at any time from your billing page. You keep access to the end of the paid period. We do not give refunds for part-periods unless the law requires it or we have materially failed to deliver.
Non-payment. If a payment fails we will retry and tell you. If it remains unpaid we may restrict access after 30 days. We will not delete Customer Data without notice first.
Price changes. We may change prices with at least 30 days notice by email before your next renewal. If you do not accept the new price, cancel before it takes effect.
6. Your data and ownership
You own your Customer Data. We claim no ownership of it. Nothing in these terms transfers any rights in it to us.
You grant us a limited licence to host, store, transmit, back up and display Customer Data strictly to provide the Service to you, and to support you when you ask.
We do not use Customer Data to train AI models, and we do not mine, sell or share it. See our privacy notice.
You are responsible for the lawfulness of what you put in: that you may record it, that any required notices have been given, and that special category data is handled appropriately. In data protection terms you are the controller and we are your processor.
Getting your data out. While your subscription is active you can export incidents as CSV, generate PDF reports and read everything through the API. On request within 30 days of termination we will provide a copy in a machine-readable format.
We keep backups for resilience. Deleted data persists in backups until they age out on the cycle described in the privacy notice.
7. Acceptable use
You agree not to:
Break the law, or infringe anyone’s rights, using the Service.
Upload malware, or content designed to damage or gain unauthorised access to any system.
Attempt to access another organisation’s data, or probe, scan or test our security without written permission. Genuine vulnerability reports to info@infosec247.co.uk are welcome and are not a breach of this clause.
Reverse engineer, decompile or copy the Service, except where the law says you may.
Resell, sublicense or provide the Service to third parties without our written agreement.
Place unreasonable load on the platform, or circumvent rate limits and seat limits.
Use the Service to build a competing product.
Remove or obscure our notices, or the classification markings on generated reports.
If use of your account threatens the platform or other customers, we may act immediately under section 16.
8. AI features
AI features are assistive. They draft, summarise and transcribe. They do not decide anything.
Output must be reviewed before you rely on it. Generative models can be confidently wrong, omit important detail or misread evidence. A root cause analysis it drafts is a first draft, which is why the product requires a named person to review and approve one.
We do not warrant that AI output is accurate, complete or fit for any regulatory, audit or legal purpose. You remain responsible for what you submit to auditors, regulators or courts.
Because models are probabilistic, the same input may produce different output on different occasions.
We may change the underlying model to improve quality, cost or availability. The capability stays; the specific model is not part of what you are buying.
Usage is metered per section 5. Attempting to evade metering is a breach of section 7.
9. External API
API access uses credentials you create in the Service. Treat a token like a password: it is shown once and we store only a hash, so we cannot recover it.
You are responsible for everything done with your credentials. Scope them to read-only and to an IP allowlist where you can.
We may apply rate limits to protect the platform.
The OpenAPI definition is the contract for the current version. We will avoid breaking changes to
/api/v1; where one is unavoidable we will give reasonable notice and, where practical, version the endpoint.
10. Availability and support
We aim for high availability but do not offer a contractual uptime guarantee on standard plans. We would rather say that plainly than imply a commitment we have not agreed. Contact us if you need a formal SLA.
We may carry out planned maintenance, and will give advance notice of anything expected to interrupt service, outside business hours where we can.
Emergency maintenance may occasionally be needed without notice, for instance to close a security hole.
Support is by email: info@infosec247.co.uk. We aim to respond within one working day. Priority support is included on the 10 User and Unlimited plans.
We are not responsible for failures caused by your network, your equipment or third-party services outside our control.
11. Security and data protection
We maintain appropriate technical and organisational measures, described in our privacy notice.
Where we process personal data on your behalf we act only on your instructions, as your processor. We will enter a data processing agreement on request.
We use the sub-processors listed on the sub-processors page. We will give notice of additions so you can object, as described there.
If we become aware of a personal data breach affecting your data, we will notify you without undue delay with the detail you need to meet your own obligations.
You are responsible for security within your own account: who you invite, what roles you give them, and removing access when people leave.
12. Intellectual property
We own the Service, its software, design and documentation, and all intellectual property in them. You get a non-exclusive, non-transferable right to use it during your subscription, for your own internal business purposes.
Our name, logo and branding may not be used without written permission, except to state factually that you use the Service.
Reports you generate are yours, and carry your branding and classification, not ours.
If you send us feedback or suggestions, we may use them to improve the Service without obligation or payment. We will not identify you as the source without asking.
13. Confidentiality
Each of us may learn confidential information about the other. Both of us agree to keep it confidential, use it only for the purposes of this agreement, and protect it with at least reasonable care. This does not apply to information that is public through no fault of the recipient, was already known, or must be disclosed by law — in which case the recipient will give notice where permitted. Your Customer Data is your confidential information.
14. Warranties and disclaimers
We warrant that we will provide the Service with reasonable skill and care, and that it will materially perform as described in our documentation.
We do not warrant that the Service will be uninterrupted or error free, or that it will meet every requirement you have in mind.
InfoSec247 does not certify you against any standard. It helps you produce and keep the evidence a standard such as ISO 27001 expects. Whether you achieve or keep certification depends on your own management system, your practices and your auditor’s judgement. We make no representation about any audit outcome.
The Service is not a substitute for professional legal, regulatory or security advice, and does not determine whether you must notify a regulator about an incident.
Except as stated here, and so far as the law allows, all other warranties and conditions, express or implied, are excluded.
15. Liability
This section above all needs a solicitor. The cap below is a common shape, not advice. Check it against your insurance and the value of your contracts, and confirm it is enforceable in your jurisdiction.
Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.
Subject to that, neither of us is liable for indirect or consequential loss, loss of profit, revenue, goodwill or anticipated savings, business interruption, or regulatory fines imposed on the other.
Subject to clause 15.1, our total liability arising out of this agreement in any twelve-month period is limited to the greater of the fees you paid us in the twelve months before the claim and £1,000.
We are not liable for loss of Customer Data to the extent it results from your own acts or omissions, including deleting records or losing credentials. You are responsible for keeping your own copies of anything critical, which the export and report features let you do.
We are not liable for decisions you take based on AI output, per section 8.
Each of us will take reasonable steps to mitigate our losses.
16. Suspension and termination
You may terminate at any time by cancelling from your billing page. Access continues to the end of the paid period.
We may terminate for convenience by giving you 30 days written notice, and will refund any fees covering the period after termination.
Either of us may terminate immediately if the other commits a material breach and has not put it right within 30 days of being asked in writing, or becomes insolvent.
We may suspend access immediately, with notice as soon as practical, where there is a serious security risk, unlawful activity, a breach of section 7, or non-payment after the grace period. We will restore access once the cause is resolved.
On termination your right to use the Service ends. You may request an export within 30 days. After that we delete Customer Data per our retention schedule, except where law requires us to keep it.
Sections on data ownership, intellectual property, confidentiality, liability and general provisions survive termination.
17. Changes to the service and to these terms
We develop the product continuously and may add, change or remove features. We will not make a change that materially reduces core functionality you rely on without 30 days notice.
We may update these terms. For material changes we will email account administrators at least 7 days before they take effect. Continuing to use the Service after that date means you accept them; if you do not, you may terminate without penalty.
The version and date at the top of this page always show the current text.
18. General
Assignment. You may not assign this agreement without our written consent. We may assign it to a group company or to a buyer of the business, on notice to you.
Force majeure. Neither of us is liable for failure caused by events beyond reasonable control, though this does not excuse payment.
No waiver. Not enforcing a right straight away does not waive it.
Severability. If a clause is unenforceable, the rest stands.
Third parties. No one other than you and us has rights under this agreement.
Notices. We will write to your account administrator’s email address. Write to us at info@infosec247.co.uk.
Governing law. This agreement is governed by the laws of United Kingdom, and the courts of United Kingdom have exclusive jurisdiction.
19. Contact
General
Support
Security
Privacy
Related: Privacy notice · Sub-processors · Contact us