Terms of service

Agreement to these terms

These Terms of Service (the "Terms") govern access to and use of the veync.com website and the Veync platform, software, API and related services (together, the "Services"), provided by VEYNC, a Delaware corporation ("VEYNC", "we", "us").

By accessing the Services, or by signing an order form that references these Terms, you accept them on behalf of the organisation you represent and confirm that you have the authority to bind it. If you do not accept them, do not use the Services.

The Services are offered to businesses and public bodies only, not to consumers. Where an order form or a master agreement signed with VEYNC exists, it prevails over these Terms to the extent of any conflict.

Definitions

"Customer" means the organisation that accepts these Terms or signs an Order Form. "Authorized User" means an employee or contractor the Customer permits to use the Services. "Engagement" means a validation activity run with the Services against Customer Systems. "Customer Systems" means the systems, networks, applications, AI models, agents and accounts that the Customer owns or is authorized in writing to have tested. "Customer Data" means data the Customer or its Authorized Users submit to the Services, together with the engagement evidence derived from Customer Systems. "Order Form" means an ordering document signed by both parties that references these Terms.

Accounts and access

The Customer is responsible for its Authorized Users, for keeping credentials confidential, for enabling the multi-factor authentication the platform provides, and for all activity under its accounts. Notify [email protected] promptly of any unauthorized access or suspected compromise.

Access is personal to each Authorized User and may not be shared. We may carry out identity and authority checks before activating an account or an Engagement.

Authorized use only

The Services provide offensive security capability. They may be used only against Customer Systems, within a scope and rules of engagement agreed in writing before each Engagement, and only under written authorization from a person with the standing to grant it. For every Engagement, the Customer represents and warrants that it holds that authorization and that it remains valid for the whole Engagement.

Use of the Services is subject to the Acceptable Use Policy, which forms part of these Terms. We will refuse an Engagement we cannot scope properly, and we may pause or stop an Engagement where authorization turns out to be absent, withdrawn, exceeded or given by someone without the authority to give it.

Customer Data and data protection

As between the parties, the Customer owns Customer Data. The Customer grants VEYNC a limited licence to host, process and analyse Customer Data solely to provide, secure and support the Services and as otherwise instructed by the Customer.

Where VEYNC processes personal data on the Customer's behalf, it does so as a processor under the data processing addendum (DPA) that forms part of the Customer's agreement. Our handling of personal data as a controller is described in the Privacy Policy.

We may use aggregated and de-identified data about the operation of the Services, which identifies neither the Customer nor any individual, to maintain and improve the Services.

Fees, invoicing and taxes

Fees are set out in the applicable Order Form. Unless the Order Form says otherwise, fees are invoiced annually in advance, in the currency stated, and are payable within thirty (30) days of the invoice date. Fees are non-refundable except as these Terms expressly provide.

Fees exclude taxes. The Customer pays all applicable sales, use, value-added and similar taxes, other than taxes on VEYNC's net income. We may suspend the Services on written notice if an undisputed invoice remains unpaid thirty (30) days after its due date.

Subscription term and renewal

Each subscription runs for the term stated in the Order Form, which is twelve (12) months unless stated otherwise. It renews automatically for successive periods of the same length unless either party gives written notice of non-renewal at least thirty (30) days before the end of the current term.

Confidentiality

Each party will protect the other's confidential information with at least the care it uses for its own, and never less than reasonable care, and will use it only to perform under these Terms. Confidential information includes Customer Data, engagement findings, pricing, non-public features of the Services and the Adversary Evidence Annex.

These obligations do not apply to information that is or becomes public without breach, was already known to the recipient, is independently developed, or is lawfully received from a third party. Disclosure required by law is permitted, with prompt notice to the other party where lawful.

Intellectual property and feedback

VEYNC and its licensors own the Services, including the software, the adversarial agent framework, the technique library, the documentation and the Veync name and marks. No right is transferred except those expressly granted in these Terms. The Customer may not copy, modify, reverse engineer or decompile the Services, create derivative works from them, or use them to build a competing product.

Reports and evidence produced for the Customer may be used freely by the Customer for its internal security, risk and compliance purposes, including sharing them with its auditors and regulators. If the Customer gives us feedback or suggestions, we may use them without obligation.

The content and design of this site belong to VEYNC except where stated. Names of standards, frameworks and their issuing bodies belong to their owners and appear here descriptively; nothing on this site asserts endorsement, partnership, accreditation or certification by any of them.

Adversary Evidence Annex

Material from the Adversary Evidence Annex is supplied only under a separate non-disclosure agreement. It may not be redistributed, published or used to attack any system.

Third-party services

The Services may interoperate with third-party systems, clouds and AI providers chosen by the Customer. VEYNC is not responsible for those services, and the Customer is responsible for ensuring that testing them is permitted by the provider's terms and published testing policies.

Warranties and disclaimers

VEYNC warrants that it will provide the Services with reasonable skill and care, substantially as described in the documentation. If the Services do not conform to this warranty, the Customer's remedy is for us to correct the non-conformity or, if we cannot do so within a reasonable time, to terminate the affected subscription and refund the prepaid fees for the remaining term.

Except as expressly stated in these Terms, the Services and this website are provided "as is" and "as available", and VEYNC disclaims all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. Nothing on this website or produced by the Services is a certification, an attestation or a conformity assessment, and VEYNC is not an accredited certification body.

Security validation establishes the presence of weaknesses that were found. It cannot establish the absence of weaknesses that were not. No Veync output should be read as a guarantee that a system is secure, and we would treat a vendor who implied otherwise as not credible.

Limitation of liability

To the maximum extent permitted by law, neither party is liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of profits, revenue, goodwill or data, arising out of or relating to these Terms, even if advised of the possibility of such damages.

To the maximum extent permitted by law, each party's total aggregate liability arising out of or relating to these Terms will not exceed the fees paid and payable by the Customer to VEYNC for the Services in the twelve (12) months before the event giving rise to the claim.

These limits do not apply to the Customer's payment obligations, to either party's indemnification obligations, to a breach of confidentiality, to the Customer's breach of the Authorized use only section or of the Acceptable Use Policy, or to any liability that cannot be limited by law.

Indemnification

VEYNC will defend the Customer against any third-party claim alleging that the Services, as provided by VEYNC, infringe that third party's intellectual property rights, and will pay the damages and costs finally awarded or agreed in settlement.

The Customer will defend VEYNC against any third-party claim arising from Customer Data, from the testing of a system the Customer was not authorized to test, or from use of the Services in breach of these Terms or the Acceptable Use Policy, and will pay the damages and costs finally awarded or agreed in settlement.

The indemnified party must notify the other party promptly, give it control of the defence and settlement, and provide reasonable cooperation.

Suspension and termination

We may suspend access to the Services immediately where we reasonably believe they are being used without authorization, in breach of the Acceptable Use Policy, or in a way that threatens the security of the Services or of a third party. We will tell the Customer the reason where lawful, and restore access once the issue is resolved.

Either party may terminate these Terms or an Order Form on written notice if the other party materially breaches them and fails to cure the breach within thirty (30) days of that notice. On termination the Customer's access ends; on request made within thirty (30) days we will make Customer Data available for export, and we then delete it in accordance with the DPA. Provisions that by their nature should survive termination will survive.

Export control and sanctions

Each party will comply with the export-control and economic-sanctions laws that apply to it, including those of the United States, the European Union and the United Kingdom. The Customer may not use, export or provide access to the Services in violation of those laws, including in an embargoed country or for the benefit of a sanctioned person.

Governing law and venue

These Terms, and any dispute arising out of or relating to them, are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws rules. The state and federal courts located in the State of Delaware have exclusive jurisdiction, and each party consents to their jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Changes to these terms

We may update these Terms from time to time. The date at the top of this page identifies the current version. Material changes take effect for existing customers at the start of their next subscription term, or earlier on thirty (30) days' notice where a change is required by law or to protect the security of the Services.

Notices

Legal notices to VEYNC must be sent to [email protected], with a copy by post to VEYNC, Tour First, 1 Place des Saisons, 92400 Courbevoie — Paris La Défense, France. We send notices to the Customer at the email address associated with its account or stated in the Order Form.

General

Neither party may assign these Terms without the other's consent, except to a successor in a merger, acquisition or sale of substantially all of its assets. If any provision is held unenforceable, the remainder stays in effect. A failure to enforce a provision is not a waiver. Neither party is liable for delays caused by events beyond its reasonable control. These Terms, the Acceptable Use Policy, the DPA and any Order Form are the entire agreement between the parties on their subject matter.

Contact

Questions about these Terms: [email protected]. Product and account support: [email protected]. Sales enquiries: [email protected].