Terms of Service

LAST UPDATED · 10 JUNE 2026

1. Acceptance

When you create a Custodis account or use the service in any way, you agree to these terms. If you do not agree, do not create an account and do not use the service. If you are signing up on behalf of an organization, you confirm that you have the authority to bind that organization to these terms, and references to "you" throughout this document mean both you personally and the organization you represent. We may update these terms from time to time; material changes will be announced in-product and via email at least fourteen days before they take effect, and your continued use of the service after that date constitutes acceptance of the revised terms.

2. The Service

Custodis is a cyber risk monitoring platform that performs non-intrusive scanning of internet-facing assets you own, calculates a graded risk score from the findings, surfaces prioritized issues, and delivers alerts when material changes occur. The service is currently offered during a beta period and is provided on an "as is" and "as available" basis, without warranties of any kind, express or implied. We may add, modify, or remove features at any time, and we may impose reasonable rate limits, queue depths, or scan-frequency caps to maintain service quality. We do not guarantee that scans will identify every issue or that the platform will be uninterrupted or error-free.

3. Your Account & Organization

Each Custodis account is tied to a single organization tenant. You are responsible for all activity that occurs under your account, including actions taken by users you invite and the roles or permissions you grant them. You must keep your login credentials and API keys confidential, choose a strong password, and use multi-factor authentication where available. You must notify us promptly at security@custodis.app if you suspect unauthorized access to your account, credential compromise, or any other security incident affecting your tenant. You are responsible for ensuring that the users you invite are entitled to access the data within your tenant on behalf of your organization.

4. Scanning & Permitted Use

You may only enable active scanning on domains, subdomains, IP addresses, and other assets that you have verified ownership of through one of our supported verification methods. By initiating a scan, you confirm that you are authorized to assess the target asset and that doing so does not violate any third-party rights or applicable law. We publish an IP allowlist so that you can confirm legitimate scan traffic; using Custodis to scan assets you do not own, attempting to evade our rate limits, or otherwise probing third parties without consent constitutes misuse and will result in immediate termination of access. See our Responsible Scanning Policy for full details.

5. Data & Privacy

We process scan results, account information, and limited usage telemetry as described in our Privacy Policy. You own the data your tenant generates and the configuration you enter, and you may export it at any time through the dashboard or API. We retain scan history for the duration set by your subscription tier; after that window, historical findings are aggregated into trend metrics and the raw scan payloads are deleted. We do not sell your data and we do not use the contents of your scans to train models or to inform any other customer's experience.

6. Subscriptions & Billing

Paid subscriptions are billed monthly in advance through Stripe in the currency displayed at checkout. New organizations receive a fourteen-day trial that does not require a card; at the end of the trial you must select a paid plan to continue scanning. If your subscription expires or payment fails, your tenant enters a read-only state for ninety days during which scans pause and the dashboard remains accessible for export; after that period the tenant and its associated data are deleted. Cancellations take effect at the end of the current billing period and you retain access until then. Refunds are issued at our discretion, typically only for billing errors on our side.

7. Acceptable Use

You agree not to reverse engineer, decompile, or attempt to extract the source code of the service; not to resell, sublicense, or provide Custodis to third parties without our prior written consent; and not to attempt to circumvent rate limits, access controls, or tenant isolation boundaries. You must not use the service to store or transmit malware, to conduct denial-of-service activity, or to probe other tenants' data. We may suspend or terminate accounts that violate this section without prior notice, and we will cooperate with law enforcement where required. Repeated or willful violations may also be referred to the relevant authorities.

8. Limitation of Liability & Termination

To the maximum extent permitted by law, neither party shall be liable for indirect, incidental, consequential, special, or punitive damages, and our aggregate liability arising from the service is limited to the fees you paid us in the twelve months preceding the event giving rise to the claim. Either party may terminate the subscription for convenience with thirty days' written notice. We may terminate or suspend access immediately for material breach of these terms, non-payment after a fifteen-day cure period, or use of the service in violation of applicable law. Sections concerning intellectual property, indemnification, confidentiality, and limitation of liability survive termination.