Terms of Use

01 Acceptance of these Terms

By accessing or using the Platform — including by clicking “I accept,” signing an order form that references these Terms, creating an account, connecting any system, or attending or participating in a demonstration, evaluation, proof-of-concept, or trial — you agree to be bound by these Terms. If you do not agree, do not access or use the Platform.

If you accept on behalf of an organization, you represent that you have authority to bind it, and “you” refers to that organization. These Terms apply to all access, including unpaid demonstrations, evaluations, and trials, and continue to apply during any such period whether or not a separate order form is later signed.

02 Definitions

• Authorized Users — employees, contractors, or agents you authorize to use the Platform on your behalf.
• Connected Systems — the cloud accounts, identity providers, code repositories, SaaS applications, endpoints, and other systems you connect.
• Customer Data — data you or your Connected Systems make accessible through the Platform, including security telemetry, logs, configuration data, and findings.
• Documentation — the user guides and technical materials we make available.
• Order Form — an ordering document specifying subscriptions, services, and fees.

03 The Platform and account access

Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Platform during the applicable subscription, trial, or evaluation period, solely for your internal business purpose of securing your own Connected Systems.

You are responsible for all activity under your account, for keeping credentials confidential, for your Authorized Users’ compliance, and for promptly notifying us of any unauthorized access.

04 Authorization to access Connected Systems

When you connect a system (typically via read-only OAuth or equivalent), you authorize 1Defender to access, scan, ingest, analyze, and — where you enable remediation features — act upon that system to provide the Platform’s security, monitoring, hardening, response, and compliance functions.

You represent that you have all rights and authority necessary to grant this access and to permit processing of the associated Customer Data, including any third-party authorizations. You are solely responsible for the scope you configure (for example, read-only versus remediation-enabled) and for the consequences of automated remediation you enable.

05 Restrictions on use

This Section is a material condition of your access. You will not, and will not permit any Authorized User or third party to:

• Reverse engineer. Reverse engineer, decompile, disassemble, or attempt to derive the source code, structure, algorithms, models, prompts, detection logic, remediation playbooks, or know-how of the Platform, except to the limited extent this restriction is prohibited by law.
• Copy or create derivative works. Copy, reproduce, modify, or create derivative works of the Platform, Documentation, or any interface, workflow, output format, or design element.
• Build a competing product. Use the Platform, any demonstration, output, or Documentation to design, develop, train, benchmark for, market, or assist any competing product or service, or for competitive analysis.
• Restrict competitor access. Access the Platform if you are, or act for, a direct competitor, except with our prior written consent; and never obtain access, a demo, or an evaluation under false pretenses or by misrepresenting your identity, affiliation, or purpose.
• Scrape or extract. Use bots, scrapers, or crawlers to access the Platform or extract data, or harvest, frame, or mirror any part of it except through functionality we expressly provide.
• Remove notices. Remove, obscure, or alter any proprietary notices, trademarks, or attributions.
• Resell. Sell, rent, lease, sublicense, distribute, or provide service-bureau access to the Platform, except as an Order Form allows.
• Circumvent or interfere. Bypass usage limits or access controls, introduce malicious code, or disrupt the integrity or performance of the Platform.
• Exceed authorization. Use the Platform to access, scan, or act on any system you are not authorized to access, or for any unlawful purpose.
• Share credentials. Share, disclose, sublicense, or otherwise make available any login, API key, access token, or other credential issued to you — including credentials issued for test, sandbox, demo, or evaluation purposes — to any person or entity not individually authorized to hold that specific credential, without the prior written consent of 1Defender management. Each credential is personal to the Authorized User to whom it is issued and may not be pooled, shared across a team, or transferred, even internally, without that consent.

Credential sharing is treated as a serious breach because a shared or leaked credential is one of the most common ways both your organization’s data and other customers’ data are exposed. Restricting each credential to a single named, authorized individual — and requiring written sign-off from 1Defender management before any exception — is a control we apply to protect user data and organizational data from leaking, not a formality.

05A Credentials and access security

This Section applies to all credentials issued in connection with the Platform, including production, staging, sandbox, and test-environment credentials, API keys, service tokens, and any credentials issued to interns, contractors, or temporary personnel.

• No sharing without written consent. Credentials may not be shared, disclosed, or transferred to any person other than the individually authorized holder unless 1Defender management has given prior written consent for that specific instance. This applies equally to test and non-production credentials, which carry the same restriction as production credentials.
• Individual accountability. Each Authorized User must use only the credentials issued to them. Actions taken under a credential are attributable to the individual to whom it was issued.
• Secure storage. Credentials must be stored using a password manager, secrets manager, or equivalent access-controlled system — never in plaintext files, chat messages, spreadsheets, shared documents, code repositories, or unencrypted notes.
• Prompt revocation. You must notify us immediately at security@1defender.ai if a credential is lost, exposed, suspected compromised, or held by someone whose access should end (including on termination, role change, or end of an internship or engagement), so it can be revoked without delay.
• No credential reuse across systems. Credentials issued for the Platform may not be reused for unrelated systems, and unrelated-system credentials may not be reused for the Platform.

A violation of this Section is a material breach of these Terms under Section 14 and may result in immediate suspension of the credential and, where warranted, termination of access, without limiting any other remedy available to us.

05B Security testing and AI / model protections

In addition to Section 5, and without limiting it, you will not, and will not permit any Authorized User or third party to:

• Conduct unauthorized security testing. Perform penetration testing, vulnerability scanning, load testing, fuzzing, or any other security assessment of the Platform or its infrastructure without our prior written authorization and an agreed scope. Legitimate security research should be reported through the process on our Security page, not carried out unilaterally against the live Platform.
• Attempt unauthorized access. Probe, scan, or test the vulnerability of the Platform or attempt to breach any security or authentication measure, whether or not the attempt succeeds.
• Extract or distill any model. Use the Platform, its outputs, or any API access to train, fine-tune, distill, or otherwise derive any machine learning model, or to replicate the functionality of any model or detection system underlying the Platform, whether by systematic querying, output collection, weight or parameter extraction, or any other means.
• Probe for internal workings. Use prompt injection, jailbreaking, adversarial inputs, or any other technique intended to cause the Platform or any AI component within it to reveal system prompts, model architecture, training data, internal configuration, detection logic, or other non-public internal workings.
• Systematically harvest outputs. Collect, log, or compile Platform outputs at scale for the purpose of analysis, benchmarking, or reproduction of the Platform’s functionality, rather than for your own operational use.
• Misrepresent automated activity. Use automated means to interact with the Platform in a way designed to obscure that the activity is automated, or to evade rate limits, monitoring, or abuse detection.

These restrictions apply regardless of whether the activity is described as research, testing, evaluation, or educational, and regardless of whether it is directed at a production, demo, sandbox, or trial instance of the Platform.

06 Demonstrations, evaluations, and trials

Any demonstration, evaluation, proof-of-concept, or trial is provided solely to evaluate the Platform for your own potential or actual use, and is Confidential Information of 1Defender under Section 9.

Without limiting Section 5, during and after any demonstration or trial you will not: (a) record, screenshot, or reproduce the Platform’s non-public interfaces, workflows, detection logic, or outputs except for your internal evaluation; (b) disclose your assessment of its non-public functionality or performance to any third party; or (c) participate on behalf of, or share what you learn with, a competitor of 1Defender.

Demonstrations and trials may be provided “as is,” may use sample or sandbox data, may omit features, and may be discontinued at any time. Nothing shown is a commitment to deliver any particular feature.

07 Customer Data

As between the parties, you retain all right, title, and interest in Customer Data. You grant 1Defender a non-exclusive, worldwide license to host, process, transmit, analyze, and display Customer Data solely to provide and improve the Platform and to comply with law, in accordance with our Privacy Policy and, where applicable, the Data Processing Addendum. You are responsible for the accuracy and legality of Customer Data and for obtaining the consents and rights necessary for us to process it.

08 Fees, billing, and wallet

Fees are stated in the applicable Order Form or pricing page. Where a balance model applies (the 1Defender Wallet), you authorize us to draw applicable fees and usage charges from your balance. Except as required by law or expressly stated, fees are non-refundable and balances are non-transferable. Fees are exclusive of taxes, for which you are responsible. We may suspend access for non-payment after 10 days’ notice.

09 Confidentiality

Confidential Information means non-public information disclosed by one party that is marked confidential or that a reasonable person would understand to be confidential, including the non-public features, interfaces, workflows, security architecture, detection logic, remediation playbooks, pricing, and roadmap of the Platform.

The receiving party will use Confidential Information only to exercise its rights and meet its obligations under these Terms, protect it with at least reasonable care, and not disclose it except to personnel and advisors who need to know and are bound by comparable obligations. These duties survive termination for three years, and indefinitely for trade secrets. They do not apply to information that becomes public through no fault of the receiver, was independently developed, or must be disclosed by law (with notice where permitted).

10 Intellectual property

The Platform, Documentation, and all related intellectual property remain the exclusive property of 1Defender and its licensors. Except for the limited rights expressly granted here, no rights are granted by implication or estoppel. “1Defender” and the 1Defender logo are trademarks of 1Defender, Inc. If you provide feedback or suggestions, you grant 1Defender a perpetual, irrevocable, royalty-free license to use them without restriction.

11 Warranties and disclaimers

We warrant that the Platform will perform materially in accordance with the Documentation during a paid subscription term. Except as expressly stated, the Platform is provided “as is” and “as available,” and 1Defender disclaims all other warranties, express or implied, including merchantability, fitness for a particular purpose, title, and non-infringement.

1Defender does not warrant that the Platform will detect or prevent all threats, vulnerabilities, or incidents, that it will be uninterrupted or error-free, or that it will achieve any particular compliance outcome. Security is a shared responsibility; you remain responsible for your own environment, configurations, and decisions.

12 Limitation of liability

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, or goodwill. Except for your breach of Section 5, the indemnification obligations, or a breach of confidentiality, each party’s total aggregate liability will not exceed the amounts you paid to 1Defender in the 12 months before the event giving rise to the claim (or, for free or trial use, USD $100). Some jurisdictions do not allow certain limitations; there, liability is limited to the greatest extent permitted.

13 Indemnification

You will defend, indemnify, and hold harmless 1Defender from third-party claims arising out of (a) your Customer Data or Connected Systems, (b) your breach of Section 4 or Section 5, or (c) your unlawful use of the Platform.

14 Term, suspension, and termination

These Terms apply for as long as you access the Platform and during any subscription or trial term. We may suspend or terminate access immediately if you breach Section 5 or Section 6, if your use poses a security or legal risk, or for non-payment. Either party may terminate for material breach uncured after 30 days’ written notice. On termination, your access ceases; we make Customer Data available for export for 30 days, then may delete it per our retention practices and the DPA; and Sections 5, 9, 10, 11, 12, 13, and 15 survive.

15 General

Governing law and venue. These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-laws rules. The parties submit to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware, except that a party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.

Changes. We may update these Terms; material changes take effect 30 days after we post or notify you. Continued use after the effective date is acceptance.

Assignment. You may not assign without our consent, except to a successor in a merger or sale of substantially all assets; we may assign freely.

Entire agreement; precedence. These Terms, plus any Order Form, the Privacy Policy, and the DPA, are the entire agreement; in a conflict, an executed Order Form controls, then the DPA, then these Terms. Severability, waiver, force majeure, and notices apply on standard terms.