Terms of Service

These Terms of Service (“Terms”) form a binding agreement between Vranox LLC (“Vranox,” “we,” “us”) and the organisation that authorises a user to access the platform (“Customer,” “you”). Each individual user accepts these Terms on behalf of their Customer organisation when they sign in.

If you do not have authority to bind your Customer organisation, you must not use the platform.

The platform is a multi-tenant tech-maturity-assessment tool that lets authorised users at a Customer organisation:

• Generate AI-mediated tech maturity assessments of Customer's own organisation and, where enabled, of prospects and clients.
• Upload documents (for example penetration-test reports) as evidence for an assessment.
• Research the products in a technology stack using AI web search and public sources, with the sources cited in the output.
• Render those assessments as PDF and PowerPoint documents.
• Track a product estate and receive risk alerts about it.
• Where enabled for Customer's workspace, use the Vranox Collector desktop app to read configuration from systems Customer connects.
• Manage prospects, users (subject to Customer's admin role), and historical assessments.

The Service is provided on an “as is” basis and we may add, modify, or remove features over time. Material removals will be announced in advance.

• Account creation is closed: Vranox sets up each Customer workspace and its administrator, and the administrator can invite Users into it within the workspace's seats (section 4).
• Customer is responsible for keeping its credentials confidential and for any activity performed using its accounts.
• Customer must promptly disable or notify us about compromised credentials.
• Customer is responsible for the actions of its users and for ensuring they use the Service in accordance with these Terms.

• License and tier. Each Customer workspace operates under one license issued by Vranox, in one of these tiers (the standard configuration at the time of issue, unless Customer's order form or license says otherwise): Starter (one administrator, no additional users, assessments of Customer's own organisation only); Professional (one administrator, two User seats, prospect assessments and custom assessment inputs); Enterprise (one administrator, five User seats, prospect assessments, custom assessment inputs and, when available, the Collector); or Custom (seats and features set by Vranox).
• Term. Vranox sets the license term when the workspace is set up and at each renewal: a trial of 14, 30 or 90 days; one to five years, ending on the same calendar date at the end of the term; or a specific end date, ending at the end of that calendar day Anywhere on Earth (UTC-12). The term starts when the workspace administrator first signs in or accepts the administrator invitation, or when Vranox activates the license, whichever comes first. A license that has not started does not expire unless it has a specific end date.
• Renewal and changes. Only Vranox renews a license or changes its tier. Customer's administrator can request a renewal, an upgrade or a data export from within the Service; those requests are sent to Vranox.
• Seats. Each workspace has one administrator (or more, where Vranox grants additional administrator seats) plus the tier's User seats. Sending an invitation uses a seat, and the seat stays used whether the invitation is pending, accepted, cancelled or expired, and after the member is removed. Only Vranox can release a used seat or add seats. While the workspace is active, the administrator can remove members and cancel invitations so that access ends immediately. Only Vranox can change who administers a workspace.
• License key. Customer must keep its license key confidential. Administrators can reveal it after re-entering their password, and Vranox may rotate it. The key is used to connect the Collector where the Collector is available.

You will not, and will not allow your users to:

• Submit data that you are not authorised to submit.
• Use the Service to compile information about identifiable individuals beyond what is reasonably necessary for a tech maturity assessment.
• Attempt to reverse engineer, decompile, or extract the underlying source code, prompts, or models.
• Use the Service to generate content that infringes intellectual property rights, defames, harasses, or violates applicable law.
• Probe, scan, or test the vulnerability of the Service without prior written permission.
• Resell, sublicense, or provide the Service to third parties as a standalone product.
• Exceed reasonable rate limits, bypass quotas, or generate volumes designed to disrupt the Service.
• Connect the Collector or any cloud connector to systems that Customer is not authorised to access and assess.
• Share license keys or credentials issued for the Service outside Customer's organisation.

We may suspend access without notice if we reasonably believe a user is violating this section, and we will notify Customer's admin contact as soon as practical thereafter.

Customer retains all right, title, and interest in the data it submits to the Service (the “Customer Data”), including prospect names, technology stacks, and assessment outputs.

Customer grants Vranox a limited, non-exclusive, worldwide licence to host, process, transmit, and display Customer Data solely as necessary to operate the Service for Customer's benefit. We do not use Customer Data to train AI models. Under our AI provider's commercial terms, it does not use our API inputs or outputs to train its models.

To research a product, the Service uses its product name (not Customer's identity or its End Companies' identities). General product information that the Service finds in public sources and stores in a shared product library, which Vranox may reuse for all customers, is not Customer Data. Customer's own entries, including which products Customer uses, remain Customer Data. Customer should not enter confidential or internal system names as products.

Our processing of Customer Data is further described in our Privacy Policy.

The Service uses large-language-model AI to generate assessment content based on inputs Customer provides, and may draw on public web sources found by AI web search and on public data feeds (for example vulnerability and end-of-life databases). AI output:

• Is non-deterministic — the same input may produce different outputs across runs.
• May rely on third-party sources that Vranox does not control and does not warrant; cited sources should be checked.
• May contain inaccuracies, omissions, or recommendations that are not appropriate for Customer's specific context.
• Must be reviewed by a qualified person before being shared externally with a prospect or client.

Customer is solely responsible for verifying AI output before using it for any business or contractual purpose.

Fees, payment terms, taxes, and any commercial milestones are governed by a separate written agreement between Vranox and the Customer organisation. Where no separate agreement is in force, access to the Service is provided on an evaluation basis at no fee and may be revoked or rate-limited at our discretion.

• Vranox retains all rights in the Service, including software, design, prompts, model configurations, portfolio data structures, and documentation.
• Customer retains all rights in Customer Data.
• Subject to Customer's compliance with these Terms, Vranox grants Customer a non-exclusive, non-transferable, worldwide right to use the Service during the term of the agreement.
• If Customer provides feedback, Vranox may use that feedback without restriction or compensation.

The Service is provided “as is” and “as available” without warranties of any kind, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted operation.

Without limiting the foregoing, AI-generated output is not professional advice (legal, security, audit, or otherwise) and should not be relied on as such.

To the maximum extent permitted by applicable law, neither party will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, including lost profits, lost revenue, or business interruption.

Vranox's total aggregate liability arising out of or relating to the Service or these Terms will not exceed the fees paid by Customer to Vranox in the 12 months preceding the event giving rise to the claim, or US$1,000, whichever is greater.

These limits apply notwithstanding any failure of essential purpose of any limited remedy.

Customer will defend, indemnify, and hold harmless Vranox from and against any third-party claims, losses, or expenses arising out of:

• Customer Data, including any claim that Customer's use or sharing of Customer Data infringes the rights of a third party.
• Customer's use of AI-generated output, including external sharing without verification.
• Customer's violation of these Terms or applicable law.

• These Terms remain in effect while Customer's account is active, and continue to apply to any read-only access described below.
• Either party may terminate for cause if the other materially breaches and fails to cure within 30 days of written notice.
• Expiry and revocation. When a license expires or Vranox revokes it, the workspace becomes read-only. Users can still sign in, view their data and download reports; the administrator can also download a granted data export, reveal the license key and request a renewal, upgrade or data export. While a workspace is read-only, you can still view and download existing reports and request your data export. Members can still update their own name, password and display settings, contact Vranox, and flag a claim in a report. Administrators can still request an additional seat and remove a Collector machine. All other changes are blocked. While the workspace is read-only, Customer may ask Vranox to remove a member or cancel an invitation, and we will do so promptly. Scheduled re-assessments, alerts, product research and digest emails stop, and the Collector pauses while keeping its local data. Revocation or expiry does not delete Customer Data.
• Downgrades. If a workspace moves to a lower tier, existing members and data are kept, but features not included in the new tier stop being available and new invitations are limited to the new tier's seats.
• The license term ends when the license expires or Vranox revokes it, or when either party terminates for cause as described above (each a “Termination”). From Termination, Customer's right to use the Service ends, except for the read-only access described above, and the export period begins. We will make Customer Data available for export for at least 30 days: Customer's administrator may request an export during that period and, once we grant it, download it while signed in for seven days. Thereafter, we may delete Customer Data. We do not delete it automatically; until we do, it is kept read-only.
• Sections 6, 9, 10, 11, 12, 14, and 15 survive termination.

These Terms are governed by the laws of State of Florida, United States, without regard to its conflict-of-laws principles. Each party submits to the exclusive jurisdiction of the courts of State of Florida, United States for any dispute arising out of or relating to these Terms, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

• Entire agreement. These Terms, together with the Privacy Policy and any signed order form, constitute the entire agreement between the parties on the subject matter and supersede prior agreements.
• Amendments. Material amendments require Customer's assent. Non-material clarifications take effect when posted with a revised “Last updated” date.
• Assignment. Neither party may assign these Terms without the other's prior written consent, except that either party may assign to an affiliate or in connection with a merger, acquisition, or sale of substantially all assets.
• Severability. If any provision is held unenforceable, the remaining provisions remain in effect.
• No waiver. Failure to enforce a provision is not a waiver of future enforcement.
• Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control.

Questions about these Terms: inquiries@vranox.com