Terms of Service
================

After Dark Systems — legal.afterdarksys.com
Last updated: 2026-08-05

> **DRAFT — NOT YET IN FORCE.** Liability caps, warranty disclaimers, governing
> law, and dispute resolution are the clauses most likely to be tested and the
> ones I am least able to set for you. Counsel must review before publication.
> Items marked `[VERIFY]` need a business decision.

## 1. Who this is between

These terms are between you and After Dark Systems, LLC, a limited liability
company `[VERIFY: state of formation]`.

They apply to the corporate site, our security products, and our infrastructure
and API services. Our DNS and internet data intelligence services have their own
terms at `legal.dnsapi.ai`.

If you are agreeing on behalf of an organisation, you confirm you have authority
to bind it, and "you" means that organisation.

## 2. Your account

You need an account for most services. You must give accurate information, keep
your credentials secure, and tell us promptly at security@afterdarksys.com if
you believe your account is compromised.

Authentication runs through Authentik single sign-on. We support passkeys and
multi-factor authentication, and we recommend both.

You must be at least 16 years old, or the age of digital consent where you live
if that is higher.

## 3. Acceptable use

You may not use our services to:

- break the law, or help anyone else break it
- access systems you are not authorised to access
- test, scan, or attack infrastructure you do not own or have written permission
  to assess
- send unsolicited bulk email
- infringe intellectual property
- upload malware, except where a security product is designed to receive samples
  and you use the channel provided for it
- circumvent rate limits, quotas, or access controls
- resell or redistribute the service without a written agreement
- misrepresent your identity or affiliation

### Security products carry a stricter rule

Our security products can be used to cause harm. You may only use them against
systems you own or where you hold **documented authorisation** from the owner.
You are responsible for holding that authorisation, and for producing it if we
ask. We may suspend access immediately where we reasonably believe a product is
being used against a third party without permission.

## 4. Data you upload

You keep ownership of everything you upload. You grant us only the licence we
need to run the service for you.

Where you upload personal data about other people — your employees, your users,
credentials from your own breach exposure — **you** are the controller and
**we** are your processor. That requires a Data Processing Agreement in addition
to these terms. See the
[Security Services Addendum](security-services-addendum.html)
([plain text](security-services-addendum.txt)).

You are responsible for having a lawful basis for the data you give us.

## 5. Our intellectual property

We keep ownership of the services, our software, and our brands. These terms
grant you a limited, non-exclusive, non-transferable, revocable right to use the
services while your account is in good standing.

Where a component is open source, its own licence governs it and that licence
wins over this section.

## 6. Fees

Paid plans are billed as described at purchase. Payment is processed by Stripe;
we never see your full card number.

`[VERIFY: business decisions needed — billing cycle, renewal terms, refund
policy, price change notice period, what happens to data on non-payment.]`

Fees exclude taxes unless stated. You are responsible for taxes other than those
on our income.

## 7. Availability

We work to keep the services running but do not promise uninterrupted
availability. We may take services down for maintenance, and will give notice
where we reasonably can.

`[VERIFY: no SLA currently offered. If any customer has been promised uptime
commitments, they need to be written down here or in a separate SLA.]`

## 8. Suspension and termination

You may stop using the services and close your account at any time.

We may suspend or terminate your access if you breach these terms, if we are
required to by law, or if your use threatens the security or stability of the
service or other customers. Where circumstances allow, we will warn you first
and give you a chance to fix the problem.

On termination we will make your data available for export for
`[VERIFY: 30 days?]`, then delete it on the schedule in our
[Privacy Policy](privacy.html) ([plain text](privacy.txt)).

## 9. Warranties

The services are provided "as is". To the extent the law allows, we disclaim
implied warranties of merchantability, fitness for a particular purpose, and
non-infringement.

Our security products report what they find. They cannot find everything. A
clean result is not a guarantee that a system is secure, and you must not
represent it as one.

## 10. Liability

`[VERIFY: cap needs a business decision. A common structure is fees paid in the
preceding 12 months, with carve-outs for death or personal injury caused by
negligence, fraud, and anything that cannot lawfully be limited.]`

Nothing in these terms limits liability that cannot lawfully be limited. Some
jurisdictions do not allow certain exclusions, so parts of this section may not
apply to you.

## 11. Indemnity

You will defend and indemnify us against third-party claims arising from your
use of the services in breach of these terms, including any claim that you
lacked authorisation to test a system you tested.

## 12. Changes

We may change these terms. For material changes we will give at least
`[VERIFY: 30 days?]` notice to account holders. Continuing to use the services
after a change takes effect means you accept it. If you do not accept, stop
using the services and close your account.

## 13. Governing law and disputes

`[VERIFY: governing law, venue, and whether to require arbitration. This is a
material business decision with real consequences for cost and consumer rights —
counsel should set it, and consumer protection law in the EU and UK limits how
far it can go.]`

## 14. General

If a provision is unenforceable, the rest survives. Our not enforcing a term is
not a waiver of it. You may not assign these terms without our consent; we may
assign them in a merger or sale of the business.

These terms, plus any addendum or order form you have signed, are the whole
agreement between us.

## 15. Contact

- General: `[VERIFY: contact address]`
- Legal notices: `[VERIFY: address for formal notice]`
- Security: security@afterdarksys.com
- Accessibility: accessibility@afterdarksys.com