Terms of service

Agreement and eligibility

These Terms of Service (“Terms”) are between DarkRisk (Pty) Ltd, registration number 2026/686205/07 (“DarkRisk”, “we”, “us”, or “our”) and the person or organisation accessing or using our websites, Cyber Risk Management platform, application programming interfaces, support, and related services (together, the “Services”).

By accessing or using the Services, creating an account, clicking to accept these Terms, or signing an order that refers to them, you agree to be bound by them. Acceptance by electronic means is as binding as a signature. If you use the Services for an organisation, you warrant that you are authorised to bind it, and “you” means that organisation; if you are not so authorised, you are personally bound. If you do not agree, do not use the Services.

You must be at least 18 and legally capable of entering into a binding agreement. The Services are provided for business use only, not for personal, family or household purposes.

Our Acceptable Use Policy, data processing termsand Scanning practices form part of these Terms. If documents conflict, they apply in this order: a master agreement signed by both parties; an order; the data processing terms, for personal information we process on your behalf; these Terms; and then the other policies.

Accounts and security

You must provide accurate account information and keep it current. Each user needs their own account. Credentials, authentication methods and API keys are personal to the user or integration they were issued to and must not be shared. You are responsible for all activity under your accounts and API keys, whether or not you authorised it, until you tell us that they have been compromised.

You must keep multi-factor authentication enabled where the Services offer it, protect API keys as secrets, limit access to people who need it, and remove users promptly when they leave or change role. Tell us immediately at compliance@darkrisk.io if you suspect unauthorised access or misuse.

We may rely on instructions given through your account. Customer administrators may manage users, permissions, integrations and Customer Data for their organisation. We may require re-authentication, reset credentials, or revoke sessions and API keys where we reasonably suspect a compromise.

The Services

Subject to these Terms and your order, DarkRisk grants you a limited, non-exclusive, non-transferable, non-sublicensable right during the subscription term to access and use the Services for your internal business purposes, within the limits of your plan, such as the number of users, vendors, domains and IP ranges. Use beyond those limits requires an upgrade, and we may measure use to enforce them.

We may improve, update, or modify the Services over time. We will not materially reduce the core functionality of a paid Service during an active subscription term without reasonable notice, except where necessary for security, legal compliance, or to prevent harm. Preview, beta, trial, free and evaluation features may be changed or withdrawn at any time and are provided without any warranty or service-level commitment.

We aim to keep the Services available but do not promise uninterrupted or error-free operation. Maintenance, incidents and failures of third parties, such as hosting and network providers, may affect them. Current status is published at darkriskstatus.com.

Ratings, findings and AI output

The Services produce scores, ratings, findings, reports, summaries, questionnaire suggestions and other output (“Output”). Output is generated automatically from public sources, third-party data, the information you and others provide and, where enabled for your organisation, artificial intelligence. It may be incomplete, out of date or wrong, reflects conditions when they were observed, and may change without notice.

Output is decision support. It is not legal, audit, financial, insurance or other professional advice, and it is not a certification, guarantee or audit opinion about any organisation. No score or assessment means that an organisation is secure or free from incidents. You must review Output, including anything generated by artificial intelligence, against the underlying evidence before relying on it.

You must not make a decision that has legal consequences for, or substantially affects, a person or organisation solely on the basis of Output. Where Output informs such a decision, you are responsible for meaningful human review, for giving the affected party an opportunity to make representations where the law requires it, and for the decision. You alone are responsible for your decisions about vendors and other third parties, including whether to engage, restrict or end a relationship, and for anything you tell them about Output.

Acceptable use

You must not, and must not help or allow anyone else to:

• use the Services unlawfully, fraudulently, or to infringe another person’s rights;
• upload malicious code or content that is illegal, deceptive, abusive, or harmful;
• probe, scan, penetrate, or test any system without its owner’s clear authorisation, or use Output to plan or support an attack;
• use the Services or Output to harass, threaten, extort, defame, or publicly shame any person or organisation;
• use breach, dark web or exposure information to access systems or accounts, contact affected individuals, or identify people;
• disrupt the Services, bypass rate limits, plan limits or safeguards, gain unauthorised access, or load-test or scan the Services other than under our disclosure policy;
• share accounts or API keys, or create accounts by automated means;
• reverse engineer, decompile, copy, frame, mirror, or create derivative works of the Services, or work out how scores are calculated, except where law expressly permits;
• scrape or extract data at scale, including through automated means, unless DarkRisk has authorised it in writing;
• resell, sublicense, rent, or provide the Services or Output to third parties except as expressly permitted in an order;
• use the Services or Output to build, train, or benchmark a competing product without our written consent;
• send unsolicited, misleading or bulk communications through the Services, or misrepresent your identity, organisation, or relationship with a vendor;
• remove proprietary notices or misrepresent the source, ownership, or reliability of information; or
• submit information that you do not have the right, authority, or lawful basis to process.

A reference to a third party in a risk workflow does not authorise intrusive testing or access to that party’s systems. Security research involving DarkRisk must follow the policy at security.darkrisk.io.

Assets you add and scanning

You decide which vendors, domains, IP ranges and autonomous systems (“Assets”) the Services monitor. For each Asset, you warrant that you have a legitimate business reason to assess it: it belongs to your organisation, or to a third party you have, or are evaluating, a business relationship with.

IP ranges and autonomous systems may be added only where you own them or their owner has authorised you to have them assessed. We may ask for evidence of that authority at any time, and they are not scanned until approved.

You authorise DarkRisk to perform the observation and scanning described in our Scanning practicesagainst your Assets and the assets connected to them. Scanning is visible to, and may be logged by, the owner of an Asset. We may refuse, pause or remove any Asset, or exclude an asset at its owner’s request, without liability to you.

Vendors and other invited users

Customers may invite vendors and other third parties to answer questionnaires, provide documents or review findings (“Invited Users”). Invited Users must comply with these Terms. Their answers, documents and attestations are shared with the customer that requested them, and each Invited User warrants that what they provide is accurate, complete and authorised by the organisation they represent.

DarkRisk is not a party to the relationship between a customer and its vendors and is not responsible for either party’s obligations, decisions or communications to the other.

Customer Data

“Customer Data” means information, files, records, and other content submitted to the Services by you or on your behalf, including by your users and Invited Users you invite. It does not include DarkRisk Data, service telemetry, or information that has been aggregated or de-identified so that it cannot reasonably identify you, an individual, or your organisation.

As between you and DarkRisk, you retain your rights in Customer Data. You grant DarkRisk and its authorised subprocessors a worldwide, limited right to host, copy, transmit, display, and otherwise process Customer Data as necessary to provide, protect, support, and improve the Services, comply with law, and perform our agreement with you. This right lasts only as long as needed for those purposes.

You are responsible for the accuracy, quality, legality, and means of acquiring Customer Data. You warrant that you have every right, notice, consent and lawful basis, including under the Protection of Personal Information Act 4 of 2013, needed for DarkRisk to process it as these Terms allow. Do not submit special personal information, personal information of children, passwords or other credentials, payment card data, or other highly sensitive data unless your order expressly allows it.

We do not routinely monitor Customer Data, but we may access it to give support you ask for, to secure the Services, to investigate a suspected breach of these Terms, or where the law requires. The Services are not a backup or record-keeping service; keep your own copies of anything you need.

DarkRisk Data

Scan results, scores, ratings, findings, breach, exposure and threat intelligence, and other information that DarkRisk collects from public and third-party sources or produces with its own methods (“DarkRisk Data”) are not Customer Data. DarkRisk owns DarkRisk Data, including where it concerns your Assets or your own organisation. During your subscription you may use the DarkRisk Data made available to you for your internal business purposes and to work with the vendor concerned, as theAcceptable Use Policy allows.

DarkRisk may collect service telemetry, and may create aggregated or de-identified information from the use of the Services, and use both for any lawful purpose, including to operate, secure and improve the Services and for benchmarking, provided the result does not identify you, your users or any individual.

Privacy and security

Our Privacy Policy describes how we process personal information for our own purposes. Where DarkRisk processes personal information in Customer Data on your instructions, ourdata processing terms govern that processing.

We maintain reasonable technical and organisational safeguards designed to protect the Services and Customer Data. More information about our security programme is available at security.darkrisk.io. No online service is completely secure. You must use the security features made available to you and tell us immediately of any security incident affecting the Services that you become aware of.

Third-party services

The Services may interoperate with or link to services operated by third parties. If you enable an integration, you instruct us to exchange relevant information with that provider. Your use of the third-party service is governed by your agreement with that provider, and DarkRisk is not responsible for third-party products, content, availability, or independent acts.

We use infrastructure providers and subprocessors to deliver the Services. Our current disclosures are maintained at trust.darkrisk.io. We remain responsible for our obligations under these Terms when using subcontractors.

Fees, payment and taxes

Fees, plan limits, payment dates, and the subscription term are stated in your order. Unless an order says otherwise, fees are payable in advance for each billing period, are quoted exclusive of VAT and other taxes, are payable in South African rand, and are non-cancellable and non-refundable, including on early termination and for unused capacity, except where these Terms or the law expressly provide otherwise.

You must pay each invoice in full by its due date, without set-off, deduction or withholding. If the law requires you to withhold tax, you must increase the payment so that DarkRisk receives the full amount invoiced. If you dispute an invoice in good faith, tell us in writing within 14 days of its date, with your reasons, and pay the undisputed part; otherwise the invoice is accepted.

Overdue amounts bear interest at the rate prescribed under the Prescribed Rate of Interest Act 55 of 1975, from the due date until payment. You must also pay our reasonable costs of recovering overdue amounts, including legal costs on the attorney-and-own-client scale. We may suspend paid Services after giving notice and an opportunity to pay. Renewals and price changes apply as set out in your order or in a notice given before the next renewal term.

Intellectual property and trademarks

DarkRisk and its licensors retain all rights, title, and interest in the Services and DarkRisk Data, including the platform, models, scoring methods, interfaces, documentation, designs, reports and report formats, aggregated insights, and all related intellectual property. Except for the limited rights in these Terms, no rights are granted to you by implication, estoppel, or otherwise.

DarkRisk, the DarkRisk name and logo, and our product names, service names, designs, and slogans are trademarks or protected brand assets of DarkRisk (Pty) Ltd. You may not use them in a business name, domain, product, advertising, endorsement, or manner likely to cause confusion without our prior written permission, and you must not use them or Output to suggest that DarkRisk endorses, certifies or has audited you or anyone else. Third-party names and marks belong to their owners.

If you provide suggestions or feedback, you grant DarkRisk a perpetual, irrevocable, worldwide, royalty-free right to use it without restriction or obligation, provided we do not identify you publicly as its source without permission.

Confidentiality

“Confidential Information”means non-public information disclosed by one party to the other that is marked confidential or should reasonably be understood as confidential, including Customer Data, DarkRisk Data, security information, product plans, pricing, and business or technical information.

The receiving party will use Confidential Information only to perform or exercise rights under the agreement, protect it with at least reasonable care, and disclose it only to personnel, advisers, and service providers who need to know it and are bound by confidentiality duties no less protective than these. These obligations do not apply to information that the receiving party can show was lawfully known without restriction, independently developed, received lawfully from another source, or made public without breach.

A party may disclose Confidential Information when legally compelled, provided it gives advance notice where legally permitted and reasonable assistance, at the disclosing party’s cost, if protection is sought. These obligations continue for five years after the agreement ends, and for as long as the information remains a trade secret or concerns security.

Suspension and termination

We may suspend all or part of the Services immediately, without prior notice, where we reasonably believe it is necessary to address a security risk, prevent harm, comply with law, or respond to a breach of the Acceptable Use Policy; and, after notice, for another material breach or for overdue fees. Where practicable we will limit the suspension to the affected use and tell you why. Fees remain payable during a suspension caused by you.

Either party may terminate for a material breach that is not remedied within 30 days after written notice, or immediately if the breach cannot be remedied. We may terminate immediately on notice for a serious or repeated breach of the Acceptable Use Policy, or where the law requires. Either party may terminate if the other is placed in liquidation, business rescue, or similar proceedings, subject to applicable law. Convenience termination and non-renewal rights are governed by your order.

On expiry or termination, your right to use the Services ends and all outstanding amounts become due immediately. At your written request made before termination or within the retrieval period stated in your order, we will make Customer Data available for export where the Services support it. When your organisation is deleted, we keep its Customer Data for 180 days, during which it can be restored, and then delete it, unless the law requires us to keep it. We keep billing records, your organisation’s name and key dates, and records of the support we provided. Provisions intended by their nature to survive, including payment, Output, DarkRisk Data, confidentiality, intellectual property, disclaimers, indemnity, and liability limits, survive.

Warranties and disclaimers

You warrant that you have authority to accept these Terms, that your use of the Services and of Output complies with the law, and that the information you give us, including about your Assets, is accurate.

We warrant that paid Services will perform in all material respects in accordance with their documentation. Your exclusive remedy for breach of this warranty is for us to use reasonable efforts to correct the non-conformity; if we cannot do so, either party may terminate the affected Service and we will refund prepaid fees covering the unused remainder of its term.

To the fullest extent permitted by law, and except for that express warranty, the Services and Output are provided “as is” and “as available”. DarkRisk disclaims all other warranties, express or implied, including of merchantability, fitness for a particular purpose, non-infringement, availability, accuracy and completeness. We do not warrant that every vulnerability, threat, vendor issue, or security event will be identified or prevented, and we are not responsible for the acts or omissions of vendors, attackers or other third parties.

Nothing in these Terms excludes a warranty, right, or remedy that cannot lawfully be excluded, including any mandatory rights under the Consumer Protection Act 68 of 2008 where it applies.

Indemnity

To the extent permitted by law, you will defend and indemnify DarkRisk and its directors, officers, employees, and affiliates against all third-party claims, and all resulting losses, damages, fines and reasonable costs, arising from: Customer Data; the Assets you add, including any claim by their owner about scanning you requested; your use of Output, including your decisions about and communications with a vendor or other third party; your or your users’ breach of these Terms or the law; and the acts of Invited Users you invite. This does not apply to the extent a claim was caused by DarkRisk’s gross negligence or wilful misconduct.

We will notify you of a covered claim and provide reasonable cooperation at your cost. You may control its defence and settlement, but may not admit liability for DarkRisk, require DarkRisk to pay money, or impose non-financial obligations on DarkRisk without our written consent.

Limitation of liability

To the fullest extent permitted by law, neither party will be liable under or in connection with the Services for indirect, incidental, special, exemplary, or consequential loss, or for loss of profits, revenue, goodwill, anticipated savings, data, or business opportunity, even if advised that such loss was possible.

DarkRisk is not liable for loss arising from: decisions made using Output; the acts or omissions of vendors, Invited Users, attackers or other third parties; third-party services; Customer Data you did not keep your own copy of; your failure to follow our security guidance; or preview, trial or free features.

Except for the excluded claims below, each party’s total aggregate liability arising out of or relating to the Services will not exceed the fees paid or payable for the affected Services during the 12 months before the event giving rise to liability. If no fee was payable, DarkRisk’s total aggregate liability will not exceed ZAR 1,000. The limits apply to all claims together, whatever their legal basis, and no director, officer, employee or contractor of DarkRisk is personally liable to you.

These exclusions and limits do not apply to liability that cannot lawfully be limited, fraud, wilful misconduct, death or personal injury caused by negligence, your payment obligations, your infringement or misuse of intellectual property, or your indemnity obligations. Any claim against DarkRisk must be brought within 12 months after the claimant became aware, or ought reasonably to have become aware, of the facts giving rise to it, unless the law does not allow that period to be shortened.

Sanctions and anti-corruption

Each party will comply with the anti-bribery and anti-corruption laws that apply to it, including the Prevention and Combating of Corrupt Activities Act 12 of 2004. You warrant that neither you nor any of your users is the subject of sanctions administered by the United Nations, South Africa, the European Union, the United Kingdom or the United States, and you will not use the Services, or allow them to be used, in breach of sanctions or export controls. We may suspend or terminate immediately if this warranty becomes untrue.

Governing law and disputes

These Terms and any non-contractual dispute arising from them are governed by the laws of the Republic of South Africa, without regard to conflict-of-law principles. Before starting formal proceedings, each party will give written notice describing the dispute and allow at least 30 days for authorised representatives to try to resolve it in good faith.

If the dispute is not resolved, the parties submit to the courts of South Africa with jurisdiction in Johannesburg, Gauteng. You consent to the jurisdiction of any magistrate’s court with jurisdiction over you, even if an amount DarkRisk claims exceeds its ordinary jurisdiction. A certificate signed by a director of DarkRisk stating an amount you owe is sufficient proof of that amount unless you prove otherwise. Either party may seek urgent interdictory or similar relief at any time to protect confidential information, intellectual property, security, or data.

General terms

• Notices. Legal notices must be in writing. Notices to DarkRisk must be sent to compliance@darkrisk.io. We may send notices to your account email or through the Services. An email notice is received when sent unless the sender receives a delivery failure.
• Electronic records. These Terms, orders, notices and records may be concluded, signed and kept electronically, and are not invalid for that reason.
• Variation.No change to these Terms or an order is valid unless in writing and agreed by both parties, except updates we make under “Changes and contact” below.
• Cession and assignment. You may not cede, assign or delegate the agreement without our written consent, except with your entire business in a merger or sale of substantially all relevant assets where the acquirer is not our competitor and can perform the agreement. We may cede, assign or delegate it in a reorganisation, merger, financing, or sale of our business.
• Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, such as power or network outages, failures of hosting providers, cyber attacks, or acts of government, except for payment obligations.
• Independent parties. The parties are independent contractors. These Terms do not create an agency, partnership, joint venture, employment, or fiduciary relationship.
• No third-party beneficiaries. Unless expressly stated, no other person has a right to enforce these Terms.
• Waiver and severability. A failure or delay in enforcing a right is not a waiver. If a provision is unenforceable, it will be adjusted only as much as necessary and the remainder will continue in effect.
• Entire agreement. These Terms, each applicable order, and documents incorporated by reference form the entire agreement about the Services and replace earlier proposals or discussions on that subject. Neither party relies on any representation not set out in them.

Changes and contact

We may update these Terms to reflect changes in law, security, or the Services. The effective date above identifies the current version. Material changes apply prospectively, and we will give reasonable notice where required. For a paid subscription, materially adverse changes take effect at the next renewal unless earlier application is needed by law or for security. Continued use of the Services after an update takes effect means you accept it.

Questions about these Terms or requests for earlier versions may be sent to compliance@darkrisk.io.