Terms & Conditions

This Software as a Service License Agreement (“SaaS Agreement”) is entered into by and between the client entity (“Company” or “Customer”) and OnDuty Security, Inc., a Delaware corporation (“Vendor”, “we”, or “OnDuty Security”). This Agreement sets forth the definitive terms, conditions, rights, and restrictions governing the license and usage of our proprietary enterprise security platform, cloud sensors, and associated services (collectively, “Services”).

Subject to timely payment of all applicable subscription fees detailed in an executed Quote or Order Form, OnDuty Security grants Customer a limited, non-exclusive, non-transferable, revocable license to utilize the SaaS and deployed eBPF sensors strictly for internal business operations during the Subscription Term.

License Audit Rights: OnDuty Security reserves the right, upon fifteen (15) days written notice, to verify compliance via remote system inspection or certified deployment reports. Discrepancies resulting in over-deployment will be invoiced at current standard list rates plus applicable late interest.

All Rights Retained: OnDuty Security and its licensors retain all exclusive rights, title, and interest in and to the platform, software, sensor binaries, SDKs, documentation, AI models, and all derivative works, modifications, and enhancements thereto. Customer receives no ownership interest or title under this Agreement.

Ownership: As between the parties, Customer retains all right, title, and interest in and to all data, source code, repository contents, cloud configuration, scan targets, and resulting scan findings that Customer submits to or connects with the Service (“Customer Data”). Customer grants OnDuty Security a limited, non-exclusive, worldwide license to host, copy, process, transmit, and analyze Customer Data solely as necessary to provide, secure, and improve the Services during the period Customer uses them.

Authorization to Scan: Customer represents and warrants that it owns, or has all rights, consents, and authorizations necessary to connect, each repository, cloud account, domain, or other asset it submits to the Service, and to authorize OnDuty Security to access and scan that asset on Customer's behalf. Customer shall not connect or direct scans at any asset it is not authorized to test.

Sensitive Material in Findings: Customer acknowledges that scans may surface credentials, secrets, or other sensitive material present in Customer's own code or environments; such material is treated as Customer Data and Customer is responsible for remediating it. Breach of this Section is subject to the indemnification obligations in Section 10 (Limitation of Liability & Indemnification).

Customer is fully responsible for all activity conducted within its authenticated enterprise workspace and must adhere to our Acceptable Use Policy (AUP). Customer shall not submit any illegal, misleading, defamatory, or threatening material ("Objectionable Matter") or utilize the platform to execute unauthorized vulnerability scans against third-party external networks.

Cryptographic Certificate Security: Customer is strictly responsible for securing API access keys, OAuth tokens, and TLS client certificates. Customer must notify us immediately upon suspecting any unauthorized token extraction or credentials compromise.

Suspension Rights: OnDuty Security reserves the absolute right to suspend workspace access immediately without advance notice if Customer's deployment threatens cloud network integrity, triggers denial-of-service protections, violates export control embargoes, or defaults on undisputed invoice obligations.

Software Conformance: OnDuty Security warrants that during the Subscription Term of an active paid subscription, the core SaaS platform will perform materially in accordance with published official Documentation under normal operational conditions.

Professional Services: Any customized onboarding, deployment engineering, or training services are warranted to be executed in a professional, workmanlike manner consistent with rigorous industry standards. Claims under this warranty must be submitted within thirty (30) calendar days of deliverable completion.

Formal service level agreements, response-time commitments, and uptime commitments are available only through a separately executed enterprise agreement signed by both parties. Nothing in this Section or elsewhere in this Agreement constitutes such a commitment.

Customer Responsibilities: To facilitate resolution of support requests, Customer agrees to designate a technical contact, submit reproduction steps where applicable, and cooperate in isolating network configurations or cloud IAM permission boundaries.

To the extent Customer processes personal information or sensitive workload parameters within the platform, our Data Processing Agreement (DPA) is incorporated by reference and governs all processing activities under GDPR Article 28 and the California Consumer Privacy Act (CCPA).

• Data Processor Status: OnDuty Security acts strictly as a Data Processor. We never sell, share, or monetize Customer personal records or sensor telemetry for commercial third-party marketing.
• Sub-processor Authorization: Customer grants general authorization for enterprise sub-processors (AWS, GCP, Azure). We provide advance notification for new sub-processor appointments, granting Customer three (3) business days to lodge legitimate data protection objections.
• Security Controls & Incident Management: We maintain commercially reasonable administrative, technical, and organizational controls appropriate to our size and stage; a SOC 2 attestation is on our roadmap (see our Trust Center). In the event of a verified data breach affecting Customer Data, we will notify Customer without undue delay as required by applicable law and provide reasonable diagnostic assistance.
• International Cross-Border Transfers: Where required by applicable law, transfers of European Economic Area (EEA) data outside the EEA rely on European Commission-approved Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

Payment Terms: All subscription invoices are due net thirty (30) calendar days from the invoice issuance date in US Dollars. Prepaid SaaS subscription fees are non-refundable except where Customer terminates for our uncured material breach.

Late Payments & Taxes: Overdue accounts are subject to late interest charges equal to the lesser of 1.5% per month or the maximum rate permitted by law. Customer is solely responsible for all federal, state, local sales, use, value-added, or withholding taxes levied on the subscription (excluding taxes based on our net income).

Customer Indemnification: Customer agrees to defend, indemnify, and hold harmless OnDuty Security and its officers against any third-party claims resulting from Customer's violation of export control restrictions, unlawful data submissions, or unauthorized execution of vulnerability testing against restricted third-party networks.

Governing Law & Arbitration: This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to conflict of laws principles. Any formal dispute or claim arising out of this Agreement shall be settled by binding arbitration administered by the American Arbitration Association (AAA) before a single arbitrator in New York City, New York, conducted in the English language.

US Government End-Users: The platform and cloud sensors are classified as "Commercial Items" under 48 C.F.R. § 2.101, consisting of commercial computer software. Licensed to US Government end-users solely with standard commercial rights.

Entire Agreement: This SaaS Agreement, together with executed Quotes, Order Forms, and the incorporated AUP and DPA, constitutes the entire understanding between the parties, superseding all prior oral or written representations.

Modifications to These Terms: We may modify this Agreement from time to time by posting an updated version and providing notice via email or in-platform notification. Changes take effect on the stated effective date, and Customer's continued use of the Service after that date constitutes acceptance of the updated Agreement. If Customer does not agree to a change, Customer's sole remedy is to stop using the Service and close its account. For negotiated enterprise agreements executed by both parties, modifications are valid only if made in a writing signed by authorized representatives of both parties.