Guard terms of service

Business terms for Guard, including authority, service scope, fees, confidentiality, remedies, liability, and termination.

Last revised: October 23, 2026

These Terms of Service ("Terms") constitute part of the binding agreement between Solarius B.V. ("Solarius") and the legal entity accepting them or an Order ("Customer," "you," or "your") for the provision and use of Guard. Solarius and Customer are each a "Party" and together the "Parties." An individual accepting on behalf of Customer represents and warrants that the individual has the legal authority to bind Customer. Authorized Users shall exercise access solely within Customer's permissions.

These Terms take effect on the date established by the applicable acceptance record or valid amendment notice. Publication or revision of this page does not, by itself, constitute acceptance or amend an executed agreement.

Definitions and interpretationCopy link

For purposes of these Terms, the following definitions apply:

• "Agreement" means the contractual instruments identified in Agreement and order of precedence, subject to the priority stated there.
• "Order" means an order form, online purchase confirmation, or other ordering instrument accepted by the Parties that identifies the purchased Services, quantities, charges, and applicable term.
• "Services" means the Guard capabilities and associated proprietary software, APIs, clients, or agents supplied by Solarius within the deployment, capacity, and support scope accepted in an Order.
• "Authorized Users" means individuals Customer authorizes to access the Services on its behalf. Service accounts and automated credentials remain subject to Customer's applicable permissions and obligations.
• "Customer Data" means data, content, configurations, credentials, and records submitted by or on behalf of Customer, or collected or generated for Customer through its authorized use of the Services.
• "Documentation" means the applicable published service specifications and operating instructions. Documentation describes functionality and limits subject to the Agreement's express contractual protections.
• "Term" means the initial service period and any renewal period established by the applicable Order.
• "Intellectual Property Rights" means copyrights, patent rights, trade secrets, database rights, trademarks, and other proprietary rights recognized under applicable law.

References to a Party include its permitted successors and assigns. References to applicable law include binding amendments and successor provisions. Examples introduced by "including" are illustrative and do not enlarge the purchased service scope. A provision of mandatory law prevails over an inconsistent contractual interpretation.

Agreement and order of precedenceCopy link

The Agreement consists of the accepted order or purchase confirmation, any negotiated master agreement, these Terms, the Solarius Acceptable Use Policy and product restrictions, the Billing and Cancellation Policy, and other policies expressly incorporated here or in the order. The Data Processing Addendum governs personal data Solarius processes on your instructions. The Privacy Policy explains Solarius's own processing and is a notice rather than permission to expand customer-data use.

Mandatory law and applicable transfer clauses take precedence. The DPA controls personal-data-processing conflicts. A negotiated signed agreement controls other conflicts, followed by an order that expressly identifies its variation, these Terms, and incorporated operational policies. The service specifications describe product behavior and limits; they do not override a contractual protection, create an unpurchased SLA, or permit unilateral changes to an accepted price. An order's ordinary product description does not silently amend liability or data protection.

Accounts, authority, and administrationCopy link

Customer shall provide and maintain accurate business, billing, and security contact information and a reachable organization owner. Customer shall administer Authorized Users, role assignments, service accounts, tokens, and connected providers within its lawful authority. Customer shall require individual user accounts, protect credentials, apply appropriate authentication, and promptly notify Solarius of suspected compromise. Solarius remains subject to its contracted service-security duties; a compromise is not automatically attributed to you merely because your credentials were used.

Customer shall be responsible for compliance with the Agreement by its Authorized Users and for downstream use it permits within its control. Customer shall take reasonable corrective action upon becoming aware of misuse. This allocation does not relieve Solarius of its own obligations or make Customer responsible for conduct attributable to Solarius's breach. Reselling standalone service access, transferring an organization to a different legal entity, or using restricted third-party licenses requires the corresponding permission. The Customer can use purchased capacity to support your own customers within your agreement. Solarius does not obtain rights over those customers' data beyond the service instructions.

Service license and deployment scopeCopy link

Subject to the Agreement, Solarius grants Customer, during the paid or authorized trial Term, a limited, nonexclusive right to access and use the purchased Guard Services and supplied client, agent, or self-hosted software for Customer's authorized business purposes. The grant extends to Authorized Users and Customer's permitted downstream use solely within the accepted deployment, license, and capacity scope. Assignment and resale remain subject to the express permissions in the Agreement. Guard covers threat intelligence, traffic protection, vulnerability assessment, endpoint controls, secure access, and managed security operations. Additional professional services require a defined scope and accepted commercial terms.

The Customer shall not copy or distribute proprietary service software beyond this license, bypass technical license or tenant boundaries, or reverse engineer it except to the extent mandatory law or an applicable open-source license permits. Open-source components retain their own license rights. Solarius and its licensors retain all right, title, and interest in the proprietary software, service materials, and related Intellectual Property Rights. As between the Parties, Customer retains all right, title, and interest in Customer Data and its independently developed applications. No license, assignment, or other right is granted by implication, estoppel, or otherwise. Each Party reserves all rights not expressly granted, subject to mandatory law and applicable component licenses.

Security authority and coverageCopy link

You authorize only the collection, monitoring, assessment, and response activities selected in your configuration, approved playbooks, and engagement scope. The Customer shall own the protected assets or hold valid permission from their owners and affected providers. Penetration testing requires written rules of engagement. Purchasing Guard does not authorize tests against Solarius, another customer, an employee's unrelated personal accounts, or a third party.

The Customer is responsible for employee notices, consultation obligations, lawful monitoring purposes, access assignments, and proportionate collection. Device enrollment does not itself authorize capture of employee content. Insider-threat signals and risk scores require contextual human review before consequential employment or similar decisions. Guard must not be used for covert employee surveillance or discriminatory decisions.

SOC monitoring does not grant blanket authority to isolate devices, disable accounts, quarantine files, or change network controls. Disruptive actions require the applicable approval or an expressly preauthorized playbook with defined targets and limits. Offline executors can retain an applied policy; withdrawing management access does not prove isolation was released. Completed actions require separate restoration or release, and incident closure does not release containment.

Protection depends on supported platforms, enabled collectors, admitted traffic, healthy routing, and the purchased capacity. WAF inspection of encrypted HTTP requires authorized TLS termination. Monitor-only policy does not enforce blocking. False positives and missed detections are possible. Guard supports your security program; you retain responsibility for application patching, independent recovery, and decisions about business continuity.

Acceptable useCopy link

The Solarius Acceptable Use, Reporting and Appeals Policy supplies the common rules for lawful use, privacy, communications, abuse reports, proportionate enforcement, and review. The following additional restrictions apply to Guard. Purchased capacity and permissions of affected owners remain controlling.

Use Guard only for legitimate protection and authorized assessment. Do not use it to conduct attacks, deploy malware outside an approved isolated test, steal credentials, gain persistence, intercept unrelated communications, stalk a person, suppress lawful reporting, or evade another operator's defensive controls. A target's public reachability does not establish testing permission.

Employee monitoring must have a defined security purpose, a lawful basis, required advance information and consultation, limited reviewers, and proportionate retention. Do not secretly activate personal-content collection or use an insider-threat signal as the sole basis for a significant employment decision. A customer's general employment contract is not universal permission for every collection method.

Contribute only reviewed, non-sensitive threat indicators through the approved sharing workflow. Do not submit personal information, private hostnames, access tokens, customer evidence, or confidential files disguised as indicators. Protected-traffic access and decrypted payloads must remain limited to authorized security purposes. Assessment scope, disruption limits, and stop procedures follow authorized security testing.

Use least privilege and collect only necessary information. Intentional processing of regulated medical information, payment-card authentication data, biometric templates, criminal-offence records, or other specially protected information requires an expressly accepted supported scope and safeguards. Incidental security evidence remains restricted under the DPA; it does not authorize a new collection program.

Report misuse through the common reporting route, with minimal redacted evidence. Product notice and suspension protections in these Terms remain controlling. A report or restriction does not grant general access to private customer content.

Customer data, confidentiality, and feedbackCopy link

You authorize Solarius to host, transmit, reproduce, and otherwise process customer data only to provide, secure, support, and administer the contracted service, follow documented instructions, or meet binding law under the DPA. This is a limited service permission, not ownership or a general commercialization license. Solarius does not sell customer personal data, use it for cross-context behavioral advertising, or use customer content to train general-purpose AI models. A separate optional analysis feature requires a specific data-use agreement before such processing.

"Confidential Information" means nonpublic business, technical, financial, security, or customer information disclosed by or on behalf of a Party ("Disclosing Party") to the other Party ("Receiving Party") that is designated confidential or should reasonably be understood to be confidential from its nature and the circumstances. Customer Data is Customer's Confidential Information. Solarius's nonpublic proprietary software and technical materials are Solarius's Confidential Information.

The Receiving Party shall use Confidential Information solely to perform the Agreement and shall protect it with at least reasonable care. Disclosure shall be limited to personnel and contracted providers with a need to know who are subject to enforceable confidentiality obligations. The Receiving Party shall remain responsible for disclosures it authorizes. The obligations exclude information the Receiving Party can demonstrate is lawfully public without breach, independently developed without use of the information, or lawfully obtained without a confidentiality restriction.

A compelled disclosure shall be limited to the information legally required and shall follow government-request safeguards, including notice when lawful. On termination or a lawful request, the Receiving Party shall return or destroy Confidential Information subject to the DPA, agreed transition rights, and lawful records or protected backup retention. Retained copies remain subject to confidentiality and purpose limitations. These obligations continue for three years after termination; trade secrets and protected personal data remain protected for as long as applicable law requires.

Customer is under no obligation to provide suggestions or feedback. If Customer voluntarily provides general feedback, Solarius is permitted to use it to improve the Services without a royalty obligation. That permission does not assign Customer's Intellectual Property Rights or license Confidential Information, personal data, trademarks, or inventions disclosed under a separate agreement. Solarius shall obtain Customer's permission before using Customer's name or logo in publicity.

Charges, renewal, and taxesCopy link

The accepted Order, purchase review, and applicable rate card shall establish the currency, purchased quantities, included capacity, usage meters, billing interval, applicable taxes, and commitments. Customer shall pay valid charges by the stated due date. A recurring subscription shall renew for its disclosed term unless canceled through the billing workflow or another accepted notice route. No undisclosed cancellation penalty shall apply, and no trial shall convert to paid service without an accepted paid purchase or express conversion authorization.

Recurring base or seat price increases apply no earlier than renewal, with at least 30 days' advance notice and time to decline renewal. Changes to variable usage rates require at least 30 days' notice before future consumption at the new rate unless you expressly purchase a separately priced resource. Fixed commitments remain governed by their agreed rates. No increase applies retroactively. Taxes legally payable by you are additional; taxes on Solarius's own net income remain ours.

Service operation, changes, and warrantiesCopy link

Solarius shall provide the contracted service with reasonable skill and care and materially in accordance with its documented core functionality. The Customer shall report a material failure with enough detail for investigation. Solarius shall use reasonable efforts to correct it. If Solarius cannot remedy a material nonconformity within 30 days after notice, you can terminate the affected service and receive a prorated refund of prepaid unused affected subscription fees, without waiving another non-excludable remedy.

Solarius can improve features, fix vulnerabilities, and make proportionate operational changes. Solarius shall not materially reduce purchased core functionality during a prepaid term without offering a substantially equivalent alternative or the right to end the affected service with a refund of its prepaid unused fees. Solarius aims to give at least 90 days' notice for planned retirement of a generally available core feature; urgent security or legal requirements can require shorter notice with an explanation. Service and support commitments govern coverage boundaries.

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, AND EXCEPT FOR EXPRESS WARRANTIES, OBLIGATIONS, AND REMEDIES IN THE AGREEMENT, SOLARIUS DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. Solarius does not warrant uninterrupted or error-free operation, absolute security, complete or infallible results, or compatibility with every external system. This disclaimer does not exclude the express reasonable-skill-and-care obligation, data-protection duties, the indemnities below, or any warranty or remedy that cannot lawfully be excluded.

Preview and beta features are provided for optional evaluation, are subject to change or withdrawal, and carry no additional service-level agreement (SLA). Customer shall assess their suitability before relying on them for production continuity. Preview status does not authorize processing outside the DPA or excuse an otherwise applicable mandatory obligation.

Restrictions, investigation, and appealCopy link

Solarius can investigate credible evidence of material breach, unlawful activity, nonpayment, or a serious service-security threat. Solarius uses the minimum customer-data access needed under the DPA and does not obtain a general right to inspect private content. Solarius normally gives the authorized contact a reason, affected scope, required remedy, and at least 10 days to cure a remediable breach before suspension. Immediate action is permitted when delay risks serious harm, legal noncompliance, active compromise, or material disruption.

Solarius scopes restrictions to the affected assets, assessments, collectors, integrations, or organization whenever that addresses the risk. Solarius coordinates continuity for protective services and retained evidence where safe and lawful. Suspension does not imply release of endpoint isolation, restoration of quarantined files, or withdrawal of an already applied policy.

The Customer can challenge a restriction through help@solarius.me, with escalation to legal@solarius.me. Solarius reviews the evidence and restores affected access when the basis is resolved. Notice can be delayed only for a binding prohibition or a concrete risk to an investigation or service security. Good-faith criticism, a valid billing dispute, or a privacy-rights request is not itself grounds for suspension.

Termination and transitionCopy link

Either Party is entitled to terminate the affected Agreement or Order by written notice if the other Party commits a material breach and fails to remedy it within 30 days after receiving written notice specifying the breach. A material breach incapable of remedy, or conduct presenting an ongoing serious unlawful threat, can justify immediate termination to the extent permitted by law. Customer is also entitled to cancel renewal under the billing policy. Solarius is entitled to decline renewal on at least 30 days' notice. Any insolvency-related termination right is subject to applicable restrictions on enforcement.

On expiry or termination, stop using the terminated licensed service except for the permitted export and transition process. Valid accrued charges and accepted noncancellable commitments remain payable. If Solarius terminates for convenience during a paid term, or you terminate for Solarius's uncured material breach, Solarius refunds prepaid unused affected subscription fees. Solarius does not charge for post-termination service Solarius no longer supplies except retained resources or transition services you expressly keep under agreed terms.

Retention and deletion governs exports, instructed deletion, backup expiry, lawful holds, and product-specific closure. Solarius shall agree reasonable transition assistance for non-self-service requests; additional professional work requires a quote, not an undisclosed exit fee. Confidentiality, accrued payment obligations, IP ownership, data-protection obligations, and enforceable liability and dispute provisions survive as needed.

Third-party claimsCopy link

Subject to the procedure and limits below, Solarius shall defend and indemnify Customer against a third-party claim alleging that the unmodified Services supplied by Solarius infringe that third party's copyright, patent, or trade secret. The indemnity covers damages finally awarded by a competent court and settlement amounts approved by Solarius. This excludes claims caused by your unlawful data, unauthorized modifications, or combinations not required by the service when the claim would not otherwise arise. Solarius can obtain continued rights, provide a materially equivalent noninfringing replacement, or terminate the affected service and refund prepaid unused affected fees.

Subject to the same procedure and limits, Customer shall defend and indemnify Solarius against a third-party claim arising from Customer Data that infringes the claimant's Intellectual Property Rights or Customer's deliberate unlawful use of the Services. The indemnity covers damages finally awarded by a competent court and settlement amounts approved by Customer. This does not apply to a claim caused by Solarius's breach, negligence, or unauthorized processing. Neither party assumes the other's ordinary commercial disputes with its own customers.

The Party seeking indemnification ("Indemnified Party") shall give the other Party ("Indemnifying Party") prompt written notice of the claim, control of its defense and settlement, and reasonable cooperation at the Indemnifying Party's expense. A delay in notice reduces the obligation only to the extent it materially prejudices the defense. The Indemnified Party is entitled to participate through its own counsel at its own expense. No settlement shall admit fault, impose nonmonetary obligations, or restrict the Indemnified Party's business without its reasonable consent. These indemnities remain subject to Liability allocation.

Liability allocationCopy link

SUBJECT TO THE EXPRESS EXCEPTIONS BELOW AND TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY SHALL BE LIABLE FOR INDIRECT OR CONSEQUENTIAL LOSS, LOST PROSPECTIVE PROFITS, OR LOST BUSINESS OPPORTUNITY ARISING OUT OF OR IN CONNECTION WITH THE AGREEMENT, WHETHER IN CONTRACT, TORT, OR OTHERWISE. Reasonable direct costs of restoring or reconstructing customer data, investigating an incident caused by a party's breach, and obtaining necessary substitute service are not excluded merely because they concern data or service interruption. Loss must remain foreseeable, evidenced, and reasonably mitigated.

Subject to the exclusions and enhanced limit below, each Party's aggregate liability arising out of or in connection with the Agreement in any rolling 12-month period shall not exceed the fees paid or payable for the affected Services during the preceding 12 months. Where the Services have been supplied for less than 12 months, the limit shall use the fees paid or payable for the first 12 months: recurring subscription fees shall be annualized, and hypothetical future variable usage shall be excluded. Related events attributable to the same cause shall be treated as a single claim arising on the date of the first such event.

For liability arising from breach of confidentiality, data-protection obligations, or an indemnity in Third-party claims, the aggregate limit shall be twice the ordinary cap and shall replace, rather than supplement, that cap. No exclusion or limitation shall apply to fraud, intentional misconduct, gross negligence to the extent its exclusion is impermissible, death or personal injury caused by negligence, or any liability that cannot lawfully be excluded or limited. Customer's obligation to pay valid service charges is a payment obligation and shall not be reduced by the damages cap. Nothing in the Agreement limits an individual's statutory data-protection rights, a supervisory authority's powers, or mandatory remedies available to a beneficiary of binding transfer clauses.

Disputes, notices, and general provisionsCopy link

Dutch law governs the agreement, excluding its conflict-of-law rules. Courts competent at Solarius's registered seat in the Netherlands have jurisdiction, subject to a negotiated forum and any mandatory jurisdiction. Before proceedings, the parties will try in good faith to resolve a written dispute for 30 days; this does not delay urgent interim relief, limitation deadlines, privacy complaints, or statutory rights. No compulsory arbitration or class-action waiver is imposed by these Terms.

Send contractual notices to legal@solarius.me and the business address in your order. Solarius sends notices to your designated contractual contact or organization owner. A material notice must be directly communicated, not merely edited into a help page. Each party must keep notice details current and make reasonable efforts to resolve delivery failures.

Neither party is responsible for delay caused by an event beyond its reasonable control when it takes reasonable mitigation steps. Routine capacity shortages, inadequate security, or a supplier failure that reasonable contingency would prevent are not automatically excused. Payment for service already delivered remains due. After 30 continuous days of a force-majeure interruption, either party can end the affected service and Solarius refunds prepaid unused affected subscription fees. Data-protection duties remain applicable.

Neither party can assign the agreement in a way that reduces the other's protections. Assignment to an affiliate or in a genuine merger or sale of substantially all relevant assets is permitted if the successor assumes the obligations and notice is given; another assignment requires consent not unreasonably withheld. The Parties are independent contractors; the Agreement does not establish a partnership, joint venture, employment, or agency relationship. Neither Party has authority to bind the other except as expressly agreed. Failure or delay in exercising a right does not waive that right. If a provision is held invalid or unenforceable, it shall be limited or severed only to the extent necessary, and the remaining provisions shall continue in effect.

The accepted contractual instruments identified in Agreement and order of precedence constitute the Parties' agreement concerning their subject matter and supersede prior inconsistent proposals or understandings on that subject, subject to mandatory law. An administrative purchase order or vendor form does not vary the Agreement unless the Parties expressly accept the variation through the applicable contracting process. This provision does not override a negotiated agreement or exclude liability for fraud or a mandatory precontractual duty.

Solarius gives at least 30 days' direct notice of materially adverse policy amendments. They apply from the next renewal unless you expressly accept earlier application or law requires an earlier change. Urgent legal or security amendments are limited to what is necessary and explained promptly. Solarius does not retroactively change accrued claims, authorize a new data purpose through a terms edit, or override the DPA amendment process. Mandatory consumer or small-business protections apply if relevant despite the business scope of these Terms.