SecureGraph Terms of Service

1. Acceptance of these Terms

You accept these Terms by (a) creating an account, (b) registering your organization, (c) submitting any asset or engagement to the Platform, or (d) otherwise accessing or using the Platform. If you are entering into these Terms on behalf of a company or other legal entity, you represent and warrant that you have authority to bind that entity, and “you” means the entity you represent. If you do not have such authority, or do not agree to these Terms, you must not create an account or use the Platform.

2. Definitions

• “Acceptable Use Policy” or “AUP” means the policy at /aup, which forms part of these Terms.
• “Assessment Services” means staff-facilitated VAPT, penetration testing, or security assessment engagements delivered by SecureGraph personnel or its approved contractors.
• “Customer Data” means data, content, and materials you submit to or through the Platform, including asset inventories, scan configurations, and your security database contents.
• “Platform” means the SecureGraph software-as-a-service application, APIs, dashboards, and related modules.
• “Submitted Assets” means any system, application, endpoint, domain, repository, or infrastructure you configure for assessment, discovery, or scanning.
• “SecureGraph” means the entity operating the Platform, its affiliates, personnel, and permitted subcontractors.

3. The Services

The Platform is a subscription-based security platform. Depending on your plan, you may use the software modules for attack-surface discovery, asset intelligence, compliance tracking, alerting, and related functions, and you may engage SecureGraph for Assessment Services. Charges are processed through our payment provider (Paystack). Your plan, module entitlements, and any project engagement scope are described in the applicable order, plan page, or statement of work.

4. Eligibility and accounts

• You must be at least 18 years old and able to form a binding contract under Nigerian law.
• You must provide accurate registration information and keep it current.
• You are responsible for all activity under your account and for the security of your credentials.
• You must promptly notify SecureGraph of any unauthorized use of your account.

5. Authorization to test — critical

Security testing is regulated and, where performed without authorization, is criminal in Nigeria. Sections 6, 8, and 28 of the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended) criminalize unauthorized access to, and interference with, computer systems. You therefore warrant and covenant that, for every Submitted Asset, you own the asset or hold written authorization from its lawful owner to configure it for assessment, discovery, or scanning, and that you will maintain and be able to produce that authorization on request. The Platform requires confirmation of ownership or authorization before active testing proceeds, and all activity is logged and auditable.

• You must confirm ownership or written authorization for every Submitted Asset before testing.
• You must keep evidence of authorization (engagement letters, penetration-test permissions, cloud-owner consents) and provide it to SecureGraph or regulators on request.
• Where a Submitted Asset is hosted on third-party infrastructure (for example cloud providers), you must comply with that provider's own testing/authorization policies.
• You must not test or scan any asset outside the in-scope set you have authorized and confirmed.
• For targets that cannot be tied to an owner by a technical check, such as IP addresses and IP ranges, you attest when you add such a target or start a test against it that you own it or hold current written authorization from its lawful owner to test it, within the scope of that authorization. SecureGraph relies on this attestation and does not independently verify it; you are solely responsible for every such target and for all consequences of testing it (see the Acceptable Use Policy, "Targets we can't verify technically").
• Findings and activity are recorded against your organization and may be provided to law enforcement or regulators as required by law.

6. Subscriptions, billing, and taxes

Subscriptions renew at the agreed billing cycle until cancelled, and are payable in advance through Paystack. Project engagements are billed as one-time fees on the terms of the applicable statement of work. Prices are exclusive of applicable taxes unless stated otherwise; where required, VAT (currently 7.5% under the Finance Act) and other statutory levies will be added. Amounts due are non-cancellable except as set out in these Terms.

• Subscriptions renew automatically unless you cancel before the renewal date.
• Fees for Assessment Services already delivered are non-refundable once work has commenced.
• Failure to pay when due may result in suspension until payment is received.
• Paystack is our payment processor; your use of Paystack is also subject to Paystack's own terms.

7. Acceptable use

You must use the Platform only for lawful purposes and only on assets you are authorized to test. Our Acceptable Use Policy forms part of these Terms and details prohibited conduct, including unauthorized access, denial-of-service activity, malware distribution, phishing, credential theft, data exfiltration, and use of the Platform to facilitate any crime. Breach of the AUP is a material breach of these Terms.

8. Intellectual property

As between you and SecureGraph, SecureGraph owns all rights in the Platform, including its software, documentation, design, and any updates or derivative works. You are granted a limited, non-exclusive, non-transferable, revocable right to use the Platform for your internal business purposes during the term, subject to these Terms. You retain ownership of your Customer Data. Nothing in these Terms assigns to SecureGraph any of your trademarks or proprietary data.

9. Data protection and privacy

To the extent personal data is processed, the parties acknowledge the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation 2019 apply. You are the data controller for personal data you submit; SecureGraph processes it as a data controller for platform operation and as a processor for Customer Data you direct. We implement appropriate technical and organizational measures (including encryption of secrets at rest) as required by Section 39 of the NDPA. Our Privacy notice explains what we store and what stays in your dedicated security database.

• Breach notification: where a personal data breach occurs, SecureGraph will notify you without undue delay, and you are responsible for notifying the Nigeria Data Protection Commission (NDPC) and affected data subjects within the timeframes required by Section 40 of the NDPA.
• Cross-border transfers of personal data will comply with the transfer requirements of the NDPA and NDPR.
• You are responsible for the lawfulness of the personal data you upload and for any data you extract from your own systems.

10. Confidentiality

Each party will protect the other's Confidential Information with at least the same care it uses for its own, and will use it only to perform obligations under these Terms. Confidential Information includes findings, evidence, credentials, and business information not generally known. The receiving party may disclose Confidential Information where required by law, regulation, or court order, provided it gives prior notice where legally permissible. This obligation survives termination of these Terms.

11. Security

SecureGraph maintains administrative, physical, and technical safeguards for the Platform and the platform database, including encryption of connection credentials (Fernet) at rest and role-based access controls. Security inventory and findings are written only to the dedicated security database you configure. You are responsible for securing your own credentials, users, and any systems you connect.

12. Third-party services

The Platform may integrate with third-party services (for example GitHub, cloud providers, and payment processors). Such services are subject to their own terms and the provider's own privacy and security practices. SecureGraph is not responsible for third-party services or for your compliance with their testing and usage policies.

13. Suspension and termination

You may cancel your subscription at any time, effective at the end of the then-current billing period. SecureGraph may suspend or terminate your access immediately, without notice, if you breach these Terms or the AUP (including unauthorized testing), if your activity creates a legal or security risk to SecureGraph or third parties, or if required by law or regulator. On termination, your access stops and encrypted secrets become unusable; you may export your Customer Data during the notice period where applicable.

14. Disclaimers

The Platform and Assessment Services are provided on an “as is” and “as available” basis. To the maximum extent permitted by law, SecureGraph disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. Security testing cannot guarantee the discovery of all vulnerabilities; findings reflect the scope, tools, and conditions at the time of testing. SecureGraph does not warrant that the Platform will be uninterrupted or error-free.

15. Limitation of liability

To the maximum extent permitted by law, SecureGraph's aggregate liability arising out of or related to these Terms (whether in contract, tort, negligence, or otherwise) will not exceed the total fees paid by you to SecureGraph in the twelve (12) months preceding the event giving rise to the claim. Neither party will be liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profits, data, or goodwill. Nothing in these Terms limits liability that cannot be limited under Nigerian law, including liability for fraud, willful misconduct, or death or personal injury caused by negligence.

• The limitation in this Section 15 is a material inducement to SecureGraph providing the Platform, and you acknowledge it is fair and reasonable in light of the fees charged.
• This Section 15 does not limit your indemnification obligations under Section 16.

16. Indemnification

You will indemnify, defend, and hold harmless SecureGraph, its affiliates, officers, and personnel from and against any third-party claims, damages, losses, and reasonable costs arising out of or related to: (a) your breach of these Terms or the AUP; (b) any testing, scanning, or assessment you perform or cause to be performed without authorization, including any testing of a target you submitted on the basis of your attestation of ownership or authorization under Section 5 (such as an IP address or IP range); (c) your Customer Data; or (d) your violation of any applicable law, including the Cybercrimes Act, the NDPA, and sectoral regulations.

17. Changes to these Terms

SecureGraph may update these Terms from time to time. We will notify you of material changes by email or in-app notice at least thirty (30) days before they take effect, and the version number will change. Continued use of the Platform after the effective date constitutes acceptance of the updated Terms. If you do not agree, you may cancel before the changes take effect.

18. Force majeure

Neither party is liable for failure or delay in performance caused by events beyond its reasonable control, including natural disasters, war, terrorism, pandemics, power or connectivity outages, government action, and cyber incidents affecting third-party infrastructure.

19. Governing law and jurisdiction

These Terms are governed by and construed in accordance with the laws of the Federal Republic of Nigeria, without regard to conflict-of-law principles. The parties irrevocably submit to the exclusive jurisdiction of the Federal High Court of Nigeria, which has jurisdiction over cybercrime and related electronic offences under the Cybercrimes Act, and the High Court of Lagos State for matters outside the Federal High Court's exclusive jurisdiction.

20. General provisions

• Entire agreement: these Terms (with the AUP and Privacy notice) constitute the entire agreement between the parties and supersede prior agreements.
• Severability: if any provision is held invalid or unenforceable, the remaining provisions continue in full force and effect.
• No waiver: failure to enforce a provision is not a waiver of that provision.
• Assignment: you may not assign these Terms without SecureGraph's prior written consent; SecureGraph may assign them in connection with a merger or sale of substantially all assets.
• Notices: SecureGraph may provide notices to the email on your account; you may contact us through the Platform or support channels.
• Survival: sections concerning payment, IP, confidentiality, data protection, disclaimers, liability, indemnification, governing law, and general provisions survive termination.

21. Contact

Questions about these Terms may be directed to us through the Platform's support channel or the contact details on our website.