Terms of Service

"Viktrix" means Viktrix Cyber Limited, a company registered in Scotland (Company No. SC887749).

"Client" means the organisation that has contracted with Viktrix for services.

"Services" means the managed SOC, Vindex platform access, and any professional services contracted.

"Platform" means the Vindex detection and response software and associated infrastructure.

"Authorised Users" means individuals authorised by the Client to access the Platform.

Vindex is a managed security operations platform: it ingests security telemetry from customer endpoints, triages alerts using automated analysis with human oversight, and can take agreed containment actions. Service tiers, endpoint counts, and support levels are set out in the applicable order form.

Viktrix will provide the Services specified in the Order Form or Statement of Work ("SOW") in accordance with these Terms and any service-level commitments in the applicable schedule.

Viktrix may update or modify the Platform from time to time. We will not materially reduce the functionality of the Platform during a paid subscription term without providing 30 days' written notice.

You are responsible for maintaining the confidentiality of console credentials and for all activity under your account. You must not:

• Attempt to access another tenant's data
• Use the Services to monitor systems you do not own or lack authority to monitor
• Reverse engineer, decompile, or extract source code from the Platform
• Use the Services in violation of applicable law, or to process data the Client is not authorised to process
• Share credentials or allow access by unauthorised persons

You warrant that you have the legal right to deploy monitoring agents on all endpoints you enrol, including any required employee notifications under applicable law.

You will provide accurate scoping information and maintain agreed prerequisites (network access, credentials) needed to deliver the Services, and ensure Authorised Users comply with these Terms.

The Platform takes automated containment actions only within the scope agreed at onboarding. Actions designated as requiring approval will not execute without sign-off by an authorised user.

You acknowledge that security monitoring is probabilistic: no provider can guarantee detection or prevention of every threat.

Invoices are payable within 30 days of the invoice date. Annual plans are invoiced quarterly. Overdue invoices accrue interest at 8% per annum above the Bank of England base rate under the Late Payment of Commercial Debts Act 1998.

Viktrix reserves the right to suspend access to the Platform after 14 days' written notice if payment is not received. Prices may change at renewal with 30 days' notice.

Each party will comply with UK GDPR. Where Viktrix processes personal data on behalf of the Client as a data processor, this is governed by the Data Processing Agreement (DPA) which forms part of the contract. The DPA sets out the categories of data processed, the purposes, the security measures, and the rights of data subjects.

The Client is responsible for ensuring it has the legal basis to share data with Viktrix and that data subjects have been appropriately informed. Our Privacy Policy describes processing for which Viktrix is controller.

Each party agrees to keep confidential all information designated as confidential or which a reasonable person would understand to be confidential, and not to use it for any purpose other than performing obligations under the contract. This obligation survives termination of the contract for a period of three years.

Viktrix maintains technical and organisational measures appropriate to the sensitivity of security telemetry, including tenant isolation, anonymisation before AI processing, and tamper-evident audit logging.

Viktrix retains all intellectual property rights in the Platform, including all software, algorithms, models, and documentation. Nothing in these Terms transfers any IP from Viktrix to the Client.

The Client retains all rights in its own data processed via the Platform. The Client grants Viktrix a licence to process that data solely to provide the Services, and to derive anonymised, aggregated, and non-attributable statistics that cannot identify the Client or any individual.

The Services are provided with reasonable skill and care. Except as expressly stated, all other warranties are excluded to the maximum extent permitted by law. To the maximum extent permitted by law:

• Viktrix's aggregate liability to the Client for all claims arising under or in connection with the contract shall not exceed the total fees paid by the Client in the 12 months preceding the claim
• Viktrix shall not be liable for indirect, incidental, consequential, or punitive damages, including loss of profit, revenue, or data

Nothing in these Terms limits liability for fraud, death or personal injury caused by negligence, or any other liability that cannot be excluded by law.

The contract commences on the start date in the Order Form and continues for the initial term specified. After the initial term, the contract renews automatically unless either party gives 30 days' written notice of non-renewal before the renewal date.

Either party may terminate immediately by written notice if the other party materially breaches the contract and fails to remedy the breach within 14 days of notice.

On termination, we will make your data available for export for 30 days, after which it is deleted in line with our retention schedule.

These Terms and any dispute arising from them are governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales.

Notices go to the addresses in the Order Form. If any provision is unenforceable, the remainder stands.

Viktrix may update these Terms with 30 days' notice. Continued use of the Services after the effective date of any changes constitutes acceptance. Material changes to existing contracts require written agreement.