Enterprise Trial Terms of Service

1. ‍INTERPRETATION
   

In these Terms:‍

“Acceptance Date” means the date on which the Customer accepts these Terms in accordance with clause 2.

“Confidential Information” has the meaning given in clause 10.1.

“Customer” means the organisation identified in the trial registration form on whose behalf these Terms are accepted.

“Customer Data” means data submitted to the Platform by or on behalf of the Customer, and data observed or collected by the Platform from the Customer Environment, including Deception Asset configuration, event logs, alerts and other output generated for the Customer, in each case to the extent attributable to the Customer.

“Customer Environment” means the cloud, network, identity, endpoint and other systems controlled by the Customer in or in respect of which the Platform is deployed.

“Deception Assets” means canaries, canary tokens, credentials, artefacts and other decoy resources created, deployed or configured by or through the Platform in the Customer Environment.

“Feedback” has the meaning given in clause 11.3.

“Platform” means Tracebit Enterprise Edition, together with any agents, connectors, integrations, applications and documentation made available for use in connection with it.

“Platform Telemetry” means technical data, telemetry and indicators observed, generated or collected through operation of the Platform, including network identifiers, DNS queries, security event logs, attack patterns, behavioural signals, configuration information and performance metrics. Platform Telemetry does not include Usage Data or Customer Data.

“Tracebit Infrastructure Activity” means that part of Platform Telemetry which relates solely to activity observed on infrastructure operated by Tracebit, and which contains no field identifying or attributable to the Customer or the Customer Environment.

“Trial” means the Customer’s access to and use of the Platform under these Terms.

“Trial Term” has the meaning given in clause 4.1.

“Usage Data” means data about how Users interact with the Platform interface, including feature usage, navigation events, session duration, error and performance data, and browser and device information. Usage Data does not include Customer Data or the content of any alert, event or investigation.

“User” means an individual authorised by the Customer to access the Platform under the Customer’s account.

“Including” means “including without limitation”. Clause headings do not affect interpretation. References to a statute include that statute as amended or replaced.

2. ACCEPTANCE AND AUTHORITY
   
   1. The individual accepting these Terms does so on behalf of the Customer, and warrants that they are authorised to bind the Customer to these Terms.
   2. The Customer must provide accurate registration details, including the full legal name of the Customer and the name, business email address and job title of the individual accepting these Terms.
   3. Tracebit may send a copy of these Terms and confirmation of the Trial to the individual accepting them and to any other contact identified by the Customer, and may decline to provision or may terminate the Trial if it is not satisfied as to the matters in clauses 2.1 and 2.2.
   4. These Terms govern the Trial. Where the Customer and Tracebit have entered into a non-disclosure agreement before the Acceptance Date, these Terms prevail over that agreement in respect of the Trial and the information exchanged in connection with it, and that agreement otherwise continues in force. Where the Customer subsequently enters into a subscription agreement with Tracebit, that agreement governs from its effective date, save that clauses 8.3(b), 8.3(c), 8.5 and 11 continue in force notwithstanding any subsequent agreement between the parties, unless that agreement expressly provides otherwise.
3. THE TRIAL
   
   1. Subject to these Terms, Tracebit grants the Customer a limited, revocable, non-sublicensable, non-exclusive, non-transferable, royalty free right during the Trial Term to permit Users to access and use the Platform for the sole purpose of evaluating it for possible purchase.
   2. The Trial is provided free of charge.
   3. Tracebit may impose, vary or remove limits on the Trial, including limits on the number of Users, the number or type of Deception Assets, data volume, API calls, features and integrations. Current limits are notified to the Customer on provisioning.
   4. The Customer is responsible for all activity under its account and under User credentials. The Customer must not permit any person other than a User to access the Platform, and must not share account credentials.
   5. Tracebit provides no technical support, customer service or service levels in connection with the Trial. Any assistance Tracebit chooses to provide is given without obligation and does not form part of these Terms.
   6. Tracebit may modify, suspend or withdraw the Platform or any feature of it at any time during the Trial Term.
4. TRIAL TERM
   
   1. The Trial begins when Tracebit provisions access to the Platform and continues for fourteen days, unless extended in writing by Tracebit or terminated earlier under clause 14 (the “Trial Term”).
   2. The Trial does not renew automatically and does not convert into a paid subscription. Any continuation of access beyond the Trial Term requires a separate written agreement.
5. LICENCE RESTRICTIONS
   
   1. The Customer will not, and will not permit any person to, directly or indirectly:
      
      1. reverse engineer, decompile, disassemble, modify, create derivative works of, or otherwise attempt to derive the source code, underlying ideas, detection logic or algorithms of the Platform, except to the extent that such activity cannot lawfully be restricted;
      2. access or use the Platform, or any Tracebit Confidential Information, to develop, train, improve or assist in the development of any product or service that competes with any Tracebit product or service;
      3. copy, transfer, resell, license, sublicense, rent, lease or assign the Platform, or provide the Platform or any output of it as a service to any third party;
      4. breach or attempt to breach the security of the Platform, or render it unavailable or unusable for any other user;
      5. publish, disclose or otherwise make available to any third party the results of any benchmarking, comparative evaluation or performance analysis of the Platform, without Tracebit’s prior written consent;
      6. remove, obscure or alter any proprietary notice on or in the Platform; or
      7. use the Platform in violation of applicable law, to infringe the rights of any third party, or otherwise outside the scope permitted by these Terms.
   2. Clause 5.1(a) does not restrict any act which the Customer is entitled to perform under sections 50B or 50BA of the Copyright, Designs and Patents Act 1988.
6. CUSTOMER OBLIGATIONS
   
   1. The Customer will:
      
      1. comply with applicable law, including export control and sanctions law;
      2. provide the cooperation, personnel, access and materials reasonably required to provision and operate the Trial;
      3. use reasonable endeavours to prevent unauthorised access to the Platform, and notify Tracebit promptly if it becomes aware of any unauthorised access;
      4. be solely responsible for obtaining and maintaining the equipment, software, network connectivity and third party services required to use the Platform; and
      5. ensure that it has all rights and permissions necessary to deploy the Platform in the Customer Environment and to permit Tracebit to process data as contemplated by these Terms.
   2. The Customer represents that it is not, and is not owned or controlled by any person that is, subject to UK, EU or US sanctions, and that it is not located in and will not access the Platform from an embargoed territory.
   3. The Platform integrates with third party content and technology controlled by or licensed to the Customer. Tracebit does not endorse or approve any such content or technology, makes no representation, warranty or commitment in relation to it, and has no liability or obligation in respect of it or its integration with the Platform.
7. EVALUATION USE AND NON-RELIANCE
   
   1. The Trial is provided for evaluation purposes only. During the Trial, the Platform must not be relied upon as a production security control.
   2. The Customer must not withdraw, disable, reduce or defer any existing security control, monitoring arrangement or incident response process in reliance on the Trial, and remains solely responsible for the security of the Customer Environment and for its own security outcomes.
   3. Tracebit gives no commitment that the Platform will detect, alert on, or correctly characterise any activity, that alerts will be generated, delivered or delivered within any period, or that the Platform will be available. The Customer is responsible for reviewing and verifying any alert or indicator produced by the Platform before acting or declining to act on it.
   4. The Customer must not use the Platform, or rely on any output of it, in connection with any activity where failure could lead to death, personal injury, or severe environmental or physical damage.
8. DATA
   
   1. Customer Data. As between the parties, the Customer owns Customer Data. The Customer grants Tracebit a non-exclusive, worldwide, royalty free licence for the Trial Term to host, copy, transmit, process and display Customer Data to the extent necessary to provide the Trial. Tracebit will not use Customer Data for any other purpose.
   2. Usage Data. Tracebit collects and processes Usage Data as controller for the purposes of operating, securing and improving the Platform and understanding how the Platform is used. Tracebit will not:
      
      1. sell, license or otherwise commercialise Usage Data;
      2. publish or disclose Usage Data to any third party in a form which identifies the Customer or any User; or
      3. use Usage Data to create, develop or supply any threat intelligence product, report or feed.
   3. Platform Telemetry. The Customer grants Tracebit a non-exclusive, worldwide, royalty free licence to collect, host, process and analyse Platform Telemetry (other than Tracebit Infrastructure Activity) for the purposes of:
      
      1. providing the Trial to the Customer;
      2. detecting, investigating and preventing cyber threats affecting Tracebit, its customers generally or third parties; and
      3. operating, securing and improving the Platform and its detection capabilities.
   4. The licences at clauses 8.3(b) and 8.3(c) survive expiry or termination of the Trial Term. The licence at clause 8.3(a) ends on expiry or termination.
   5. Restrictions on Platform Telemetry. Tracebit will not publish, license, sell or otherwise commercialise Platform Telemetry, or any report, feed, signature, model or other output derived from it, except to the extent the data in question is Tracebit Infrastructure Activity. Tracebit will not join Tracebit Infrastructure Activity to any data identifying or attributable to the Customer or the Customer Environment for any such purpose.
   6. Security. Tracebit will maintain a security programme materially in accordance with industry standards, designed to ensure the security of Customer Data and to prevent unauthorised access to it, including measures preventing access to, modification or disclosure of Customer Data by Tracebit personnel except to provide the Trial, as required by law, or as permitted by these Terms or by the Customer. Tracebit will not materially diminish these protections during the Trial Term.
   7. Deletion. Tracebit will delete or anonymise Customer Data within thirty days after expiry or termination of the Trial Term, except to the extent retention is required by law or permitted by clause 8.3. This clause does not require deletion of Usage Data.
9. DATA PROTECTION
   
   1. In this clause and in Schedule 1, “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings given in the UK GDPR.
   2. The parties acknowledge that Tracebit processes personal data in two distinct capacities, and that the same personal data may be processed in both capacities for different purposes.
   3. These Terms govern access to and use of the Tracebit Platform Enterprise Edition on a free trial basis. By ticking the box marked “I have read and agree to the Tracebit Enterprise Trial Terms and Conditions” and submitting the trial registration form, the Customer accepts these Terms.‍
   4. Tracebit as processor. In respect of personal data processed for the purpose of providing the Trial to the Customer, including deploying and operating Deception Assets, detecting interaction with them, and generating and delivering alerts and associated event data to the Customer, the Customer is controller and Tracebit is processor. Schedule 1 applies to that processing.
   5. ‍Tracebit as controller. In respect of personal data processed for Tracebit’s own purposes, being the purposes at clauses 8.2, 8.3(b) and 8.3(c), Tracebit is controller and processes those personal data in accordance with its privacy policy at tracebit.com/legal/privacy-policy. Schedule 1 does not apply to that processing.
   6. The Customer will make Tracebit’s privacy policy available to those of its personnel whose personal data may be processed under clause 9.4.
   7. Where the Customer requires Tracebit to enter into its own data processing agreement, the parties will negotiate in good faith, but Tracebit is not obliged to provision the Trial until terms are agreed.

10. CONFIDENTIALITY
    
    1. Each party will use information disclosed by the other, whether before or after the Acceptance Date, which is identified as confidential or which should reasonably be understood to be confidential (“Confidential Information”) solely in accordance with these Terms, and will not disclose it to any third party without the other’s prior written consent. Tracebit’s Confidential Information includes the Platform, its features, functionality, detection logic, Deception Asset design, roadmap and pricing.
    2. Confidential Information does not include information which: (a) is in the public domain through no fault of the receiving party; (b) was properly known to the receiving party, without restriction, before disclosure; (c) was properly disclosed to the receiving party, without restriction, by another person with authority to do so; or (d) is independently developed by the receiving party without use of or reference to the disclosing party’s Confidential Information.
    3. Either party may disclose Confidential Information: (a) to its personnel and professional advisers who need to know it and who are bound by obligations of confidentiality consistent with these Terms; and (b) as required by law, in which case the receiving party will, to the extent lawful, give the disclosing party prior written notice and a reasonable opportunity to contest the disclosure, and will use reasonable endeavours to minimise the extent of disclosure.
    4. Each party will exercise due care in protecting Confidential Information from unauthorised use and disclosure, and will promptly notify the other in writing if it becomes aware of any breach of this clause.
    5. Neither party will disclose the existence or terms of the Trial to any third party, except that either party may disclose them in confidence to actual or potential lenders, investors or acquirers.
    6. In the event of a breach or threatened breach of this clause 10 or of clause 5, the non-breaching party is entitled to seek injunctive and other equitable relief in any jurisdiction, in addition to any other remedy.
11. INTELLECTUAL PROPERTY
    
    1. As between the parties, Tracebit owns all right, title and interest in and to the Platform, Usage Data, Tracebit Infrastructure Activity and Tracebit’s Confidential Information, together with all intellectual property rights in them. No rights are granted to the Customer other than those expressly set out in these Terms.
    2. The Customer owns Customer Data and the Customer’s Confidential Information.
    3. The Customer may provide Tracebit with suggestions, comments or other feedback relating to the Platform (“Feedback”). Tracebit has the full, unencumbered and perpetual right to use and exploit Feedback for any purpose, without obligation to compensate or attribute the Customer.
12. WARRANTIES AND DISCLAIMERS
    
    1. To the maximum extent permitted by law, the Platform is provided during the Trial “as is” and “as available”, without warranties or conditions of any kind, express or implied, including as to merchantability, satisfactory quality, fitness for a particular purpose, non-infringement, title, accuracy, completeness, timeliness, reliability, availability, uninterrupted or error free operation, correction of defects, or freedom from harmful components.
    2. The Platform may incorporate or interoperate with third party or open source components subject to their own terms. Tracebit is not responsible for those components.
    3. The Customer warrants that it has all rights necessary to provide the information and materials it provides under these Terms, and to permit Tracebit to use them as contemplated by these Terms.
    4. Nothing in these Terms affects any statutory right which cannot lawfully be excluded or restricted.
13. LIMITATION OF LIABILITY
    
    1. Nothing in these Terms excludes or limits either party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability which cannot lawfully be excluded or limited.
    2. Subject to clause 13.1, neither party is liable for any: (a) indirect, special, incidental or consequential loss; (b) loss of profits, revenue, business, goodwill, data or anticipated savings; (c) business interruption, work stoppage, computer failure or malfunction; or (d) damage to equipment.
    3. Subject to clause 13.1, Tracebit has no liability for any loss arising from: (a) interruption, suspension, withdrawal, expiry or termination of the Trial; (b) errors, bugs or defects in the Platform; (c) any failure to detect, alert on or correctly characterise any activity; (d) unauthorised access to or use of any data; (e) the acts, omissions, content or services of any third party; or (f) the Customer’s use of, or reliance on, the Platform or any output of it.
    4. Subject to clauses 13.1 to 13.3, Tracebit’s total aggregate liability arising out of or in connection with these Terms, whether in contract, tort including negligence, breach of statutory duty or otherwise, is limited to £100.
    5. Clause 13.4 does not apply to the Customer’s liability. The Customer’s liability for breach of clause 5 (licence restrictions), clause 10 (confidentiality) or clause 11 (intellectual property) is not limited by these Terms.
    6. The Customer acknowledges that the Platform is provided free of charge during the Trial, that use of it is at the Customer’s own risk, and that the allocation of risk in this clause 13 reflects the fact that no fees are payable.
14. EXPIRY, TERMINATION AND REMOVAL
    
    1. The Trial expires automatically at the end of the Trial Term without notice.
    2. Either party may terminate the Trial at any time, for any reason or no reason, on notice. Tracebit may terminate by disabling access to the Platform. The Customer may terminate by ceasing use and notifying Tracebit.
    3. On expiry or termination:
       
       1. all rights granted to the Customer end immediately, and the Customer must cease all use of the Platform;
       2. the Customer must uninstall and delete all agents, applications, software, documentation and other materials belonging to Tracebit, and revoke all credentials, roles, permissions and access granted to Tracebit or to the Platform in respect of the Customer Environment;
       3. Tracebit will cease monitoring the Customer Environment and will cease generating or delivering alerts;
       4. Tracebit will, on request, provide instructions for the identification and removal of Deception Assets, and will use reasonable endeavours to remove or disable those Deception Assets which it is able to remove or disable remotely; and
       5. the Customer is responsible for removing from the Customer Environment any Deception Asset which remains after expiry or termination, and for updating its own runbooks, alerting and documentation accordingly.
    4. The Customer acknowledges that any Deception Asset remaining in the Customer Environment after expiry or termination is no longer monitored by Tracebit, that no alert will be generated in respect of it, and that it must not be relied upon as a security control.
15. SURVIVAL
    
    1. The following survive expiry or termination of the Trial: clause 1 (interpretation); clause 5 (licence restrictions); clause 7 (evaluation use and non-reliance); clause 8 (data), save that the licence at clause 8.3(a) ends in accordance with clause 8.4; clause 9 and Schedule 1 (data protection); clause 10 (confidentiality); clause 11 (intellectual property); clause 12 (warranties and disclaimers); clause 13 (limitation of liability); clause 14 (expiry, termination and removal); this clause 15; and clause 16 (general).
16. GENERAL
    
    1. Neither party is liable for any failure or delay caused by events beyond its reasonable control, including natural disaster, act of God, pandemic, cyber attack, failure of third party or Customer software, hardware or network, or change in law.
    2. Tracebit may assign or transfer these Terms to an affiliate or to a successor to substantially all of its assets or business. The Customer may not assign or transfer these Terms without Tracebit’s prior written consent.
    3. No variation of these Terms is effective unless agreed in writing by both parties.
    4. No failure or delay in enforcing these Terms is a waiver of any right, and no waiver of any breach is a waiver of any subsequent breach.
    5. Nothing in these Terms creates a partnership, agency, employment or joint venture, and neither party has authority to bind the other.
    6. A person who is not a party to these Terms has no right to enforce any of them under the Contracts (Rights of Third Parties) Act 1999 or otherwise.
    7. If any provision is held invalid or unenforceable, it will be enforced as nearly as possible in accordance with the parties’ intention, and the remainder of these Terms continues in full force.
    8. These Terms constitute the entire agreement between the parties in relation to the Trial and supersede all prior proposals, statements, materials and agreements relating to it, subject to clause 2.4. Neither party has a remedy in respect of any statement, representation or warranty not expressly set out in these Terms, other than for fraudulent misrepresentation.
    9. Notices to the Customer may be given by email to the address provided at registration or by posting within the Platform. Notices to Tracebit must be sent to support@tracebit.com.
    10. These Terms, and any dispute arising out of or in connection with them or their subject matter, are governed by the law of England and Wales. The parties irrevocably agree that the courts of England have exclusive jurisdiction.

SCHEDULE 1 – DATA PROCESSING

Subject matter

Provision of the Trial

Duration

The Trial Term, plus any period of retention permitted by clause 8.7

Nature and purpose

Deployment and operation of Deception Assets in the Customer Environment; detection of interaction with those assets; generation, analysis and delivery of alerts and associated event data to the Customer

Types of personal data

Identifiers within the Customer Environment, including usernames, account and directory identifiers, email addresses, device and host identifiers, IP addresses and session identifiers; data contained within event logs, alerts and associated metadata; User account details

Categories of data subject

The Customer’s personnel, contractors and other authorised users of the Customer Environment; individuals interacting with Deception Assets

Processor obligations

1. Tracebit will process personal data within Customer Data only on the Customer’s documented instructions, including as to transfers outside the United Kingdom, unless required otherwise by law, in which case Tracebit will inform the Customer before processing unless prohibited from doing so. These Terms, together with the Customer’s configuration of the Platform, constitute the Customer’s documented instructions.
2. Tracebit will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.
3. Tracebit will ensure that persons authorised to process personal data are subject to an appropriate duty of confidence.
4. Tracebit will implement appropriate technical and organisational measures in accordance with Article 32 of the UK GDPR, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing.
5. The Customer gives general authorisation for Tracebit to engage sub-processors. Tracebit maintains a current list of sub-processors at trust.tracebit.com and will notify the Customer of any intended addition or replacement, giving the Customer the opportunity to object. Tracebit will impose on each sub-processor data protection obligations materially equivalent to those in this Schedule, and remains liable for each sub-processor’s performance.
6. Tracebit will assist the Customer, by appropriate technical and organisational measures and insofar as reasonably possible, in responding to requests from data subjects exercising their rights under the UK GDPR.
7. Tracebit will assist the Customer in complying with its obligations under Articles 32 to 36 of the UK GDPR, taking into account the nature of processing and the information available to Tracebit. Tracebit will notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data within Customer Data.
8. Tracebit will, at the Customer’s election, delete or return personal data within Customer Data at the end of the Trial Term (or such period as permitted by clause 8.7), and will delete existing copies unless required by law to retain them.
9. Tracebit will make available to the Customer the information reasonably necessary to demonstrate compliance with this Schedule, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, on reasonable notice, no more than once during the Trial Term, and subject to the Customer bearing its own costs. Tracebit may satisfy this obligation by providing its current third party audit reports and completed security questionnaires.
10. Where Tracebit transfers personal data within Customer Data outside the United Kingdom, it will do so in accordance with a transfer mechanism recognised under applicable law, including the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.