Terms of Service

1. This agreement

These Terms of Service (the “Terms”) are a contract between Direwolf Cybersecurity (“Direwolf”, “we”, “us”) and the organization that creates an account on the Direwolf Platform (“Customer”, “you”). They also apply, in sections 1, 15, 16, 17, 20 and 22 only, to visitors of the website at www.direwolfcybersecurity.com.

Acceptance. You accept these Terms by checking the acceptance box and creating an account, by clicking to accept them when we present a new version, or by purchasing a subscription. The person who accepts represents that they are at least 18 years old and are authorized to bind the Customer organization. The Platform records the version you accepted, when, and from where.

Documents that form the agreement. The following are incorporated by reference, in this order of precedence if they conflict: (1) any written order, quote or addendum signed or electronically accepted by both parties (an “Order”), including a DoD contractor addendum where one applies; (2) these Terms; (3) the Acceptable Use Policy (the “AUP”); (4) the Privacy Policy; (5) the Subprocessors list; and (6) the vendor terms described in section 7. Our Cookie Notice, Accessibility Statement and Security and responsible disclosure pages describe our practices and are not part of the contract except where these Terms say so.

Not in effect until published. While this document is marked as a draft, it is not in effect and no one is bound by it.

2. Definitions

• “Platform” means the Direwolf web application at app.direwolfcybersecurity.com, its API, and the installers and tokens it issues.
• “Services” means the Platform and the services Direwolf provides through it under your subscription: the Direwolf AI SOC, managed endpoint protection, endpoint management, and compliance guidance, as described in your Order and on our Services page at the time of purchase.
• “Third-Party Software” means software products made by other companies that Direwolf resells and provisions for you through the Platform, currently SentinelOne endpoint protection and NinjaOne endpoint management, together with their vendors’ clouds.
• “Endpoint” means a device (workstation, server or virtual machine) on which a sensor or agent for the Services is installed.
• “Customer Data” means all data you or your Endpoints provide to the Services, including account and organization data, security data from your Endpoints (alerts, inventory, telemetry and the records the SOC creates about them), notes, settings and support messages.
• “Service Data” means data Direwolf derives from operating the Services that does not identify you, your users or your Endpoints: de-identified detection statistics, triage accuracy measurements, and the prompts and rules we tune from analyst feedback.
• “Response Policy” means the per-organization settings in the Platform that govern what containment actions the Direwolf AI SOC may take automatically on your Endpoints (section 10).
• “Users” means the individuals your administrators invite to use the Platform on your behalf.
• “Prohibited Data” means the data categories in section 9.

3. The Services

3.1 What we provide

Direwolf provides the Services described in your Order. The Direwolf AI SOC enriches and triages every alert from your Endpoints automatically, around the clock, producing a verdict, a confidence level, a MITRE ATT&CK mapping and a plain-English summary; when it confirms a threat with high confidence it contains the threat through your endpoint protection under your Response Policy; and a Direwolf analyst reviews the AI’s decisions and takes every case it cannot decide. Managed endpoint protection and endpoint management are delivered through Third-Party Software bound to your organization. Compliance guidance is a consulting service scoped in its Order.

3.2 What we do not promise

No security service detects or prevents every threat. The Services reduce risk; they do not eliminate it. We do not guarantee that the Services will detect, prevent, contain or remediate any particular threat, that any verdict will be correct, or that any response action will be timely or free of side effects. You remain responsible for your own security program, backups, business continuity and compliance obligations.

3.3 Roadmap features

Features we describe as “roadmap” or “coming later” on our website are not part of the Services, are not promised, and may change or never ship. You should not buy the Services in reliance on them.

3.4 Changes to the Services

We may improve, add to and change the Services, provided we do not materially reduce the core functionality you have paid for during your current subscription term. We will give you reasonable notice of changes that require action on your part. If we discontinue a Service you have paid for, we will refund the prepaid fees for the unused remainder of the term.

3.5 Support

We provide support by email and through the Platform during the hours and at the targets described in your Order or, where an Order is silent, on a reasonable-efforts basis. [Service level terms, if any, to be set out in a separate SLA document before launch; no availability or response-time commitments are made in these Terms.]

4. Accounts and organizations

4.1 Your administrators and Users

The person who creates your organization becomes its first administrator. Administrators may invite Users, assign roles, remove Users, configure settings including the Response Policy, download installers, buy and cancel subscriptions, and view your organization’s audit log. You are responsible for everything done in your organization’s account by your Users and by anyone who uses credentials issued to your Users, whether or not you authorized it, until you tell us the credentials are compromised.

4.2 Account security

Every User must enroll in multi-factor authentication before accessing any data. Users must keep their credentials, authenticator apps, passkeys and recovery codes confidential, must not share accounts, and must tell us promptly at security@direwolfcybersecurity.com if they suspect compromise. You must remove Users who leave your organization promptly. We may suspend an account we reasonably believe is compromised.

4.3 Sign-in notice and monitoring

The Platform is a private system for authorized use only. A system-use notice is shown at sign-in and must be acknowledged. Activity on the Platform is logged and may be audited; the logs are part of the Services and of our own security program, and are available to your administrators for your organization.

4.4 Accurate information

You must give us accurate organization, contact and billing information and keep it current. Notices we send to your administrators’ email addresses of record are effective when sent.

5. Acceptable use

Your use of the Services must comply with the Acceptable Use Policy, which is part of these Terms. In particular, you may install sensors and agents only on Endpoints you own or are authorized to manage, you must inform your own personnel of the monitoring the Services perform in the manner your policies and applicable law require, and you may not use the Services to attack, probe or interfere with anyone else’s systems. We may suspend access for AUP violations as described in section 19.

6. Subscriptions, fees and billing

6.1 Subscriptions

Services are sold as subscriptions in the quantities (for example, number of Endpoints or seats) and for the term stated at checkout or in your Order. You may increase quantities at any time; increases are charged pro rata for the remainder of the current billing period. Decreases take effect at the next renewal.

6.2 Payment processor

Payments are processed by Stripe. Direwolf never sees or stores your card number. By providing a payment method you authorize Stripe to charge it for the fees you incur, and you agree to Stripe’s terms for the use of its services. Invoices, receipts and payment-method management are provided through Stripe and the Platform.

6.3 Automatic renewal

Your subscription renews automatically at the end of each term, for a further term of the same length, at the then-current price for your plan, unless you cancel before the renewal date. The renewal term, the recurring charge, and how to cancel are shown at checkout and in your Platform billing page before you buy. For annual subscriptions we will email your billing contact a renewal reminder between 25 and 40 days before each renewal. No subscription renews for a term longer than one year without your express consent.

6.4 Cancellation

You may cancel a subscription at any time, in one step, from the Platform billing page or the billing portal linked from it, without having to contact us. Cancellation takes effect at the end of the current term; you keep access until then. Prepaid fees are not refunded except as these Terms state or the law requires.

6.5 Prices and changes

Prices are those shown at checkout or in your Order. We may change prices for a subsequent term by notifying your billing contact at least 30 days before the renewal date; the change applies if you renew. Promotional and introductory prices expire as stated.

6.6 Taxes

Fees exclude sales, use, value-added and similar taxes. Where we are required to collect tax, we will add it to your invoice; where you are exempt, provide a valid exemption certificate.

6.7 Late and failed payments

If a payment fails, Stripe will retry it and we will email your billing contact. If fees remain unpaid 14 days after they are due, we may suspend the Services until payment is made; if they remain unpaid 30 days after they are due, we may terminate the affected subscriptions. Suspension does not relieve you of the obligation to pay. During suspension, Third-Party Software on your Endpoints may continue to operate under the vendor’s own policy for a period the vendor controls, but the Direwolf AI SOC will not be monitoring it.

6.8 Refunds

Except where these Terms provide for a refund (sections 3.4, 7.6 and 21) or the law requires one, fees are non-refundable.

7. Third-Party Software and pass-through terms

7.1 Vendor terms apply

Third-Party Software is licensed to you by its vendor, not by Direwolf, under the vendor’s own end user license agreement or terms of service (the “Vendor Terms”). For SentinelOne that is the SentinelOne Terms of Service, and for NinjaOne the NinjaOne End User License Agreement for End Users of Resellers, each as the vendor publishes and updates them. You must accept the applicable Vendor Terms before we provision the product for you, and we will present them to you, with their version, for separate acceptance in the purchase flow. If the Vendor Terms and these Terms conflict as to the Third-Party Software itself, the Vendor Terms govern your relationship with the vendor.

7.2 What Direwolf does and does not provide

Direwolf resells the subscription, provisions a dedicated vendor site or organization for you, binds the installers to it, and, for products connected to the Direwolf AI SOC, monitors and acts on the alerts the product generates. The vendor provides the software, its updates, its cloud and any warranties, support commitments and data-handling terms that the Vendor Terms contain. Direwolf passes through to you only the rights the vendor grants to end users of its resellers, and makes no warranty of its own about Third-Party Software.

7.3 Quantities and device limits

Your use of Third-Party Software is limited to the number of Endpoints or seats you have bought. The Platform tracks usage; if you exceed your quantity we may bill the overage at the then-current price or ask you to remove the excess. The vendor may also enforce its own limits.

7.4 Liability for Third-Party Software

Because vendors route end-user claims to their resellers, Direwolf’s total liability to you for a Third-Party Software product is limited to the amount Direwolf actually recovers from the vendor for your claim, in addition to the limits in section 17. We will pursue a legitimate claim with the vendor on your behalf in good faith.

7.5 Suspension by a vendor

If a vendor suspends or terminates Third-Party Software for reasons attributable to you, we may suspend or terminate the matching Direwolf subscription. If a vendor suspends or terminates for reasons not attributable to you, section 7.6 applies.

7.6 End of a vendor relationship

If Direwolf’s agreement with a vendor ends, we will honor your current paid term for that product where the vendor permits, will tell you at least 30 days before the product can no longer be renewed through Direwolf, and will refund prepaid fees for any part of the term we cannot deliver.

7.7 Vendor data

Your Endpoints send data to the vendor’s cloud directly. The vendor’s handling of that data, including any de-identified “system data” or “usage data” the Vendor Terms permit the vendor to retain, is governed by the Vendor Terms and the vendor’s privacy policy. The Subprocessors page describes what Direwolf itself receives from each vendor.

8. Customer Data

8.1 You own it

As between you and Direwolf, you own all Customer Data. You grant Direwolf a non-exclusive, worldwide, royalty-free license to host, copy, process, transmit and display Customer Data solely to provide, secure, support and improve the Services, to prevent or address technical or security problems, and as required by law. Direwolf claims no other rights in Customer Data.

8.2 Service Data

Direwolf owns Service Data and may use it to operate and improve the Services. We will not re-identify Service Data, will not sell it, and will not disclose it in a form that identifies you, your Users or your Endpoints.

8.3 Your responsibilities

You are responsible for the accuracy and lawfulness of Customer Data and for having the rights and consents needed to provide it to us and to have the Services process it, including any notice to your own personnel about monitoring of Endpoints that your policies or applicable law require. You will not provide Prohibited Data (section 9).

8.4 Access, export and deletion

During the term, your administrators can view and export your organization’s alerts, inventory and audit log from the Platform, and can ask us for a copy of other Customer Data in a reasonable machine-readable format. After your organization’s account closes we will delete Customer Data within [30 days], except for (a) audit and consent records, which we keep for the periods in the Privacy Policy, (b) data in encrypted backups, which expires on their rolling schedule, and (c) data we must retain by law. You should export anything you need before the account closes; we will remind you when you cancel.

8.5 Direwolf’s access

Direwolf staff access Customer Data only to provide, secure and support the Services or as required by law. Staff access is logged with the reason and is visible in your organization’s audit log.

9. Prohibited Data

The Services are not approved for the following, and you must not upload, store, transmit or process any of it through the Platform, and must configure the Services so that they do not collect it, unless and until an Order signed by Direwolf expressly states that the Service is approved for it:

• Controlled Unclassified Information (CUI) and Covered Defense Information, including any information marked or required to be marked as CUI. The Platform stores Security Protection Data (alerts, sensor inventory, triage notes), not CUI. A CUI document repository is on our roadmap and is not available today.
• Export-controlled technical data subject to the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR), other than information publicly available or designated EAR99.
• Protected health information (PHI) regulated by HIPAA. Direwolf does not currently sign business associate agreements. If your organization is a covered entity or business associate, do not deploy sensors on systems that store or process PHI, or accept that incidental telemetry (for example file names and process arguments) may contain PHI at your own risk, and tell us so we can discuss options.
• Payment card account numbers and other cardholder data.
• Classified information of any kind.

Please do not place these in alert notes, organization settings, support messages, uploaded files or the website contact form. If Prohibited Data reaches the Platform, tell us at security@direwolfcybersecurity.com; we will work with you to remove it, and we may suspend affected features until it is removed. You will reimburse our reasonable costs of removal if the upload was knowing or repeated. Direwolf is not responsible for Prohibited Data you provide in breach of this section.

10. Response actions on your Endpoints

10.1 Your authorization

The Direwolf AI SOC acts on your Endpoints without waiting for a human when its confidence is high. By enabling the Direwolf AI SOC you authorize Direwolf, acting through its automated systems and its analysts, to take the containment actions permitted by your Response Policy on your Endpoints, including killing processes, quarantining files and isolating hosts from the network, and you acknowledge that these actions can interrupt business operations and that an isolated host may lose network connectivity until it is reconnected. Actions taken in accordance with your Response Policy are authorized access to your Endpoints for the purposes of the Computer Fraud and Abuse Act and comparable state laws.

10.2 Your Response Policy and guardrails

The Response Policy is yours to configure. It includes toggles for each action type, confidence thresholds, a list of hosts the AI may never isolate on its own (for example domain controllers and hosts you tag as critical), a cap on automatic isolations per hour, and a cool-down that prevents a host from being isolated and reconnected repeatedly. Direwolf also maintains a platform-wide switch that drops the AI to recommend-only mode. You are responsible for keeping the never-isolate list and critical-host tags current. We will tell you when you first enable the Direwolf AI SOC what the default policy is.

10.3 Records, notification and undo

Every automated action is recorded in your audit log with the AI’s reasoning, your administrators are notified when actions are taken, and every action can be reversed with one click (reconnect host, restore file) from the Platform. Your administrators can also report a false positive, which reverses the verdict and records the correction.

10.4 Your authority over Endpoints

You represent that you own or control every Endpoint on which you install a sensor, that you have authority to permit the actions in this section on it, and that you have informed its users as your policies and applicable law require.

10.5 Allocation of responsibility

Subject to the exclusions in section 17.3, Direwolf is not liable for losses resulting from response actions taken in good faith in accordance with your Response Policy, including on a false positive. You remain responsible for backups, redundancy and business continuity for your Endpoints. If you prefer that no action be taken automatically, set your Response Policy accordingly; the AI will then recommend and a Direwolf analyst or your administrators will decide.

11. Security and security incidents

11.1 Our security obligations

Direwolf will maintain administrative, technical and physical safeguards for Customer Data appropriate to its nature, as described in the Privacy Policy and on the Platform page, and will require its subprocessors to do the same. These safeguards are designed to meet Colorado’s reasonable-security requirement (C.R.S. 6-1-713.5) and to align with NIST SP 800-171 Rev. 2.

11.2 Security incident notification

A “Security Incident” is confirmed unauthorized access to, or acquisition, disclosure, loss or alteration of, Customer Data on systems Direwolf controls. It does not include the threats the Services detect on your Endpoints, which are the product and are reported through the Platform, nor unsuccessful attempts such as blocked scans or failed sign-ins.

If Direwolf confirms a Security Incident affecting your Customer Data, Direwolf will notify your administrators and designated security contacts without undue delay and in any event within 72 hours of confirming it, with what we know about the nature of the incident, the data and Endpoints affected, the steps we have taken, and a point of contact, and will update you as material facts develop. We will preserve relevant logs and images for at least 90 days, cooperate reasonably with your investigation and with the notifications and reports you are required to make (for example to the Department of Defense under DFARS 252.204-7012 or to individuals under state breach laws), and provide the facts you need to make them. You make notifications required of you as the owner of the data; Direwolf makes notifications required of it as the holder of its own account data.

11.3 Your security obligations

You will keep your Users’ credentials and MFA devices secure, remove departed Users promptly, review your audit log, act on notifications, keep Endpoints patched and sensors installed, and report suspected compromise of your account to us promptly.

12. Compliance program statements

Direwolf makes the following statements about its own compliance posture and no others. Our Compliance page is kept current and controls if it differs from this section.

• The Platform and our internal practices are built and operated to align with NIST SP 800-171 Rev. 2, the standard that CMMC Level 2 is based on. Direwolf is preparing for a CMMC Level 2 assessment. Direwolf does not claim to be CMMC certified, and “aligned” is not a certification.
• The Platform runs in AWS GovCloud (US), with customer data stored in the United States. Authorizations held by Amazon Web Services for that infrastructure belong to AWS and do not make the Direwolf Platform an authorized service. The Platform is being brought into service; these statements describe how customer data is handled once you use it.
• Direwolf does not hold SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, ITAR or StateRAMP attestations or authorizations of its own, and does not hold any government cloud authorization of its own; authorizations held by our infrastructure provider are not ours.
• For customers subject to NIST SP 800-171, Direwolf is an External Service Provider that handles Security Protection Data and not CUI. We provide customers and their assessors with a service description and a Customer Responsibility Matrix describing which NIST SP 800-171 requirements AWS, Direwolf and the customer each own, and we will make our control evidence available to your assessor under a non-disclosure agreement as it is completed.
• Government contract clauses. No FAR, DFARS or other government flow-down clause applies to Direwolf unless expressly accepted in an Order. The Services are not designed for Covered Defense Information, and you will not flow down obligations premised on Direwolf handling CDI. A DoD contractor addendum covering the matters in this section and in section 11 is available on request.

13. Export control and sanctions

Each party will comply with United States export control and sanctions laws, including the EAR, the ITAR and the regulations of the Office of Foreign Assets Control. You represent that neither you nor any of your Users is located in, organized under the laws of, or ordinarily resident in a country or territory subject to comprehensive U.S. sanctions, or listed on a U.S. government restricted-party list, and you will not permit access to the Services from such a country or by such a person. You will not provide export-controlled technical data to the Services except as section 9 permits. The Services are offered to organizations in the United States; if you are organized outside the United States, tell us before purchasing so we can confirm whether we can serve you.

14. Confidentiality

Each party will protect the other’s Confidential Information with at least the care it uses for its own confidential information, and no less than reasonable care; will use it only to perform under these Terms; and will disclose it only to employees, contractors and advisers who need to know it and are bound by confidentiality obligations at least as protective. “Confidential Information” means non-public information disclosed by one party to the other that is marked confidential or that a reasonable person would understand to be confidential, and includes Customer Data, the Platform’s non-public design and security details, and pricing. It excludes information that is or becomes public without breach, was already known to the recipient, is independently developed, or is received from a third party without restriction. A party may disclose Confidential Information when legally compelled, after giving the other party notice and a chance to object where lawful. These obligations last for three years after the agreement ends, and for Customer Data and trade secrets, for as long as the information remains confidential.

15. Intellectual property, feedback and publicity

Direwolf and its licensors own the Platform, the Services, the Website, their content, and all related intellectual property. You receive only the rights these Terms expressly grant. You may not copy, modify, reverse engineer, resell, sublicense or create derivative works of the Platform except as the law permits notwithstanding this restriction, and you may not remove proprietary notices. If you give us suggestions or feedback, we may use them without obligation to you. We will not use your name or logo in marketing, customer lists or testimonials without your prior written consent.

The Website’s content is provided for information. You may view, download and print it for your own non-commercial reference, keeping all notices intact. SentinelOne, NinjaOne, AWS, Stripe and other product names on the Website are trademarks of their owners and are used only to identify those products.

16. Warranties and disclaimers

16.1 Mutual

Each party warrants that it has the authority to enter into these Terms and that doing so does not breach any other agreement it has.

16.2 Direwolf

Direwolf warrants that the Services will perform materially as described in your Order and on the Services page at the time of purchase, and that it will provide them with reasonable skill and care. Your exclusive remedy for breach of this warranty is for Direwolf to use reasonable efforts to correct the nonconformity and, if it cannot do so within 30 days of your notice, for you to terminate the affected subscription and receive a refund of prepaid fees for the unused remainder of the term.

16.3 Disclaimer

EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICES, THE PLATFORM, THE WEBSITE AND ALL THIRD-PARTY SOFTWARE ARE PROVIDED “AS IS” AND “AS AVAILABLE”, AND DIREWOLF DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WITHOUT LIMITING THE FOREGOING, DIREWOLF DOES NOT WARRANT THAT THE SERVICES WILL DETECT, PREVENT, CONTAIN OR REMEDIATE ANY OR ALL THREATS, THAT ANY AUTOMATED VERDICT OR ACTION WILL BE CORRECT, THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT USE OF THE SERVICES WILL MAKE YOU COMPLIANT WITH ANY LAW, REGULATION, STANDARD OR CONTRACT. COMPLIANCE GUIDANCE IS NOT LEGAL ADVICE AND DOES NOT REPLACE AN ASSESSMENT BY AN AUTHORIZED ASSESSOR. SOME JURISDICTIONS DO NOT ALLOW CERTAIN DISCLAIMERS; TO THAT EXTENT, DIREWOLF’S WARRANTIES ARE LIMITED TO THE MINIMUM THE LAW REQUIRES.

17. Limitation of liability

17.1 Exclusion of certain damages

TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA (OTHER THAN DIREWOLF’S OBLIGATIONS TO RESTORE CUSTOMER DATA FROM BACKUPS), BUSINESS INTERRUPTION OR LOSS OF GOODWILL, ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

17.2 Cap

TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY’S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO DIREWOLF FOR THE SERVICES GIVING RISE TO THE CLAIM IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY. FOR DIREWOLF’S BREACH OF ITS SECURITY OBLIGATIONS IN SECTION 11.1 OR ITS CONFIDENTIALITY OBLIGATIONS WITH RESPECT TO CUSTOMER DATA, THAT CAP IS INSTEAD TWO TIMES THOSE FEES. FOR THIRD-PARTY SOFTWARE, SECTION 7.4 ALSO APPLIES.

17.3 Exceptions

The exclusions and caps in this section do not apply to a party’s indemnification obligations under section 18, to a party’s gross negligence, willful misconduct or fraud, to Customer’s payment obligations, to Customer’s breach of section 9 (Prohibited Data) or section 13 (Export control), or to liability that cannot be limited by law.

17.4 Specific exclusions

Without limiting the above, Direwolf is not liable for losses caused by threats the Services did not detect or contain; by response actions taken in good faith in accordance with your Response Policy (section 10.5); by your configuration choices, including allow-lists, disabled actions and thresholds; by Third-Party Software or vendor clouds; by Prohibited Data you provided; or by your failure to keep backups, apply patches or act on notifications.

17.5 Basis of the bargain

The parties agree that these limitations reflect a reasonable allocation of risk and are an essential basis of the bargain, and that Direwolf would not provide the Services at these prices without them.

18. Indemnification

18.1 By Direwolf

Direwolf will defend you against any third-party claim alleging that the Platform, as provided by Direwolf and used in accordance with these Terms, infringes a United States patent, copyright or trademark or misappropriates a trade secret, and will pay the damages and costs finally awarded or agreed in settlement. This does not cover claims arising from Third-Party Software, Customer Data, your combination of the Platform with things we did not supply, or your use after we told you to stop. If the Platform is or may be enjoined, Direwolf may procure the right for you to keep using it, modify it to be non-infringing, or terminate the affected Service and refund prepaid fees for the unused term. This section states Direwolf’s entire liability for infringement claims.

18.2 By Customer

You will defend Direwolf against any third-party claim arising from Customer Data, from Prohibited Data you provided, from your or your Users’ breach of the AUP or of sections 9, 10.4 or 13, from your installation of sensors on devices you did not own or control, or from your failure to give your own personnel any legally required notice of monitoring, and will pay the damages and costs finally awarded or agreed in settlement.

18.3 Procedure

The indemnified party must promptly notify the indemnifying party of the claim (delay excuses the obligation only to the extent of prejudice), give it sole control of the defense and settlement (except that no settlement may impose obligations on or admit fault by the indemnified party without its consent), and provide reasonable cooperation at the indemnifying party’s expense.

19. Term, suspension and termination

19.1 Term

These Terms take effect when you accept them and continue until all your subscriptions have ended and your organization’s account is closed.

19.2 Suspension

We may suspend some or all of the Services, after notice where practicable, if: fees are overdue as described in section 6.7; you or a User materially breach the AUP or section 9; we reasonably believe your account is compromised or is being used in a way that threatens the security or integrity of the Platform or other customers; a vendor suspends the matching Third-Party Software; or the law requires it. We will limit suspension to what is necessary and lift it when the cause is resolved.

19.3 Termination for cause

Either party may terminate these Terms or an affected subscription if the other materially breaches them and does not cure the breach within 30 days of written notice (10 days for non-payment). Direwolf may terminate immediately for a breach of section 9 or 13 that is not promptly cured, or if you become insolvent.

19.4 Termination for convenience

You may end any subscription by cancelling it as described in section 6.4, and may close your organization’s account at any time. Direwolf may discontinue a Service as described in section 3.4.

19.5 Effect of termination

On termination, your right to use the affected Services ends, you must uninstall the related sensors and agents, and the data provisions in section 8.4 apply. Fees already due remain payable. Sections 1, 2, 7.4, 8.2, 8.4, 9, 10.5, 11.2 (for incidents during the term), 14 through 18, 19.5, 20 and 22 survive.

20. Governing law and disputes

20.1 Governing law

These Terms and any dispute arising out of or relating to them or the Services are governed by the laws of the State of Colorado and applicable United States federal law, without regard to conflict-of-law rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

20.2 Informal resolution first

Before starting formal proceedings, a party will send the other a written description of the dispute and the parties will try in good faith to resolve it within 30 days through discussions between people with authority to settle it.

20.3 Venue

Subject to 20.2, the state and federal courts located in El Paso County, Colorado have exclusive jurisdiction over any dispute, and each party submits to their personal jurisdiction and waives objection to venue there, except that either party may seek injunctive relief to protect its intellectual property or Confidential Information in any court of competent jurisdiction.

20.4 Time limit

To the extent permitted by law, a claim arising out of these Terms must be brought within two years after the cause of action accrues.

21. Changes to these Terms

These Terms are versioned. The version and effective date appear at the top of the page, and a changed document is always published as a new version; we never edit a published version in place. We will notify your administrators by email at least 30 days before a material change takes effect, unless the change is required by law or is needed to address a security or legal risk, in which case we will give as much notice as we reasonably can. Users will be asked to review and accept the new version at their next sign-in, and the Platform will record that acceptance. If you do not agree to a material change, you may terminate the affected subscriptions before the change takes effect and we will refund prepaid fees for the unused remainder of the term. Earlier versions are available on request.

22. General

• Notices. Notices to Direwolf go to legal@direwolfcybersecurity.com and, for security matters, security@direwolfcybersecurity.com, with a copy by post to the address on the Contact page once published. Notices to you go to your administrators’ and billing contact’s email addresses of record.
• Assignment. Neither party may assign these Terms without the other’s consent, except to a successor in a merger, acquisition or sale of substantially all assets that assumes them in writing. Direwolf may use subprocessors as described in the Subprocessors list.
• Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, including acts of government, internet or utility failures, and vendor outages, provided it uses reasonable efforts to mitigate. Payment obligations are not excused.
• Independent contractors. The parties are independent contractors; nothing creates a partnership, agency or joint venture.
• Entire agreement; order of precedence. These Terms, with the documents incorporated in section 1, are the entire agreement between the parties about their subject and supersede all prior and contemporaneous agreements and understandings. Terms in your purchase orders or vendor-registration portals do not apply. Order of precedence is as stated in section 1.
• Severability; waiver. If a provision is unenforceable it will be enforced to the maximum extent permitted and the rest remains in effect. A failure to enforce a provision is not a waiver.
• No third-party beneficiaries, except that vendors of Third-Party Software may enforce section 7 as it concerns their products.
• Electronic contracting. You agree that acceptance by checkbox and click is an electronic signature and that the Platform’s consent records are admissible evidence of it, consistent with the federal E-SIGN Act and Colorado’s Uniform Electronic Transactions Act.
• Headings and interpretation. Headings are for convenience. “Including” means “including without limitation”.

23. Contact

Questions about these Terms: legal@direwolfcybersecurity.com or the contact form.