These terms govern the use of CyberWatch AI, a security console that helps organizations measure and strengthen their security posture, together with the personal scanner, the browser extension and the newsletter that accompany it.
These Terms of Service constitute a binding agreement between CyberWatch AI and the person or organization using the service. Creating an account, accepting an invitation into an organization, installing the browser extension, or using any part of the service constitutes acceptance of them.
Where acceptance is given on behalf of a company or other body, the person accepting confirms that they hold the authority to bind that body, and the obligations in these terms attach to it. A person without that authority, or who does not accept these terms, should not use the service.
These terms operate alongside the Privacy Policy, which describes the handling of personal data and forms part of this agreement.
The service means the CyberWatch AI website, the organization console and every tool within it, the personal scanner, the browser extension, the newsletter and any application programming interface made available. The console means the part of the service in which an organization manages its security programme.
An organization means a company or other body holding an account on the service together with the members it invites. An administrator means a member of an organization holding rights to configure it, invite and remove others, launch simulations and view reporting. A member means anyone invited into an organization, including employees who receive training, sit assessments or are included in simulations.
Customer content means anything placed into the service, including employee names and email addresses, departments, submitted links, messages, emails and screenshots, reports made by members, assessment answers, tasks, notes and messages exchanged within the console. Organization data means the customer content of an organization together with the results, scores and records the service derives from it.
The security score means the figure the console presents as a summary of an organization's security posture. A simulation means a harmless but realistic message sent to an organization's own people in order to measure their response. An assessment means a set of scenarios or questions put to members in order to measure their readiness. AI output means anything the service produces through an artificial intelligence model, including the analysis of a submission, answers and actions of the advisor, recommendations and written summaries.
CyberWatch AI is a security console for organizations. Its purpose is to show an organization where it stands on security, with particular attention to the part of security that depends upon what people do when a convincing message arrives, and to help it improve that position over time.
Within the console an organization can follow its security score and how it changes; run phishing simulations against its own staff and see who opened, clicked and reported them; assign training and track completion; put readiness assessments to its members; receive and work through alerts raised when members report suspicious content; allow members to check a link, message or screenshot before acting on it; keep a list of remediation tasks; produce reports on its posture for management; exchange messages between members; and ask an artificial intelligence advisor questions about its own security data.
Alongside the console, CyberWatch AI offers a personal scanner for individuals, a browser extension that places the scanner in the right-click menu, and a monthly newsletter on security matters for those who subscribe to it.
The service is developed continuously, and features may be added, altered or withdrawn. Section 23 governs how changes affecting customers are handled.
An account holder must be at least sixteen years of age. Details supplied must be accurate and kept current, and an account created under a false identity may be closed.
The account holder is responsible for all activity conducted through the account and for keeping the password confidential. Where there is reason to believe another person has obtained access, notification should be sent promptly to info@cyberwatchai.com. A single account must not be shared between several people; an organization should invite each person separately.
Two-factor sign-in is available and is strongly recommended, particularly for administrators. Once an account has enrolled a second factor, access to organization data from that account requires the second factor to have been used in the current session, and the account holder must keep the device that holds it secure.
Where an organization subscribes, it controls the account and the organization data within it. Its administrators may invite and remove members, configure departments, launch simulations, assign training and assessments, manage alerts and tasks, and view reporting. Each plan permits a number of members, counting pending invitations, and no further people can be invited once that number is reached until the plan is changed or members or invitations are removed.
A member of an organization should understand two things. The first is that the organization controls its data: it can see simulation results, training completions, assessment results, reports the member has made and the scores derived from them, and it may withdraw access at any time. Questions concerning why it does so are properly directed to the organization rather than to CyberWatch AI. The second is that certain things remain private to the member. A check of suspicious content that the member runs without reporting it is not disclosed to an administrator, and neither are direct messages exchanged between two members. This is a deliberate element of the design of the service and not a configurable setting.
An organization is responsible for informing its people that the service is in use and what it measures, for holding a lawful basis for that use, and for discharging any obligation to consult staff or their representatives that applies where it operates.
The security score is calculated from activity recorded within the service, including simulation results, training completion, reported threats, the risk of content members check, and the organization's answers about its own security baseline. It reflects only what the service has been able to observe. Where there is too little activity to support a figure, the console says so rather than presenting one.
The score, the reports built upon it and the recommendations accompanying them are a guide to where an organization should direct its effort. They are not an audit, a penetration test, a certification or an attestation of compliance with any law or standard, and they do not examine an organization's networks, devices or systems beyond what is entered into the service. They must not be presented to a customer, insurer, regulator or other third party as any of those things.
An organization remains responsible for its own security and for the decisions it takes. Following every recommendation the service makes will not render an organization secure, and a high score is no assurance that an attack will fail.
A simulation delivers realistic but harmless messages to an organization's own people. Launching one constitutes confirmation that every recipient is a member of the customer's organization or is otherwise a person the customer is entitled to test, that the person launching it holds the authority within the organization to do so, and that any legal or contractual obligation to inform staff or their representatives that simulations take place has been discharged.
The service requires an explicit confirmation before a simulation is launched, because genuine messages will arrive with genuine colleagues. That step applies whether a simulation is started by hand or proposed by the advisor, it exists for a reason, and it will not be removed.
Simulation messages must not impersonate a real third party in a manner liable to mislead anyone as to that party, and must not therefore purport to come from a named bank, regulator or supplier. They must not capture genuine credentials; simulated pages record that a submission occurred rather than what was entered, and no attempt may be made to alter that behaviour. They must not employ content calculated to cause distress, such as false information concerning a person's employment, health or family. They must not be used to single out, discipline or dismiss an individual, a simulation being a measurement of a system rather than of a person's worth. The customer is responsible for the use made of the results.
The training modules and assessments supplied with the service are intended to raise awareness and to measure readiness. They describe common attacks and sound responses in general terms and are not legal, regulatory or professional advice for any particular situation.
Assessment results, training records and any scores derived from them describe how a person responded within an exercise. They are not a measure of any person's competence, honesty or value as an employee, and must not be used as the sole basis for a decision concerning a person.
Several parts of the service rely on artificial intelligence models, among them the analysis of submitted content, the advisor, recommendations and written summaries. AI output is an informed opinion generated by a model. It is not a guarantee, and it may be incomplete or wrong.
The analysis of a submission may mark a harmless message as risky and may fail to identify a genuine attack, and a low score constitutes no assurance that a thing is safe. It is a second opinion to be weighed alongside the customer's own judgement and other controls. The service must not be relied upon alone in deciding whether to follow a link, open an attachment, make a payment or act upon an instruction, and where a message requests the movement of money or a change of bank details, it should be verified through a channel already known to be trustworthy, whatever score the service has returned.
The advisor answers questions using the organization's own data and may act on an administrator's request. Actions that stay within the console and can be reversed, such as creating a task or acknowledging an alert, may be carried out directly. Actions that reach outside the console, such as sending simulation messages or inviting people, are only ever proposed, and take place only when an administrator confirms them. The administrator who asks is responsible for reviewing what the advisor does and proposes.
The service may be used for its purpose, which is the protection of the customer's own organization and the people within it, or in the case of the personal scanner, the protection of the individual using it.
The service must not be used to attack, test or profile any person the customer is not authorised to test. Content must not be submitted where there is no right to submit it or where submission would infringe the rights of another. AI output must not be used to refine phishing, malware or fraud so that it evades detection. No attempt may be made to break, overload, probe or circumvent the service, its rate limits or its access controls, nor to reach another organization's data. The service must not be scraped, nor used to construct a competing product. It must not be resold, sublicensed or supplied to third parties absent written agreement. Malware must not be uploaded, and the service must not be used to store or distribute unlawful material. No person or relationship with an organization may be misrepresented, and notices of ownership within the service must not be removed or obscured.
The vulnerability assessment examines what any visitor to the internet can see of a domain, such as its public DNS records, its website and the certificates it presents. Active scanning goes further and connects to the customer's own systems to establish which services are reachable, which versions they run and which files they expose. Active scanning is carried out only for a domain whose control the customer has proved by publishing a DNS record unique to its organization, and only after an administrator has approved a written authorization within the service, which is valid for twenty-four hours and recorded as a task. In approving it, the administrator confirms that the organization owns the domain or holds written permission from its owner to test it, that the administrator has the authority to give that confirmation, and that any hosting provider or other party whose terms require notice of such testing has been given it. The customer is responsible for that confirmation being true. Active scanning is confined to hosts under the verified domain; it is never directed at private or internal addresses, nor at any other party's systems, and no attempt may be made to point it elsewhere. Neither form of assessment is exhaustive: a clean result means only that the checks performed found nothing, not that a system is secure.
This is a security tool. Directed at people whom the customer has no right to test, or used to render an attack more convincing, it becomes the opposite of the thing it was built to be. Accounts believed to be used in that manner will be suspended without notice, and unlawful activity will be reported to the appropriate authorities.
The personal scanner allows an individual to check a link, message, email or screenshot for signs of fraud. It is free to use, with no daily allowance and no paid plan, although checks may be refused where their volume suggests automated or abusive use. Section 9 applies to every check it performs.
The browser extension is provided subject to these terms and to the policies of the Chrome Web Store. It requests a single permission, being the addition of entries to the right-click menu, and holds no access to the pages a person browses. It must not be modified, repackaged or distributed in altered form. It may be updated automatically through the store, including for the correction of security defects.
Customer content remains the property of the customer, and CyberWatch AI claims no ownership of what is submitted or of the organization data derived from it.
The customer grants a limited, worldwide, non-exclusive, royalty-free licence to host, store, process and transmit customer content for the sole purpose of providing the service, which includes transmitting it to the AI provider in order to produce AI output, calculating scores and reports, sending the emails the customer asks the service to send, and displaying the content within the customer's own account. That licence terminates upon deletion of the content or closure of the account, save in respect of copies held in routine backups, which are removed on their ordinary cycle.
Customer content is not used to train artificial intelligence models, and is neither sold nor disclosed otherwise than as the Privacy Policy describes.
The customer is responsible for holding the right to submit whatever is submitted, including the names and email addresses of the people it invites. Material that the customer is not permitted to disclose to a processor should not be placed into the service, and information not required for a check should be removed before submitting. Content breaching these terms may be removed, and records may be retained where the law requires it.
The console is offered on paid plans designated Starter, Business and Enterprise, which differ in the number of members permitted and the features included. Current plan details and prices appear in the console and are available on request, and form part of this agreement upon subscription. Enterprise terms are agreed in writing.
A new organization may be offered a fourteen-day free trial requiring no payment card. When a trial ends without a plan having been chosen, the organization's access to the console is paused until a plan is chosen. Nothing is charged, and the organization data is not deleted at that point; it is retained as the Privacy Policy describes.
Payments are processed by Paystack, and CyberWatch AI neither receives nor stores a full card number. Subscriptions renew automatically for successive periods until cancelled. Fees are payable in advance and, save as set out below or as the law requires, are non-refundable. Prices are exclusive of applicable taxes, which are added where required. Where a payment fails, a further attempt may be made and the customer notified, and paid features may be suspended while a payment remains outstanding.
An organization may move to a different plan or billing cycle from within the console. The change is paid for at checkout as a new subscription, and once that payment is confirmed the subscription it replaces is cancelled automatically, so that the organization is not billed for both. The unused portion of the replaced subscription is not refunded automatically; a customer who considers a refund appropriate may ask for one under the final paragraph of this section.
A subscription may be cancelled at any time by writing to info@cyberwatchai.com. Cancellation prevents the next renewal, and the plan continues until the end of the period already paid for. No cancellation fee is charged and no notice period is required.
Prices may change. Existing subscribers will receive at least thirty days' notice before a change affects them and may cancel in advance of it rather than accept it.
Where the service fails materially and the failure is not corrected within a reasonable period, or where a charge has arisen in error, the matter will be dealt with fairly upon contact, including by refunding the unused portion of the period where that is the appropriate outcome. Nothing in this section limits any refund right conferred by law.
The service sends email in order to operate: invitations to join an organization, simulation messages the customer has launched, notifications to administrators when a member reports a threat, and messages concerning the account, its security and billing. These are part of the service and continue for as long as the account is active.
The newsletter is sent only to those who subscribe to it, and every edition carries a link by which the recipient may unsubscribe at once. Its content is general information on security matters drawn from public reporting, and the provisions of section 9 concerning reliance apply to it equally.
CyberWatch AI relies upon other providers for hosting, database, AI processing, email and payment processing, each of which is identified in the Privacy Policy. Their availability affects the availability of the service. They are selected with care and engaged under contract, but they are not under the control of CyberWatch AI, which is not responsible for their acts beyond its own obligations under this agreement.
Where the service links to a third-party site or displays third-party content, such as a security news report, no endorsement is implied and no responsibility is accepted for it.
The service, including its software, design, text, the CyberWatch AI name and logo, and the training modules, assessments and simulation templates supplied with it, belongs to CyberWatch AI or to its licensors and is protected by intellectual property law. The customer receives a limited, non-exclusive, non-transferable and revocable right to use the service as these terms permit, and nothing in this agreement transfers ownership. Reports the service produces for an organization may be shared freely within that organization and with its advisers.
Feedback and suggestions submitted to CyberWatch AI may be used freely and without obligation. They are welcome, and an uncomfortable one is preferred to a polite silence.
Each party may learn information about the other that is not public, including the customer's security posture, security score, simulation and assessment results and reported threats on one side, and non-public technical and commercial information on the other. Each party undertakes to protect the other's confidential information with reasonable care, to use it only for the purposes of this agreement, and not to disclose it except to persons who require it and are bound by a similar duty, or where disclosure is compelled by law.
CyberWatch AI works to keep the service available and responsive but does not warrant on standard plans that it will be uninterrupted or free from error. The service may be taken down for maintenance, and notice will be given where that is reasonably practicable.
Support is provided by email at info@cyberwatchai.com. An Enterprise agreement may include specific availability and response commitments, and where a signed agreement differs from this section, the signed agreement prevails.
A customer may close an account at any time, and the cancellation of a paid plan is governed by section 13.
CyberWatch AI may suspend or terminate access where these terms are breached, where use places the service or other users at risk, where fees remain unpaid, or where required to do so by law. Where it is reasonable and lawful, notice will be given beforehand together with an opportunity to remedy the position.
Upon termination the right to use the service ends. For thirty days thereafter an organization may ask for an export of its organization data, after which it is deleted on the schedule described in the Privacy Policy. Provisions which by their nature should survive termination, including those concerning content ownership, confidentiality, disclaimers, limitation of liability, indemnity and governing law, continue in force.
To the fullest extent permitted by law, the service is provided on an "as is" and "as available" basis, without warranty of any kind, whether express or implied, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement.
No warranty is given that the service will detect or prevent every threat, that AI output, scores or reports will prove accurate or complete, that use of the service will make an organization secure or compliant with any law or standard, that the service will be uninterrupted or secure, or that defects will be corrected.
Nothing in this section excludes any warranty or right which cannot lawfully be excluded, including any right held in the capacity of a consumer.
To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive loss, nor for loss of profits, revenue, goodwill or data, however arising.
The total liability of CyberWatch AI arising out of or in connection with this agreement, in any period of twelve months, is limited to the total amount paid by the customer for the service in the twelve months preceding the claim.
CyberWatch AI is not liable for loss arising from a security incident the service failed to detect or prevent, from reliance placed upon AI output, a score or a report, from a decision taken by the customer concerning its staff, or from the act of a third party, save to the extent that such loss results from its own breach of this agreement.
Nothing in this section limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other matter which cannot lawfully be limited. These limits reflect the price of the service and the fact that it constitutes one control among many within a security programme, and represent a deliberate allocation of risk between the parties.
The customer shall indemnify CyberWatch AI against claims, damages, losses and reasonable costs arising from breach of these terms, from customer content, or from use of the service in a manner these terms prohibit, and in particular from the conduct of simulations against people the customer was not entitled to test and from decisions the customer takes concerning its staff on the basis of results produced by the service. CyberWatch AI will give prompt notice of any such claim and permit the customer to control its defence, and the customer will not settle in a manner admitting fault on the part of CyberWatch AI without its consent.
The service is improved and altered continuously. A feature upon which a customer relies will not be withdrawn without notice where that can reasonably be avoided.
These terms may be revised, and the date at the head of the page identifies the current version. Where a revision materially affects rights or obligations, at least thirty days' notice will be given by email or within the service before it takes effect. Continued use of the service after that date constitutes acceptance; a customer who does not accept may cancel, and the unused portion of any period already paid for will be refunded.
This agreement is governed by the laws of the jurisdiction in which CyberWatch AI is established, without regard to conflict of law rules, and the courts of that jurisdiction have exclusive jurisdiction over any dispute arising from it, save that either party may seek urgent injunctive relief in any court of competent jurisdiction in order to protect its intellectual property or confidential information.
Before proceedings are commenced, the party raising the matter should set out the problem in correspondence. Most disputes arise from a misunderstanding and are resolved when two people read the same sentence together, and the parties will engage in good faith for thirty days before either proceeds further.
Where the customer is a consumer, this section does not deprive them of the protection of the mandatory laws of their country of residence.
These terms, the Privacy Policy and any order form or signed agreement between the parties constitute the entire agreement upon their subject matter and supersede anything said beforehand. Where a signed agreement conflicts with these terms, the signed agreement prevails in respect of that customer.
Should any provision be held unenforceable, the remainder continues in force and that provision is read down to the minimum extent necessary to render it enforceable. A failure to enforce a right on one occasion does not waive it.
The customer may not assign this agreement without written consent. CyberWatch AI may assign it to an affiliate or in connection with a merger or sale of its business. Nothing in this agreement creates a partnership, joint venture, employment or agency relationship.
Neither party is liable for a failure caused by circumstances genuinely beyond its reasonable control, provided that it notifies the other and works to resume performance. Notices to a customer are sent to the email address held on the account, and notices to CyberWatch AI may be sent to the address below; email constitutes writing for this purpose. The customer's name or logo will not be used as a reference without written permission.
Correspondence concerning these terms should be sent to info@cyberwatchai.com. Matters concerning personal data are addressed in the Privacy Policy.
A security vulnerability may be reported to the same address with the word "Security" in the subject line. Such reports are acknowledged promptly, and no action will be taken against a person who reports a genuine vulnerability in good faith.