Terms and Conditions

1. Agreement to These Terms

These Terms and Conditions ("Terms") are an agreement between you and CHLELA INC. (doing business as "Akadenia," "we," "us," or "our"). They apply to our website at akadenia.com (the "Website") and to Akadenia Security, our external security scanning and reporting service at security.akadenia.com (the "Service").

If you use the Service on behalf of a company or other organization, you accept these Terms for that organization and confirm you have the authority to do so; "you" then means that organization.

If you have a separate written agreement with us, or bought the Service through AWS Marketplace, that agreement or the AWS Marketplace terms you accepted take precedence over these Terms where they conflict.

2. Using Our Website

You may browse and use the Website for lawful purposes. You agree not to:

• Interfere with, disrupt or attempt to gain unauthorized access to the Website or its infrastructure
• Scrape or copy the Website in a way that places an unreasonable load on it
• Use the Website to send spam or unlawful content, including through our contact forms
• Misrepresent your identity or affiliation when contacting us

Content on the Website, including articles and case studies, is provided for general information and is not professional advice for your specific situation.

3. Accounts and Sign-In

Sign-in to the Service is provided by Auth0, an identity service operated by Okta, Inc. You can sign in with an email address and password or with a supported identity provider such as Google. When you sign in, Auth0 processes your sign-in details on our behalf, and your use of a third-party identity provider is also subject to that provider's terms.

• Keep your sign-in credentials secure and do not share your account
• Give accurate information, including a working email address
• Tell us promptly through our contact page if you suspect unauthorized use of your account

You are responsible for activity under your account and, if you are an organization owner or admin, for the members, roles and invitations you manage.

Access to the Service is currently by request. We may approve or decline a request, and we may require additional verification before granting access.

4. Akadenia Security

4.1 What the Service Does

The Service runs external security checks against hosts and URLs you register ("Targets"), such as port and service discovery, web server checks, TLS certificate and uptime checks, and records the results ("Findings") over time. It can send alerts and, where you engage us for a penetration test, produce reports that Akadenia reviews and approves.

4.2 Authorization to Test

Security scanning without permission can be unlawful. You may only add a Target that you own or that you are authorized, in writing, to test. By adding a Target you confirm that:

• You own the Target or hold written authorization from its owner to scan it, and the person you record as authorizing testing actually gave that authorization
• Scanning the Target does not breach any agreement that applies to it, including your hosting or cloud provider’s policies
• You will remove the Target or stop its scans when that authorization ends

Scans only run once you prove control of a Target's domain with a DNS record, or once we grant an exception (for example, for an IP address, which cannot be verified by DNS). Passing that check, or receiving an exception, does not replace the authorization above. We refuse private and internal addresses unless we approve an exception. We may ask you for evidence of authorization and may pause or remove a Target at any time if we believe it is not authorized.

4.3 Acceptable Use

You agree not to use the Service to:

• Scan, probe or attack any system you are not authorized to test
• Circumvent domain verification, plan limits, or the restriction on private and internal addresses
• Perform denial-of-service or load testing, or generate traffic intended to disrupt a system
• Resell or provide the Service to third parties without our written agreement
• Reverse engineer, copy or interfere with the Service, or test its security without our prior written permission
• Violate any applicable law, including computer misuse and export control laws

4.4 Effect of Scans

Scans send network traffic to your Targets. They are designed to be non-destructive, but they may trigger intrusion detection, firewall or provider alerts, and in rare cases may affect the performance of a fragile system. You choose which checks run and when. Schedule them appropriately and let your providers or security teams know where that is needed.

4.5 Findings and Reports

Findings reflect what our checks observed at a point in time from outside your network. No scan finds every vulnerability, and a clean result does not mean a system is secure. Mappings to frameworks such as the OWASP Top 10 and NIST SP 800-53 or CSF 2.0 are informational and are not a certification or audit of compliance. Penetration test reports cover only the scope and period stated in them.

4.6 Your Data

You keep ownership of the information you provide and of the Findings and reports about your Targets ("Customer Data"). You grant us the rights we need to host, process and display Customer Data in order to provide, secure and support the Service. We do not sell Customer Data.

• Customer Data is stored on Amazon Web Services in the United States (us-west-2), and each organization’s data is logically separated from every other organization’s
• Scans run from infrastructure Akadenia operates, which processes raw scan output temporarily and deletes it once the results are uploaded
• Raw scan output and draft reports are deleted about 180 days after they are created, and backup copies are removed within a further 30 days
• Findings, scan history and approved reports are kept while the Target or your account is active
• You can ask us to delete your organization’s data at any time through our contact page. Copies in backups and system logs may remain for a limited time after deletion
• Personal information is handled as described in our Privacy Policy

4.7 Alerts and Integrations

Depending on your plan, you can send alerts by email, to Slack and to your own webhooks. You are responsible for the destinations you configure and for who can read them, since alerts may describe weaknesses in your systems. We may stop sending email to an address that bounces or reports our messages as spam.

4.8 Plans and Fees

Each plan sets limits such as the number of Targets and how often scans can run. Paid plans are provided under a written agreement with us or, where available, purchased through AWS Marketplace, and fees are billed on the terms of that agreement or purchase. If a paid plan ends, we may limit your organization to the features of a free plan or suspend scanning, and we will handle your data as described in section 4.6.

4.9 Availability and Changes

We work to keep the Service available but do not promise uninterrupted operation unless we agree to a service level in writing. We may change, add or remove features, and we will give reasonable notice before removing a feature you pay for.

5. Third-Party Services

We rely on third-party services to run the Website and the Service, including:

• Auth0 (Okta): sign-in and account authentication for the Service
• PostHog: analytics on the Website, to understand how visitors use it. See our Cookie Policy for the cookies it sets and how to opt out
• Amazon Web Services: hosting, storage and email delivery, and billing where you buy through AWS Marketplace
• Integrations you enable: such as Slack or your own webhooks

These providers process data under their own terms and privacy policies. We are not responsible for third-party services we do not control, or for websites we link to.

6. Intellectual Property

The Website and the Service, including their software, design, text and trademarks, belong to Akadenia or its licensors. We grant you a limited, non-exclusive, non-transferable right to use the Service for your internal security purposes while your account is active. If you send us feedback, we may use it without obligation to you.

7. Disclaimers

Except as expressly stated in a written agreement with us, the Website and the Service are provided "as is" and "as available," without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement, and that the Service will detect every vulnerability or be error-free.

8. Limitation of Liability

To the maximum extent permitted by law, Akadenia will not be liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, or for any security incident that the Service did not detect. Our total liability for any claim arising from these Terms, the Website or the Service is limited to the greater of the fees you paid us for the Service in the twelve months before the claim and one hundred US dollars (US$100).

9. Indemnification

You will defend and indemnify Akadenia against claims, damages and costs, including reasonable legal fees, arising from a Target you were not authorized to test, your breach of these Terms, or your misuse of the Service.

10. Suspension and Termination

You may stop using the Service and ask us to close your account at any time. We may suspend or terminate access, immediately if necessary, if you breach these Terms, if we believe a Target is being scanned without authorization, or if required by law. Sections that by their nature should survive termination, including 4.2, 6, 7, 8, 9 and 11, survive it.

11. Governing Law

These Terms are governed by the laws of the State of Idaho, without regard to its conflict of law rules. Any dispute will be brought in the state or federal courts located in Idaho, and you and we consent to their jurisdiction.

12. Changes to These Terms

We may update these Terms from time to time. We will post the updated Terms on this page and update the "Last Updated" date, and for material changes affecting the Service we will notify account owners by email or in the Service. Continuing to use the Website or the Service after a change takes effect means you accept the updated Terms.

13. Contact Us