Terms of Service

1. Definitions

• “Agent” means the EmberHound endpoint software that Customer installs on Authorized Devices to perform local data discovery and compliance scanning.
• “Authorized Device” means any computing device that Customer owns, lawfully leases, or is contractually authorized to manage and on which Customer is permitted by law and by the device’s end user (where required) to deploy the Agent.
• “Customer Data” means data about Customer’s organization, devices, users, and findings metadata that is submitted to or generated by the Service in connection with Customer’s use, expressly excluding the raw sensitive data discovered on Authorized Devices.
• “Findings Metadata” means the structured records produced by the Agent describing detections, including file paths, masked previews, fingerprint hashes, confidence scores, rule identifiers, and similar derived signals — but not the raw underlying personal data, payment data, or other regulated content.
• “Documentation” means the technical and user documentation we make available for the Service, as updated from time to time.
• “Order Form” means any online checkout, written ordering document, or in-product subscription selection referencing these Terms and identifying the Subscription Plan, fees, term, and Service entitlements.
• “Service” means the EmberHound hosted platform (including web application, APIs, admin console, and supporting infrastructure) together with the Agent and the Documentation.
• “Subscription Plan” means the EmberHound subscription tier, included entitlements (seats, Authorized Devices, addons), and term selected by Customer.

2. The Service

The Service is a multi-tenant security-and-compliance platform that enables Customer to discover and inventory sensitive data on Authorized Devices, manage security findings, track remediation, evidence SOC 2 and CIS benchmark controls, and process data-subject access requests. The Service is designed to operate on a data-minimization basis: the Agent transmits only Findings Metadata to the Service and does not transmit the raw regulated content it discovers. Customer acknowledges that this architecture is a material element of the Service and that requesting raw content transmission falls outside the supported scope.

We may update, modify, or improve the Service from time to time. We will not materially degrade the core Service functionality during a paid subscription term without providing reasonable notice and a commercially reasonable replacement.

3. Accounts, Users, and Access

Customer is responsible for (i) the accuracy of account information, (ii) maintaining the confidentiality of credentials, API keys, and device enrollment secrets, (iii) all activity that occurs under its account, and (iv) ensuring that each individual accessing the Service does so under a unique named user account in accordance with the seat entitlement of Customer’s Subscription Plan. Sharing of credentials between individuals is prohibited. Customer will promptly notify EmberHound at security@emberhound.com of any suspected unauthorized access or credential compromise.

4. Agent Software License

Subject to these Terms and Customer’s payment of all applicable fees, EmberHound grants Customer a limited, non-exclusive, non-transferable, non-sublicensable license during the subscription term to install, execute, and run the Agent in object-code form solely on Authorized Devices and solely for the purpose of using the Service. Customer may not, and may not permit any third party to:

• install or run the Agent on any device that is not an Authorized Device, or whose deployment Customer is not legally entitled to authorize;
• reverse-engineer, decompile, disassemble, or attempt to derive the source code, underlying ideas, file formats, or non-public APIs of the Agent or any other component of the Service, except to the extent expressly permitted by mandatory applicable law;
• modify, translate, or create derivative works of the Agent;
• remove or alter any proprietary notices, marks, or labels;
• circumvent or disable any usage limits, license keys, integrity checks, telemetry, certificate pinning, or security controls;
• use the Agent to develop a competing product, to benchmark the Service for publication without our written consent, or to provide the Service to third parties on a service-bureau basis; or
• introduce malicious code or use the Agent in violation of applicable law, including computer-misuse, wiretapping, or workplace-monitoring laws.

The Agent emits operational telemetry (heartbeats, version, configuration hash, scan timing, error diagnostics) needed for the Service to function. Customer consents to this telemetry as a condition of using the Agent.

5. Authorized Deployment of the Agent

Customer represents, warrants, and covenants that, for each device on which it installs the Agent:

• Customer has the legal right and contractual authority to install monitoring or data-discovery software on the device;
• where required by applicable law (including but not limited to employee notice and consent regimes, works-council consultation, and end-user disclosure requirements), Customer has provided all notices and obtained all consents necessary for the Agent’s operation;
• Customer has assessed the lawful basis for any processing of personal data that the Agent may incidentally observe; and
• Customer will promptly uninstall the Agent from any device that ceases to qualify as an Authorized Device.

EmberHound has no ability to independently verify that a device on which the Agent enrolls is an Authorized Device, and relies entirely on Customer’s warranty in this Section. Customer is solely responsible for ensuring that Agent deployment complies with applicable computer-misuse, privacy, employment, and surveillance laws.

6. Acceptable Use

Customer will not (and will not permit any user to): (a) use the Service to violate applicable law or third-party rights; (b) attempt to gain unauthorized access to any portion of the Service or other customers’ data; (c) interfere with or disrupt the integrity or performance of the Service; (d) probe, scan, or load-test the Service except through Documented mechanisms; (e) use the Service to transmit malware or to facilitate unauthorized data exfiltration; (f) misrepresent the identity of any user or device; or (g) use the Service to process data of children under 13 without Documented authorization.

We may suspend access (in whole or in part) immediately and without prior notice if we reasonably determine that Customer’s use poses a security, legal, or operational risk to the Service or to other customers. We will use commercially reasonable efforts to provide notice as soon as practicable and to restore access once the underlying issue is resolved.

7. Customer Data and Security

As between the parties, Customer owns all right, title, and interest in and to Customer Data. Customer grants EmberHound a limited, worldwide, royalty-free licence to process Customer Data solely to provide, maintain, secure, and improve the Service in accordance with these Terms, the Privacy Policy, and (where applicable) the Data Processing Addendum.

EmberHound maintains administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, including encryption in transit (TLS 1.3) and at rest (AES-256), tenant isolation via row-level security, per-tenant cryptographic peppering for sensitive identifiers, role-based access controls, audit logging, and least-privilege production access. Our security posture is described further in our Trust Center.

Where EmberHound processes personal data on behalf of Customer, such processing is governed by the Data Processing Addendum incorporated by reference and available at /privacy (or upon request). Customer is the controller and EmberHound is the processor for such personal data, except for aggregated and de-identified data derived from the Service, which EmberHound may retain and use to operate, secure, and improve the Service.

8. Subscriptions, Fees, and Taxes

The Service is offered solely to businesses and other legal entities acting in a commercial or professional capacity. Consumers may not purchase or use the Service.

Fees, included entitlements, and overage rates are set forth in the applicable Order Form. Unless otherwise stated, subscriptions renew automatically for successive terms equal to the initial term at the then-current list price. Either party may elect not to renew by providing written notice at least thirty (30) days before the end of the then-current term.

Overage and metered usage (including extra seats, extra Authorized Devices in excess of plan capacity, and addon entitlements) are billed in arrears in accordance with the Order Form. Capacity calculations follow the methodology described in the Documentation (active seats and billable assets, computed at snapshot time).

All fees are exclusive of taxes, levies, or duties (including VAT, GST, and sales/use tax), which Customer is responsible for paying, except for taxes based on EmberHound’s net income. Fees are non-refundable except as expressly set out in these Terms. Late payments accrue interest at the lower of 1.5% per month or the maximum permitted by law.

If Customer’s subscription enters a grace, expired, or suspended state due to non-payment or non-renewal, the Service may transition to soft- or hard-enforcement modes that restrict scanning, enrollment, and asset creation, as described in the Documentation. Hard enforcement does not relieve Customer of accrued payment obligations.

9. Trials and Beta Features

EmberHound may offer free trials, founding-customer offers, or beta features (collectively, “Pre-Release Offerings”). Pre-Release Offerings are provided “AS IS” and “AS AVAILABLE”, without warranty of any kind, and may be modified or discontinued at any time. Service-level commitments, indemnities, and warranties do not apply to Pre-Release Offerings.

10. Intellectual Property and Feedback

EmberHound and its licensors retain all right, title, and interest in and to the Service, the Agent, the Documentation, all rule packs and detection logic, all derived analytics, and any modifications or improvements thereto, including all intellectual property rights therein. Except for the limited licence in Section 4, no rights are granted to Customer by implication, estoppel, or otherwise.

If Customer provides feedback, suggestions, or ideas about the Service (“Feedback”), Customer grants EmberHound a perpetual, irrevocable, worldwide, royalty-free, fully sublicensable licence to use the Feedback for any purpose without restriction or attribution.

11. Confidentiality

Each party (as “Recipient”) will protect the Confidential Information of the other party (as “Discloser”) using the same degree of care it uses to protect its own confidential information of like importance (and in no event less than reasonable care), and will use such Confidential Information only to perform its obligations or exercise its rights under these Terms. “Confidential Information” includes the non-public terms of any Order Form, the Service’s non-public technical details, Customer Data, and any information identified as confidential or that should reasonably be understood as such. Standard exclusions apply for information that is (a) publicly available without breach, (b) independently developed, (c) rightfully received from a third party, or (d) required to be disclosed by law (with prompt notice where permitted).

12. Limited Warranty and Disclaimers

EmberHound warrants that, during an active paid subscription, the Service will perform materially in accordance with the Documentation. Customer’s exclusive remedy and EmberHound’s sole liability for breach of this warranty is, at EmberHound’s option, to (i) use commercially reasonable efforts to correct the non-conformity, or (ii) terminate the affected subscription and refund any prepaid fees for the unused portion of the term.

EXCEPT FOR THE EXPRESS LIMITED WARRANTY ABOVE, THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE.” EMBERHOUND DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE.

EmberHound does not warrant that the Service will detect all sensitive data, prevent all data loss, identify all regulatory violations, or ensure that Customer is compliant with PCI DSS, GDPR, CCPA, SOC 2, the CIS Benchmarks, HIPAA, or any other framework. Compliance is an organizational outcome that depends on Customer’s policies, controls, training, and remediation actions. The Service is a tool that supports — but does not substitute for — Customer’s own compliance program and the judgment of its qualified personnel and advisers.

13. Indemnification

The parties’ mutual indemnification obligations are set out in the EmberHound Indemnification Agreement, available at /indemnity and incorporated into these Terms by reference. The remedies set forth there are subject to and limited by Section 14 (Limitation of Liability).

14. Limitation of Liability

EXCLUSION OF INDIRECT DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, GOODWILL, OR DATA, ARISING OUT OF OR RELATED TO THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

AGGREGATE LIABILITY CAP. EACH PARTY’S TOTAL AGGREGATE LIABILITY UNDER THESE TERMS WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO EMBERHOUND FOR THE SERVICE IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

CARVE-OUTS. The above limitations do not apply to: (i) a party’s indemnification obligations under the Indemnification Agreement; (ii) Customer’s payment obligations; (iii) Customer’s breach of Section 4 (Agent Software License), Section 5 (Authorized Deployment), or Section 6 (Acceptable Use); or (iv) liability that cannot be excluded or limited under applicable law.

These limitations form an essential basis of the bargain. The fees reflect, and would be materially higher absent, these allocations of risk.

15. Term and Termination

These Terms remain in effect for so long as Customer has an active subscription. Either party may terminate for material breach by the other that remains uncured thirty (30) days after written notice (or immediately for breach of Section 4, 5, 6, or 11). On expiration or termination: (a) Customer’s right to access the Service and run the Agent ceases; (b) Customer is responsible for uninstalling the Agent from all devices upon termination or expiration of the subscription; (c) within ninety (90) days, EmberHound will delete or anonymize Customer Data in accordance with the retention provisions of the Privacy Policy, except where required to retain it by law; and (d) Sections 7, 10–14, 16, and 17 survive termination.

16. Modifications to these Terms

We may update these Terms from time to time. We will post the updated Terms with a new “Last updated” date and, for material changes, will provide reasonable advance notice (by email or in-product notice) before the changes take effect. Continued use of the Service after the effective date constitutes acceptance.

17. General

Governing Law and Venue. These Terms and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with them, their subject matter, or formation shall be governed by and construed in accordance with the laws of England and Wales.

Subject to any applicable mandatory consumer protection laws, the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with these Terms, their subject matter, or formation.

These Terms shall be governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction over any dispute arising out of or in connection with these Terms.

Assignment. Neither party may assign these Terms without the other’s prior written consent, except that either party may assign without consent in connection with a merger, acquisition, or sale of substantially all assets, provided the assignee assumes all obligations.

Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control, including acts of God, war, terrorism, civil unrest, government action, labour disputes, internet or utility failures, or pandemics.

Independent contractors. The parties are independent contractors. These Terms do not create any agency, partnership, joint venture, or employment relationship.

Notices. Notices to EmberHound must be sent to legal@emberhound.com. Notices to Customer may be sent to the administrative email on file or delivered in-product.

Severability and waiver. If any provision is held unenforceable, the remaining provisions remain in full force. A waiver is effective only if in writing and signed by the waiving party.

Entire agreement. These Terms, together with the Privacy Policy, the Data Processing Addendum (where applicable), the Indemnification Agreement, and any Order Form, constitute the entire agreement between the parties regarding the Service and supersede all prior or contemporaneous agreements, proposals, or representations on the subject.

18. Contact

Questions about these Terms: legal@emberhound.com.