Customer Terms of Service

These Customer Terms of Service (“Customer Terms”) govern the terms on which Embroidery AS, reg. no. 937476965, Frydenlundgata 1, 0169 Oslo, Norway (“Embroidery”) makes the Embroidery Platform available to customers (“Customer”). These Customer Terms apply to all Customers, whether access is obtained directly from Embroidery or through an Embroidery partner.

By signing an Order Form or Special Arrangement referencing these Customer Terms, or by accessing the Embroidery Platform and accepting these terms as part of the signup flow, the individual doing so confirms they have authority to bind the Customer as a legal entity, and that the Customer has read, understood, and accepted these Customer Terms.

1. DEFINITIONS

“Credits” means the prepaid balance recorded in the Customer’s account and used to pay for usage of the Platform. Credits are units for use within the Platform and are not currency or a stored-value payment instrument.

“Data Processing Agreement” means Embroidery’s standard data processing agreement governing Embroidery’s processing of personal data on behalf of the Customer.

“Effective Date” means the date the Customer first gains access to the Platform.

“Embroidery Platform” means Embroidery’s cloud platform, endpoint applications, integrations, dashboards, APIs, detection systems, and related services made available by Embroidery.

“Endpoint Application” means Embroidery’s signed endpoint application installed on Customer-controlled devices to collect telemetry and security-relevant activity data for use with the Platform.

“Intellectual Property Rights” means all intellectual property rights worldwide, whether registered or unregistered, including copyright, trademarks, patents, trade secrets, database rights, design rights, and know-how.

“Platform” means the Embroidery Platform.

“Term” means the period beginning on the Effective Date and continuing until these Customer Terms are terminated in accordance with Section 8.

“Telemetry Data” means data collected through the Platform, including audit logs, prompts, reasoning, tool calls, command execution metadata, configuration data, API interactions, security events, and related operational metadata generated through Customer systems, integrations, AI agents, or Users. For the purposes of these Customer Terms, Telemetry Data includes the “activity data” described in Embroidery’s Privacy Policy.

“Users” means individuals authorized by the Customer to access or use the Platform on the Customer’s behalf.

2. USE OF THE PLATFORM

2.1 License grant. Subject to these Customer Terms, Embroidery grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Platform solely for the Customer’s internal business purposes. Rights to access and use the Platform are licensed, not sold.

2.2 Availability. Embroidery targets commercially reasonable availability of the Platform and may perform planned or emergency maintenance at any time. Embroidery does not guarantee uninterrupted or error-free operation.

2.3 Restrictions. Except as expressly permitted under these Customer Terms, the Customer and its Users may not:

resell, sublicense, distribute, or make the Platform available to third parties;
use the Platform unlawfully or in violation of applicable regulations;
attempt to reverse engineer, decompile, or replicate the Platform;
use the Platform to develop competing systems or models;
use the Platform for malware development, offensive cyber operations, or unlawful surveillance;
interfere with or circumvent security protections or access controls.

2.4 Account security. The Customer is responsible for maintaining the confidentiality and security of its credentials and for all activity conducted through its accounts. The Customer must notify Embroidery promptly upon becoming aware of any unauthorised access or suspected compromise of the Platform.

2.5 Data collection and analysis. The Customer acknowledges and agrees that the Platform operates by collecting, transmitting, storing, processing, and analysing Telemetry Data and related activity data. Depending on the integrations and functionality enabled by the Customer, such data may include:

user data such as name, email address, job title, department, phone number, country and language, and account identifiers;
group or directory membership information;
audit logs and activity records;
prompts, reasoning, and tool calls generated through AI systems;
command execution metadata;
API interactions;
configuration and environment metadata;
login and authentication events.

2.6 Data collection purpose. Embroidery processes such data for the purposes of:

providing and operating the Platform;
threat detection, monitoring, and analysis;
troubleshooting and customer support;
maintaining and improving the Platform, and conducting security research, using aggregated and anonymised data;
complying with legal obligations.

Embroidery processes personal data in accordance with the applicable Data Processing Agreement and Privacy Policy.

2.7 Customer responsibilities. The Customer is solely responsible for:

determining whether use of the Platform is lawful in its jurisdiction;
providing any legally required notices to employees, contractors, or Users;
obtaining any necessary consents or approvals;
conducting any required works council or employee representative consultations;
ensuring that use of the Platform complies with applicable employment, privacy, monitoring, and AI regulations.

2.8 Customer data ownership. As between the parties, the Customer retains ownership of Customer data and Telemetry Data processed through the Platform. Embroidery may use aggregated and anonymised data for analytics, benchmarking, security research, and improvement of the Platform.

2.9 Platform modifications. Embroidery may update, modify, improve, or discontinue portions of the Platform at any time, provided that such changes do not materially reduce the overall functionality of the Platform during the Term.

2.10 Support. Embroidery may provide support through email, chat, documentation, or other channels made available by Embroidery.

3. BILLING AND COMMERCIAL TERMS

3.1 Prepaid credit model. Unless otherwise agreed in writing, paid use of the Platform requires the Customer to purchase Credits in advance and maintain a sufficient Credit balance.

3.2 Credit purchases. The Customer may purchase Credits using the payment methods made available by Embroidery. The price, currency, taxes, and number or value of Credits included in a purchase will be shown at checkout, stated in the applicable invoice, or agreed in an Order Form or Special Arrangement. Except where Embroidery makes invoice payment available, payment is due at the time of purchase. Credits are added to the Customer’s balance after payment has been successfully processed, unless Embroidery agrees to make them available earlier.

3.3 Usage deductions. Credits are deducted from the Customer’s balance as the Platform is used. The number of Credits deducted may be based on telemetry volume, endpoints, API usage, storage, processing volume, or other usage metrics specified by Embroidery. Credits are consumed in the order in which they were added to the Customer’s balance, oldest first. The Customer is responsible for monitoring its Credit balance and usage.

3.4 Auto-refill. If the Customer enables auto-refill, the Customer authorizes Embroidery to initiate additional Credit purchases using the selected payment method when the Customer’s balance reaches the configured threshold, subject to any limits configured by the Customer. Auto-refill processing may be delayed or fail, and the Customer remains responsible for maintaining sufficient Credits.

3.5 Insufficient balance. If the Customer does not have sufficient Credits, Embroidery may restrict or suspend access to paid Platform functionality until sufficient Credits are available. Embroidery is not responsible for interruptions resulting from an insufficient Credit balance or a failed or delayed Credit purchase.

3.6 Price changes. Embroidery may update pricing, including the rates at which Credits are purchased or consumed, on thirty (30) days’ written notice. Pricing changes apply only to Credit purchases and Platform usage occurring after the change takes effect. A change will not reduce the numerical value of the Customer’s existing Credit balance, but a change to consumption rates may affect how quickly that balance is used for future Platform usage.

3.7 Taxes. All fees are exclusive of VAT and similar taxes.

3.8 Invoice payments. Where Embroidery permits the Customer to purchase Credits by invoice, invoices are payable within thirty (30) calendar days after the Customer receives the invoice, unless otherwise stated on the invoice or agreed in writing. If an invoice remains overdue for fifteen (15) calendar days after Embroidery gives written notice, Embroidery may suspend access to the Platform, withhold or reverse any Credits made available before payment, and disable invoice payment or auto-refill.

3.9 Credit validity and refunds. Purchased Credits do not expire during the Term. Except as required by law or provided in Section 8.4, completed Credit purchases are final and non-refundable. Promotional, complimentary, coupon, or other Credits not paid for by the Customer have no refundable value.

4. INTELLECTUAL PROPERTY

4.1 Ownership. Embroidery and its licensors retain all Intellectual Property Rights in and to the Platform. Except for the limited rights expressly granted under these Customer Terms, no rights are transferred to the Customer.

4.2 Feedback. The Customer grants Embroidery a perpetual, irrevocable, worldwide right to use feedback, suggestions, or improvement ideas relating to the Platform without restriction or compensation.

5. CONFIDENTIALITY

Each party shall keep confidential all non-public information disclosed by the other party that would reasonably be understood to be confidential. Confidential information may only be used for purposes connected with these Customer Terms.

6. DISCLAIMER AND LIMITATION OF LIABILITY

6.1 No security guarantee. The Platform is designed to assist with security monitoring and threat detection but does not guarantee detection of all threats, attacks, vulnerabilities, policy violations, or unsafe behaviour. AI-generated detections, classifications, summaries, and alerts are probabilistic in nature and may produce false positives or false negatives. The Customer remains solely responsible for security decisions, investigations, incident response, compliance obligations, and operational actions taken based on output generated by the Platform.

6.2 Disclaimer. The Platform is provided “as is” and “as available” without warranties of any kind, whether express, implied, statutory, or otherwise.

6.3 Limitation of liability. To the maximum extent permitted by law:

neither party is liable for indirect, consequential, incidental, special, punitive, or exemplary damages, including loss of profits, revenue, business, goodwill, or data;
Embroidery’s total aggregate liability under these Customer Terms shall not exceed the fees paid by the Customer to Embroidery during the twelve (12) months preceding the event giving rise to the claim.

6.4 Non-excludable liability. Nothing in these Customer Terms limits liability that cannot lawfully be excluded.

7. DATA PROTECTION

7.1 Processor relationship. Where Embroidery processes personal data on behalf of the Customer, Embroidery acts as a data processor.

7.2 Controller relationship. Embroidery acts as an independent controller for business contact data, billing data, analytics, fraud prevention, legal compliance, and Platform security purposes.

7.3 Security measures. Embroidery implements commercially reasonable technical and organisational security measures designed to protect Customer data.

7.4 Breach notification. Each party shall notify the other without undue delay upon becoming aware of a personal data breach affecting the other party’s data.

7.5 Data retention. Unless otherwise agreed in writing, Embroidery retains activity data for sixty (60) days, after which it is automatically deleted. Where the Platform generates alerts or detections, Embroidery may retain limited data associated with those alerts for as long as the Customer remains active and for up to twelve (12) months thereafter for security, audit, support, and operational purposes.

7.6 Data hosting and transfers. Embroidery’s primary hosting and storage infrastructure is located within Europe. Customer data may be processed outside the European Economic Area by AI service providers and other sub-processors used to provide the Platform. Embroidery makes such transfers in compliance with applicable law and, where required, relies on an adequacy decision, approved standard contractual clauses, or another lawful transfer mechanism.

7.7 Privacy Policy. Embroidery’s Privacy Policy describes how Embroidery processes personal data for its own purposes as a controller. Where Embroidery processes personal data on behalf of the Customer, the Data Processing Agreement applies and the Customer is responsible for providing required notices to data subjects.

8. TERM AND TERMINATION

8.1 Termination for convenience. Either party may terminate these Customer Terms at any time by providing written notice.

8.2 Termination for cause. Either party may terminate these Customer Terms immediately if the other party materially breaches these Customer Terms and fails to cure the breach within thirty (30) days of written notice.

8.3 Suspension. Embroidery may suspend access immediately if:

continued access poses a security risk;
the Customer is using the Platform unlawfully;
the Customer is in material breach of these Customer Terms;
Embroidery reasonably believes the Platform is being used for offensive cyber activity, abuse, or unlawful conduct.

8.4 Effect of termination. Upon termination, the Customer’s right to access the Platform immediately ceases. Termination does not affect accrued rights or liabilities, including amounts due for completed or authorised Credit purchases. If the Customer terminates these Customer Terms, unused Credits remain non-refundable except as required by law. If Embroidery terminates these Customer Terms, Embroidery will refund the monetary value of any unused Credits purchased and paid for by the Customer, calculated as the unused proportion of the price actually paid for the applicable Credit purchase and excluding taxes. Promotional, complimentary, coupon, or other Credits not paid for by the Customer have no refundable value. Embroidery may deduct any amounts the Customer owes from the refund. The refund will be issued within thirty (30) calendar days after termination to the original payment method or, where that is not reasonably possible, by another method agreed with the Customer.

9. PUBLICITY

Unless otherwise agreed in writing, Embroidery may identify the Customer as a customer of Embroidery using the Customer’s name and logo. The Customer may withdraw this permission at any time by written notice.

10. GENERAL

10.1 Governing law. These Customer Terms and any non-contractual obligations arising out of or in connection with them are governed by the laws of England and Wales.

10.2 Venue. The courts of England and Wales shall have exclusive jurisdiction over any dispute arising out of or in connection with these Customer Terms, including any question regarding their existence, validity, or termination.

10.3 Assignment. Embroidery may assign these Customer Terms in connection with a merger, acquisition, financing, or sale of assets.

10.4 Amendments. Any amendment or modification to these Customer Terms must be agreed in writing by both parties.

10.5 Severability. If any provision of these Customer Terms is held unenforceable, the remaining provisions remain in full force and effect.

10.6 Entire agreement. These Customer Terms, together with any applicable Order Form, Special Arrangement, and Data Processing Agreement, constitute the entire agreement between the parties concerning the Platform.

10.7 Order of precedence. If there is a conflict between these Customer Terms and an Order Form or Special Arrangement signed by both parties, the Order Form or Special Arrangement prevails only to the extent that it expressly identifies and overrides the conflicting provision. The Data Processing Agreement prevails over these Customer Terms with respect to the processing of personal data on behalf of the Customer.

11. COMPLIANCE

11.1 Export controls and sanctions. The Customer may not access or use the Platform in violation of applicable export control or sanctions laws.

11.2 Acceptable conduct. The Customer may not use the Platform:

to violate applicable law;
to infringe third-party rights;
for unlawful monitoring or surveillance;
to support offensive cyber operations;
to develop malicious software or malware.