Terms and Conditions

INTRUDER

FREE TRIAL TERMS

BETWEEN:

(1) Intruder Systems LTD with registered office 71-75 Shelton Street, London, WC2H 9JQ and registered number 09529593 (“Intruder”); and

(2) The Customer as identified in the Order (“Customer”)

Background

(A) Intruder has developed certain vulnerability scanner software products which it makes available to customers on a SaaS basis, to enable the Customer to find cyber security weaknesses in their digital infrastructure.

(B) The Customer wishes to take a 14 Day Free Trial of Intruder’s services for its internal business purposes.

(C) Intruder has agreed to provide, and the Customer has agreed to take a 14 Day Free Trial of Intruder’s services subject to the terms and conditions of this Agreement.

1 Definitions

1.1 In this Agreement, the following words will have the following meanings:

“Agreement” means these terms and conditions together with the Order, schedules, annexes and all other documents referred to herein;

"Confidential Information" means the provisions of this Agreement and in relation to either Party, all information, in any form or medium, which is secret or otherwise not publicly available (either in its entirety or in the precise configuration or assembly of its components), including commercial, financial, marketing or technical information, accounts, business plans, business methods, strategies and financial forecasts, tax records, correspondence, designs, drawings, manuals, specifications, customer or sales or supplier information, technical or commercial expertise, software, formulae, processes, methods, knowledge, know-how and trade secrets, whether disclosed orally, in writing or by electronic means, before or after the date of this Agreement, and in the case of the Customer shall include the specific Customer results and reports generated from use of the Service;

"Customer User" means any employee, agent, contractor and/or consultant of the Customer who uses the Service on behalf of the Customer;

“Effective Date” means the date that the Order is accepted by Intruder;

“End Customers” means the end customers of the Customer on behalf of whom the Customer may use the Service.

"Intellectual Property Rights” means any and all rights in and to any patent, copyright, database, design, trade mark, service mark, domain name, know-how, utility model, business method or process, whether such right is registered or not, or where relevant, any application for any such right, or other industrial or intellectual property right anywhere in the world;

"Intruder Portal" means the online portal (as may be modified by Intruder from time to time) through which the Customer and Customer Users can manage their Target(s) and view their security Weaknesses;

“Order” means the specific order for the Service as accepted by Intruder during the relevant sign up process;

"Party" or "Parties" means Intruder and/or the Customer as the context may require;

“Platform” means the Intruder software platform, including the Intruder Portal, via which the Service is made available, including all versions, amendments and improvements thereto and/or any other tools, methods, models, know how, code, functionality or other elements owned or developed by Intruder;

“Platform Data” means all usage and/or statistical or other data, information, learnings or know how related to and/or derived from the use of the Platform by customers and users, only in anonymised and aggregated form, and at all times not including any data or information that could individually identify a Customer;

“Service” means the services to be supplied by Intruder under this Agreement under the Trial;

"Service Specification" means the specification of the Service set out at http://www.intruder.io/the-intruder-service as updated and amended from time to time by Intruder to reflect changes, enhancements and improvements that it makes to the Intruder systems and technology;

"Target(s)" means an individual computer system as identified by the IP address, hostname or other unique identifier assigned to it. Where the same computer system is monitored via multiple IP addresses, hostnames, or other identifiers, each separate entry in the Intruder Portal will count as a unique system;

“Term” means a 14 Day Free Trial;

“Trial” means the 14 Day Free Trial plan as made available by Intruder.

"Weakness" means a particular configuration, software patch level, or application code deployment which is perceived as likely to, or can be demonstrated to reduce or undermine the security of  Target(s), or the information stored, processed or transmitted by it;

2 The Service

2.1 Subject to acceptance of a relevant Order by Intruder, and subject to compliance by the Customer with the provisions of the Trial and the terms of this Agreement, Intruder agrees to provide the Customer with the Service.

2.2 The Customer may under the Trial:

(a) use the Service for the Customer's own internal business purposes in relation to its own Target(s);

(b) use the Service to conduct trials in relation to its own End Customers, by including its End Customer’s systems in the Target(s).

2.3 For the avoidance of doubt the Customer may not permit its End Customers to use the Service or access the Platform directly, and the Customer must at all times use the Service on behalf of its End Customers. The Customer is responsible for ensuring that only employees, agents and consultants authorised and permitted by the Customer can access and use the Service. Only employees, agents and consultants of the Customer are entitled to be Customer Users.

2.4 The Customer shall be responsible for all access to and use of the Service as enabled by the Customer via the Customer’s account and or Customer Users’ login credentials.

2.5 In connection with its supply of the Service, Intruder may be required to process personal data on behalf of the Customer. In such circumstances the parties will each comply with the terms and conditions of the Data Processing Agreement available here.

3 Customer Systems and Customer Responsibilities

3.1 The Customer shall perform or comply with the Customer responsibilities under this Agreement and agrees that Intruder's provision of the Service is dependent on the Customer performing or complying with the Customer responsibilities.

3.2 The Customer authorises and permits Intruder to access the Customer's systems and networks (including without limitation the Target(s) and any applications or data held on such network and systems) for the purposes of the Computer Misuse Act 1990 (as updated, replaced and amended from time to time) and / or other relevant legislation and regulations in the relevant territories, and represents it has authority and will have authority at all times during this Agreement, to give such permission. To the extent permitted by law, the Customer waives any rights or protections it may have under the Computer Misuse Act 1990 and / or equivalent local legislation, with respect to Intruder's activities performed in the course of providing the Service, save in the event of negligence, fraud or wilful misconduct on the part of Intruder.

3.3 The Customer warrants and represents that it has and will have at all times during this Agreement, all necessary permissions, authorisations and consents from the owners or licensors of the Customer's systems and networks and or those of the End Customer (including without limitation the Target(s) and any hosting provider, cloud provider, software-as-a-service provider, infrastructure provider or other party whose authorisation is required for the AI Pentest) to enable the Service to be provided to the Customer.

3.4 The Customer warrants and represents that where it uses the Service in any jurisdiction or territory other than the UK, it shall be wholly responsible for ensuring that the use of the Service in that jurisdiction or territory complies with applicable laws or regulation.

3.5 The Customer shall not and shall not permit any third party to:

(a) attempt to download, copy, modify, create derivative works from, frame, mirror, republish or distribute any portion of the Platform except to the extent expressly set out in this Agreement; or

(b) attempt to copy, adapt, decompile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Platform, except as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties;

(c) use any knowledge or information acquired in relation to the Platform or Service in order to build a software product which competes with the Platform;

(d) resell, sublicense or otherwise use the Platform or Service to provide services to third parties.

4 Security and Disclaimers

4.1 The Customer acknowledges that in order for Intruder to provide the Service it will use penetration testing techniques on the Target(s) in accordance with the Service Specification to try and identify Weaknesses. The Customer acknowledges that use of the Service may cause certain temporary increase of network bandwidth usage and / or system processing load of the Target(s) during the tests, and that Intruder is not responsible for any consequences of Customer network bandwidth or processing capacity limitations.

4.2 Notwithstanding the above, Intruder will ensure it or the Service does not cause any new or worsen any existing Weaknesses, and will not enable any unauthorised access to or use of the Target(s).

4.3 The Customer acknowledges that the Service is not built specifically as a service for the Customer or the Target(s) and is not guaranteed to and may not identify all Weaknesses that can impact or affect systems.

4.4 Intruder shall not be responsible for any damage or loss that the Customer, any Customer User or End Customer may suffer, whether directly or indirectly as a result of use and provision of the Service as intended, and / or in relation to any Weakness that is not identified by the Service.

5 Intellectual  Property

5.1 Intruder has, at its sole cost, created, licensed and developed the Service and the technology and systems including the Platform that form part of the Service.

5.2 As between the Parties, all Intellectual Property Rights in the Service, the Platform and the Platform Data belong to Intruder.

6 Confidentiality

6.1 Each Party shall keep and procure to be kept secret and confidential all Confidential Information of the other Party disclosed or obtained as a result of the relationship of the Parties under this Agreement and shall not use nor disclose the same except in relation to the performance of this Agreement or with the prior written consent of the other Party. Where disclosure is made by a Party of the other Party's Confidential Information, to any employee, agent or consultant, it shall be done subject to obligations equivalent to those set out in this Agreement. Each Party agrees to use its best endeavours to procure that any such employee, agent or consultant complies with such obligations provided that each Party shall continue to be responsible to the other Party in respect of any disclosure or use of such Confidential Information by a person to whom disclosure is made.

7 Warranties and Indemnities

7.1 The Service under the Trial is provided to the Customer on an "as is" and "as available" basis, without warranty of any kind, whether express, implied, or statutory. In any event, Intruder does not warrant that the Service will be uninterrupted, timely, secure, or error-free, that defects will be corrected. No advice or information, whether oral or written, obtained by the Customer from Intruder or through or from the Service shall create any warranty not expressly stated in this Agreement

7.2 Save as expressly set out here, any other conditions, warranties or other terms which might have effect between the parties or be implied or incorporated into this Agreement whether by statute, common law or otherwise, are hereby excluded to the fullest extent permitted by law, including, without limitation, the implied conditions, warranties or other terms as to satisfactory quality and fitness for purpose, title, non-infringement, accuracy, reliability, security, compatibility, or arising from any course of dealing, usage, or trade practice.

7.3 The Customer warrants that:

(a) it, and its representative signing up to the Agreement, has full right, power and authority to enter into this Agreement;

(b) it has all the rights, licences, permits, approvals and clearance of third party rights as required by applicable laws and as are necessary to perform its obligations and allow Intruder to perform its obligations under this Agreement.

7.4 The Customer will indemnify Intruder from and against any and all losses, damages, claims, penalties, fines, costs and expenses (including reasonable external legal expenses) suffered or incurred by or awarded against Intruder payable in relation to any third party claims or actions as a result of or in connection with any breach by the Customer of clause 7.3 and/or clauses 3.2, 3.3 and 3.4.

7.5 Each Party will fully indemnify the other from and against any and all losses, damages, claims, penalties, fines, costs and expenses (including reasonable external legal expenses) suffered or incurred by or awarded against the other as a result of or in connection with any breach by the other of clause 6 (Confidentiality).

8 Limitation of Liability

8.1 Nothing in this Agreement shall exclude or limit either Party’s liability for death or personal injury caused by that Party’s negligence, fraud or fraudulent misrepresentation, or any liability which cannot be legally excluded or limited.

8.2 Subject to clause 8.1, neither party will be liable, whether in contract, tort (including negligence) breach of statutory duty, or otherwise, for any of the following losses or damage (whether or not such losses or damage were direct, foreseen, foreseeable, known or otherwise) howsoever arising in respect of any: special, indirect, incidental or consequential loss or damage; loss of actual or anticipated profits; loss of business or contracts; loss of revenue or of the use of money; loss of anticipated savings; and/or loss of goodwill, arising out of or in connection with this Agreement.

8.3 Subject to clauses 8.1, the maximum aggregate liability of Intruder to the Customer for all claims arising in connection with this Agreement whether in contract, tort (including negligence) or breach of statutory duty, misrepresentation or otherwise shall be limited £10 (ten pounds).

8.4 Intruder shall have no liability towards any End Customer.

8.5  For the avoidance of doubt, the Service under the Trial is provided free of charge, and the Customer acknowledges that no consideration has been paid and that the limitations and exclusions set out in this Agreement are fundamental elements of this Agreement, reflect a fair and reasonable allocation of risk between the parties and that the Provider would not provide the Service to the Customer without such limitations

9 Term, Termination and Suspension

9.1 This Agreement will begin on the Effective Date and continue for the Term, unless terminated in accordance with these terms.

9.2 At the end of the Term the Customer may sign up separately for a paid plan or limited functionality free plan.

9.3 Either Party may terminate this Agreement if the other party commits a material breach of this Agreement.

9.4 Upon termination of this Agreement for any reason whatsoever:

(a) the relationship of the Parties shall cease and all rights granted under this Agreement to access and use the Service shall cease immediately;

(b) any provision which is expressly or by implication intended to come into force or remain in force on or after termination will continue in full force and effect.

9.5 The termination of this Agreement shall be without prejudice to the rights and remedies of either Party which may have accrued up to the date of termination.

10 Entire Agreement

10.1 This Agreement contains the entire agreement between the Parties in relation to its subject matter and supersedes any prior arrangement, understanding written or oral agreements between the Parties in relation to such subject matter.

10.2 All warranties, conditions, terms and representations not set out in this Agreement whether implied by statute or otherwise are excluded to the extent permitted by law.

11 Applicable Law and Jurisdiction

11.1 This Agreement and any issues, disputes or claims arising out of or in connection with it (whether contractual or non-contractual in nature) shall be governed by, and construed in accordance with, the laws of England.

11.2 All disputes or claims arising out of or relating to this Agreement shall be subject to the exclusive jurisdiction of the English Courts to which the Parties irrevocably submit.

‍

INTRUDER 

FREE PLAN TERMS 

BETWEEN:

(1) Intruder Systems LTD with registered office 71-75 Shelton Street, London, WC2H 9JQ and registered number 09529593 (“Intruder”); and

(2) The Customer as identified in the Order (“Customer”)

Background

1. Intruder has developed certain vulnerability scanner software products which it makes available to customers on a SaaS basis, to enable the Customer to find cyber security weaknesses in their digital infrastructure.
2. Intruder also offers a Free Plan for the product as a basic no commitment alternative.
3. The Customer wishes to sign up to the Free Plan for its internal business purposes.
4. Intruder has agreed to provide, and the Customer has agreed to take the Free Plan subject to the terms and conditions of this Agreement.

1. Definitions
   
   1. In this Agreement, the following words will have the following meanings:

“Agreement” means these terms and conditions together with the Order, schedules, annexes and all other documents referred to herein; 

"Confidential Information" means the provisions of this Agreement and in relation to either Party, all information, in any form or medium, which is secret or otherwise not publicly available (either in its entirety or in the precise configuration or assembly of its components), including commercial, financial, marketing or technical information, accounts, business plans, business methods, strategies and financial forecasts, tax records, correspondence, designs, drawings, manuals, specifications, customer or sales or supplier information, technical or commercial expertise, software, formulae, processes, methods, knowledge, know-how and trade secrets, whether disclosed orally, in writing or by electronic means, before or after the date of this Agreement, and in the case of the Customer shall include the specific Customer results and reports generated from use of the Service;

"Customer User" means any employee, agent, contractor and/or consultant of the Customer who uses the Service on behalf of the Customer;

“Effective Date” means the date that the Order is accepted by Intruder;

“End Customers” means the end customers of the Customer on behalf of whom the Customer provides other services;

“Free Plan” means the free plan for the Intruder Service with limited and restricted functionality as made available by Intruder;

"Intellectual Property Rights” means any and all rights in and to any patent, copyright, database, design, trade mark, service mark, domain name, know-how, utility model, business method or process, whether such right is registered or not, or where relevant, any application for any such right, or other industrial or intellectual property right anywhere in the world;

"Intruder Portal" means the online portal (as may be modified by Intruder from time to time) through which the Customer and Customer Users can manage their Target(s) and view their security Weaknesses;

“Order” means the specific order for the Service as accepted by Intruder during the relevant sign up process; 

"Party" or "Parties" means Intruder and/or the Customer as the context may require;

“Platform” means the Intruder software platform, including the Intruder Portal, via which the Service is made available, including all versions, amendments and improvements thereto and/or any other tools, methods, models, know how, code, functionality or other elements owned or developed by Intruder;

“Platform Data” means all usage and/or statistical or other data, information, learnings or know how related to and/or derived from the use of the Platform by customers and users, only in anonymised and aggregated form, and at all times not including any data or information that could individually identify a Customer;

“Service” means the limited and restricted services to be supplied by Intruder under this Agreement under the Free Plan;

"Service Specification" means the limited and restricted specification of the Service set out at http://www.intruder.io/pricing as updated and amended from time to time by Intruder to reflect changes, enhancements and improvements that it makes to the Intruder systems and technology;

"Target(s)" means an individual computer system as identified by the IP address, hostname or other unique identifier assigned to it. Where the same computer system is monitored via multiple IP addresses, hostnames, or other identifiers, each separate entry in the Intruder Portal will count as a unique system;

“Term” means perpetual, subject to termination rights below;

"Weakness" means a particular configuration, software patch level, or application code deployment which is perceived as likely to, or can be demonstrated to reduce or undermine the security of Target(s), or the information stored, processed or transmitted by it;

2. The Service
   
   1. Subject to acceptance of a relevant Order by Intruder, and subject to compliance by the Customer with the provisions of the Free Plan and the terms of this Agreement, Intruder agrees to provide the Customer with the Service.
   2. The Customer under the Free Plan:
      
      1. may only use the Service solely for the Customer's own internal business purposes in relation to its own Target(s);
      2. must not use and is specifically restricted from using the Service to provide services to its own End Customers, including by adding its End Customer’s systems as the Target(s).
   3. The Customer is responsible for ensuring that only its own employees, agents and consultants authorised and permitted by the Customer can access and use the Service. Only employees, agents and consultants of the Customer are entitled to be Customer Users.
   4. The Customer shall be responsible for all access to and use of the Service as enabled by the Customer via the Customer’s account and or Customer Users’ login credentials.
   5. In connection with its supply of the Service, Intruder may be required to process personal data on behalf of the Customer. In such circumstances the parties will each comply with the terms and conditions of the Data Processing Agreement available here.
3. Customer Systems and Customer Responsibilities
   
   1. The Customer shall perform or comply with the Customer responsibilities under this Agreement and agrees that Intruder's provision of the Service is dependent on the Customer performing or complying with the Customer responsibilities.
   2. The Customer authorises and permits Intruder to access the Customer's systems and networks (including without limitation the Target(s) and any applications or data held on such network and systems) for the purposes of the Computer Misuse Act 1990 (as updated, replaced and amended from time to time) and / or other relevant legislation and regulations in the relevant territories, and represents it has authority and will have authority at all times during this Agreement, to give such permission. To the extent permitted by law, the Customer waives any rights or protections it may have under the Computer Misuse Act 1990 and / or equivalent local legislation, with respect to Intruder's activities performed in the course of providing the Service, save in the event of negligence, fraud or wilful misconduct on the part of Intruder.
   3. The Customer warrants and represents that it has and will have at all times during this Agreement, all necessary permissions, authorisations and consents from the owners or licensors of the Customer's systems and networks (including without limitation the Target(s) and any hosting provider, cloud provider, software-as-a-service provider, infrastructure provider or other party whose authorisation is required for the AI Pentest) to enable the Service to be provided to the Customer.
   4. The Customer warrants and represents that where it uses the Service in any jurisdiction or territory other than the UK, it shall be wholly responsible for ensuring that the use of the Service in that jurisdiction or territory complies with applicable laws or regulation.
   5. The Customer shall not and shall not permit any third party to:

1. attempt to download, copy, modify, create derivative works from, frame, mirror, republish or distribute any portion of the Platform except to the extent expressly set out in this Agreement; or
2. attempt to copy, adapt, decompile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Platform, except as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties;
3. use any knowledge or information acquired in relation to the Platform or Service in order to build a software product which competes with the Platform;
4. resell, sublicense or otherwise use the Platform or Service to provide services to third parties.

4. Security and Disclaimers 
   
   1. The Customer acknowledges that in order for Intruder to provide the Service it will use penetration testing techniques on the Target(s) in accordance with the Service Specification to try and identify Weaknesses. The Customer acknowledges that use of the Service may cause certain temporary increase of network bandwidth usage and / or system processing load of the Target(s) during the tests, and that Intruder is not responsible for any consequences of Customer network bandwidth or processing capacity limitations.
   2. Notwithstanding the above, Intruder will ensure it or the Service does not cause any new or worsen any existing Weaknesses, and will not enable any unauthorised access to or use of the Target(s).
   3. The Customer acknowledges that the Service is not built specifically as a service for the Customer or the Target(s) and is not guaranteed to and may not identify all Weaknesses that can impact or affect systems. 
   4. Intruder shall not be responsible for any damage or loss that the Customer or any Customer User may suffer, whether directly or indirectly as a result of use and provision of the Service as intended, and / or in relation to any Weakness that is not identified by the Service.
5. Intellectual Property
   
   1. Intruder has, at its sole cost, created, licensed and developed the Service and the technology and systems including the Platform that form part of the Service.
   2. As between the Parties, all Intellectual Property Rights in the Service, the Platform and the Platform Data belong to Intruder.
6. Confidentiality
   
   1. Each Party shall keep and procure to be kept secret and confidential all Confidential Information of the other Party disclosed or obtained as a result of the relationship of the Parties under this Agreement and shall not use nor disclose the same except in relation to the performance of this Agreement or with the prior written consent of the other Party. Where disclosure is made by a Party of the other Party's Confidential Information, to any employee, agent or consultant, it shall be done subject to obligations equivalent to those set out in this Agreement. Each Party agrees to use its best endeavours to procure that any such employee, agent or consultant complies with such obligations provided that each Party shall continue to be responsible to the other Party in respect of any disclosure or use of such Confidential Information by a person to whom disclosure is made.
7. Warranties and Indemnities
   
   1. The Service is provided to the Customer on an "as is" and "as available" basis, without warranty of any kind, whether express, implied, or statutory. In any event, Intruder does not warrant that the Service will be uninterrupted, timely, secure, or error-free, that defects will be corrected. No advice or information, whether oral or written, obtained by the Customer from Intruder or through or from the Service shall create any warranty not expressly stated in this Agreement.
   2. Save as expressly set out here, any other conditions, warranties or other terms which might have effect between the parties or be implied or incorporated into this Agreement whether by statute, common law or otherwise, are hereby excluded to the fullest extent permitted by law, including, without limitation, the implied conditions, warranties or other terms as to satisfactory quality, fitness for purpose, title, non-infringement, accuracy, reliability, security, compatibility, or arising from any course of dealing, usage, or trade practice.
   3. The Customer warrants that: 
      
      1. it, and its representative signing up to the Agreement, has full right, power and authority to enter into this Agreement;
      2. it has all the rights, licences, permits, approvals and clearance of third party rights as required by applicable laws and as are necessary to perform its obligations and allow Intruder to perform its obligations under this Agreement.
   4. The Customer will indemnify Intruder from and against any and all losses, damages, claims, penalties, fines, costs and expenses (including reasonable external legal expenses) suffered or incurred by or awarded against Intruder payable in relation to any third party claims or actions as a result of or in connection with any breach by the Customer of clause 7.3 and/or clauses 3.2, 3.3 and 3.4.
   5. Each Party will fully indemnify the other from and against any and all losses, damages, claims, penalties, fines, costs and expenses (including reasonable external legal expenses) suffered or incurred by or awarded against the other as a result of or in connection with any breach by the other of clause 6 (Confidentiality).
8. Limitation of Liability
   
   1. Nothing in this Agreement shall exclude or limit either Party’s liability for death or personal injury caused by that Party’s negligence, fraud or fraudulent misrepresentation, or any liability which cannot be legally excluded or limited.
   2. Subject to clause 8.1, neither party will be liable, whether in contract, tort (including negligence) breach of statutory duty, or otherwise, for any of the following losses or damage (whether or not such losses or damage were direct, foreseen, foreseeable, known or otherwise) howsoever arising in respect of any: special, indirect, incidental or consequential loss or damage; loss of actual or anticipated profits; loss of business or contracts; loss of revenue or of the use of money; loss of anticipated savings; and/or loss of goodwill, arising out of or in connection with this Agreement.
   3. Subject to clauses 8.1, the maximum aggregate liability of Intruder to the Customer for all claims arising in connection with this Agreement whether in contract, tort (including negligence) or breach of statutory duty, misrepresentation or otherwise shall be limited £10 (ten pounds).
   4. For the avoidance of doubt, the Service is provided free of charge, and the Customer acknowledges that no consideration has been paid and that the limitations and exclusions set out in this Agreement are fundamental elements of this Agreement, reflect a fair and reasonable allocation of risk between the parties and that the Provider would not provide the Service to the Customer without such limitations.
9. Term, Termination and Suspension
   
   1. This Agreement will begin on the Effective Date and continue for the Term, unless terminated in accordance with these terms. 
   2. Either Party may terminate this Agreement if the other party commits a material breach of this Agreement.
   3. Intruder may terminate the Agreement at will at any time for any or no reason on 28 days’ notice.
   4. Upon termination of this Agreement for any reason whatsoever:
      
      1. the relationship of the Parties shall cease and all rights granted under this Agreement to access and use the Service shall cease immediately;
      2. any provision which is expressly or by implication intended to come into force or remain in force on or after termination will continue in full force and effect.
   5. The termination of this Agreement shall be without prejudice to the rights and remedies of either Party which may have accrued up to the date of termination.
10. Entire Agreement
    
    1. This Agreement contains the entire agreement between the Parties in relation to its subject matter and supersedes any prior arrangement, understanding written or oral agreements between the Parties in relation to such subject matter.
    2. All warranties, conditions, terms and representations not set out in this Agreement whether implied by statute or otherwise are excluded to the extent permitted by law.
11. Applicable Law and Jurisdiction
    
    1. This Agreement and any issues, disputes or claims arising out of or in connection with it (whether contractual or non-contractual in nature) shall be governed by, and construed in accordance with, the laws of England.
    2. All disputes or claims arising out of or relating to this Agreement shall be subject to the exclusive jurisdiction of the English Courts to which the Parties irrevocably submit. 

‍

INTRUDER 

AI PENETRATION TEST TERMS

Between

(1) Intruder Systems LTD with registered office 71-75 Shelton Street, London, WC2H 9JQ and registered number 09529593 (“Intruder”); and

(2) The Customer as identified in the Order (“Customer”)

Background

A. Intruder has developed an AI enabled penetration testing software product which it makes available to customers on a SaaS basis, to enable the Customer to find cyber security weaknesses in their digital infrastructure.

B. The Customer wishes to use Intruder’s services for its internal business purposes.

C. Intruder has agreed to provide, and the Customer has agreed to take and pay for, Intruder’s services subject to the terms and conditions of this Agreement.

1 Definitions

1.1 In this Agreement, the following words will have the following meanings:

“Agreement” means these terms and conditions together with the Order, schedules, annexes and all other documents referred to herein;

"AI Pentest" means a one-off automated penetration testing engagement performed by Intruder against the Target(s) using the AI Pentest Agent to create one AI Pentest Report;

“AI Pentest Agent(s)”  means AI-assisted and large language model-based tooling alongside conventional security testing techniques.

"AI Pentest Report" means the written report deliverable produced by Intruder following completion of the AI Pentest;

"Business Day" means any day which is not a Saturday, a Sunday or a bank or public holiday in England;

"Confidential Information" means the provisions of this Agreement and in relation to either Party, all information, in any form or medium, which is secret or otherwise not publicly available (either in its entirety or in the precise configuration or assembly of its components), including commercial, financial, marketing or technical information, accounts, business plans, business methods, strategies and financial forecasts, tax records, correspondence, designs, drawings, manuals, specifications, customer or sales or supplier information, technical or commercial expertise, software, formulae, processes, methods, knowledge, know-how and trade secrets, whether disclosed orally, in writing or by electronic means, before or after the date of this Agreement, and in the case of the Customer shall include the specific Customer results and reports generated from use of the Service;

"Customer User" means any employee, agent, contractor and/or consultant of the Customer who uses the Service on behalf of the Customer;

“Effective Date” means the date that the Order is accepted by Intruder;

“End Customers” means the end customers of the Customer on behalf of whom the Customer may use the Service.

“Fees” means the fees for the Service as specified in the relevant Order;

"Force Majeure" means any event outside the reasonable control of either Party affecting that Party's ability to perform any of its obligations (other than payment) under this Agreement including act of God, fire, flood, lightning, illegality, compliance with any law or governmental order, rule, regulation or direction, war, revolution, act of terrorism, riot or civil commotion, strikes, lock outs and industrial action, failure of supplies of power, fuel, transport, equipment, raw materials or other goods or services including telecommunications and internet services;

"Intellectual Property Rights” means any and all rights in and to any patent, copyright, database, design, trade mark, service mark, domain name, know-how, utility model, business method or process, whether such right is registered or not, or where relevant, any application for any such right, or other industrial or intellectual property right anywhere in the world;

"Intruder Portal" means the online portal (as may be modified by Intruder from time to time) through which the Customer and Customer Users can manage their Target(s) and view their security Weaknesses;

“Order” means the specific order for the AI Pentest Service as accepted by Intruder during the relevant sign up process;

"Party" or "Parties" means Intruder and/or the Customer as the context may require;

“Platform” means the Intruder software platform, including the Intruder Portal, via which the Service is made available, including all versions, amendments and improvements thereto and/or any other tools, methods, models, know how, code, functionality or other elements owned or developed by Intruder;

“Platform Data” means all usage and/or statistical or other data, information, learnings or know how related to and/or derived from the use of the Platform by customers and users, only in anonymized and aggregated form, and at all times not including any data or information that could individually identify a Customer.

“Service” means the single AI Pentest to be provided by Intruder under this Agreement, in accordance with the scope of the relevant Order, including the creation and delivery of one AI Pentest Report;

"Service Specification" means the specification of the AI Pentest Service set out at https://www.intruder.io/pentest-pricing as updated and amended from time to time by Intruder to reflect changes, enhancements and improvements that it makes to the Intruder systems and technology, which will at all times in any event be subject to the AI Pentest Process, Acknowledgements and Disclaimers at Annex 1;

"Target(s)" means an individual computer system as identified by the IP address, hostname or other unique identifier assigned to it. Where the same computer system is monitored via multiple IP addresses, hostnames, or other identifiers, each separate entry in the Intruder Portal will count as a unique system; 

‍

"Weakness" means a particular configuration, software patch level, or application code deployment which is perceived as likely to, or can be demonstrated to reduce or undermine the security of Target(s), or the information stored, processed or transmitted by it;

1.2 Drafting Conventions

(a) The headings in this Agreement are inserted for convenience only and shall not affect the interpretation or construction of this Agreement.

(b) Words expressed in the singular shall include the plural and vice versa. Words referring to a particular gender include every gender. References to a person include an individual, company, body corporate, corporation, unincorporated association, firm, partnership or other legal entity.

(c) The words "other", "including" and "in particular" shall not limit the generality of any preceding words or be construed as being limited to the same class as any preceding words where a wider construction is possible.

(d) All references in this Agreement to clauses are to the clauses in these Terms and Conditions unless otherwise stated.

2 The Service

2.1 Subject to acceptance of a relevant Order by Intruder, and receipt of the Fees in accordance with the relevant payment terms, and subject to compliance by the Customer with the scope of the relevant Order and the terms of this Agreement, Intruder agrees to provide the Customer with the Service.

2.2 The Customer may, subject to the scope of the relevant Order:

(a) use the Service for the Customer's own internal business purposes in relation to its own Target(s);

(b) use the Service to provide services to its own End Customers, by including its End Customer’s systems in the Target(s).

2.3  The Service includes the execution of a single AI Pentest against the defined Target(s) and the delivery of a single AI Pentest Report. The Customer is not entitled to repeat, re-run or extend the AI Pentest, nor to add additional Target(s), nor to substitute Target(s) after launch, without placing a further Order.

2.4 The Service must be used within 12 months of the Order.  In the event it is not used within the time limit, there will be no refund or credit given.

2.5 For the avoidance of doubt, the scope of the AI Pentest Service will be as set out in the Order and includes the Target(s) identified in the Order, along with any domains, services or resources upon which those Target(s) depend for their normal function, along with any additional scope or instructions provided by the Customer to the AI Pentest Agent during the use of the Service. Intruder will not knowingly test any system outside that scope.

2.6 For the avoidance of doubt the Customer may not permit its End Customers to use the Service or access the Platform directly, and the Customer must at all times use the Service on behalf of its End Customers. The Customer is responsible for ensuring that only employees, agents and consultants authorized and permitted by the Customer can access and use the Service. Only employees, agents and consultants of the Customer are entitled to be Customer Users.

2.7 The Customer shall be responsible for all access to and use of the Service as enabled by the Customer via the Customer’s account and or Customer Users’ login credentials.

2.8 In connection with its supply of the Service, Intruder may be required to process personal data on behalf of the Customer. In such circumstances the parties will each comply with the terms and conditions of Schedule 1 – the Data Processing Agreement.

3 Customer Systems and Customer Responsibilities

3.1 The Customer shall perform or comply with the Customer responsibilities under this Agreement and agrees that Intruder's provision of the Service is dependent on the Customer performing or complying with the Customer responsibilities.

3.2 The Customer authorises and permits Intruder to access the Customer's systems and networks (including without limitation the Target(s) and any applications or data held on such network and systems) for the purposes of the Computer Misuse Act 1990 (as updated, replaced and amended from time to time) and / or other relevant legislation and regulations in the relevant territories, and represents it has authority and will have authority at all times during this Agreement, to give such permission. To the extent permitted by law, the Customer waives any rights or protections it may have under the Computer Misuse Act 1990 and / or equivalent local legislation, with respect to Intruder's activities performed in the course of providing the Service, save in the event of negligence, fraud or wilful misconduct on the part of Intruder.

3.3 The Customer warrants and represents that it has and will have at all times during this Agreement, all necessary permissions, authorizations and consents from the owners or licensors of the Customer's systems and networks and or those of the End Customer (including without limitation the Target(s) and any hosting provider, cloud provider, software-as-a-service provider, infrastructure provider or other party whose authorisation is required for the AI Pentest) to enable the Service to be provided to the Customer.

3.4 The Customer warrants and represents that where it uses the Service in any jurisdiction or territory other than the UK, it shall be wholly responsible for ensuring that the use of the Service in that jurisdiction or territory complies with applicable laws or regulation.

3.5 The Customer shall not and shall not permit any third party to:

(a) attempt to download, copy, modify, create derivative works from, frame, mirror, republish or distribute any portion of the Platform except to the extent expressly set out in this Agreement; or

(b) attempt to copy, adapt, decompile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Platform, except as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties;

(c) use any knowledge or information acquired in relation to the Platform or Service in order to build a software product which competes with the Platform;

(d) resell, sublicense or otherwise use the Platform or Service to provide services to third parties, save as permitted under clause 2.2.

4 AI Pentest Process, Acknowledgments and Disclaimers

‍

4.1 The Customer specifically acknowledges that the use of the Service to conduct an AI Pentest comes with inherent risks. Whilst Intruder will use all reasonable endeavours to avoid and mitigate such risks, the Customer specifically and expressly acknowledges and accepts the Process, Acknowledgments and Disclaimers set out in Annex 1.

4.2 The Customer also acknowledges that the Service is not built specifically as a service for the Customer or the Target(s) and is not guaranteed to and may not identify all Weaknesses that can impact or affect systems.

4.3 Intruder shall not be responsible for any damage or loss that the Customer, any Customer User or End Customer may suffer, whether directly or indirectly as a result of use and provision of the Service as intended, and / or in relation to any Weakness that is not identified by the Service.

5 Intellectual Property

5.1 Intruder has, at its sole cost, created, licensed and developed the Service and the technology and systems including the Platform that form part of the Service.

5.2 As between the Parties, all Intellectual Property Rights in the Service, the Platform and the Platform Data belong to Intruder.

5.3 This Agreement shall not constitute a transfer of any Intellectual Property Rights in the Service or Platform to the Customer, nor grant the Customer any rights to the Service or Platform, (including any Intellectual Property Rights in the same) other than as set out in clause 2.

6 Fees

6.1 The Fee under this Agreement is payable by the Customer in full and cleared funds on the Effective Date and in any event in advance of any access to the Service. 

6.2 The Fee payable under this Agreement is exclusive of value added, sales, withholding or any similar tax, import or customs duties, which shall be paid in addition by the Customer to Intruder at the then prevailing rate.

6.3 If any sum payable under this Agreement is not paid when due then until payment is made in full Intruder shall be entitled to:

(a) suspend access to the Service; and

(b) charge interest on any overdue payment at the rate of 4% per annum above the base rate of the Bank of England.

6.4 The Service must be used within 12 months of the Order.  In the event it is not used, there will be no refund or credit given.

7 Confidentiality

7.1 Each Party shall keep and procure to be kept secret and confidential all Confidential Information of the other Party disclosed or obtained as a result of the relationship of the Parties under this Agreement and shall not use nor disclose the same except in relation to the performance of this Agreement or with the prior written consent of the other Party. Where disclosure is made by a Party of the other Party's Confidential Information, to any employee, agent or consultant, it shall be done subject to obligations equivalent to those set out in this Agreement. Each Party agrees to use its best endeavors to procure that any such employee, agent or consultant complies with such obligations provided that each Party shall continue to be responsible to the other Party in respect of any disclosure or use of such Confidential Information by a person to whom disclosure is made.

7.2 The obligations of confidentiality in this clause  shall not extend to any information which the other Party can show:

(a) is in, or has become part of, the public domain other than as a result of a breach of the obligations of confidentiality under this Agreement; or

(b) was in its written records prior to the date of this Agreement and not subject to any confidentiality obligations; or

(c) was independently disclosed to it by a third party entitled to disclose the same; or

(d) is required to be disclosed under any applicable law, or by order of a court or governmental body or authority of competent jurisdiction.

7.3 The Customer shall ensure that the Customer Users are aware of and undertake to comply with the obligations of confidentiality set out in this clause.

7.4 This clause  shall survive termination of this Agreement.

8 Warranties and Indemnities

8.1 Subject to clauses 4 and 8.2, Intruder warrants that:

(a) the Service shall comply in all material respects with the Service Specification and shall be provided with all reasonable skill and care and good industry practice.

(b) it has full right, power and authority to enter into this Agreement; and

(c) the Platform and Service will, to the best of its knowledge, contain nothing that infringes the statutory, common law, or Intellectual Property Rights of any third party.

8.2 Save as expressly set out here, any other conditions, warranties or other terms which might have effect between the parties or be implied or incorporated into this Agreement whether by statute, common law or otherwise, are hereby excluded to the fullest extent permitted by law, including, without limitation, the implied conditions, warranties or other terms as to satisfactory quality and fitness for purpose.

8.3 The Customer warrants that:

(a) it, and its representative signing up to the Agreement, has full right, power and authority to enter into this Agreement;

(b) it has all the rights, licenses, permits, approvals and clearance of third party rights as required by applicable laws and as are necessary to perform its obligations and allow Intruder to perform its obligations under this Agreement;

8.4 Intruder will indemnify the Customer from and against any and all losses, damages, claims, penalties, fines, costs and expenses (including reasonable external legal expenses) suffered or incurred by or awarded against the Customer payable in relation to any third party claims or actions as a result of or in connection with any breach by Intruder of clause 8.1.

8.5 The Customer will indemnify Intruder from and against any and all losses, damages, claims, penalties, fines, costs and expenses (including reasonable external legal expenses) suffered or incurred by or awarded against Intruder payable in relation to any third party claims or actions as a result of or in connection with any breach by the Customer of clause 8.3 and/or clauses 3.2, 3.3 and 3.4.

8.6 Each Party will fully indemnify the other from and against any and all losses, damages, claims, penalties, fines, costs and expenses (including reasonable external legal expenses) suffered or incurred by or awarded against the other as a result of or in connection with any breach by the other of clause 7 (Confidentiality).

8.7 In all cases the indemnified party agrees to:

(a) promptly notify the indemnifying party of any allegation of infringement or other claim that may give rise to reliance on an indemnity, which comes to its attention, and give the indemnifying party all reasonable assistance subject to reimbursement by the indemnifying party of the indemnified party’s costs so incurred;

(b) not to make any admission, settle, compromise or negotiate the settlement of any such claim without the prior consent of the indemnifying party (such consent not to be unreasonably withheld) provided that the indemnifying party considers and defends any claim diligently, using competent counsel and in such a way as not to bring the reputation of the indemnified party into disrepute; and

(c) allow the indemnifying party to conduct and settle all negotiations and proceedings, save that the indemnifying party may not conclude settlement of any negotiations and proceedings which may have a material effect (whether financial, practical or in terms of reputation) on the indemnified party without the indemnified party’s prior written consent which will not be unreasonably withheld.

9 Limitation of Liability

9.1 Nothing in this Agreement shall exclude or limit:

(a) either Party’s liability for death or personal injury caused by that Party’s negligence, fraud or fraudulent misrepresentation, or any liability which cannot be legally excluded or limited;

(b) the Customer's liability to pay the Fees.

9.2 Subject to clause 9.1, neither party will be liable, whether in contract, tort (including negligence) breach of statutory duty, or otherwise, for any of the following losses or damage (whether or not such losses or damage were direct, foreseen, foreseeable, known or otherwise) howsoever arising in respect of any: special, indirect, incidental or consequential loss or damage; loss of actual or anticipated profits; loss of business or contracts; loss of revenue or of the use of money; loss of anticipated savings; and/or loss of goodwill, arising out of or in connection with this Agreement.

9.3 Subject to clauses 9.1, the maximum aggregate liability of Intruder to the Customer for all claims arising in connection with this Agreement whether in contract, tort (including negligence) or breach of statutory duty, misrepresentation or otherwise shall be limited £1,000,000 (one million pounds).

9.4 Intruder shall have no liability towards any End Customer.

10 Term, Termination and Suspension

10.1 This Agreement will begin on the Effective Date and continue until the Service has been fulfilled, subject to a maximum period of 12 months in accordance with clause 2.4, unless terminated in accordance with these terms.

10.2 Either Party may terminate this Agreement if the other party commits a material breach of this Agreement that is capable of remedy and which the party in breach has not remedied within 30 days of a receipt of a written notice identifying the breach.

10.3 Intruder may terminate this Agreement immediately and/or suspend the Service without notice if the Fee has not been received by the due date, or if the provision of the Service is found to be unlawful in the jurisdiction or territory in which it is used.

10.4 In the event of any termination of this Agreement by Intruder under clause 10.2 or 10.3, Intruder will not refund nor shall credit, and the Customer will not be entitled to any refund or credit for, any portion of the Fee for any unused part of the Service.

10.5 Upon termination of this Agreement for any reason whatsoever:

(a) the relationship of the Parties shall cease and all rights granted under this Agreement to access and use the Service shall cease immediately;

(b) any provision which is expressly or by implication intended to come into force or remain in force on or after termination will continue in full force and effect.

10.6 The termination of this Agreement shall be without prejudice to the rights and remedies of either Party which may have accrued up to the date of termination.

11 Force Majeure

11.1 A Party will not be in breach of this Agreement nor liable for any failure or delay in performance of any obligations (except for those in relation to payment) under this Agreement, and the date for performance of the obligations affected will be extended accordingly, as a result of Force Majeure, provided that such Party shall:

(a) promptly notify the other Party in writing of the matters constituting the Force Majeure and shall keep that Party fully informed of their continuance and of any relevant change of circumstances whilst such Force Majeure continues; and

(b) take all reasonable steps available to it to minimize its effects on the performance of its obligations under this Agreement.

11.2 If Force Majeure continues for longer than 30 days' either Party may, whilst the Force Majeure continues, immediately terminate this Agreement by notice in writing to the other.

12 Parties

12.1 The Customer may not assign, transfer, charge or otherwise dispose of all or any of its rights and responsibilities under this Agreement.

12.2 A person who is not a Party to this Agreement has no rights (whether under the Contracts (Rights of Third Parties) Act 1999 or otherwise) to enforce any provision of this Agreement.

12.3 Neither Party may pledge the credit of the other Party nor represent itself as being the other Party nor an agent, partner, employee or representative of the other Party and neither Party may hold itself out as such nor as having any power or authority to incur any obligation of any nature, express or implied, on behalf of the other.

12.4 Nothing in this Agreement, and no action taken by the Parties pursuant to this Agreement creates, or is deemed to create, a partnership or joint venture or relationship of employer and employee or principal and agent between the Parties.

13 Construction

13.1 Entire Agreement

(a) This Agreement contains the entire agreement between the Parties in relation to its subject matter and supersedes any prior arrangement, understanding written or oral agreements between the Parties in relation to such subject matter.

(b) The Parties acknowledge that this Agreement has not been entered into wholly or partly in reliance on, nor has either Party been given, any warranty, statement, promise or representation by the other or on its behalf other than as expressly set out in this Agreement.

(c) Each Party agrees that the only rights and remedies available to it arising out of or in connection with any warranties, statements, promises or representations will be for breach of contract and irrevocably and unconditionally waives any right it may have to any claim, rights or remedies including any right to rescind this Agreement which it might otherwise have had in relation to them.

(d) All warranties, conditions, terms and representations not set out in this Agreement whether implied by statute or otherwise are excluded to the extent permitted by law.

(e) Nothing in this clause will exclude any liability in respect of misrepresentations made fraudulently.

13.2 Severability of provisions

(a) If at any time any part of this Agreement is held to be or becomes void or otherwise unenforceable for any reason under any applicable law, the same shall be deemed omitted from this Agreement and the validity and/or enforceability of the remaining provisions of this Agreement shall not in any way be affected or impaired as a result of that omission.

(b) If any void or unenforceable part of this Agreement would be valid and enforceable if some part of it were deleted, the part shall apply with the minimum modification necessary to make it valid and enforceable.

13.3 Waiver. The rights and remedies of either Party in respect of this Agreement shall not be diminished, waived or extinguished by the granting of any indulgence, forbearance or extension of time granted by that Party to the other nor by any failure of, or delay in ascertaining or exercising any such rights or remedies. Any waiver of any breach of this Agreement shall be in writing. The waiver by either Party of any breach of this Agreement shall not prevent the subsequent enforcement of that provision and shall not be deemed to be a waiver of any subsequent breach of that or any other provision.

14 Contract Administration

14.1 Variation. No purported alteration or variation of this Agreement shall be effective unless it is in writing, refers specifically to this Agreement, and is signed or otherwise expressly agreed to by each of the Parties to this Agreement.

14.2 Language. This Agreement is entered into in the English language. All amendments or correspondence concerning or relating to this Agreement and all notices given and all documentation to be delivered by either Party to the other under this Agreement shall be written in the English language or shall be accompanied by an English translation prepared by such person or body as the Parties shall have approved in advance. If there is any conflict in meaning between the English language version and any version or translation of this Agreement in any other language the English version shall prevail.

14.3 Notices

(a) Any notices sent under this Agreement must be in writing, sent and delivered by email to contact@intruder.io.

(b) Notices shall be served to the addresses set out above or to such other email address and/or address as the relevant Party may give notice to the other Party for the purpose of service of notices under this Agreement. The deemed time of delivery of notice by email shall be 9:00am recipient’s time on the first Business Day after sending and proof of service of email despatched in a legible and complete form to the correct email address without any error message.

14.4 Complaints. Formal complaints relating to the Service must be delivered either by email to contact@intruder.io, or via the in-app customer support widget.

15 Applicable Law and Jurisdiction

15.1 This Agreement and any issues, disputes or claims arising out of or in connection with it (whether contractual or non-contractual in nature) shall be governed by, and construed in accordance with, the laws of England.

15.2 All disputes or claims arising out of or relating to this Agreement shall be subject to the exclusive jurisdiction of the English Courts to which the Parties irrevocably submit.

16 Publicity

Intruder shall be entitled to describe the Customer as a customer of this Service and include its name on marketing and promotional materials. In addition and on reasonable notice the Customer shall act as a referee for Intruder in respect of prospective customers of Intruder for the Service.

Annex 1

AI Pentest Process, Acknowledgements and Disclaimers

1 Customer Acknowledgment of Risk. 

The Customer acknowledges that an AI Pentest simulates the activity of a real attacker and uses AI-assisted tooling that operates with a degree of autonomy. The Customer acknowledges in particular that:

(a) by design, Intruder's AI Pentest tooling is exploratory and non-deterministic, adapting its actions to what it discovers during the engagement, and the specific actions taken in any given engagement cannot be predicted in advance and may differ from one execution to another;

(b) the AI Pentest Agent is configured to avoid destructive actions where possible, but the Customer acknowledges that the AI Pentest may still result in state-changing and potentially destructive operations on the AI Pentest Target(s), including without limitation: the creation, modification or deletion of data, records, files, database tables or user accounts; the upload of files; the submission of forms; the sending of messages or notifications from the AI Pentest Target(s); the issuing of commands intended to validate whether a Weakness is exploitable (which may include destructive operations such as data deletion, file removal, or modification of system state); and the triggering of automated workflows or third-party integrations;

(c) the AI Pentest may trigger alerts, notifications, billing events, fraud-prevention measures or other automated responses within the Customer's own systems or those of its service providers;

(d) the AI Pentest may, where it identifies an exploitable Weakness, demonstrate that exploitation by carrying it out, which may result in temporary states of the AI Pentest Target(s) that did not exist prior to the AI Pentest;

(e) as with any penetration test, Intruder cannot guarantee the security of the AI Pentest Target(s) at any stage before, during or after the AI Pentest, nor that the AI Pentest will identify every Weakness present;

(f) as with any penetration test, the results may include false positives (findings reported as Weaknesses which, on independent verification, are not present or are not exploitable in the manner described). Intruder takes reasonable steps to minimise false positives but cannot eliminate them entirely, and the Customer is responsible for validating findings before undertaking remediation activity;

(g) the AI Pentest Agent processes content received from the AI Pentest Target(s) in the course of its testing, and such content may contain adversarial inputs (commonly known as prompt injection) deliberately or inadvertently designed to influence the AI Pentest Agent 's behaviour. While Intruder applies safeguards in accordance with section 2 below, the Customer acknowledges that Intruder cannot guarantee absolute prevention of such influence. 

IN ANY EVENT the Customer expressly acknowledges and agrees and that any actions taken by the AI Pentest Agent within the AI Pentest Target(s) remain within the scope of the Customer's authorisation under clause 3 of the Agreement, and that the possible consequences described above and in this Annex are not a breach of the Agreement and the Customer accepts such consequences at its own risk, save to the extent caused by a breach by Intruder of the Agreement and subject to clause 9.1(a).

2 Intruder safeguards. 

Intruder maintains technical and organisational measures designed to:

(a) operate the AI Pentest Agent within the scope set out in the Agreement;

(b) apply industry-standard prompt injection mitigations to the AI Pentest Agent, including by submitting prompts used by the AI Pentest Agent to a third-party prompt injection detection service for screening;

c) ensure isolation of context, prompts, intermediate state and outputs between AI Pentests for different Customers, such that no Customer data is reused, exposed or commingled in another Customer's AI Pentest.

The Customer acknowledges that the measures described in this section 2 reduce but do not eliminate the risks described in  section 1 above.

3 Treatment of source code and other Customer data ingested by the AI Pentest.

(a) Where the Customer provides source code or other data to the AI Pentest Agent, that data is processed solely within the engagement's testing container for the duration of the engagement, and is deleted on engagement teardown. Intruder does not retain Customer source code or other ingested data after the engagement ends, save where excerpts are required for delivery of the AI Pentest results or Reports.

(b) Notwithstanding section 3(a), source code excerpts may be retained for improving the AI Pentest service, but will be deleted within 30 days of engagement teardown. Intruder personnel will not access any complete copy of a source code repository provided by the Customer.

(c) AI model providers used in delivering the AI Pentest act as sub-processors. Customer data ingested by the AI Pentest is not used to train, fine-tune or otherwise improve any AI model.

(d) The Customer retains all Intellectual Property Rights in source code and other data provided to the AI Pentest. Nothing in this Agreement transfers any such rights to Intruder.

4 Customer Responsibilities – targets and environments. 

(a) The Customer is solely responsible for selecting AI Pentest Target(s) appropriate for active automated security testing.

(b) Intruder strongly recommends that AI Pentests be performed against non-production, staging or test environments wherever feasible. Where the Customer selects a production environment as an AI Pentest Target(s), the Customer warrants that it has:

(i) taken adequate backups and/or system snapshots immediately prior to the AI Pentest;

(ii) the ability to roll back any changes made during the AI Pentest; and

(iii) considered and accepted the risk of disruption to its business operations, end users and third parties as a result of the AI Pentest.

(c) Prohibited Target(s). The Customer warrants that no AI Pentest Target(s) falls within any of the following categories, and the Customer shall not include any such system as an AI Pentest Target(s):

(i) industrial control systems, operational technology (OT), supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs), distributed control systems, or any system controlling physical processes, machinery or equipment;

(ii) safety-instrumented systems, life-safety systems, fire suppression systems, or any system whose failure, disruption or unauthorised modification could result in death, personal injury or harm to physical health;

(iii) medical devices, hospital information systems, or any system in active use in the diagnosis, monitoring, treatment or care of patients;

(iv) vehicles, aircraft, marine vessels, autonomous or semi-autonomous systems, or any system integrated with the control, navigation or safety functions of any of the foregoing;

(v) any system which the Customer does not own or operate, and for which the Customer has not obtained authorisation as required by clause 3 of the Agreement.

(d) The Customer acknowledges that breach of section 4(c) is a material breach of the Agreement. In the event of breach, Intruder may, in its sole discretion and without prejudice to any other rights or remedies:

(i) immediately suspend or terminate the AI Pentest without notice and without refund of Fees; and

(ii) refuse to provide the AI Pentest Report or, where the AI Pentest Report has already been delivered, withdraw it and require its destruction.

(e) The Customer shall indemnify Intruder,  from or in connection with any breach by the Customer of section 4(c), which will be added to and dealt with under the indemnity in clause 8.3 of the Agreement.

5 Conduct and suspension/halt of the AI Pentest

(a) Customer Halt. Intruder shall make available to the Customer, at all times during the engagement , a control accessible through the Intruder Portal through which the Customer may halt the AI Pentest immediately ("Customer Halt"). On a Customer Halt:

(i) Intruder shall halt all AI Pentest activity against the AI Pentest Target(s) without delay; and

(ii) Intruder shall confirm to the Customer through the Intruder Portal when halt is complete.

(b) The Customer acknowledges that a Customer Halt halts further activity by the AI Pentest Agent but does not interrupt actions already initiated by the AI Pentest Agent at the moment halt is activated (which may complete before halt is achieved), and does not undo or roll back actions already taken on the AI Pentest Target(s). The Customer further acknowledges that any AI Pentest activity occurring between Customer Halt and halt completion remains within the scope of the Customer's authorisation under clause 3 of the Agreement.

(c) Intruder right to suspend or halt. Intruder may, in its sole and absolute discretion, suspend or halt an AI Pentest where Intruder identifies or considers that continued testing poses a risk to the AI Pentest Target(s), to third parties, to Intruder's testing infrastructure, or to the integrity or accuracy of the AI Pentest. The Customer acknowledges that Intruder has no duty or obligation to actively monitor or supervise the AI Pentest for such risks, and Intruder shall have no liability for any failure to exercise its right to suspend or halt under this section. Where Intruder exercises this right:

(i) Intruder shall notify the Customer as soon as reasonably practicable;

(ii) where the AI Pentest is permanently halted before completion and the cause is not the Customer's breach of this Agreement, Intruder shall re-run the AI Pentest at no additional Fee, subject to the Customer's agreement to the rescheduled timing; and

(iii) Intruder shall have no further obligation to deliver an AI Pentest Report in respect of the halted engagement.

(d) Model provider and infrastructure dependencies. The AI Pentest relies on AI model providers, cloud infrastructure and other supporting services operated by third parties. The Customer acknowledges that outages, degraded performance or interruptions in those services may delay or interrupt the AI Pentest. Ongoing infrastructure status is published on Intruder's status page at https://status.intruder.io, to which the Customer may subscribe for updates. Where any such issue causes a delay or interruption to the AI Pentest exceeding 24 hours, Intruder shall notify the Customer directly. Where third-party service issues have prevented the AI Pentest from running substantially in accordance with the agreed scope of the AI Pentest Order, Intruder shall re-run the AI Pentest (or the affected portion of it) at no further Fee, and shall not represent the AI Pentest as complete or deliver the AI Pentest Report as final until it has so run.

6. Delivery of AI Pentest Report

(a) The AI Pentest Report shall be made available to the Customer for download in the Intruder Portal upon completion of the AI Pentest.

(b) The AI Pentest Report will be provided in PDF format and will include a description of the Weaknesses identified, an opinion on the impact and likelihood of exploitation, supporting evidence, and suggested remediation advice.

(c) The Customer may use, copy and distribute the AI Pentest Report internally for its own business purposes, and may share the AI Pentest Report only with its own customers, regulators, auditors and professional advisors to demonstrate compliance with its security obligations. The Customer shall not share the AI Pentest Report with any other third party, and is specifically restricted from sharing the AI Pentest Report with any entity that provides security testing services in competition with Intruder, without Intruder's prior written consent.

‍

Policy owner: Jen Guglielmi

Applies to: Everyone who works at or with Intruder

Effective from: 30 October 2026

Next review: 30 October 2027, or sooner if the law or our risk assessment changes

1. Why we have this policy

At Intruder, we want everyone to be able to do their best work in an environment where they feel safe, respected and able to speak up. Sexual harassment has no place here, whether it happens in the office, on a video call, in a Slack message or at a team social.

Sexual harassment is unlawful under the Equality Act 2010. We will not tolerate it, and we take every report seriously.

From 30 October 2026, the law requires employers to take all reasonable steps to prevent sexual harassment of their staff, and to take all reasonable steps to prevent staff being harassed by people outside the business, such as customers or suppliers. This policy sets out what we do to prevent harassment, what we expect from everyone, and what happens if you raise a concern.

If you have experienced or witnessed sexual harassment, please tell us. You will be listened to, supported and protected from any negative treatment for speaking up.

2. Who this policy applies to

This policy applies to everyone who works for or with Intruder, including employees, workers, contractors, and anyone working with us through an employer of record (EOR) provider, wherever they are based. 

Colleagues employed through an EOR provider may also be protected by local laws and by their EOR provider's own procedures. Nothing in this policy limits those rights. If you are based outside the UK, you can raise a concern under this policy, through your EOR provider, or both, and the People team will help you work out the best route.

3. Responsibilities

Everyone is responsible for treating colleagues and the people we work with respectfully, and for following this policy.

Managers are responsible for setting the tone in their teams, acting on concerns promptly (even if they are raised informally), and completing the training described in section 12.

The People team is responsible for running this policy day to day, supporting anyone who raises a concern, keeping records of reports and outcomes, and carrying out our annual risk assessment.

The leadership team is accountable for making sure Intruder meets its legal duty to take all reasonable steps to prevent sexual harassment. Jen Guglielmi has overall responsibility for this policy.

4. What sexual harassment is

Sexual harassment is unwanted conduct of a sexual nature that has the purpose or effect of violating someone's dignity, or of creating an intimidating, hostile, degrading, humiliating or offensive environment for them. It is the impact on the person that matters, not whether the other person meant to cause offence.

It is also sexual harassment to treat someone less favourably because they submitted to, or rejected, unwanted conduct of a sexual nature or conduct related to sex or gender reassignment.

Sexual harassment can be a one-off incident or a pattern of behaviour. It can happen in person or online, and a person can be affected by it even if they were not the target. Examples include, but are not limited to:

• sexual comments, jokes or innuendo, including when described as “banter”
• comments about someone's appearance, body or clothing that are sexual in nature
• suggestive looks, staring or leering
• sexual advances, propositions or repeated requests for dates after someone has said no
• offering or implying work benefits in return for sexual favours, or threatening consequences for refusing
• sexual gestures
• intrusive questions about someone's private or sex life, or someone discussing their own sex life in a way others find unwelcome
• sharing or displaying sexual images, memes, GIFs or videos, including in Slack channels, group chats or on screen during calls
• sending sexually explicit messages or emails, or making sexual comments on social media
• spreading sexual rumours about someone
• unwelcome physical contact, such as touching, hugging, massaging or kissing.

5. Victimisation

Victimisation means treating someone badly because they have done, or are believed to have done or be planning to do, something protected under equality law. The protected acts include:

• making a complaint or bringing a claim of sexual harassment or discrimination
• giving evidence or information to support someone else's complaint or claim
• alleging that someone has breached the Equality Act 2010
• doing anything else in connection with the Equality Act 2010.

Examples of victimisation include not considering someone for a promotion because they previously raised a complaint, excluding someone from meetings because they acted as a witness, or treating someone less favourably because they accompanied a colleague to a meeting about a complaint.

Victimisation is a serious disciplinary matter in its own right. You will not be treated badly for raising a concern in good faith, or for supporting someone who has.

6. When and where this policy applies

Intruder works in a hybrid way, so this policy covers conduct wherever work happens, including:

• in our London office, including shared areas such as kitchens, lounges and phone booths
• when working from home or anywhere else, including on video calls
• on Slack, email and any other channel we use to communicate, including private messages and group chats
• at work-related events, such as team socials, company offsites, client meetings, industry conferences and business travel, including the time around them, such as drinks afterwards or travel to and from an event
• outside work, where the behaviour involves a colleague or someone connected to Intruder (including on personal social media), or where it affects someone's suitability for their role.

7. How we work to prevent sexual harassment

Having a policy is not enough on its own. To meet our duty to take all reasonable steps, we will:

• carry out a sexual harassment risk assessment at least once a year, and after any significant change (such as an office move, a new event format or a report of harassment), and act on what it tells us
• look specifically at risks linked to our way of working, including remote and online communication, shared office space, social events where alcohol is served, overnight travel and working with customers and partners
• provide training for everyone, as set out in section 12
• make it easy to report concerns through more than one channel, including to someone outside your reporting line
• set clear expectations for behaviour at company events and ask event organisers to consider harassment risks as part of planning
• keep confidential records of reports and outcomes, and review anonymised trends regularly so we can spot patterns and improve
• ask for feedback, for example through our engagement surveys, on whether people feel safe and confident to speak up
• review this policy at least annually.

8. What to do if you experience sexual harassment

You can raise a concern informally or formally. You do not have to try the informal route first, and you can move to a formal complaint at any point. Whichever route you choose, you can talk to the People team in confidence first to understand your options.

Getting support

Raising a concern about sexual harassment can feel difficult. You can ask a colleague you trust, at any level, to act as your confidential supporter. They can help you think through your options, prepare a complaint or come with you to meetings. Your supporter will not be involved in investigating the matter.

Raising it informally

If you feel comfortable doing so, you may choose to tell the person that their behaviour is unwelcome and ask them to stop. You can do this in person or in writing, and your supporter can help. You are never expected to confront someone if you do not feel safe or comfortable doing so.

You can also raise concerns with your manager, for example in a one-to-one, or with any member of the People team. They will listen, take your concern seriously and talk you through what could happen next. Even when a concern is raised informally, we may still need to take action if there is a risk to you or others, but we will talk to you about this first.

Making a formal complaint

If you want the matter formally investigated, or if the behaviour is serious, you can make a formal complaint by:

• Completing this anonymous reporting form, or
• Emailing Jen Gugliemi (Head of People), or
• Emailing Alexa Francis (People Partner), or
• Emailing Patrick Craston (CTO)

We will acknowledge your complaint within two working days. If you can, it helps to include:

• the name of the person or people involved
• what happened
• when and where it happened
• the names of anyone who saw or heard what happened
• any screenshots, messages or other evidence

Do not worry if you do not have all of these details. You can still raise a concern.

What happens next

We will look at whether any temporary measures are needed while the matter is being investigated, such as changes to working arrangements, seating, meeting attendance or reporting lines, or, where appropriate, suspending the person complained about on full pay. We will discuss these with you, and our aim will be to avoid placing any disadvantage on you. These measures are not a disciplinary sanction.

The amount of any investigation required will depend on the nature of the matter and will vary from case to case. It may involve interviewing and taking statements from you and any witnesses, and/or reviewing relevant evidence.

Appealing the outcome

If you are not happy with the outcome, you can appeal by writing to Jen within five working days of receiving it. Your appeal will be heard, where practicable, by a more senior person who was not involved in the original investigation. We will normally confirm the final decision in writing within 10 working days of the appeal meeting.

After a complaint

Whatever the outcome, we will continue to support you. This may include adjustments to working arrangements, support through our employee assistance programme or, if you want it, facilitated conversations to help rebuild working relationships. We will check in with you afterwards to make sure the behaviour has stopped and that you have not been treated badly for speaking up.

9. What to do if you witness sexual harassment

If you see or hear something that makes you uncomfortable, please do not ignore it. Only if you feel safe to do so, step in by calling out the behaviour, interrupting the conversation or helping the person leave the situation. 

You can also check in with the person afterwards, encourage them to report what happened or report it yourself using any of the channels in section 8. We will speak sensitively to the person affected about how they would like the matter to be handled, although in some cases we may need to act to protect them or others.

You will not be treated badly for reporting something you witnessed in good faith.

10. Harassment by people outside Intruder

Harassment can come from people who do not work for us but whom you come across through your work. At Intruder, this could include customers and prospects, partners and resellers, suppliers, contractors, candidates, non-Intruder staff at a coworking space, and people you meet at conferences, events or in online security communities as part of your role.

From 30 October 2026, we are legally responsible for harassment of our employees by third parties if we have not taken all reasonable steps to prevent it. This applies to harassment related to any protected characteristic, not just sexual harassment. Harassment by a third party is unacceptable, and you are entitled to the same protection and support as if it had come from a colleague.

To reduce the risk of third-party harassment, we will:

• make clear to customers, partners and suppliers that we expect our people to be treated with respect, for example in our Terms and Conditions
• consider harassment risks when planning attendance at conferences, client entertainment and business travel, including arrangements for working alone, overnight stays and events where alcohol is served
• raise concerns with WeWork where harassment involves other members or building staff
• make sure no one is expected to keep working with a customer or partner who has harassed them.

If you experience harassment from someone outside Intruder, please report it as soon as you can using the channels in section 8. Depending on the circumstances, our response may include raising the matter with the person's organisation, reassigning the account or relationship, removing the person from future events or meetings, or ending a commercial relationship. Where a crime may have been committed, we will support you if you choose to report it to the police.

Equally, we expect our people to treat everyone outside Intruder with respect. Sexual harassment of a customer, partner or anyone else by a member of our team will be dealt with under our disciplinary procedure.

11. Disciplinary action

If an investigation finds that sexual harassment or victimisation has taken place, we will take action under our disciplinary procedure. Depending on the seriousness of the conduct, this may lead to dismissal, including for a first offence. Anyone who receives a disciplinary sanction can appeal under the disciplinary procedure.

When deciding on the right sanction, we will consider any aggravating factors, such as abuse of seniority or a position of trust, targeting a junior or new colleague, or repeated behaviour.

A complaint that is made in good faith but is not upheld will never lead to disciplinary action against the person who raised it. Disciplinary action will only be considered where a complaint is found to be both untrue and made maliciously.

12. Training

Everyone at Intruder will complete sexual harassment training when they join and refresher training once a year. The training covers:

• what sexual harassment is, how it can happen (including online and in hybrid settings) and why it will not be tolerated
• the standards of behaviour we expect
• how to step in safely as a bystander
• how to report something you have experienced or witnessed, including harassment from people outside Intruder
• how complaints are handled and the possible consequences, including dismissal.

Managers and anyone involved in handling complaints will receive additional training on preventing harassment, responding to concerns sensitively and following this policy. We will keep a record of training completion and review whether the training is working.

13. Speaking up and confidentiality

Since April 2026, reporting sexual harassment can qualify as a protected disclosure under whistleblowing law. This gives you extra protection against being treated badly for raising a concern. See our Whistleblowing Policy for more information.

Intruder will not use confidentiality clauses or settlement agreements to stop anyone reporting harassment, cooperating with an investigation, or speaking to the police, a regulator, a legal adviser, a medical professional or a support service.

We will handle every report as confidentially as we can. Information will only be shared with people who need to know it in order to investigate, support you or keep others safe. Records will be kept securely and handled in line with our Data Management policy.

You can also get free, independent advice from organisations such as Acas and Rape Crisis England & Wales. The People team can point you towards further support. 

15. Related policies

This policy should be read alongside our Grievance Procedure, Disciplinary Procedure, Whistleblower Policy and Data Protection Policy. 

This policy does not form part of any contract of employment, and we may amend it at any time.

‍