Last updated: 1st July 2026 · Version 1.0
This Enterprise Subscription Agreement (“Agreement”) is between Attack Insights Software Pty Ltd (ABN 24 692 309 336), trading as DarkThreatX (“DarkThreatX”, “we”, “us”), and the customer named in an Order Form (“Customer”, “you”). It applies when you sign an Order Form that references it. It does not apply to self-serve, individual or family plans, which are governed by our Terms of Service.
On this page
- Structure and order of precedence
- Definitions
- The Service
- Authorised monitoring and use of Intelligence Data
- Fees and payment
- Confidentiality
- Data protection
- Security
- Intellectual property
- Warranties
- Indemnities
- Limitation of liability
- Term, suspension and termination
- General
- Contact
1. Structure and order of precedence
1.1 This Agreement is made up of this document, each Order Form, the Data Processing Addendum (“DPA”), the Service Level Agreement (“SLA”) and the Acceptable Use Policy (“AUP”).
1.2 If there is any inconsistency, the following order applies, highest first: (a) the DPA, for the processing of personal information; (b) an Order Form, but only for the specific deviation it expressly identifies; (c) this Agreement; (d) the SLA; (e) the AUP.
1.3 Terms in a purchase order, supplier portal, vendor registration or similar document issued by you do not apply, even if accepted or acknowledged by us, unless both parties sign a document that expressly amends this Agreement.
1.4 Our self-serve Terms of Service do not apply to your use of the Service under an Order Form.
2. Definitions
Affiliate: an entity that controls, is controlled by, or is under common control with a party.
Authorised Assets: the domains, email domains, IP ranges, brands, executive identities and other identifiers listed in an Order Form or registered in the Service, that you own or are legally authorised to monitor.
Customer Data: data you or your Users submit to the Service, including Authorised Assets, configuration, user details and alert workflow data.
Intelligence Data: data we collect, aggregate or derive from third-party sources, including breach datasets, dark web, deep web and paste sources, criminal forums, marketplaces and messaging channels, whether or not it relates to your Authorised Assets.
Outputs: the alerts, reports, findings, exports and API responses the Service delivers to you, including the Intelligence Data contained in them.
Security Incident: a confirmed unauthorised access to, or disclosure, loss or alteration of, Customer Data in our systems.
Service: the DarkThreatX platform, API, integrations and related services described in an Order Form, including updates.
Subscription Term: the period stated in an Order Form, including any renewal.
Users: your and your Affiliates’ employees and contractors whom you authorise to use the Service.
3. The Service
3.1 Access. During the Subscription Term we grant you a non-exclusive, non-transferable right for your Users to access and use the Service and Outputs for your internal security, risk, fraud-prevention and compliance purposes, within the scope, Authorised Assets and usage limits in the Order Form.
3.2 Affiliates. Your Affiliates may use the Service under your Order Form. You are responsible for their compliance with this Agreement.
3.3 Users and credentials. You are responsible for your Users’ acts and omissions. You must keep credentials confidential and enforce single sign-on or multi-factor authentication where the Service supports it. Tell us promptly if you become aware of any unauthorised use.
3.4 API. API access is subject to the rate limits and documentation we publish. We will give at least 90 days’ notice before removing or making a breaking change to a generally available API version, unless a shorter period is needed to address a security or legal risk.
3.5 Changes to the Service. We may improve and modify the Service. We will not materially reduce the core functionality you subscribed to during a Subscription Term. If we do, you may terminate the affected Order Form and receive a pro-rata refund of prepaid fees for the remaining term.
3.6 Availability and support. We will provide the Service in line with the SLA, including the availability commitment, support hours, response times and service credits for your support tier. Service credits are your sole financial remedy for an SLA failure, except where repeated failures give you a termination right under the SLA.
3.7 Third-party integrations. Integrations with SIEM, SOAR, ticketing and other third-party products are provided as connectors. We are not responsible for the third-party products themselves, or for data once it leaves the Service at your direction.
3.8 Professional services. Onboarding, threat-hunting, takedown support or investigation services are provided only if described in an Order Form or statement of work, and are performed with due care and skill.
4. Authorised monitoring and use of Intelligence Data
4.1 Authorised Assets only. You must only register Authorised Assets. You warrant that you own each Authorised Asset or have written authority from its owner to monitor it. For executive or VIP monitoring, you warrant that you have a lawful basis and have given any notice required by law to the individuals concerned.
4.2 Verification. We may require you to verify control of an Authorised Asset (for example by DNS record, email verification or a letter of authority) before we deliver Outputs about it. We may withhold Outputs for an asset until verification is complete.
4.3 Nature of Intelligence Data. You acknowledge that Intelligence Data comes from third-party sources, including data that was obtained unlawfully by others, and may include personal information about individuals who are not parties to this Agreement. We collect and process Intelligence Data for the purpose of helping organisations detect and respond to exposure, and in accordance with our Privacy Policy and applicable law.
4.4 Permitted use. You may use Outputs only to: (a) identify and remediate exposure affecting your Authorised Assets, Users, customers and supply chain; (b) prevent fraud and account takeover against your own systems; (c) investigate and respond to security incidents; and (d) meet your legal, regulatory and contractual obligations, including notifying affected individuals or regulators.
4.5 Prohibited use. You must not, and must not permit anyone to:
- use any credential, session token, cookie or other authentication data in an Output to log in to, or attempt to access, any account or system, except accounts and systems you own, and then only to reset or invalidate them;
- use Outputs to identify, profile, locate, contact, harass, extort or discriminate against any individual, other than as permitted by clause 4.4;
- sell, resell, sublicense, publish or otherwise make Outputs available to third parties, except to your professional advisers, insurers, regulators and law enforcement on a need-to-know basis, or as permitted by a Partner Agreement;
- use Outputs to build or enrich a competing dataset or product, or to train machine-learning models other than for your internal security purposes;
- scrape, bulk-export or systematically extract Intelligence Data beyond the limits in the Order Form;
- register assets you are not authorised to monitor, or use the Service to research a third party without that party’s authority;
- reverse engineer, probe or circumvent the security or usage controls of the Service; or
- use the Service in breach of any law, including privacy, anti-hacking, anti-spam and sanctions laws, or the AUP.
4.6 Handling of sensitive Outputs. You must restrict access to Outputs containing plaintext or reversible credentials to Users who need them for remediation, protect them with security controls at least as strong as those you apply to your own confidential information, and delete them once remediation is complete or the purpose in clause 4.4 ends.
4.7 Monitoring and enforcement. We may monitor use of the Service for compliance with this clause 4. If we reasonably believe you are in breach of it, we may suspend affected access under clause 13.2, and we may report suspected unlawful activity to the relevant authorities.
4.8 Takedown and suppression. We maintain a process for individuals to request suppression of their personal information from Intelligence Data. Suppression may mean that some exposures are no longer reported through the Service.
5. Fees and payment
5.1 Fees. You must pay the fees in each Order Form. Unless the Order Form says otherwise, fees are invoiced annually in advance and are payable within 30 days of the invoice date.
5.2 Disputes. If you dispute an invoice in good faith, tell us in writing within 15 days of receiving it, with reasons. You must pay the undisputed portion on time, and the parties will work to resolve the dispute within 30 days.
5.3 Late payment. If undisputed fees are more than 30 days overdue, we may, after giving 14 days’ written notice, suspend the Service until payment is made.
5.4 Taxes. Fees exclude GST and other taxes. Where GST applies, we will issue a valid tax invoice and you must pay the GST amount in addition to the fees. If you are required to withhold tax, you must gross up the payment so we receive the full invoiced amount, unless a tax treaty provides otherwise.
5.5 Usage above entitlement. If your use exceeds the limits in the Order Form (for example monitored domains, Users or API calls), we will notify you and agree an upgrade with you. We will not charge for overage without your written agreement.
5.6 Renewal. Each Order Form renews for successive 12-month periods unless either party gives written notice of non-renewal at least 60 days before the end of the current Subscription Term. We will remind you of upcoming renewal at least 90 days before it occurs.
5.7 Renewal pricing. We will notify you of any change to fees at least 90 days before renewal. If you do not accept the change, you may give notice of non-renewal under clause 5.6.
6. Confidentiality
6.1 Definition. “Confidential Information” means information disclosed by one party to the other that is marked confidential or would reasonably be understood to be confidential. Your Customer Data and Outputs are your Confidential Information. The Service, our pricing, security documentation and non-public product information are ours.
6.2 Obligations. The receiving party must use the disclosing party’s Confidential Information only to perform or exercise rights under this Agreement, protect it with at least reasonable care, and disclose it only to its and its Affiliates’ personnel, contractors and professional advisers who need to know it and are bound by equivalent confidentiality obligations.
6.3 Exceptions. These obligations do not apply to information that is or becomes public through no fault of the receiving party, was lawfully known to it without restriction, is independently developed, or is lawfully received from a third party without restriction. Intelligence Data is not your Confidential Information merely because it relates to you, but the fact that it relates to you, and the Outputs we deliver to you, are.
6.4 Compelled disclosure. A party may disclose Confidential Information if required by law, a court or a regulator, provided it gives the other party prompt notice where lawful and discloses only what is required.
6.5 Duration. These obligations continue for 5 years after this Agreement ends, and indefinitely for trade secrets and personal information.
7. Data protection
7.1 Roles. For Customer Data that is personal information, we process it on your behalf and under your instructions as set out in the DPA. For Intelligence Data, we act on our own account and are responsible for our own compliance with the Privacy Act 1988 (Cth) and other applicable privacy laws.
7.2 DPA. The DPA forms part of this Agreement. It covers processing instructions, sub-processors, international transfers, data subject requests, assistance with your obligations, and audit.
7.3 Data location. Unless the Order Form says otherwise, we host Customer Data in the United States. Where Customer Data is transferred outside Australia, we will take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, as set out in the DPA. We will provide our current list of sub-processors and their locations on request, and will give at least 30 days’ notice of a new sub-processor. You may object on reasonable data protection grounds.
7.4 No sale or training. We will not sell Customer Data, and will not use Customer Data or Outputs delivered to you to train machine-learning models offered to other customers.
8. Security
8.1 Security program. We will maintain administrative, technical and physical safeguards appropriate to the nature of the Service and the data. These will include encryption of Customer Data in transit and at rest, role-based access control, multi-factor authentication for privileged access, logging and monitoring, vulnerability management, and regular independent penetration testing. We will not materially reduce these safeguards during a Subscription Term.
8.2 Assurance. On request, and no more than once a year, we will provide our current security documentation, a summary of our most recent independent penetration test, and responses to a reasonable security questionnaire.
8.3 Security Incidents. If we become aware of a Security Incident affecting your Customer Data, we will notify you without undue delay, and in any case within 72 hours of confirming it. We will provide the information reasonably available to help you meet your own obligations, including under the Notifiable Data Breaches scheme, take reasonable steps to contain and remediate it, and keep you informed.
8.4 Your security. You are responsible for the security of your systems, your Users’ credentials, and Outputs once they are exported or integrated into your systems.
9. Intellectual property
9.1 Our IP. We and our licensors own the Service, the Intelligence Data as compiled and structured by us, and all related software, documentation, methods and improvements. No rights are granted except as expressly stated in this Agreement.
9.2 Your IP. You own Customer Data. You grant us a non-exclusive licence to host, process and use Customer Data only to provide, secure and support the Service for you, and as described in the DPA.
9.3 Outputs. Subject to clause 4 and payment of fees, you may use, copy and retain Outputs for the purposes in clause 4.4, including in internal reports and in reports to your board, auditors, insurers and regulators. This right continues after the Agreement ends for Outputs you have already received, subject to clauses 4.6 and 6.
9.4 Feedback. If you give us suggestions or feedback about the Service, we may use them without restriction or payment, provided we do not identify you or disclose your Confidential Information.
9.5 Aggregated data. We may collect technical and usage data about the Service, and create aggregated statistics that do not identify you, your Users or any individual, to operate and improve the Service and for benchmarking and threat research. We will not publish anything that identifies you as a customer or as affected by an exposure without your written consent.
9.6 Publicity. Neither party may use the other’s name or logo in marketing without prior written consent.
10. Warranties
10.1 Mutual. Each party warrants that it is validly existing, has authority to enter into this Agreement, and will comply with laws applicable to its performance.
10.2 Our warranties. We warrant that during the Subscription Term: (a) the Service will perform materially in line with its documentation; (b) we will provide the Service with due care and skill, using appropriately qualified personnel; (c) we will not knowingly introduce malicious code into the Service; and (d) we collect and process Intelligence Data in accordance with applicable law.
10.3 Remedy. If the Service breaches clause 10.2(a), tell us and we will use reasonable efforts to correct it. If we cannot correct it within 30 days, you may terminate the affected Order Form and receive a pro-rata refund of prepaid fees for the remaining term.
10.4 Disclaimer. Dark web and breach monitoring depends on sources outside our control. We do not warrant that the Service will detect every exposure, that Intelligence Data is complete or accurate, or that the Service will be uninterrupted or error-free. Outputs support, and do not replace, your own security judgement. Except as expressly stated in this Agreement, and to the extent permitted by law, all other warranties and conditions are excluded.
10.5 Australian Consumer Law. Nothing in this Agreement excludes rights that cannot lawfully be excluded under the Competition and Consumer Act 2010 (Cth). Where our liability for breach of a non-excludable guarantee can be limited, it is limited, at our option, to supplying the services again or paying the cost of having them supplied again.
11. Indemnities
11.1 Our IP indemnity. We will defend you against any third-party claim alleging that your authorised use of the Service infringes that party’s intellectual property rights, and pay damages and costs finally awarded or agreed in settlement. If such a claim is made or likely, we may procure the right for you to continue using the Service, modify it to be non-infringing, or, if neither is reasonably possible, terminate the affected Order Form and refund prepaid fees for the remaining term. This indemnity does not apply to claims arising from Customer Data, your modifications, combination with items we did not supply, or use in breach of this Agreement.
11.2 Your indemnity. You will defend us against any third-party claim, and any regulatory action, arising from: (a) your registration or monitoring of assets you were not authorised to monitor; (b) your use of Outputs in breach of clause 4; or (c) Customer Data infringing a third party’s rights.
11.3 Procedure. The indemnified party must promptly notify the indemnifying party of the claim, give it sole control of the defence and settlement (but no settlement may admit fault by, or impose obligations on, the indemnified party without its consent), and provide reasonable cooperation at the indemnifying party’s cost. Each party must take reasonable steps to mitigate its loss.
12. Limitation of liability
12.1 Excluded loss. Neither party is liable for any loss of profit, revenue, business opportunity or goodwill, or any indirect or consequential loss, however caused, even if it was foreseeable.
12.2 General cap. Each party’s total aggregate liability arising out of or in connection with this Agreement is limited to the fees paid and payable by you under this Agreement in the 12 months before the event giving rise to the claim.
12.3 Data protection cap. For breach of clause 6 (Confidentiality), clause 7 (Data protection), clause 8 (Security) or the DPA, each party’s total aggregate liability is limited to 3 times the general cap in clause 12.2. This amount is in place of, not in addition to, the general cap.
12.4 Uncapped. Clauses 12.1 to 12.3 do not limit: (a) your obligation to pay fees; (b) a party’s liability under its indemnity in clause 11; (c) liability for your breach of clause 4 (Authorised monitoring and use of Intelligence Data); (d) liability for fraud, wilful misconduct, or death or personal injury caused by negligence; or (e) any liability that cannot be limited by law.
12.5 Contribution. Each party’s liability is reduced to the extent the other party, its personnel or contractors contributed to the loss.
13. Term, suspension and termination
13.1 Term. This Agreement starts when the first Order Form is signed and continues until all Order Forms have expired or been terminated.
13.2 Suspension. We may suspend access to all or part of the Service, limited to what is reasonably necessary, if: (a) your use poses a material security risk to the Service or others; (b) we reasonably believe you are in breach of clause 4; (c) undisputed fees are overdue as described in clause 5.3; or (d) suspension is required by law. Except where immediate action is needed to prevent harm, we will give prior notice and an opportunity to remedy. We will restore access promptly once the cause is resolved.
13.3 Termination for cause. Either party may terminate this Agreement or an Order Form by written notice if the other party: (a) materially breaches it and does not remedy the breach within 30 days of written notice; or (b) becomes insolvent, enters administration, liquidation or receivership, or makes an arrangement with its creditors, to the extent termination for this reason is permitted by law.
13.4 Effect of termination. On termination or expiry, your access ends and any unpaid fees for services provided become due. If you terminate for our breach, or under clauses 3.5, 10.3 or 11.1, we will refund prepaid fees for the remaining term.
13.5 Data return and deletion. For 30 days after termination or expiry, on request, we will make Customer Data and your alert history available for export in a standard format. After that period we will delete Customer Data from production systems within 30 days and from backups within 90 days, unless the law requires us to keep it, and will confirm deletion in writing on request.
13.6 Survival. Clauses 4.5, 4.6, 5 (for unpaid fees), 6, 9, 11, 12, 13.4 to 13.6 and 14 survive termination.
14. General
14.1 Governing law. This Agreement is governed by the laws of New South Wales, Australia. The parties submit to the non-exclusive jurisdiction of the courts of New South Wales and the courts that may hear appeals from them.
14.2 Dispute resolution. Before starting court proceedings (except for urgent interlocutory relief), a party must give written notice of the dispute, and senior representatives of both parties must meet within 14 days and try in good faith to resolve it. If it is not resolved within 30 days of the notice, either party may refer it to mediation administered by the Resolution Institute, or start proceedings.
14.3 Changes to this Agreement. We may update this published Agreement from time to time. Updates do not apply to an Order Form during its current Subscription Term unless you agree in writing. They apply on renewal only if we notified you at least 90 days before the renewal date. Any change to a signed Order Form must be in writing and signed by both parties.
14.4 Assignment. Neither party may assign or transfer this Agreement without the other’s written consent, not to be unreasonably withheld. Either party may assign it without consent to an Affiliate or a successor in a merger, acquisition or sale of substantially all of its relevant business or assets, by giving written notice, provided the successor is not a competitor of the other party.
14.5 Subcontracting. We may use subcontractors and sub-processors to provide the Service. We remain responsible for their performance.
14.6 Force majeure. Neither party is liable for a failure or delay (other than a payment obligation) caused by events beyond its reasonable control, provided it notifies the other party and takes reasonable steps to mitigate. If the event continues for more than 30 days, either party may terminate the affected Order Form, and we will refund prepaid fees for the remaining term. A cyber attack is a force majeure event only if we had maintained the safeguards required by clause 8.
14.7 Sanctions and export. Each party warrants that it is not a person targeted by Australian, UN, US, UK or EU sanctions. You must not use or permit use of the Service in breach of applicable sanctions or export control laws.
14.8 Anti-bribery and modern slavery. Each party will comply with applicable anti-bribery and corruption laws and the Modern Slavery Act 2018 (Cth), to the extent it applies.
14.9 Notices. Notices must be in writing and sent by email to the address in the Order Form (for us, [email protected]). A notice is received when sent, unless the sender receives an automated message that it was not delivered. Notices of breach or termination must also be copied to the other party’s nominated contact.
14.10 Relationship. The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship.
14.11 Entire agreement. This Agreement is the entire agreement between the parties on its subject matter and replaces all prior proposals and understandings. Each party acknowledges it has not relied on any representation not set out in this Agreement.
14.12 Severability and waiver. If any provision is invalid or unenforceable, it is read down or severed to the extent necessary, and the rest of the Agreement continues. A failure to exercise a right is not a waiver of it.
14.13 Counterparts. An Order Form may be signed electronically and in counterparts.
Contact
Attack Insights Software Pty Ltd (ABN 24 692 309 336), trading as DarkThreatX
Level 12, 64 York Street, Sydney NSW 2000
Commercial enquiries: [email protected]
Legal notices: [email protected]
Security: [email protected]
