Terms of Service
What you get, what you owe, what we may do to a website you enrol, and how either side ends the arrangement.
Draft, pending review by external counsel. It describes how the platform actually operates today and is published so you can read it now — but treat it as a working document until this notice is removed.
The agreement
These terms govern your use of AegiFlow. By creating a workspace you accept them, and the platform records which version you accepted and when. Nothing is implied by usage alone.
If you are accepting on behalf of an organization, you confirm you are entitled to bind it.
What the service is
AegiFlow observes web services you enrol, tells you which published vulnerabilities actually match the software they run, applies bounded and reversible controls when you approve them, keeps a signed static copy of approved public pages available during an incident, and exercises recovery so it can be shown to work rather than assumed.
Capability states are published, not promised. Every page on this site labels each capability with its real operating state, including the ones still in observation and the ones we have not finished. The current state is on the status page. We do not sell a capability by describing a state it is not in.
Authorization — the part that matters most
Security work on a website is only legitimate with permission from someone entitled to give it. Before a service can be set up you must:
- Prove control of the domain with the exact DNS TXT value we issue. We do not act on a domain on your word alone.
- Confirm you are authorized to have non-intrusive checks run against it. If the site belongs to a client, you confirm you have their authority.
We are then authorized to: resolve and record DNS for the hostnames you enrol; request and manage TLS certificates for them; connect to the origin you configure, over HTTPS, to measure health and latency; read a software inventory if you install the connector; and, once you activate protection, route and inspect traffic for those hostnames.
We are not authorized to, and will not: change A, CNAME or MX records; move traffic without a separate, explicit and reversible step you take; access anything outside the hostnames you enrolled; or run intrusive testing of any kind.
Every automated action is bounded by the safety contract you set for that service: pages that must never be blocked, how far an automatic action may go, who must approve it, and what happens when a check is inconclusive. Automation cannot exceed those limits. Every applied control carries an expiry and a tested way back.
What you are responsible for
Keeping your account credentials and second factors safe. Making sure the people you invite should have the roles you give them. Having the right to enrol every domain you enrol. Complying with the law where you operate.
You may not use AegiFlow to attack or test infrastructure you do not control, to circumvent someone else’s security, or to break the law.
Plans, billing and limits
The observation tier costs nothing and changes nothing for your visitors: inventory, threat relevance and traffic visibility while every activation gate is still closed. Paid plans exist for active protection and resilience, and each carries its own limits on services, hostnames, daily events and retention — shown in the product before you choose.
Billing fails closed. If we cannot confirm a payment state, nothing is silently charged and nothing is silently enabled. Fees are payable in advance and are not refundable for a period already served, except where the law says otherwise.
Availability and honesty about limits
We publish real operating states rather than an uptime figure we would have to defend with asterisks. AegiFlow currently runs as a bounded validation environment while activation gates remain open, and we say so on every page rather than in a footnote.
The service is provided as it is described on this site and in the product — no more. To the extent the law allows, we exclude implied warranties. Nothing here limits liability for death or personal injury, fraud, or anything else that cannot lawfully be limited.
Where liability can be limited, our aggregate liability in any twelve-month period is capped at the fees you paid us in that period. Neither side is liable for indirect or consequential loss.
Ending it
You can stop at any time and export your evidence before you go. Offboarding is a controlled sequence: we preserve and verify the exact rollback configuration first, and when a hostname is removed only the records AegiFlow created and marked are deleted. Your traffic is never left stranded.
We may suspend an account that is being used to break these terms or the law, and we will tell you why.
Changes
We keep the version and effective date at the top of this page. Material changes are announced in the product before they take effect, and continued use after that date is acceptance.
Governing law
These terms are governed by Romanian law, and the courts of Romania have jurisdiction. If you contract with us as a consumer, this does not remove protections you have under the law of your own country.
The English version of this document governs. Translations are provided for convenience.