Terms of Service

1. Who we are

The Services are operated by Autogon Inc. (“Company,” “we,” “us,” “our”), a U.S. corporation. “Nemesis Labs” is our product and marketing brand. Where these Terms refer to “Nemesis Labs,” the contracting party is Autogon Inc. “You” and “your” mean the individual or entity using the Services.

2. Eligibility and authority

You must be at least 18 years old and legally capable of entering into a contract. If you use the Services on behalf of an organization, you represent and warrant that you are authorized to bind that organization to these Terms, and “you” refers to that organization. You are responsible for all activity that occurs under your account, license keys, API tokens, or SDK credentials, whether or not you authorized that activity. Keep your credentials confidential and notify us promptly of any suspected compromise.

3. The license we grant you

Subject to your continuous compliance with these Terms and the Acceptable Use Policy (“AUP,” incorporated by reference), we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to use the Services for their intended purpose. We reserve all rights not expressly granted. The Services, including all software, models, and documentation, remain our property or that of our licensors.

3.1 Nemesis Blue

Free tier: one device, personal or single-organization use, no commercial resale. Paid tiers (Pro, Family, Business, MSSP): per the seat or endpoint counts purchased. Blue is a defense-in-depth control, not a guarantee against compromise (see sections 5 and 9).

3.2 Nemesis Red

Red is offensive security tooling made available self-serve (Free, Pro, Business) or under a separate Enterprise order form. Your use of Red is conditional on the AUP and on a per-engagement consent attestation for every target. You are the sole operator of Red and are solely responsible for the scope, authorization, timing, blast radius, and consequences of every action you direct it to take. Where a signed Enterprise order form conflicts with these Terms, the specific order terms control for that customer.

3.3 Nemesis Shield

Shield is a runtime protection and SecOps platform, currently offered in early access and subject to section 8 (Beta and early-access Services). You are responsible for embedding the Shield SDK only in applications you own or are authorized to instrument, for the lawfulness of the traffic and data you route through it, and for configuring enforcement modes appropriately for your environment. Shield reduces risk from behavioral deviation; it does not guarantee that any attack, zero-day, or misuse will be blocked (see sections 5 and 9).

4. What you may not do

The full list lives in our Acceptable Use Policy. In summary, you may not: use the Services to access, scan, exploit, or test any system you do not own or have written, signed authorization to test; circumvent licensing, seat, or usage limits; resell, sublicense, or rebrand without written authorization; remove or obscure attribution or license notices; use the Services in violation of export controls or sanctions; or reverse-engineer the Services to build a competing product. Violation is a material breach and grounds for immediate termination under section 13.

5. Your responsibilities and assumption of risk

You acknowledge that security software (including offensive tooling) is inherently high-risk, operates in adversarial conditions, and cannot be guaranteed to work in every circumstance. You knowingly and voluntarily assume all risk arising from your use of the Services.

You are solely responsible for:

• Authorization and scope. Obtaining and retaining valid written authorization for every target, and for correctly scoping and constraining any test, scan, or enforcement action. We do not verify your authorization and are not a party to your engagements.
• Operational consequences. Any disruption, downtime, data loss, corruption, degraded performance, instability, alerting, or other effect that results from running the Services against, or embedding them within, any system, including systems you own and systems you are authorized to test. Offensive and inline security tools can cause outages; you accept that risk.
• Independent safeguards. Maintaining your own backups, business-continuity, and disaster-recovery measures independent of the Services. You must not rely on any Nemesis feature (including ransomware rollback, detection, or blocking) as your sole safeguard.
• Non-production validation. Testing the Services in a non-production or controlled environment before relying on them in production, and validating any output, finding, verdict, or automated action before acting on it.
• Configuration and enforcement. Choosing observe versus enforce modes, tuning baselines and rules, and reviewing the approve/deny queue. Misconfiguration and its consequences are your responsibility.
• Your data and your users. The lawfulness, accuracy, and handling of any data you process through, or route into, the Services, and compliance with all laws applicable to you and your users.
• Compliance. Your compliance with all applicable laws, regulations, contractual obligations, and third-party rights, including computer-misuse, privacy, wiretap, export-control, and sanctions laws.

To the maximum extent permitted by law, we are not responsible or liable for any harm, loss, claim, or damage caused by your use or operation of the Services, including harm to any system, network, data, or person that you target, instrument, or affect. As between you and us, that responsibility is entirely yours.

6. Payment, renewal, refunds

Paid tiers bill via the payment provider listed at checkout (Stripe or Paystack depending on your region). Fees are stated exclusive of taxes; you are responsible for applicable taxes. Subscriptions auto-renew at the end of each billing cycle at the then-current price unless cancelled via the customer portal we email after checkout. You may cancel at any time; cancellation prevents the next charge but does not refund the current term. We may change prices on renewal with notice.

Except where required by law, fees are non-refundable and are not prorated on cancellation. Any refunds are at our discretion and reviewed case-by-case; email [email protected] within 30 days of charge. Trial or free users who have not been charged are not entitled to a refund. We may suspend access for non-payment.

7. Your content and data

We do not claim ownership of any data your installation of the Services produces or processes. You retain all rights to your data. Detection events, scans, pentest findings, behavioral baselines, and reports remain yours. Where the Services process data on your behalf (for example, telemetry routed to Grid or behavioral state streamed by the Shield SDK), you are the controller and we act as your processor, and you are responsible for having a lawful basis and any required notices or consents for that processing. We process limited operational telemetry as described in our Privacy Policy. You grant us a limited license to use your data solely to provide, secure, and support the Services, and, only where you have opted in, to improve them as described in the Privacy Policy.

8. Beta and early-access Services

Services or features designated as beta, preview, early access, or experimental (including Nemesis Shield during early access) are provided for evaluation, may be incomplete or unstable, may change or be discontinued at any time without notice, and carry no service-level commitment or uptime guarantee. They are provided “as is” with no warranty of any kind, and you use them at your own risk. Do not rely on a beta or early-access Service as a sole or primary security control in production. Nothing about early-access access creates any obligation to release a general-availability version.

9. Disclaimer of warranties

The Services are provided “as is” and “as available,” with all faults, and without warranty of any kind, whether express, implied, or statutory. To the maximum extent permitted by law, we disclaim all warranties, including any implied warranties of merchantability, fitness for a particular purpose, title, accuracy, quiet enjoyment, and non-infringement, and any warranties arising from course of dealing or usage of trade.

We do not warrant that the Services will be uninterrupted, timely, secure, error-free, or free of harmful components, or that any defect will be corrected. We make no warranty regarding security outcomes. We do not warrant or guarantee that Nemesis Blue will detect, block, or remediate any particular threat; that Nemesis Shield will prevent any particular attack, exploit, or misuse; that ransomware rollback or recovery will succeed or fully restore any data; or that Nemesis Red will discover all, or any, vulnerabilities, or that its output is complete or accurate. Red's outputs (findings, reports, exploit chains) are produced by automated reasoning and may contain errors, false positives, or omissions; you are solely responsible for reviewing and validating any output before relying on it. Some jurisdictions do not allow certain warranty exclusions, so some of the above may not apply to you.

10. Limitation of liability

To the maximum extent permitted by law, in no event will Autogon Inc. or its affiliates, officers, directors, employees, agents, suppliers, or licensors be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, data, use, goodwill, or business, arising out of or relating to the Services or these Terms, however caused and under any theory of liability (contract, tort including negligence, strict liability, or otherwise), even if we have been advised of the possibility of such damages.

Without limiting the foregoing, we will have no liability for any security breach, intrusion, ransomware event, malware infection, unauthorized access, data loss or corruption, business interruption, downtime, regulatory penalty, or third-party claim, that the Services fail to prevent, detect, block, or remediate, or that arises from your use or operation of the Services.

Our total, aggregate liability for all claims arising out of or relating to the Services or these Terms will not exceed the greater of (a) the total amount you paid us for the specific Service giving rise to the claim in the twelve (12) months immediately preceding the event giving rise to the claim, or (b) one hundred U.S. dollars ($100). These limitations apply even if a limited remedy fails of its essential purpose, and they reflect an agreed allocation of risk that is a basis of the bargain between us. Some jurisdictions do not allow the exclusion or limitation of certain damages, so some of the above may not apply to you; nothing in these Terms excludes liability that cannot be excluded by law (such as for fraud, gross negligence, willful misconduct, or death or personal injury caused by our negligence).

11. Indemnification

You agree to defend, indemnify, and hold harmless Autogon Inc. and its affiliates, officers, directors, employees, agents, and licensors from and against any and all claims, demands, actions, investigations, losses, liabilities, damages, fines, penalties, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to:

• your access to or use or operation of the Services;
• any action the Services take at your direction, and any effect of that action on any system, network, data, or person, including targets you own or are authorized to test;
• your breach of these Terms, the AUP, or any consent attestation, including any false, inaccurate, or expired attestation of authorization;
• your violation of any law or regulation, or of any third-party right, including privacy, publicity, intellectual-property, computer-misuse, wiretap, export-control, or sanctions rights or laws;
• the data or content you process through, route into, or generate with the Services;
• any dispute between you and a third party, including a target organization, an employer, a customer, or an affected individual.

We may assume the exclusive defense and control of any matter subject to indemnification, at your expense, and you agree to cooperate. You will not settle any matter that imposes liability or an admission on us without our prior written consent.

12. Third-party and open-source components

The Services may operate alongside, integrate with, or drive third-party or open-source tools (for example, the Kali toolchain that Nemesis Red orchestrates on infrastructure you control). We do not control and are not responsible for third-party software, services, or infrastructure, and your use of them is governed by their own terms and licenses. Open- source components are provided under their respective licenses, which continue to apply.

13. Termination and survival

We may suspend or terminate your access to the Services at any time, with or without notice, for breach of these Terms or the AUP, for risk to us or others, or as required by law. You may stop using the Services at any time. On termination, your license ends immediately and you must cease use and, if we request, delete any locally cached components. Termination does not entitle you to a refund. Any provision that by its nature should survive (including sections 5, 7, 9, 10, 11, 14, and this sentence) survives termination.

14. Governing law and dispute resolution

These Terms are governed by the laws of the State of Delaware, U.S.A., without regard to its conflict-of-laws principles, and, where applicable, by the U.S. Federal Arbitration Act.

Binding arbitration. Except as stated below, any dispute, claim, or controversy arising out of or relating to the Services or these Terms will be resolved by final and binding individual arbitration administered by the American Arbitration Association under its applicable rules, seated in Wilmington, Delaware. Judgment on the award may be entered in any court of competent jurisdiction.

Class-action and jury waiver. You and we each waive any right to a jury trial and any right to bring or participate in a class, collective, consolidated, or representative action. Disputes must be brought in an individual capacity only.

Time limit. Any claim must be brought within one (1) year after it arises, or it is permanently barred, to the extent permitted by law.

Exceptions. Either party may (a) bring an individual claim in small-claims court, and (b) seek injunctive or equitable relief in any court of competent jurisdiction to protect its intellectual property or to stop actual or threatened misuse of the Services. If the class or jury waiver is found unenforceable, the remainder of this section still applies; if arbitration is held unavailable, the parties consent to the exclusive jurisdiction of the state and federal courts located in Delaware. Nothing here waives any non-waivable right you have under the mandatory law of your place of residence.

15. Force majeure

We are not liable for any failure or delay in performance caused by events beyond our reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, labor disputes, internet or utility failures, cyberattacks, supplier or infrastructure failures, or governmental action.

16. General

These Terms, together with the AUP, the Privacy Policy, and any order form, are the entire agreement between you and us regarding the Services and supersede any prior agreements on the subject. If any provision is held unenforceable, it will be limited or severed to the minimum extent necessary and the remaining provisions remain in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our written consent; we may assign them to an affiliate or in connection with a merger, acquisition, or sale of assets. We may provide notices by email or in-product; headings are for convenience only. Nothing in these Terms creates a partnership, agency, or employment relationship.

17. Partner Program (resellers, MSSPs, agencies, hosting companies)

This Section applies if you register a partner account to provide or resell the Services to your own customers (your "End Customers"). It is in addition to the rest of these Terms; if there is a conflict, this Section controls for partner activity. The same partner account, portal, and Partner API are used whether you are a reseller, MSSP, agency, or hosting company.

Approval. Partner accounts are reviewed before activation. We may request business registration or other verification and may approve, decline, suspend, or revoke partner status at our discretion. Partner API keys and agent install keys are issued to you; you are responsible for keeping them secret and for all activity under them.

Your End Customers. You contract with, bill, and support your own End Customers. You are responsible for their use of the Services and for ensuring they agree to terms and an acceptable-use policy at least as protective as these Terms and our AUP. You will not enroll or protect any application, site, server, or system without authorization from the party that controls it.

Pricing. You pay us the wholesale rates for your partner plan; you set your own retail pricing to your End Customers. You are responsible for your own invoicing, collection, and taxes on your sales. Wholesale rates and metering are shown in your partner console and may be updated on notice.

Data. For data processed through the Services on behalf of your End Customers, you are responsible for having a lawful basis and appropriate agreements with them. We process data as described in our Privacy Policy and any applicable data processing terms.

Branding and conduct. You may present the protection to your End Customers, but you may not misrepresent your relationship with us, imply an endorsement or certification we have not given, or use our names or marks except as we permit in writing. You will not make commitments on our behalf.

Termination. Either party may end the partner relationship as provided in these Terms. On termination or suspension you will promptly notify affected End Customers, and protection provided through your partner account may be transitioned or discontinued. You remain responsible for amounts owed. The partner relationship is non-exclusive, and nothing here makes the parties partners, agents, or employees of one another.

18. Changes to these Terms

We may update these Terms from time to time. Material changes will be notified at least thirty (30) days in advance via email or in-product notice. Continued use after the effective date of the update constitutes acceptance of the revised Terms. If you do not agree to a change, stop using the Services before the effective date.

18. Contact

Questions about these Terms? Email [email protected]. For legal notices: [email protected].