Terms of Service

1. The parties and this agreement

These Terms are an agreement between the operator named in the introduction above and the organization on whose behalf the Service is used (“Customer”, “you”). If you accept them for an organization, you confirm that you have authority to bind it; if you do not have that authority, you must not accept them or use the Service.

These Terms, any order form signed by both parties, and (where the parties have entered into it) the Data Processing Addendum at /dpa together form the agreement (the “Agreement”). The Privacy Policy at /privacy explains how personal information is handled. If an order form conflicts with these Terms, the order form governs that subject.

2. Business use only

The Service is offered to businesses and professionals for use in their trade or profession, internationally. It is not offered to consumers or for personal, family or household use. Individual users must be at least 18 and act on behalf of a Customer.

If, despite this, mandatory consumer-protection law applies to you, nothing in these Terms limits a right that law does not allow to be limited.

3. The Service

Kultarr. is a cloud-security service. It reads configuration, identity and activity information from cloud accounts you connect (today primarily Amazon Web Services) and produces inventories, findings, permission explanations, identity-activity analysis, investigations and proposed remediations.

Unless an order form expressly says otherwise:

• the Service is decision-support information, not a managed security service, security operations center, audit, legal or compliance opinion, or insurance;
• it does not guarantee that every vulnerability, compromise, misconfiguration, excessive permission or compliance gap will be detected;
• it is not a backup, archival or disaster-recovery service, and does not replace your own monitoring, backups, incident response, access reviews or professional judgment;
• it does not change anything in your cloud environment, as section 12 describes.

4. Accounts and security

You must give accurate registration information, keep credentials confidential, keep contact details current, and promptly tell us of any suspected unauthorized access. Multi-factor authentication is available, and you should require it for everyone who administers a workspace or connects cloud accounts.

You are responsible for what is done through your workspace by people you authorize. You are not responsible for unauthorized access caused by our breach of the Agreement.

5. Authority to connect cloud accounts and repositories

Each time you connect a cloud account or repository, you confirm that:

• Customer owns or is authorized to administer it, and you are authorized by Customer to connect it;
• you may grant the access the connection requires, and permit us to process the configuration, activity records and personal information it makes available;
• Customer has given any notices to, and obtained any permissions from, its personnel and others whose information the account contains, that the law requires.

You must not connect an account, repository or system you are not authorized to connect. These confirmations do not replace access control: the Service separately enforces, on its servers, which workspace data belongs to and what each user may do.

The recommended AWS connection is an IAM role you create in your account, which we assume with temporary credentials and a unique ExternalId, and which grants read permissions only. If you choose to connect with a long-lived access key instead, you control what that key permits, you accept the added risk of a long-lived credential, and we store the secret encrypted for as long as the connection uses it. Never send root credentials, private keys or passwords through support channels or forms.

6. Acceptable use

You must not, and must not allow anyone to:

• use the Service unlawfully, or to monitor, profile or investigate people without lawful authority;
• access or attempt to access another customer’s data, workspace or systems;
• use the Service for unauthorized security testing, credential theft or attacks on any system;
• probe, scan or test the Service’s security except as the Responsible Disclosure Policy permits;
• bypass authentication, rate limits or access controls, or interfere with the Service;
• upload malicious code;
• resell or provide the Service to third parties unless an order form permits it;
• reverse engineer the Service, except to the extent mandatory law permits;
• rely on the Service’s output as the sole basis for a decision with legal or similarly significant effects on an individual, without appropriate human review and lawful authority.

7. Customer Data

“Customer Data” means information collected from the cloud accounts and repositories Customer connects, what the Service derives from it, and what Customer’s users enter about Customer’s environment. As between the parties, Customer keeps all its rights in Customer Data and grants us the rights needed to host, process and display it to provide the Service.

Kultarr. processes Customer Data only to provide, secure and support the Service for the customer that connected it, on that customer’s instructions, and as the law requires.

Kultarr. does not use raw Customer Data to develop or improve the Service for other customers. To maintain and improve the Service, Kultarr. may use (a) information about how the Service itself operates, such as error rates, job timings and which features are used, and (b) aggregated or de-identified information derived from Customer Data that cannot reasonably be used to identify the customer or any individual, and that Kultarr. does not attempt to re-identify.

Kultarr. does not use Customer Data to train a general-purpose artificial-intelligence model, and does not send it to an artificial-intelligence provider, unless the customer has separately and expressly agreed to that in writing.

Where Customer Data contains personal data, we act as Customer’s processor or service provider. Customer is responsible for the lawfulness of the Customer Data it chooses to connect, and must not connect sources intended to send us workload content, secrets, payment-card data or special categories of personal data.

8. Third-party platforms and cloud-provider charges

The Service works with platforms we do not control, including Amazon Web Services and any repository host you connect. Their availability, API behavior, pricing and terms are theirs, and your agreements with them remain between you and them.

Cloud-provider and third-party charges

You acknowledge that use of cloud platforms and third-party services may generate charges imposed directly by those providers. The Service connects to your cloud environments through the providers’ APIs. Connecting or using the Service may result in API requests, log queries, storage operations, network traffic, data transfer or use of cloud-provider services. For example, AWS bills requests to its Cost Explorer API, and additional CloudTrail trails in your account may be billed for recording the Service’s requests. Depending on your cloud configuration, usage volume and the provider’s pricing model, these activities may result in additional or unexpected charges, including where you enable or extend CloudTrail trails, GuardDuty or other services because the Service recommends it.

Cloud providers determine their own prices. Cloud-provider and third-party charges are determined and billed by the relevant provider and are not included in our fees unless expressly stated otherwise in an order form. We do not guarantee that using the Service will produce no third-party charges.

You are responsible for monitoring your cloud-provider usage, budgets, billing alerts and spending limits.

Where we know that an optional action initiated through the Service is reasonably likely to create a material additional provider charge, we will use reasonable efforts to identify that risk before the action is performed. This does not mean that the Service can identify every charge a provider may apply.

You are not responsible under this section for charges directly caused by our acting outside your authorization, by our breach of the Agreement, or by our negligence where liability for it cannot validly be excluded or limited under applicable law.

9. Security information is not a guarantee

Cloud environments and permission models change continuously. Findings can be incomplete, delayed, duplicated or wrong because of configuration, missing permissions, provider limitations, unavailable logs or unsupported policy features.

The Service reports what it could not determine rather than guessing, and its results must be read that way:

• “unknown” or “unsupported” means the Service could not evaluate the question, so it is not a clean result;
• “not collected” means the Service did not read that information, so it is not “no issue”;
• “permission denied” means the connection could not read it, so it is not “no finding”.

None of these states means safe, and we will not represent any of them as safe. You are responsible for validating findings before relying on them. We remain responsible for providing the Service with reasonable care and skill and for obligations the law does not allow to be excluded.

10. Shared responsibility

We are responsible for

• operating the Service with reasonable care and skill, and as the Agreement describes;
• protecting data in our control with the technical and organizational measures described in the Data Processing Addendum;
• representing the evidence available to the Service, and its limits, accurately;
• acting on a proposed change only as an authorized user approved it, and only then;
• charges and losses caused by our own breach of the Agreement or by our acting outside your authorization, as the Agreement provides.

You are responsible for

• the configuration and security of your AWS environment and other connected systems;
• deciding who may connect accounts and use the Service, and granting and removing the access it needs;
• validating findings and recommendations, and deciding whether and how to act on them;
• testing changes before deploying them;
• backups, disaster recovery, incident response and business continuity for your own systems and data (section 11);
• monitoring your cloud-provider usage, billing, budgets and spending limits (section 8);
• your own security program and the compliance and regulatory obligations specific to your organization.

11. Customer backups and risk of data loss

The Service is a cloud-security and decision-support service and is not a backup, archival or disaster-recovery service. You are responsible for maintaining independent and current backups of your systems, configurations, repositories and other information necessary to operate your business.

You must not rely on the Service as the sole copy or permanent archive of Customer Data. Customer Data is retained and deleted as the Privacy Policy and the Data Processing Addendum describe, including after termination (section 19).

Although we use reasonable technical and organizational measures designed to protect Customer Data, no online service can guarantee that data will never be lost, corrupted, delayed or become unavailable. You remain responsible for maintaining appropriate backup, recovery and business-continuity arrangements for your own environment.

Nothing in this section excludes or limits liability that cannot lawfully be excluded or limited, or our obligations under the Agreement to protect Customer Data in our control.

12. Recommendations and remediation

A recommendation reflects the evidence available when it was made. Infrastructure changes can affect availability, connectivity and dependent systems, and a recommendation is not a statement that a change is free of risk.

The Service does not currently make changes in your AWS accounts, whichever remediation mode a workspace administrator selects. It explains the problem and the recommended fix, can prepare the change with its diff and an impact assessment, and, where you have connected a repository, can open a pull request for you to review. You decide whether to merge and deploy it.

The AWS collection connection is read-only. Kultarr. also documents an optional, separate remediation role that permits one action on resources you opt in; the Service does not currently use it to make changes, and you can remove it at any time. If the Service ever begins applying changes in AWS accounts, these Terms will be updated first, and no change will be applied without the approval or policy your workspace configures. A connected repository is different: its token lets the Service create branches and open pull requests, but not merge them.

You remain responsible for the decision to make a change, including merging and deploying a pull request the Service opened. We remain responsible for preparing the change as described and for the accuracy of what the Service told you about it.

13. Trials, free use and early-access features

Trials, free use and features labelled beta, preview or early access may have limited functionality or capacity, may change or end on reasonable notice, and carry no service-level commitment. Do not rely on an early-access feature for a production-critical decision unless an order form says you may.

Free trial

We may offer a free trial of the Service. Unless different terms are stated when it is offered, the trial lasts 3 days, starts when the workspace’s first cloud-account connection is verified, requires no payment details, and is limited to one per workspace and per account holder.

A trial does not convert into a paid subscription automatically, and nothing is charged when it ends. At the end of the trial, access to the Service is restricted until a paid subscription is purchased.

14. Fees and payment

Fees, plans, limits and billing periods are those shown at checkout or in an order form. Our fees do not include charges from cloud providers or other third parties (section 8).

Subscriptions

Unless an order form says otherwise, a subscription is billed in advance for each monthly billing period and renews automatically at the end of each period until it is cancelled. The current list price is published on the Kultarr. website and shown at checkout.

You can cancel a subscription at any time from your workspace’s billing settings. Cancellation takes effect at the end of the current billing period: the Service remains available until then, and no further renewal charges are made.

Payments through Paddle

Kultarr. is offered as a paid subscription to a hosted software service. Paid subscriptions are sold through Paddle (Paddle.com Market Limited and its affiliates), which acts as merchant of record and authorised reseller for purchases processed through it. The price, billing period, renewal terms, cancellation method and any statutory cancellation rights are shown at checkout before you confirm a purchase.

For a purchase processed through Paddle, Paddle handles payment, invoicing, sales taxes, subscription billing, cancellations and refunds for that transaction, and Paddle’s Buyer Terms (https://www.paddle.com/legal/checkout-buyer-terms) also apply to it as a separate agreement between you and Paddle. These Terms govern your use of the Service.

Refunds and cancellations

Where a purchase is processed through Paddle, Paddle acts as merchant of record, and refund, cancellation and statutory withdrawal requests relating to that transaction are handled in accordance with Paddle’s applicable Buyer Terms and Refund Policy (https://www.paddle.com/legal/refund-policy).

Except where required by applicable law, expressly agreed in an order form, approved through Paddle’s applicable refund process, or where a payment was made in error, purchases are generally non-refundable.

Cancelling a subscription stops future renewal charges. It does not by itself entitle you to a refund or credit for a service period that has already started.

Nothing in the Kultarr Terms of Service or Refund Policy limits any mandatory consumer right that cannot legally be waived, including a statutory cancellation or withdrawal right.

The Kultarr Refund Policy at /refund sets out the same position and how to make a request.

15. Intellectual property and feedback

We and our licensors keep all rights in the Service, its software, detection logic, documentation and design, excluding Customer Data and third-party materials. During the Agreement you may use the Service for your internal business purposes, subject to these Terms; the right is non-exclusive, non-transferable and may not be sublicensed.

If you choose to give us feedback, we may use it without obligation to you, provided we do not identify you or disclose your confidential information.

16. Confidentiality

Each party will protect the other’s non-public information with at least reasonable care and use it only for the Agreement. This does not cover information that is or becomes public without breach, was already lawfully known, is independently developed, or is lawfully received from someone else. Disclosure required by law is permitted, with prior notice where lawful and practicable.

17. Availability and changes to the Service

We aim to keep the Service available and reliable, but do not promise uninterrupted or error-free operation unless an order form includes a service-level commitment.

We may change the Service for security, legal, technical or product reasons. We will not materially reduce the core functionality of a paid subscription during its current term without reasonable notice, except where urgently needed for security or by law.

18. Suspension

We may suspend access, in whole or in part, where reasonably necessary to prevent harm to the Service, other customers or third parties, to respond to a suspected compromise, to comply with law, or to stop a material breach. We will limit a suspension to what is necessary, give notice beforehand where reasonable and lawful, and restore access once the reason is resolved.

19. Term, termination, export and deletion

The Agreement continues while you use the Service or any subscription is active. You may stop using the Service at any time and ask us to close your workspace. Either party may terminate for the other’s material breach that is not cured within a reasonable period after written notice, or immediately where the breach cannot be cured or urgent action is required.

After termination, you may request an export of available Customer Data for up to 30 days. After that period, Customer Data is deleted in accordance with the Privacy Policy and the Data Processing Addendum, except where applicable law requires retention.

Disconnecting a cloud account stops collection from it. Removing the role or access key from your AWS account is your step to take, and it is the one that guarantees we can no longer read the account.

Sections that by their nature should continue survive termination. These include Customer Data, confidentiality, disclaimers, limitation of liability and governing law.

20. Disclaimer of warranties

To the extent the law permits, and except as the Agreement expressly provides, the Service is provided “as is” and “as available”, and we disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement. This does not exclude an express commitment in an order form or a warranty that cannot lawfully be excluded.

21. Limitation of liability

To the extent the law permits, neither party is liable for indirect, incidental, special, punitive or consequential damages, or for loss of profits, revenue, goodwill or anticipated savings, arising out of or relating to the Agreement, even if told such loss was possible.

To the extent the law permits, each party’s total aggregate liability arising out of or relating to the Agreement will not exceed the greater of (a) the fees paid or payable by Customer for the Service during the 12 months immediately preceding the event giving rise to the claim, and (b) USD 1,000.

These limits do not apply to liability that cannot lawfully be limited or excluded, including liability for fraud, wilful misconduct, or death or personal injury caused by negligence.

22. Governing law and courts

The Agreement, and any dispute arising out of or relating to it or the Service, are governed by the laws of the State of Israel, without regard to conflict-of-law rules.

To the extent the law permits, the competent courts in Rishon LeZion, Israel, have exclusive jurisdiction. Where a dispute falls within the subject-matter jurisdiction of a court that does not sit in Rishon LeZion, the competent court for the Central District of Israel has exclusive jurisdiction instead.

This section does not deprive either party of a forum, or of the protection of a law, that mandatory law gives it, and either party may seek urgent interim relief from any court with authority to grant it.

23. Changes to these Terms

We may update these Terms. Each version is identified at the top of this page and earlier versions are listed there. Your account records the version you accepted and when.

For a material change, we will give notice through the Service or by email before it takes effect, and where the law or your agreement requires your agreement we will ask you to accept the new version before you continue. Changes apply going forward, not to disputes that arose before them.

24. General

Notices to us must be sent to the legal address in section 25; notices to you may be sent to the email address of your workspace’s owner or through the Service.

Neither party may assign the Agreement without the other’s consent, except to a successor to all or substantially all of the relevant business or of the operation of the Service, with notice. Neither party is liable for failure caused by events beyond its reasonable control. Failure to enforce a provision is not a waiver. If a provision is unenforceable, it is limited to the minimum extent necessary and the rest remains in effect. Nothing in the Agreement limits rights or remedies that cannot lawfully be limited.

25. Contact

Operator

Ofir Benav

Service name

Kultarr. (not a separate legal entity)

Address for legal notices

Ofir Benav, Bernstein 29, Rishon LeZion, Israel

Legal email

ofirbe@kultarr.io