Terms of Service

These Terms of Service ("Terms") are a binding agreement between you (or the organisation you represent) ("Customer," "you") and Shadow Span Technologies Inc. ("Shadow Span," "we," "us"). By creating an account, subscribing, or otherwise accessing the Shadow Span platform (the "Service"), you agree to these Terms. If you do not agree, do not use the Service.

Relationship to a Master Services Agreement. If you have entered into a signed Master Services Agreement with us, that MSA (together with its Order Forms and DPA) governs your use of the Service and supersedes these Terms to the extent of any conflict. These Terms otherwise apply to self-serve, trial, and online access.

By accessing the Service, you confirm that: (a) you have authority to bind the organisation you represent; (b) you are at least 18 years of age; and (c) your use will comply with all applicable laws. We may update these Terms and will give at least 30 days' notice of material changes by email or in-platform notice. Continued use after the effective date constitutes acceptance.

Shadow Span is a sovereign, intelligence-led security operations and Cloud-Native Application Protection Platform (CNAPP). Its currently available capabilities include: Application Security (AppSec) — SAST, SCA, IaC scanning, and SBOM generation; External Attack Surface Management (EASM); endpoint and executive threat intelligence; phishing and brand-impersonation detection; supply-chain risk intelligence; vulnerability and threat-intelligence aggregation; and AI-usage monitoring (endpoint scanning of local AI command-line-tool activity for sensitive-data patterns).

Additional capabilities — including broader data-loss prevention (DLP) — are under development and, if and when released, will be offered on an opt-in basis. The specific features available to you depend on your subscription tier and current availability; not all features are available in all tiers or regions. We may modify, add, or remove features, provided that material reductions in functionality for paid subscribers will be communicated with at least 30 days' notice.

The Service is provided for lawful, defensive security purposes only. Intelligence outputs are intended to help you identify and respond to threats affecting your own organisation and its authorized monitored assets.

Provide accurate registration information and keep it current. You are responsible for safeguarding your credentials and for all activity under your account, and must notify us promptly at legal@shadowspan.com of any suspected unauthorised access. We may disable an account we reasonably believe is compromised or misused. An account administrator may invite additional users, and you are responsible for their compliance with these Terms.

You must use the Service only for lawful purposes. You must not:

(a) use the Service to conduct or facilitate unauthorised access to systems, networks, or data; (b) configure the Service to monitor, scan, or collect intelligence on assets you do not own or lack explicit written authorisation to monitor; (c) use intelligence outputs to target, harass, extort, or harm any individual or organisation; (d) reverse-engineer, decompile, or extract source code from the Service; (e) scrape or extract data beyond your API entitlements; (f) circumvent or interfere with security, authentication, rate-limiting, or access controls; (g) introduce malicious code; (h) use the Service to send spam, phishing, or unlawful content; or (i) resell, sublicense, or provide access to third parties without our prior written consent.

Violation may result in immediate suspension or termination without refund.

Plans. Features and limits vary by tier as described on our pricing page. Fees. Subscription fees are invoiced in advance monthly or annually and are exclusive of taxes, which are your responsibility. Payment. We bill by invoice; payment is due per the invoice terms. If payment is overdue, we will notify you, and continued non-payment may result in suspension. Renewals. Subscriptions auto-renew each period unless cancelled before the renewal date; cancellation takes effect at the end of the current period, with no refund for the unused portion. Price changes. We give at least 30 days' notice of increases, effective at your next renewal. Refunds. Fees are non-refundable except as required by applicable consumer-protection law or where we have materially failed to deliver the Service. Free/trial tier. Any free or trial tier is subject to fair-use limits and these Terms and may be modified or discontinued with 30 days' notice.

Shadow Span platform. The Service, including all software, algorithms, interfaces, documentation, and aggregated intelligence datasets we compile, is owned by or licensed to Shadow Span and protected by intellectual-property laws. Nothing transfers ownership of our intellectual property to you. Your data. You retain ownership of the data, configurations, and content you input ("Customer Data"), and grant us a non-exclusive, worldwide licence to process it solely to provide the Service. Feedback. We may use suggestions or feedback without restriction or compensation. Intelligence outputs. You may use outputs internally for your security operations but may not redistribute, publish, or resell them without our prior written consent.

Each party will keep confidential the other's non-public information that is designated confidential or reasonably understood to be confidential, except information that is or becomes public without fault, was known before disclosure, is received from a third party without restriction, or is independently developed. We will not disclose your Customer Data except to provide the Service, as required by law, or as described in our Privacy Policy and DPA.

To the extent we process personal data on your behalf, we act as your processor under your instructions as controller, in accordance with our Data Processing Agreement (DPA), incorporated by reference. The DPA is the controlling document for all personal-data processing by the Service, and describes each processing module (including endpoint management and AI-usage monitoring) in its Annex II.

Where you enable our endpoint agent, it supports endpoint management and security-posture monitoring (Aegis) and AI-usage monitoring. For AI-usage monitoring, pattern matching and redaction occur locally on the endpoint; we do not receive raw secret values or full prompts/transcripts, only minimized detection records as described in the DPA. Both endpoint functions constitute employee monitoring. You are responsible for ensuring your use of the Service — including the assets and personnel data you configure for monitoring — complies with applicable law, including establishing a lawful basis and providing any required notices (for example, employee-monitoring notices).

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. We do not warrant that the Service will be uninterrupted, error-free, or secure, or that it will detect or prevent all threats, vulnerabilities, zero-days, or incidents. Intelligence data derives from open-source and third-party feeds we do not independently verify; you are responsible for validating intelligence before acting on it.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, SHADOW SPAN'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE — WHETHER IN CONTRACT, TORT, OR OTHERWISE — WILL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID IN THE 12 MONTHS BEFORE THE CLAIM, OR (B) CAD/USD $100. IN NO EVENT WILL WE BE LIABLE FOR LOST PROFITS, REVENUE, DATA, BUSINESS, OR GOODWILL, OR FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES.

These limits apply to the fullest extent permitted by law. Nothing limits liability for death or personal injury caused by negligence, fraud, or any liability that cannot be limited by law. If you have a signed MSA, the limitation of liability in that MSA applies to your use of the Service instead of this Section.

You agree to indemnify, defend, and hold harmless Shadow Span and its officers, directors, employees, and agents from claims, damages, losses, and costs (including reasonable legal fees) arising from: (a) your breach of these Terms; (b) your violation of any law or third-party rights; (c) your use of the Service in a manner not permitted, including monitoring assets you do not own or lack authorisation to monitor; or (d) Customer Data that infringes third-party rights or violates law.

Term. These Terms apply from first access until terminated. By you. You may terminate via your account settings, effective at the end of the current billing period. By us. We may suspend or terminate immediately on notice if you materially breach and fail to cure within 10 days, breach the Acceptable Use Policy, become insolvent, or where required by law. Effect. On termination, access ceases; you may export Customer Data within 60 days; after that we delete Customer Data from production systems within 60 days, subject to legal retention obligations. Sections that by their nature should survive (including 6, 7, 8, 9, 10, 11, and 13) survive.

These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada, without regard to conflict-of-law principles. Disputes are first subject to good-faith negotiation for 30 days from written notice; if unresolved, they are subject to the exclusive jurisdiction of the courts of Ontario, except that either party may seek injunctive or equitable relief in any court of competent jurisdiction to prevent irreparable harm. For customers with a signed MSA, the governing-law and dispute terms of that MSA apply instead. Nothing affects mandatory rights or remedies available to you under applicable law.

Entire agreement. These Terms, with our Privacy Policy, DPA, and any Order Forms, are the entire agreement on their subject matter and supersede prior agreements — except that a signed MSA prevails over these Terms as stated above. Severability. Unenforceable provisions are modified to the minimum extent necessary; the rest remain in effect. Waiver. Failure to enforce is not a waiver. Assignment. You may not assign without our consent; we may assign in a merger, acquisition, or sale of assets. Force majeure. Neither party is liable for delays caused by events beyond its reasonable control. Notices. Legal notices to us: legal@shadowspan.com; to you: the email on your account. Relationship. The parties are independent contractors.

Shadow Span Technologies Inc. — legal@shadowspan.com