Terms of Service

• "Agreement" or "ToS" refers to these Terms of Service.

• "Services" refers to the Customer Portal provided by Redguard AG, including all associated applications, interfaces, modules, and services.

• "Customer" refers to the company or legal entity (B2B) utilizing the Services.

• "Customer Data" encompasses all data and content that the Customer processes or uploads within the Customer Portal, explicitly excluding Usage Data, Telemetry Data, and Derived Data.

• "Usage Data" includes all technical interactions, activities, usage patterns, and configurations that arise during the use of the Portal.

• "Telemetry Data" refers to automatically collected technical data, server logs, diagnostic data, performance metrics, and security events.

• "Derived Data" means aggregated, anonymized, or derived data created from Customer Data, Usage Data, and Telemetry Data that does not allow for the identification of the Customer or any individual.

• "AI Features" refers to functions within the Services that are based on artificial intelligence.

2.1 The subject matter of these Terms of Service (ToS) is the provision and utilization of the Customer Portal of Redguard AG ("Redguard"), including all associated applications, interfaces, modules, and services (hereinafter "Services"), unless deviating individual agreements exist.

2.2 These provisions are an essential component of all offers, contracts, order processes, and Service Orders concerning the use of the Services between Redguard and the Customer.

2.3 The Customer's own terms and conditions are hereby explicitly excluded. This also applies if Redguard does not explicitly object to their inclusion or provides its services unconditionally while being aware of conflicting terms.

2.4 In the event of discrepancies within the documentation concerning the Customer Portal, the following order of precedence shall apply (highest priority first):

1. These ToS (Terms of Use for the Portal);
2. Service and product descriptions as well as specific terms of Redguard;
3. Offers, order confirmations, or corresponding Service Orders;
4. Other written individual agreements, provided they explicitly reference these ToS and modify their validity for the Services.

2.5 Redguard reserves the right to establish additional conditions (such as Service Level Agreements) for dedicated Services, which shall supplement these ToS.

2.6 The range of services is exclusively tailored for business use by companies and legal entities (B2B).

2.7 The Customer acknowledges that the Services are dynamic digital products that Redguard continuously adapts to technical, regulatory, and security-specific circumstances.

3.1 A contract is concluded through an offer declaration, signature, online order, or the activation of the Services by Redguard. There is no legal entitlement to the conclusion of a contract.

3.2 Following the conclusion of the contract, Redguard shall provide the Services and access to the Customer Portal. The Customer shall designate at least one Administrator to manage accounts and permissions.

3.3 The Customer is responsible for all user accounts under its customer account and for its users' compliance with these ToS.

3.4 Redguard may rely on the assumption that all actions taken by Administrators and users are authorized. This applies unrestrictedly even when connecting external identity providers (e.g., SSO, Azure AD); the Customer is solely responsible for permission management within its own systems.

3.5 The Customer is obligated to keep access credentials confidential, protect them from unauthorized access, and immediately revoke access for departing employees. Actions performed via user accounts are fully attributed to the Customer.

3.6 The Customer shall inform Redguard immediately of any suspected security incidents or unauthorized use.

3.7 Redguard is entitled to temporarily or permanently suspend access at any time for security reasons, ToS violations, legal necessities, or to protect the Services. The Customer will be informed as soon as reasonably possible.

3.8 The Customer is strictly obligated to enforce Multi-Factor Authentication (MFA) and robust access controls for all its users. The Customer shall fully indemnify and hold Redguard harmless from any data breaches, leaks of Customer Data, or unauthorized access arising out of the Customer's failure to adequately secure its credentials, manage permissions, or enforce MFA. The Customer assumes absolute responsibility for all activities occurring under its accounts, including malicious, unauthorized, or negligent acts committed by its own employees, contractors, or 'rogue' administrators. The Customer explicitly acknowledges that Redguard has no obligation to monitor user accounts for anomalous or suspicious activity. The Customer shall fully indemnify Redguard against any claims, regulatory fines, or damages arising from data exfiltration executed via authenticated Customer accounts.

4.1 Redguard provides the Customer with access to the Customer Portal as a cloud-based SaaS solution for the duration of the contract. The Customer receives a limited, non-exclusive, non-transferable right for internal business use.

4.2 Redguard continuously develops the Services and is entitled at any time to modify, expand, limit, or discontinue features, user interfaces, designs, workflows, role models, security mechanisms, APIs, and technical components.

4.3 The Customer has no claim to the unaltered continuation of specific functions, designs, or product versions. Modifications do not constitute a defect and do not entitle the Customer to a price reduction or termination, provided the essential functions are maintained.

4.4 Redguard may utilize third-party providers, cloud providers, and subcontractors for provisioning and may replace them at any time.

4.5 APIs and integrations may be adjusted or discontinued by Redguard at any time. The Customer is liable for the compatibility of its own systems. Redguard assumes no liability for disruptions originating on the Customer's side or with third-party applications.

4.6 Beta, preview, or test features are provided without warranty, support, or availability commitments ("as is") and may be modified or discontinued at any time.

4.7 The Customer is solely responsible for fulfilling the technical system requirements on its end (hardware, internet, browser).

5.1 The Customer commits to the lawful and careful use of the Services in accordance with the contractual specifications.

5.2 It is prohibited to use the Services for unlawful purposes, bypass security mechanisms, introduce malicious software, place an excessive load on the operations, employ automated processes (scraping/data mining), copy or reverse engineer the Services, or use them to develop competing products.

5.3 The Customer shall implement appropriate technical and organizational protective measures for its systems and is solely responsible for all data processed via the Services.

5.4 Redguard may deploy technical measures to ensure stability and security, restrict the use of individual functions, or block access in the event of misuse.

5.5 The Customer and its users shall interact with Redguard staff in a respectful and professional manner. Redguard reserves the right to immediately, and without prior notice, suspend portal access for any individual user who engages in abusive, threatening, or harassing behavior toward Redguard personnel. Such suspension shall not constitute a breach of this Agreement, nor shall it entitle the Customer to any Service Credits or refunds. The Customer agrees not to directly or indirectly solicit, recruit, or hire any Redguard employee or contractor with whom they interact through the Services during the term of this Agreement and for twelve (12) months thereafter.

5.6 The Customer explicitly represents and warrants that it owns, or has obtained explicit, legally binding written authorization from the target owner for, all IP addresses, domains, and web applications registered for security scanning within the Portal. The Customer explicitly authorizes Redguard and its automated scanning engines (including automated network, web application, and vulnerability scanning modules) to perform vulnerability probing, port assessments, and security testing against designated target assets. The Customer agrees to indemnify and hold harmless Redguard against any third-party claims, liabilities, or damages arising from unauthorized target scanning or network disruptions caused by target assets registered by Customer users.

6.1 The Customer acknowledges that digital services are subject to ongoing further development. Redguard is entitled to adjust, replace, or discontinue functions, designs, workflows, data structures, APIs, and security mechanisms at any time at its sole discretion.

6.2 The Customer has no claim to the maintenance of specific versions, functionalities, interfaces, or product architectures.

6.3 Adjustments do not constitute a defect, provided Redguard maintains the essential functions of the Services overall. Redguard alone decides on the prioritization and timing of further developments.

7.1 "Customer Data" comprises all data and content that the Customer processes or uploads in the Customer Portal. Excluded are Usage Data, Telemetry Data, technical data, and Derived Data.

7.2 The Customer remains the owner of its Customer Data and grants Redguard a free, worldwide right of use insofar as this is necessary for operation, maintenance, support, security, and the fulfillment of contractual or statutory obligations. The Customer further grants Redguard the explicit right to process Customer Data for the purpose of creating Derived Data (as defined in Section 10) to train internal analytical models and AI systems, provided the resulting Derived Data remains fully anonymized.

7.3 Redguard may have Customer Data processed by engaged service providers and create technical backups for operational security.

7.4 The Customer is solely liable for the lawfulness, accuracy, and third-party rights regarding its data. Redguard is not obligated to conduct any legal review.

7.5 The Customer is responsible for regularly backing up and exporting its data. Upon termination of the contract, Redguard may delete Customer Data in accordance with legal and data protection requirements.

7.6 Persistent storage of Customer Data is located exclusively on servers in Switzerland. When the Customer actively utilizes AI Features or the AI Assistant, relevant input data, prompts, and context provided by the Customer may be processed by dedicated AI infrastructure providers in other secure locations solely for the purpose of generating real-time AI responses, in accordance with Section 13 (AI Features) and Section 16 (Data Protection & DPA).

8.1 "Usage Data" includes all technical interactions, activities, usage patterns, and configurations that arise during the use of the Portal.

8.2 Redguard is entitled to collect, store, and use Usage Data for product improvement, user experience optimization, support, development planning, as well as for targeted marketing, cross-selling, and proposing customized service offerings to the Customer and its users. In addition to Usage Data, the Customer explicitly grants Redguard the right to use the contact information, role titles, and Portal interaction data of its authorized users to send administrative notifications, targeted marketing campaigns, cross-selling offers, and customized service proposals. The Customer is responsible for ensuring it has the legal right to permit such use of its users' data.

8.3 Redguard may process Usage Data within its corporate group and through service providers, as well as combine it with technical data.

8.4 The Customer has no claim to the release of Usage Data. Redguard may reuse anonymized or aggregated Usage Data permanently and without restriction.

9.1 Redguard is entitled to automatically collect and analyze technical data, server logs, diagnostic data, performance metrics, and security events ("Telemetry Data").

9.2 This data serves the purpose of secure operations, stability and error monitoring, capacity planning, and performance optimization.

9.3 Redguard may employ machine learning processes, statistical methods, and external specialized service providers for analysis.

9.4 Redguard may continue to use anonymized or aggregated technical data unrestrictedly even after the termination of the contract.

10.1 Redguard is entitled to create aggregated, anonymized, or derived data ("Derived Data") from Customer Data, Usage Data, and Telemetry Data, which do not allow conclusions to be drawn about the Customer or individuals. This explicitly includes the right to extract, aggregate, and anonymize vulnerability types, CVE trends, and configuration weaknesses across our customer base for industry benchmarking.

10.2 All rights, title, and interest in Derived Data, as well as any machine learning models, algorithms, or AI systems trained using such data, belong exclusively to Redguard.

10.3 Redguard may use Derived Data without temporal or spatial restrictions – including after the contract ends – for product development, research, benchmarks, market analyses, and for training automated systems and AI models. The Customer expressly waives any intellectual property claims, moral rights, or demands for royalties regarding Redguard's AI models, even if Customer Data was utilized in their training, provided the AI models themselves do not output the Customer's raw Confidential Information.

10.4 The Customer has no claim to the release, transfer, or restriction of the use of Derived Data.

11.1 All rights to the Services, software, source codes, architectures, UIs, designs, databases, APIs, trademarks, and documentation remain exclusively with Redguard or its licensors.

11.2 The Customer receives only a simple, non-transferable right for contractual use during the term.

11.3 The Customer is prohibited from copying, selling, modifying, decompiling software or content, or deriving source code/models (reverse engineering).

11.4 All developments, customizations, and custom features belong exclusively to Redguard. Redguard may integrate open-source or third-party components, for which supplementary license terms may apply.

12.1 Feedback voluntarily submitted by the Customer (ideas, suggestions, requirements) is deemed transferred to Redguard as a free, worldwide, irrevocable, and transferable right.

12.2 Redguard may use, exploit, and integrate feedback into its own or third-party products without restriction and without any obligation for compensation, attribution, or implementation.

12.3 Feedback does not establish any protective or participation rights for the Customer in the Services.

13.1 If the Services contain functions based on artificial intelligence ("AI Features"), these serve exclusively as support. Automated results may be erroneous or incomplete.

13.2 The Customer shall review and evaluate AI results under its own responsibility and must never make business, legal, or security-relevant decisions solely based on them.

13.3 Redguard assumes no warranty for the constant availability, accuracy, or suitability of AI Features and may adjust models, procedures, and third-party providers at any time.

13.4 The processing of Customer Data by AI Features occurs within the framework of the agreed data protection and data usage provisions.

13.5 Redguard will not permit external third-party AI LLM providers to use raw Customer Data to train public or foundational AI models. The Customer receives a non-exclusive, royalty-free license to use all AI-generated reports, remediation advice, and chat findings for its internal security operations.

14.1 Redguard strives for a stable operation of the Services over the internet but does not owe uninterrupted or error-free availability unless a deviating SLA has been agreed upon. If an SLA is agreed upon and availability targets are not met, the provision of "Service Credits" shall constitute the sole and exclusive remedy available to the Customer.

14.2 Availability limitations due to maintenance work, updates, security measures, disruptions at cloud and third-party providers, or force majeure do not justify claims for damages or price reductions.

14.3 Redguard is entitled to perform urgent maintenance work to ensure stability at any time without prior notice.

14.4 The Customer is responsible for the functionality of its own hardware, software, and internet infrastructure.

14.5 Scheduled Maintenance will be conducted during off-peak hours with reasonable prior notice. Urgent or Emergency Maintenance required to patch critical security vulnerabilities, mitigate active cyber threats, or preserve system integrity may be performed at any time.

15.1 Support services are provided to the agreed extent or according to an SLA. Without an SLA, there are no guarantees for specific response or resolution times.

15.2 The Customer shall adequately support Redguard in error analysis. Redguard may refuse support if disruptions were caused by Customer systems, improper use, or missing information.

15.3 Support does not include individual consulting, training, or customer-specific development. Redguard may use insights from support requests for quality assurance and product improvement.

16.1 Both parties shall comply with applicable data protection regulations, in particular the Swiss Federal Act on Data Protection (FADP/DSG) and the EU General Data Protection Regulation (GDPR) where applicable. Where Customer Data contains personal data, the Customer acts as Data Controller and Redguard acts as Data Processor bound strictly by documented Customer instructions.

16.2 Redguard implements robust technical and organizational security measures, including industry-standard encryption at rest and in transit, strict role-based access controls, multi-factor authentication, regular backups, and continuous vulnerability management.

16.3 The Customer grants general authorization to Redguard to engage third-party sub-processors (including cloud hosting providers located in Switzerland and dedicated AI infrastructure providers) necessary to deliver the Services. Redguard shall maintain an up-to-date list of sub-processors and notify the Customer prior to adding or replacing sub-processors.

16.4 Redguard shall notify the Customer without undue delay (and no later than 72 hours) upon confirming a personal data breach affecting Customer Data.

16.5 Redguard shall assist the Customer in responding to data subject requests and regulatory inquiries. Upon contract termination, Redguard shall retain Customer Data during the 60-day export window (Section 23.2) and subsequently delete or anonymize all personal data, except where required by applicable statutory retention laws.

17.1 The Customer shall pay the agreed prices according to the offer or Service Order, plus statutory value-added tax (VAT).

17.2 Invoices are payable within the agreed payment period without deduction. Offsetting against counterclaims by the Customer is excluded.

17.3 In the event of default in payment, Redguard is entitled to charge default interest and reminder fees, and to temporarily suspend access to the Services after prior notice. The obligation to pay remains in effect.

17.4 Redguard may adjust prices for future contract periods with reasonable notice.

17.5 Because customers can order new services through the portal, the Customer is fully financially liable for any and all charges, fees, or new services ordered via their accounts. This applies unconditionally, even if such orders result from compromised credentials, unauthorized access, or hacked accounts. Furthermore, the Customer explicitly waives any defense of lack of authority, apparent authority, or absence of signatory power for any commercial orders, Service Orders, or feature upgrades executed by any user authenticated under the Customer's account. The Customer explicitly designates the Customer Portal as an authorized procurement channel. The Customer waives any defense that a Service Order executed via the Portal is invalid due to the absence of a formal Purchase Order (PO), lack of an executive signature, or non-compliance with the Customer's internal procurement policies. The Customer bears the sole responsibility for securing their access data and monitoring account activity.

18.1 The parties commit to keeping confidential information of the other party secret and to use it only for the execution of the contract.

18.2 Excluded is information that is publicly known, lawfully obtained from third parties, independently developed, or Derived Data (as defined in Section 10), provided such Derived Data cannot be reverse-engineered to identify the Customer or its specific Confidential Information.

18.3 Redguard may process confidential information to the extent necessary for operations, security, or fulfillment of the contract. The obligation of confidentiality applies during the term as well as 5 years thereafter (indefinitely for trade secrets).

18.4 In the event that a government entity, law enforcement agency, or court subpoenas or legally requests access to Customer Data, Redguard commits to notifying the Customer prior to disclosure, unless explicitly prohibited from doing so by applicable law.

19.1 Redguard provides the Services carefully but assumes no warranty for uninterrupted freedom from errors, specific economic results, or compatibility with Customer systems.

19.2 Defects in the Services shall be remedied by Redguard at its own discretion through corrections, updates, or workarounds within a reasonable period after written notification.

19.3 Beta and test features are provided without warranty. Further warranty claims are excluded to the extent legally permissible.

19.4 Point-in-Time Security Disclaimer: The Customer acknowledges that vulnerability data, penetration test reports, and security metrics reflect a point-in-time snapshot of the tested environment. The Services do not constitute a guarantee, warranty, or certification that the Customer's environment is entirely secure, immune to cyberattacks, or free from undiscovered vulnerabilities. Furthermore, unless the Customer has actively subscribed to a specific 'Continuous Monitoring' service, Redguard expressly disclaims any ongoing duty to warn, notify, or update the Customer regarding newly discovered vulnerabilities, zero-day exploits, or threat intelligence that emerges after the generation of a specific report or snapshot.

20.1 Redguard is liable to the Customer exclusively for direct damages demonstrably caused by Redguard's intentional or grossly negligent behavior. Liability for slight negligence is – to the extent legally permissible – fully excluded.

20.2 Redguard assumes no liability whatsoever for the loss, damage, destruction, or recovery of Customer Data or other content entered into the Portal, regardless of the legal basis. The Customer is responsible for regularly backing up and exporting data processed in the Customer Portal.

20.3 To the extent legally permissible, any liability of Redguard for indirect damages, consequential damages, lost profits, business interruptions, reputational damage, third-party claims, as well as for decisions or results that the Customer makes based on the Services or AI Features, is excluded.

20.4 Redguard is not liable for damages caused by improper use, inadequate security measures by the Customer, misconfigurations, disruptions at third-party providers, or failures of the Customer's infrastructure.

20.5 The total liability of Redguard arising from or in connection with this contractual relationship is limited to the extent legally permissible to the amount the Customer actually paid for the affected Services in the last twelve (12) months prior to the event giving rise to the claim.

20.6 In the event of Service outages or availability issues, any agreed-upon "Service Credits" (as per Section 14.1) constitute the Customer's sole and exclusive remedy. The Customer is legally prevented from claiming general damages or any other compensation for such outages.

20.7 Safe Harbor for Remediation: All vulnerability data, remediation advice, and security metrics provided within the Services are for informational purposes only. The Services, including all vulnerability tracking and remediation suggestions, are provided strictly on an 'as-is' and 'informational only' basis, and do not constitute tailored professional consulting, engineering services, or a substitute for the Customer's own change-management processes. The Customer is solely responsible for testing and validating any remediation actions prior to deploying them in production environments. Redguard disclaims all liability for system outages, data loss, or business interruption resulting from the Customer's implementation of security recommendations. The Customer waives all claims related to system downtime, data loss, or business interruption resulting from remediation actions, even if such actions were explicitly recommended by the Services.

21.1 The Customer indemnifies Redguard, its executive bodies, and employees against all third-party claims arising from a use of the Services in breach of the contract, rights violations caused by Customer Data, or breaches of duty by the Customer.

21.2 The indemnification also includes the reasonable costs of legal defense and settlements.

22.1 The term is determined by the individual contract. In the absence of a termination, the contract automatically renews for the respective initial term.

22.2 The right to extraordinary termination without notice for good cause (e.g., material ToS violations, default in payment, security risks) remains reserved.

22.3 Redguard may discontinue individual Services provided the essential core functions remain or reasonable alternatives are offered.

23.1 Upon termination of the contract, the Customer's right of use expires immediately, and access may be blocked.

23.2 The Customer is responsible for exporting its data prior to or during a 60-day period following the end of the contract. Redguard will retain Customer Data for this 60-day period solely to allow for export. Exactly 60 days after contract termination, all Customer Data will be irrevocably deleted. Redguard is not obligated to perform data migrations on behalf of the Customer.

23.3 Provisions regarding intellectual property, confidentiality, liability, indemnification, and the use of Derived Data shall remain effective beyond the termination of the contract.

24.1 Redguard is entitled to amend these ToS and supplementary contractual terms at any time, in particular to account for legal, technical, regulatory, security-related, or business developments.

24.2 Updated versions of these ToS will be communicated to the Customer or its users directly within the Customer Portal (e.g., upon login or during Portal use), via e-mail, or through other electronic means.

24.3 Redguard is entitled to make the continued use of the Customer Portal and Services dependent on explicit electronic consent (e.g., by clicking a confirmation box / "Click-Through") to the updated ToS. Actions taken by Administrators or authorized users during the confirmation are deemed fully authorized by the Customer.

24.4 If the Customer or a user refuses to consent to the updated ToS, Redguard is entitled to temporarily restrict or block access to the Customer Portal and the Services.

24.5 If the Customer permanently objects to the amended ToS and a continuation of the contract under the previous conditions is technically, legally, or economically unreasonable for Redguard, Redguard is entitled to extraordinarily terminate the affected contract with a notice period of 30 days and to deactivate the user account.

24.6 Updated versions of these ToS replace previous versions at the time of their activation or confirmation.

25.1 Rights and obligations may only be transferred by the Customer with the written consent of Redguard. Redguard is entitled to engage subcontractors.

25.2 The Customer shall comply with applicable export control and sanctions regulations.

25.3 Neither party is liable for delays or failures due to force majeure (e.g., natural disasters, war, official orders, widespread cyberattacks, or failures of global IT infrastructure).

25.4 Should individual provisions be invalid, the validity of the remaining ToS shall remain unaffected.

25.5 Exclusive substantive Swiss law applies (excluding conflict of laws and the CISG). The exclusive place of jurisdiction is the registered office of Redguard AG.

25.6 Redguard is entitled to name the Customer as a reference (name/logo) unless the Customer explicitly objects in writing.

26.1 Neither party is liable for the non-fulfillment or delayed fulfillment of its contractual obligations to the extent these are attributable to events of force majeure.

26.2 Force majeure includes, but is not limited to: natural events, pandemics, war, terrorism, official measures or sanctions, power or internet infrastructure outages, failures or security incidents at cloud and hosting third-party providers, as well as cyberattacks (especially large-scale DDoS attacks, ransomware attacks, or attacks on critical infrastructure) that lie outside the reasonable sphere of influence of the affected party.

26.3 During an event of force majeure, performance obligations are suspended for the duration of the disruption. If the event lasts longer than thirty (30) days, both parties are entitled to terminate the contract in writing with immediate effect.