Terms of Use — FerrumSec Suite

§01Who we are & these terms

Ferrum ResponseLab, Ferrum Sentinel, and the FerrumSec ID hub that connects them (together, the "Ferrum suite" or "the services") are operated by FerrumSec, a division of Funway Interactive SRL ("FerrumSec", "we", "us"). The same entity operates all three, is the data controller for the suite, and is your point of contact for the whole suite.

FerrumSec ID (id.ferrumsec.com) is the identity hub for the suite: it manages your account, single sign-on, organizations, roles, licensing, and billing. Each product — Ferrum ResponseLab (responselab.ferrumsec.com) and Ferrum Sentinel (sentinel.ferrumsec.com) — links up to this hub and is governed by these canonical Terms together with the product-specific terms set out below.

These canonical Terms are the single agreement for the whole suite. They supersede and replace any earlier, product-specific terms you may have previously accepted for ResponseLab or Sentinel; where a product still shows separate legacy terms during the beta transition, these canonical Terms control to the extent of any conflict.

By creating a FerrumSec ID, joining an organization, or using any product in the suite, you agree to these Terms. If you act on behalf of an organization, you confirm you are authorized to bind that organization. The suite is offered as a beta while we work toward general availability; features, limits, and these Terms may change as the product matures.

§02Your FerrumSec ID account & organizations

You sign in once with a FerrumSec ID, and that single sign-on carries across every product in the suite. You must provide accurate account information, keep your credentials secure, and you are responsible for everything done under your account. You must be able to form a binding contract, and you should tell us promptly if you suspect unauthorized use.

Work is organized into organizations (workspaces). Roles — such as Owner, Admin, and Facilitator — control who can manage members, run exercises or scans, and view results. Each organization's data is isolated from every other organization. MSPs, partners, and consultants may manage client workspaces where their plan allows, and remain responsible for use within those workspaces.

You are responsible for the people you invite to your organization and for what they do there. We use only essential, keep-signed-in cookies — no advertising, analytics, or third-party tracking — as described in the Privacy Policy.

§03Acceptable use of the suite

These rules apply across the whole suite, in addition to the product-specific limits for each product. You agree that you will not, and will not allow anyone else to:

• access organizations, exercises, scans, or data that are not yours, or bypass tenant isolation, authentication, or rate limits;
• probe, overload, reverse-engineer, or disrupt the services or their infrastructure, or upload malicious content;
• use the services, or any output from them, to facilitate an attack on, or unauthorized access to, any system or person;
• resell, sublicense, or white-label the services except under an MSP or partner arrangement that expressly permits it;
• use the services in violation of any applicable law or these Terms.

You are responsible for the content you and your members create and for whom you share it with.

§04Plans, billing & payments

Some features require a paid plan. Your entitlements are issued and enforced through the FerrumSec ID hub, so a plan you buy applies to your organization across the products it covers.

Payments are handled by Paddle, which acts as our merchant of record. This means Paddle — not FerrumSec directly — is the seller of record for your purchase: it processes payment, issues invoices, and collects and remits applicable taxes (including EU VAT). Your purchase is therefore also subject to Paddle's buyer terms. Subscriptions renew for successive periods until cancelled; you can manage or cancel through the billing portal, and your entitlements then lapse at the end of the paid period.

Because the suite is in beta, plans, prices, and entitlements may change, and we will give reasonable notice of material changes. Except where required by law or stated otherwise, fees already paid are non-refundable.

§05Product-specific terms

The following terms apply to each product in addition to the general terms in this document. Where a product-specific term is stricter, it controls for that product.

Ferrum ResponseLab — defensive & educational use only

ResponseLab is a tabletop simulator for rehearsing incident-response decisions using fictional organizations and artifacts only. It exists to teach detection, escalation, containment, recovery, communications, and governance — and to surface gaps and improvement actions.

It provides no offensive security capability, and you may not use it to create, request, or distribute any: no malware, ransomware, exploit code, payloads, persistence, evasion, credential theft, phishing, intrusion, scanning, brute force, lateral movement, or real operational steps for attacking real systems or third parties. Do not target any real organization, and do not enter another party's real confidential data into scenarios — keep exercises fictional. ResponseLab is not legal advice, a compliance certification, or a professional incident-response engagement; readiness scores and after-action reports are training aids, not assurances, and the service will not prevent, detect, or resolve any actual incident.

Ferrum Sentinel — authorized scanning only

Sentinel is a passive external-posture scanner that runs safe, rate-limited, non-invasive public checks against domains and produces health scores, findings, and reports. A free public preview shows basic publicly-visible information; deeper, verified-domain checks require proving you own or control the domain through the verification mechanism we provide.

You may only scan domains you own or are explicitly authorized to assess, and you must not circumvent the safety limits. By design Sentinel does not perform exploitation, credential guessing, denial-of-service, or aggressive crawling, and you agree not to misuse the service or its results inconsistently with that design — in particular, not to use findings to facilitate an attack. A passing score means only that safe public checks found no problem; it is not a guarantee of security and does not assess your internal network, endpoints, or application logic.

§06Intellectual property & your content

Your content stays yours. The content your organization creates — ResponseLab exercises, injects, decisions, observations, readiness scores, action items, and reports, together with Sentinel scan results, findings, and reports ("Your Content") — belongs to your organization. You grant us only the limited rights needed to host, generate, store, and deliver it as part of operating the services for you, including sending transactional notifications.

The platform stays ours. The services, the FerrumSec brand, the built-in scenario templates, the scoring and posture models, and the software are the intellectual property of FerrumSec and its licensors. We grant you a limited, non-exclusive, non-transferable right to use the services under these Terms; nothing here transfers any of those rights to you. Feedback you send us may be used to improve the products without obligation to you.

§07Beta status & availability

During beta the services are provided as-is and may be modified, interrupted, discontinued, or have data reset, with reasonable notice where practical. We do not offer a service-level agreement during beta. We may impose or change usage limits — such as rate limits or plan entitlements — to keep the services reliable and safe for everyone.

§08Warranties & disclaimers

The services are provided "as is" and "as available", without warranties of any kind, whether express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the services will be uninterrupted or error-free, that scoring or guidance is exhaustive, or that using them will prevent, detect, or resolve any actual security incident.

In particular: ResponseLab readiness scores and after-action reports are training aids, not assurances; and a passing Sentinel score means only that safe public checks detected no problem — it does not assess your internal network, endpoints, or application logic. You remain responsible for your own security decisions.

§09Limitation of liability

To the maximum extent permitted by law, FerrumSec and Funway Interactive SRL will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of data, profits, or goodwill, arising from your use of (or inability to use) the services or from reliance on their output.

Aggregate cap. To the maximum extent permitted by law, the total aggregate liability of FerrumSec and Funway Interactive SRL arising out of or relating to the services and these Terms — whether in contract, tort, or any other theory — will not exceed the greater of (a) the total fees you actually paid for the affected service in the twelve (12) months immediately before the event giving rise to the claim, or (b) one hundred euros (EUR 100) where you use a free tier or paid no fees in that period.

Nothing in these Terms limits or excludes liability that cannot be limited or excluded under applicable law, including liability for death or personal injury caused by negligence, or for fraud.

§10Indemnification

You agree to indemnify and hold harmless FerrumSec and Funway Interactive SRL, together with our staff and licensors, from and against any third-party claims, losses, liabilities, and reasonable expenses (including reasonable legal fees) arising out of or relating to: your breach of these Terms — in particular the acceptable-use and product-specific sections; your misuse of the services, including any scanning with Ferrum Sentinel that is not authorized, safe, and within the product's limits, or any attempt to use Ferrum ResponseLab against real systems, organizations, or third parties; the content you or your members submit; or your violation of applicable law or the rights of others.

We may, at our option, assume the exclusive defense and control of any matter subject to indemnification by you, in which case you agree to cooperate with us. This section survives termination of these Terms.

§11Suspension & termination

You may stop using the services and close your account at any time. We may suspend or terminate access — to one product or the whole suite — if you breach these Terms (in particular the acceptable-use and product-specific sections), or where needed to protect the services, other users, or third parties from harm. On termination, your right to use the services ends and any active entitlements stop; we handle Your Content as described in the Privacy Policy.

§12Governing law

These Terms, and any dispute arising out of or relating to them or the services, are governed by the law of the place where Funway Interactive SRL is established, without regard to its conflict-of-laws rules, and the competent courts of that place will have jurisdiction — subject to any mandatory consumer-protection rights you have in your country of residence. Where Paddle acts as merchant of record, its buyer terms additionally apply to the payment transaction itself.

Beta placeholder — to be confirmed. The specific governing law and exclusive forum for these Terms will be finalized before general availability. This template does not yet fix a binding choice of law or venue; the clause above must be confirmed with qualified legal counsel, and against the company's actual place of registration, before anyone relies on it.

§13Changes & contact

We may update these Terms as the suite evolves. When we make material changes we will update the effective date shown for this document and, where appropriate, notify organization administrators. Continuing to use the services after the stated effective date of a change means you accept the updated Terms.

Questions about these Terms, or anything legal, can go to hello@ferrumsec.com. For privacy questions and data requests, contact privacy@ferrumsec.com or see the Privacy Policy. You can also reach your workspace administrator for organization-level matters.