Terms of Service

1. Agreement

By creating an account or using ViperSonar ("the Service"), you agree to these Terms of Service ("Terms") and our Privacy Policy. The Service is operated by IOT LTD, a company registered in Cyprus (registration number HE343300; registered office Mnasiadou 9, Demokritos Building, 1065 Nicosia, Cyprus) ("ViperSonar", "we", "us").

If you use the Service for an organisation, you accept these Terms on its behalf and confirm that you may. If you don't agree to these Terms, don't use the Service.

2. The Service

ViperSonar watches the systems, jobs and devices you tell it about, and alerts you when something goes silent or a check fails. It works in two ways:

• Signals you send. Your jobs, scripts and devices report in over our API or by email, and we alert you when an expected signal does not arrive on time.
• Checks a collector runs. Our collector software, installed on a computer inside your network, checks your devices by ping, TCP, HTTP and SNMP and reports the results to us.

Monitoring makes it less likely that a failure goes unnoticed; it cannot rule it out. Detecting a failure and delivering an alert depend on networks, email and SMS carriers and other services we do not control, so do not rely on the Service as the only safeguard for life-safety, medical or other systems whose failure could cause injury or serious loss.

3. Accounts

• You must give accurate registration information and keep it up to date.
• You are responsible for what happens under your account and in your organisation's workspaces, including the API keys and collector tokens you create. Keep them confidential, and tell us at support@vipersonar.com if you suspect unauthorised access.
• You must be at least 18 years old, or older if you are not yet an adult where you live, and able to enter a binding contract.
• You use the Service for your business, trade or profession, including as a sole trader, and not as a consumer.

4. The collector

To check devices inside your network, you install our collector on a computer you control. We grant you a limited, non-exclusive, non-transferable licence to run it only to use the Service, for as long as your account is active.

• Install it only on networks you operate or are authorised to monitor, and point it — including any discovery scan you start — only at devices and address ranges you are authorised to probe.
• The collector connects to us with a token of its own. Anyone holding that token can report as your collector, so treat it like a password.
• We do not update the collector automatically; you install new versions. We may stop supporting an old version after telling you, and it will then stop receiving work from the Service.
• Don't modify, reverse-engineer or redistribute it, except where the law gives you that right.

5. Acceptable use

You agree not to:

• Scan, probe or monitor networks, devices or services you are not authorised to, or use the Service to attack, overload or disrupt anyone's systems.
• Send alerts to people who have not agreed to receive them, or use alert channels for spam or unlawful content.
• Attempt to reverse-engineer, scrape or get around the Service's access controls or rate limits.
• Send us content you don't have the right to, or that infringes someone else's rights.

We may close the organisation responsible for breaking these rules, without notice, as the termination section describes.

We may suspend your account if you breach these Terms or misuse the Service. Suspension ends your signed-in sessions and prevents you from signing in or using services that require your account. We email you the reason and email you again if we lift the suspension; contact support if you believe it was a mistake. Suspension does not close your workspaces, erase their data, cancel existing subscriptions or revoke workspace API keys or other workspace credentials. Those credentials remain subject to their existing restrictions and can be revoked separately.

6. Alerts and SMS

• You choose where alerts go — email, SMS, webhooks and chat or paging services. An email address receives a workspace's alerts and test messages only while it belongs to a verified account that can open that workspace, or after its owner confirms receipt for that workspace. An address can stop that workspace's alerts or block all alert and confirmation email from the Service; workspace editors cannot undo that choice or a spam complaint.
• Only a verified account can request an email confirmation. The confirmation message identifies the requester by their verified email address, without workspace, channel or device text. Opening a confirmation or stop link does not change the choice; the recipient submits the answer on that page without needing an account.
• You confirm that everyone whose phone number you add has agreed to receive SMS alerts, and you keep those details current.
• SMS alerts are sent through our SMS provider to the numbers you add. Carriers can delay or drop a message, and a recipient's carrier may charge them for receiving it.
• When you connect another service — Slack, Microsoft Teams, Discord, PagerDuty or a webhook — we send alert content to it because you asked us to. You are responsible for having the right to send that content there and for your own agreement with that service, and its own terms govern what it does with the content.

7. Public status pages

If you publish a status page, the device names, labels and statuses you choose to show on it can be seen by anyone with its address, or its password if you set one. You are responsible for what you publish, and you can unpublish it at any time.

8. Your data

You keep ownership of the data you and your collectors send us — device details, check results, signals and incident notes ("Customer Data"). You grant IOT LTD a limited, worldwide, royalty-free licence to host, process and transmit Customer Data only to provide the Service to you, including through the sub-processors named in the Privacy Policy. We process the personal data in it as your processor, under the data processing terms.

We do not use Customer Data to train AI models, and we do not sell it. If you ask ViperSonar to identify discovered devices with AI, the discovery details of those devices are sent to our AI provider for that purpose only.

9. Data processing

This section covers the personal data in your Customer Data and in the alert settings you create ("Customer Personal Data"): for example device names and addresses, signal messages, incident notes, and the email addresses and phone numbers of the people you alert. For that data you are the controller and IOT LTD is your processor, and this section is our data processing agreement under Article 28 of the GDPR. It applies from the moment you create an account or start using the Service, and needs no separate signature. Your account, billing and security data, including the address-wide records that prevent unwanted email, are different: we hold them as controller, as the Privacy Policy explains.

If you use the Service on behalf of your own customers, you are a processor too and we are your sub-processor. You confirm that each of them has authorised you to use us, and the sub-processors named below, for that; that what you tell us to do is consistent with what they have told you to do; and that you pass on to them the notices we send you under this section, such as a change of sub-processor or a breach. This section is the sub-processing agreement between you and us.

• What we process, and why. We process Customer Personal Data only to provide the Service to you as these Terms describe: checking your devices, watching for signals, opening incidents, sending the alerts you set up, showing the status pages you publish and, only when someone asks for it, identifying discovered devices with AI. We do not use it for anything else, sell it or use it to train AI models.
• How, and for how long. We receive, store, compare, summarise, display, send and delete it. We process it for as long as your organisation uses the Service, and afterwards until it is deleted as the Privacy Policy describes.
• Whose data it is. The people you name as alert recipients or incident participants (your colleagues and contractors and, if you are an MSP, your customers' contacts); people whose names or addresses appear in device names, labels, notes and signal messages; and the senders of signals you send us by email.
• What data it is. Device names, tags, IP addresses, hostnames, MAC addresses, SNMP system names and descriptions, network interfaces and firmware versions; check results and measurements; what discovery scans find (open ports, SSH banners, and the headers, title and a short extract of web pages); the settings of the checks you create and of the discovery scans you start, which can include the headers and body of an HTTP request and an SNMP community string; the public IP address a collector connects from; signals and their messages; the sender, subject, date and authentication results of emailed signals; the email addresses, phone numbers and webhook addresses of alert recipients; and incident notes.
• What we do not want. The Service is not built for special categories of personal data, such as health data, or for data about criminal convictions. Do not put them in device names, labels, notes or signal messages.
• Your duties as controller. You decide what is monitored and who is alerted. You make sure that you may monitor the devices and networks you point the Service at, that you have a lawful basis to give us this data, that the people you add as alert recipients know about it, and that your instructions comply with the law.

We will:

• Follow your instructions. We process Customer Personal Data only on your documented instructions: these Terms, the settings you choose in the Service and the requests you email us. You instruct us to host it with the sub-processors below and to make the transfers described in the international transfers section of the Privacy Policy. If the law requires us to do otherwise, we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you at once and may hold it until you confirm or change it.
• Keep it confidential. Everyone who works for us and can reach Customer Personal Data is bound to keep it confidential, and only the people who operate the Service can reach production data.
• Keep it secure. We protect it as the Privacy Policy describes: encryption in transit (TLS) and at rest by our hosting providers, passwords, API keys and collector tokens stored only as hashes, and access limited to the people who operate the Service. HTTP check headers and request bodies, SNMP community strings, and discovery credentials are encrypted at rest and withheld from workspace read responses. The assigned collector receives the values it needs to run those checks. Other check settings, including target addresses and URLs, remain visible to workspace members; do not put credentials in those fields. We record every sign-in and security action on your account, the main changes to your organisation and its workspaces (deleting, closing and restoring them, billing and plan changes, API keys, publishing a status page or a custom domain), and every time our staff sign in as a customer. We also record the creation, changes and deletion of devices, alert channels, collectors, monitors, maintenance windows and device groups, and manual incident acknowledgments, resolutions and note changes. We record these acts too: acknowledging a device's flapping, sending a test notification through an alert channel, requesting email recipient confirmation, changing or resetting a Monitoring Cadence setting, using Reactivate now on the Billing screen when it changes anything, and re-checking a custom domain. These records name the target and the person who acted, including the original staff operator when acting as a customer, and contain field names rather than field values. Device, collector, alert-channel, monitor, maintenance-window and device-group edits record only the fields that changed; unchanged resource saves and unchanged cadence settings create no record. Reads are not recorded. An acknowledgment through Slack is recorded on the incident timeline with its Slack actor label, without assigning it to a Service account. We may change these measures, but not in a way that gives materially less protection.
• Use sub-processors only as this section allows. You authorise the sub-processors that handle Customer Personal Data and are named in the sub-processors section of the Privacy Policy: Cloudflare, Neon, Resend, Twilio, Sentry and, only when you ask for AI identification, Google. Stripe and the Google and Microsoft sign-in services handle only your account and billing details. Slack, Microsoft Teams, Discord, PagerDuty and any webhook you connect are your own choice: we send alert content to them because you instruct us to, they are not our sub-processors, and their terms govern what they do with it. We choose sub-processors for their security and reliability, bind each by a written contract with data protection obligations that are in substance the same as these, and remain responsible to you for what they do.
• Tell you before a sub-processor changes. At least 30 days before a new sub-processor starts to handle Customer Personal Data, or replaces another, we update the Privacy Policy and email your organisation's owners and administrators. If you have a reasonable data protection objection, email support@vipersonar.com within those 30 days and we will work with you in good faith. If we cannot resolve it you may end the affected subscription at once: email support@vipersonar.com and we cancel it and refund what you paid for the rest of the billing period. If a sub-processor has to be replaced immediately to keep the Service running or secure, we tell you as soon as we can and the same right to object applies.
• Help with people's requests. If someone asks us about data we process for you, we pass the request to you promptly and do not answer it ourselves. You can change or remove alert recipients' details and delete a device and its records in the Service yourself; for anything else email support@vipersonar.com and we will correct, delete or send you the data.
• Help you meet your own duties. We help with security, breach notification, data protection impact assessments and consulting your supervisory authority, taking into account what we know about the processing: email support@vipersonar.com with what you need.
• Tell you about breaches. If we become aware of a personal data breach affecting Customer Personal Data, including at a sub-processor, we email your organisation's owners and administrators without undue delay and in any case within 72 hours, saying what happened, which data and roughly how many people are concerned, the likely consequences, what we have done and who to contact. We send more as we learn it. You decide whether to notify your supervisory authority and the people affected; we help you do it.
• Delete or return it when you leave. You choose whether we delete Customer Personal Data or return it. Unless you tell us otherwise we delete it as the Privacy Policy describes. For a copy first, email support@vipersonar.com before the restore period described there ends and we send it in a common electronic format within 14 days. The copy leaves out the credentials and secrets the Service keeps — passwords, tokens and keys, the full addresses of webhooks, the headers and body of an HTTP check, SNMP community strings and discovery credentials — because anyone who read it could use them. If the organisation has been deleted, we restore it to prepare the copy, which switches its monitoring and alerts back on until you delete it again. Check history held in our analytics store expires there on its own schedule, as the Privacy Policy says; until then this section still protects it and we do not read or use it. The messages Resend received for your devices' addresses stay with Resend for 30 days, as the Privacy Policy says, and this section protects them until then. On request we confirm in writing that deletion is complete. If the law requires us to keep something, we tell you and this section keeps applying to it.
• Show that we comply, and allow audits. We give you the information you need to check that we meet this section: this section, the Privacy Policy, written answers to your questions and the security reports our sub-processors publish. You, or an auditor you appoint who is bound to confidentiality, may audit us on 30 days' written notice (less when a supervisory authority requires it or after a breach), once in any 12 months unless a breach, a supervisory authority or specific signs of non-compliance justify more. We start with documents and a remote review of the Service's settings and records, and we agree an inspection where we operate the Service from if that is not enough or your supervisory authority requires one. Each of us bears its own costs. An audit cannot reach other customers' data or weaken our security, and we audit sub-processors through their published reports and pass on the audit rights their terms give us.
• Give you a signed copy. On request we send you a copy of this section, signed for us, that names your organisation.

If this section and the rest of the Terms or the Privacy Policy disagree about Customer Personal Data, this section wins. The limits on liability apply to claims under this section as they do to the rest of the Terms. We change this section only where the law requires it or where the change does not reduce the protection it gives you or widen what we may do with Customer Personal Data, and we email your organisation's owners and administrators at least 30 days before the change takes effect. The general changes clause does not apply to it.

10. Fees

Paid plans are billed in US dollars through our payment processor, Stripe, for the plan and add-ons you choose. Prices are shown before you subscribe and do not include taxes.

• A subscription renews each billing period until you cancel it. A cancellation takes effect at the end of the period you have paid for; your organisation then moves to the Free plan, and nothing you have set up is deleted by the change.
• If we offer you a free trial of a paid plan, it needs no card. When it ends your organisation moves to the Free plan unless you choose a paid one.
• Each plan includes a number of devices, published status pages and alert channels. When your organisation has more than its plan includes — after a move to a smaller plan, a cancellation or the end of a trial — we email its owner and billing contacts. If it still has more fourteen days after that email, we suspend its newest devices, unpublish its most recently published status pages and turn off its newest alert channels until the rest fit. Nothing is deleted, and they come back when the plan has room for them. A suspended device is not monitored and what it sends is not stored, and a new device that reports in while the plan has no room for it is added suspended.
• A plan that keeps less history hides anything older at once and deletes it fourteen days later, as the Privacy Policy describes.
• We may raise the price of your plan or add-ons. We will email your organisation's owner and billing contacts at least 30 days before an increase applies. It applies only from your first renewal that falls at least 30 days after that email, never to a period you have already paid for. If you do not want the new price, cancel before that renewal: you keep your plan at the old price until the end of the period you have paid for, and you are not charged the new price. A change in tax is not a price change.
• Taxes. We add VAT, sales tax and similar taxes where the law requires us to collect them, based on the billing address and other location details you give us. If you buy for your business, enter your tax or VAT number in your billing details when you have one; where the law allows, we then invoice you without the tax and you account for it yourself, which is often called the reverse charge. Tell us if your registration ends. If a number or statement you give us is wrong, you are responsible for the tax, penalties and interest that follow. Where we do not collect a tax that applies to your purchase, including United States sales and use tax, you are responsible for it. If you are exempt from a tax, or you resell the Service, send us a valid exemption or resale certificate for your state and we will stop adding that tax from the next invoice after we accept it.

11. Availability and support

We work to keep the Service available, but we make no uptime commitment unless we agree one with you in writing. We may change or remove features, and we will give reasonable notice before discontinuing the Service as a whole. Support is by email at support@vipersonar.com.

12. Termination

You may delete a workspace at any time from the settings. You may delete your account from the settings once any organisation you own has no other members and no subscription still running; until then, hand the organisation over or end the subscription first (a cancelled subscription runs to the end of the period you paid for). We may close your organisation, and every workspace in it, if you breach these Terms or misuse the Service, or for any reason on 30 days' notice. Monitoring and alerting stop at once for its workspaces, and we email its owners and administrators our reason; until its data is deleted we can reopen it if the closure was a mistake. What happens to your data when a workspace, an organisation or an account is deleted or closed is described in the Privacy Policy.

13. Warranty and liability

Except as these Terms expressly say, the Service is provided as is, without warranty of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement. In particular, we do not promise that every failure will be detected or every alert delivered, as the Service section explains.

To the maximum extent the law permits, IOT LTD will not be liable for any indirect, incidental, consequential, special or punitive damages, or for any loss of profits, revenue, business, data or goodwill, even if we were told they were possible. This applies to claims in contract, negligence or anything else, and it includes loss caused by a failure that went undetected or an alert that was not delivered, even where we were negligent.

Our total liability for all claims arising out of or relating to these Terms or the Service, in contract, negligence or anything else, is capped at the greater of the fees you paid us in the 12 months before the first event that gave rise to liability and US$100, unless we have agreed a different limit with you in writing.

Nothing in these Terms limits or excludes our liability for fraud or fraudulent misrepresentation, for death or personal injury caused by our negligence, for our wilful misconduct or gross negligence, or for anything else the law does not allow us to limit. Some jurisdictions don't allow the other limits in this section; where they don't, those limits apply only as far as the law permits.

14. Indemnification

You agree to indemnify and hold IOT LTD harmless from claims arising from (a) your breach of these Terms, (b) the networks and devices you point the Service at, or (c) your violation of any law or third-party right.

15. Changes to these Terms

We may change these Terms. The date at the top shows when they last changed, and the version on this page is the one that applies. When a change matters to you, we may also tell you in ViperSonar or by email. A change applies from the date at the top; if you keep using ViperSonar after that, you accept it, and if you do not accept it you can cancel your subscription, stop using ViperSonar and close your account. If you use ViperSonar as a consumer, we will tell you about a change that affects you before it applies, and you can then end your contract free of charge.

Two kinds of change follow their own rules instead of this section: a price increase, which the fees section says when it applies, and a change to the data processing section, which that section says when it applies. Every other change, including one to what a plan includes, follows this section.

16. Governing law

These Terms are governed by the laws of the Republic of Cyprus, without regard to its conflict-of-laws rules. Disputes will be resolved by the competent courts of Nicosia, Cyprus, except where mandatory consumer-protection law gives you a different forum.

17. Contact

Questions about these Terms? Email support@vipersonar.com.