Terms of
service.

The short version.

• If you hire us, your signed agreement is the main contract and wins over these terms.
• We use the access you grant only to deliver the services.
• Security services reduce risk. Nobody can promise to stop every attack, and we don’t.
• Our liability is capped at the fees you paid us in the prior 12 months.

1. Who we are.

YellowForce Inc. (“YellowForce”, “we”, “us”) is a Delaware corporation at 825 Geary St, Apt 1400, San Francisco, CA 94109, USA. Phone +1 (415) 583-7381. Legal notices: info@yellow-force.com. Website: https://yellow-force.com.

“You” means the person using our website, or the company that hires us and the people acting for it.

2. How these terms fit with your agreement.

Our services are provided under a signed order, statement of work or engagement agreement (your “Agreement”), together with these terms, our Data Processing Addendum (https://yellow-force.com/dpa/, the “DPA”) and our Privacy Policy (https://yellow-force.com/privacy/). If they conflict, this order applies: the DPA for personal data, then the Agreement, then these terms.

If you use the website only, sections 3, 5, 12 to 14 and 18 to 20 apply to you.

3. The website.

The website tells you about YellowForce. Its content is general information, not security, legal or other professional advice for your situation. We own the website and its content. You may read, share and link to it, but not copy it to build a competing service or present it as your own.

4. Our services.

We provide fully managed, AI-assisted cybersecurity: monitoring, detection, investigation, response where you authorize it, and a dashboard that shows you what is going on. Security engineers and AI models analyze your data to do this. The scope, fees, term and service levels are in your Agreement.

5. Acceptable use.

You must not:

• attack, probe, overload or try to break into the website, our dashboard or our systems, except under a written testing agreement with us;
• ask us to access, monitor or test any system you don’t own or aren’t authorized to grant access to;
• use our services to monitor people for any purpose other than the security of your systems, or in breach of employment, privacy or communications laws;
• share your dashboard logins, or let people outside your organization use the services, unless your Agreement allows it;
• copy, reverse engineer or resell our software, dashboard or methods, except where the law allows it despite this limit;
• use the services for anything illegal, or in breach of sanctions or export control laws.

6. Your responsibilities.

You agree to:

• Have authority. Grant access only to systems you own or control, with the authority to let us access the data in them, including any notice to or consent from your staff that your local law requires.
• Keep control of your systems. Keep your own administrator accounts, including at least one emergency administrator account we don’t control. We never become your only way into your systems.
• Keep us informed. Name contacts who can authorize response actions, and tell us about changes that affect our coverage (new systems, known incidents).
• Do your part. Keep your own backups, apply fixes we recommend or accept the risk, and give us the information we reasonably ask for.
• Pay the fees in your Agreement on time.

7. Our access to your systems.

• Our access is limited to what your administrator grants. It is read-only by default.
• We use it only to deliver the services, and never to view or change anything outside them.
• We don’t widen our access without asking. If a service needs more access, for example to take a response action, we ask for it separately.
• We log our access and you can see it in your dashboard.
• You can remove our access at any time. If you do, the services for that system stop, and we are not responsible for what we can no longer see.

8. Response actions.

Some services include actions such as disabling an account, signing a user out, isolating a device or blocking an address. We take an action only when you have authorized it, in advance in your Agreement or runbook, or in the moment through a contact you named. An authorized action can disrupt your users or systems. That is part of the action, and we are not liable for the normal effects of an action you authorized, carried out as authorized.

9. Confidentiality.

Each of us will keep the other’s confidential information secret, use it only for the Agreement, and share it only with people who need it for that purpose and are bound by similar duties. Your data, your system details and our findings about you are your confidential information. Our pricing, software and methods are ours.

This doesn’t cover information that is public through no fault of the receiver, was already known to the receiver, was received lawfully from someone else, or was developed independently. If the law forces either of us to disclose the other’s confidential information, we will give notice first where allowed, and disclose only what is required.

These duties last for the Agreement and 5 years after it, and for as long as we hold your data.

10. Data and ownership.

• Your data stays yours. We process it under the DPA and our Privacy Policy. We don’t sell it, use it for ads, or use it to train AI models.
• Our tools stay ours. We keep all rights in our software, dashboard, detection rules, playbooks and know-how, including improvements. You get the right to use them during your Agreement for your own business.
• Reports. You may use our reports for your own business, including with your auditors, insurers and advisers. We may use your feedback freely.

11. Fees.

Fees, invoicing and payment terms are in your Agreement. Fees don’t include taxes, which you pay except taxes on our income.

12. No guarantee of security.

Security services reduce risk. They cannot remove it. We will provide the services with reasonable skill and care, by trained people, following good industry practice. But we do not promise that we will detect or stop every attack, that your systems will be free of vulnerabilities, or that the services will run without interruption or error. AI analysis can be wrong, which is one reason our engineers review it before we act.

Except as your Agreement says otherwise, the website and services are provided “as is”, and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement, to the extent the law allows.

13. Limitation of liability.

• No indirect losses. Neither of us is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, business or goodwill, even if told they were possible.
• Cap. Each party’s total liability arising from the Agreement and these terms is limited to the fees you paid us in the 12 months before the event that caused the claim. If you have paid us nothing, our liability is limited to US $100.
• What the cap doesn’t limit: your obligation to pay fees; either party’s obligations under section 14 (indemnity); liability for fraud, gross negligence or willful misconduct; and any liability the law doesn’t allow to be limited.

14. Indemnity.

• You will defend us against third-party claims arising from: your lack of authority to grant access or give instructions; your breach of section 5; or data or instructions you provide breaking the law. You will pay the resulting costs, damages and reasonable legal fees awarded or agreed in settlement.
• We will defend you against third-party claims that our software or dashboard, as we provide it, infringes their intellectual property rights, and pay the same. This doesn’t apply to claims caused by your changes, your data, or use with things we didn’t provide.
• The defended party must give prompt notice, let the other control the defense, and cooperate. No settlement may bind the defended party without its consent.

15. Term, suspension and termination.

• Your Agreement sets the term.
• Either of us may end the Agreement by written notice if the other materially breaches it and doesn’t fix the breach within 30 days of being told.
• We may suspend services, with notice where possible, if fees are more than 30 days overdue, or if your use puts our systems, other clients or third parties at serious risk, or breaks the law. We restore them once the problem is fixed.

16. When the engagement ends.

• We stop the services and disable our credentials for your systems. We give you a checklist to remove our roles and apps on your side.
• If you ask within 30 days of the end date, we return your data in a standard format.
• We delete your data, including backups, within 30 days of the end date, and confirm deletion in writing if you ask. We keep only what the law requires, such as contracts and invoices, and keep it confidential.
• Sections 9, 10, 12, 13, 14, 16, 18 and 19 continue after the end.

17. Changes to these terms.

We may update these terms. We’ll post the new version here and change the effective date. Changes don’t apply to a signed Agreement during its current term unless both of us agree in writing.

18. Governing law and courts.

These terms and any Agreement that refers to them are governed by the laws of the State of Delaware, without regard to conflict of law rules. The state and federal courts located in Delaware have exclusive jurisdiction, and both of us agree to their jurisdiction. Either of us may still seek urgent relief in any court to protect confidential information or intellectual property.

19. General.

• Entire agreement. The Agreement, these terms, the DPA and the Privacy Policy are the whole agreement on this subject. Purchase order terms don’t apply.
• Assignment. Neither of us may transfer the Agreement without consent, except to a successor in a merger or acquisition, with notice.
• Force majeure. Neither of us is liable for delays caused by events beyond reasonable control, except for payment.
• Publicity. We won’t name you as a client without your permission.
• Notices. Legal notices go to info@yellow-force.com and our mailing address, and to the contact in your Agreement.
• Other. We are independent contractors. If a part of these terms can’t be enforced, the rest still applies. Not enforcing a right is not a waiver. There are no third-party beneficiaries.

20. Contact.

YellowForce Inc., 825 Geary St, Apt 1400, San Francisco, CA 94109, USA. Phone +1 (415) 583-7381. Legal: info@yellow-force.com. Privacy: privacy@yellow-force.com. Security: security@yellow-force.com.