Terms of Service

By accessing or using our website or services, you represent and warrant that: (1) you are at least 18 years of age or the age of majority in your jurisdiction; (2) if you are accepting on behalf of an organization, you have the authority to bind it; and (3) you will comply with these Terms and all applicable laws and regulations.

Reallysec provides professional cybersecurity services to enterprise clients, including but not limited to:

• Security consulting (architecture design, risk assessment, defense strategy)
• Penetration testing and red team engagements
• 24/7 managed Security Operations Center (SOC)
• Compliance auditing (MLPS 2.0, ISO 27001, GDPR, PCI DSS, and more)
• Incident response and digital forensics
• Threat intelligence and situational awareness
• Code security audit (SAST/DAST)
• Cloud security, data protection, IoT security, blockchain security

Specific scope, deliverables, service levels (SLAs), fees, and duration are defined in a separate Service Agreement or Statement of Work (SOW). In case of conflict between these Terms and the Service Agreement, the Service Agreement prevails.

Alongside professional services, Reallysec sells licensed software — the Reallysec licence server and the applications that run against it. Buying a licence grants you a non-exclusive, non-transferable, revocable right to use that software, for the edition, term and node count shown on your order. It does not sell you the software itself.

Each licence is bound to the deployment it is activated on and enforces the node limit of your edition. Activation and periodic heartbeats are part of how the licence works, not an optional feature; a deployment that cannot reach the licence server continues to run through the configured offline grace period and then stops being licensed.

You may not:

• Copy, redistribute, sublicense, rent, or resell the software
• Reverse engineer, decompile, or disassemble it, except where that right cannot be excluded by law
• Circumvent, disable, or tamper with licensing, activation, or node-count enforcement
• Share licence tokens, activation credentials, or offline activation files outside your organisation
• Exceed the node count of your edition, whether deliberately or by leaving decommissioned nodes activated

We may verify compliance with the node count using data the software already reports. If a deployment is over its limit we will tell you and give you a reasonable period to reduce it or upgrade, before taking any other step.

Subscriptions are charged in advance for each billing period and renew automatically at the then-current price until cancelled. Renewal exists so a licence does not lapse mid-deployment; it is not a lock-in, and cancelling takes one click.

We send a renewal reminder before each renewal to the account email address. You can cancel at any time from Console → Subscriptions. Cancellation takes effect at the end of the period you have already paid for, and the licence keeps working until then.

Also worth knowing:

• Prices may change, but never for a period already paid; we give at least 30 days notice before a change affects your renewal
• Failed payments are retried; a subscription unpaid after the retry window is suspended, and the licence with it
• Quoted prices exclude VAT, GST and sales tax unless stated; the tax applied at checkout depends on your billing location
• Refunds are governed by our Refund Policy, which forms part of these Terms

Trial licences are provided for evaluation, free of charge and without a payment card. They are time-limited, may be capped in node count or features, and are for evaluation rather than production use.

A trial does not convert into a paid subscription by itself and nothing is charged when it ends. We may decline or withdraw a trial where it is being used to avoid paying for production use, or where the same organisation applies repeatedly for successive trials of the same product.

Penetration testing, red team exercises, code audits, and similar active-testing services require written authorization from the Client. You represent and warrant that:

(1) you lawfully own or control the systems, networks, applications, or source code to be tested;
(2) you have obtained all necessary third-party consents (e.g., from cloud providers, partners);
(3) you will not request testing of systems you are not authorized to test.

You are solely responsible for all legal consequences arising from defects in the authorization you provide. Unauthorized testing of third-party systems is strictly prohibited.

You agree NOT to:

• Violate any applicable law or regulation, or infringe any third-party rights
• Interfere with, disrupt, or gain unauthorized access to our website, servers, or networks
• Reverse engineer, decompile, disassemble, or resell our services without authorization
• Transmit malware, viruses, ransomware, or other harmful code
• Impersonate others or misrepresent your identity or affiliation
• Use our services to attack, harass, or perform any unlawful act against third parties
• Circumvent or defeat any security, authentication, or access control mechanism
• Use automated tools to scrape or harvest website data outside normal use

All content on reallysec.com—including text, graphics, logos, images, software code, trademarks, and product names—is owned by Reallysec or its licensors and is protected by the Copyright Law and Trademark Law of the People’s Republic of China and international treaties. You may not copy, modify, distribute, publish, or use such content for commercial purposes without our prior written consent.

Ownership and licensing of service deliverables (e.g., penetration test reports, threat intelligence briefs, audit opinions) are governed by the applicable Service Agreement.

During engagements, each party may receive confidential information from the other. Each party shall protect such information with no less than the same degree of care it applies to its own confidential information, and use it solely for purposes of performing these Terms or the Service Agreement. Confidentiality obligations survive termination for a period of five (5) years or longer where required by applicable law.

To enable successful service delivery, you shall:

• Provide accurate, complete, and timely information and materials
• Back up critical systems and data before service activities begin
• Designate an authorised point of contact and respond promptly to our communications
• Pay fees on time as specified in the Service Agreement
• Comply with applicable laws and not use our services for any unlawful purpose

Fees for professional services are specified in the applicable Service Agreement or SOW. Unless otherwise agreed, invoices are due within 30 days of issuance. Overdue amounts accrue interest at 1.5% per month (or the maximum permitted by law, whichever is lower), and we may suspend services until paid. All fees exclude applicable VAT or other taxes, which are borne by the Client.

Software licences and subscriptions bought online are covered by our Refund Policy, which is incorporated into these Terms by reference. In summary: a full refund within 14 days of a first purchase, no reason required, with a refunded licence being revoked.

Professional services are not covered by that policy; the applicable Service Agreement or SOW governs them.

Our website is provided “AS IS” and “AS AVAILABLE” without warranty of any kind, express or implied. While we strive to deliver high-quality security services, given the complexity and evolving nature of cybersecurity:

(1) we do not warrant that every vulnerability or threat will be identified;
(2) we do not warrant that services will be uninterrupted or entirely error-free;
(3) we do not warrant the continued availability of third-party products or integrated components.

A security assessment is a point-in-time check and does not constitute a continuing guarantee. You are responsible for your own business decisions based on our services.

To the maximum extent permitted by law, Reallysec’s total aggregate liability to you arising from or related to the services (whether in contract, tort, or otherwise) shall not exceed the fees actually paid by you to us in the 12 months preceding the event giving rise to the claim.

In no event shall we be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to lost profits, business interruption, data loss, or reputational harm—even if advised of the possibility of such damages.

The above limitations do not apply to liability arising from intentional misconduct, gross negligence, breach of confidentiality, infringement of intellectual property, or mandatory statutory provisions.

You agree to indemnify, defend, and hold harmless Reallysec, its affiliates, directors, officers, employees, and agents from and against any claims, damages, liabilities, and costs (including reasonable attorneys’ fees) arising from:

• Your breach of these Terms or the Service Agreement
• Your violation of any law or infringement of any third-party right
• Your unauthorized use of our services
• Any claim arising from defects in the authorization, data, or materials you provide

We may suspend or terminate your access to the website or services, with or without notice, in the following circumstances:

• Material breach of these Terms or the Service Agreement
• Fraud, abuse, or threats to system security
• Legal, regulatory, or judicial requirements
• Your bankruptcy, dissolution, or similar insolvency event

Termination of engagements is further governed by the Service Agreement. Provisions relating to intellectual property, confidentiality, limitation of liability, indemnification, and dispute resolution survive termination.

These Terms are governed by the laws of the People’s Republic of China, without regard to conflict of laws principles.

Any dispute arising from or related to these Terms shall first be resolved through good-faith negotiation. If unresolved, either party may bring the dispute before the competent People’s Court at Reallysec’s principal place of business in Hefei, Anhui Province.

For international clients, the parties may agree in writing to submit disputes to arbitration before the Shanghai International Arbitration Center (SHIAC) under its then-effective rules, seated in Shanghai, conducted in Chinese and English; the arbitral award shall be final and binding.

We may update these Terms to reflect business, legal, or technological changes. Material changes will be notified via website announcement or email at least 30 days before taking effect. Continued use of the services after such changes constitutes acceptance. If you disagree, you should cease use of the services.

• Severability: If any provision is held invalid or unenforceable, the remaining provisions remain in full effect
• No waiver: Our failure to immediately enforce any right is not a waiver of that right
• Assignment: You may not assign these Terms without our prior written consent; we may assign within our group or in a business reorganization
• Entire agreement: These Terms, together with applicable Service Agreements and NDAs, constitute the entire agreement between the parties and supersede all prior oral or written understandings
• Language: These Terms are provided in Chinese and English. The Chinese version prevails in case of conflict