These OST form part of a broader contractual framework consisting of:

• these OST, which govern use of the Service, commercial terms, report use, permitted use, liability, IP, export controls, governing law and general legal terms;
• the Data Processing Agreement (“DPA”) where BlackCrypt processes Customer Data on behalf of Customer; and
• any order, checkout confirmation, invoice, billing information, or separately signed agreement confirmed through or alongside the Service.

No report legal notice, dashboard page, help text, FAQ, generated report, or other informational surface creates separate accepted terms unless expressly incorporated into these OST or a separately signed agreement.

The Service provides automated, point-in-time analysis of encrypted network traffic metadata. It does not decrypt payloads, inspect cleartext content, access your endpoints, or directly modify your infrastructure.

The Service focuses on encrypted-session telemetry such as TLS fingerprints, SNI where available, IP addresses, ports, timing, sizes, certificates, and related metadata. Findings reflect only the data submitted, the capture window, the capture point’s visibility, and the model and threat-intelligence snapshot available at analysis time.

The Service is not a managed detection and response (MDR) service, 24/7 SOC, incident-response engagement, endpoint-forensics service, general-purpose PCAP forensics platform, vulnerability scanner, SIEM, EDR, DLP tool, or compliance-audit service.

The Service uses statistical, AI and machine-learning models and may use external threat-intelligence sources. Outputs are probabilistic indicators and may include false positives and false negatives. Family/type labels, severity levels and threat-intelligence enrichments are triage signals, not conclusive proof of compromise, definitive malware attribution, or threat-actor attribution.

Results and Reports are point-in-time outputs. BlackCrypt has no obligation to update a completed analysis or Report for later threat-intelligence changes, IP reputation changes, infrastructure reuse, model updates, or newly discovered information unless separately agreed.

Detection methods, feature engineering, models, weights, templates and internal scoring logic are proprietary. BlackCrypt may disclose high-level methodology or label-space information in the Service or in Reports, but is not required to disclose proprietary detection methods.

Basic Analyses are provided free of charge and are intended for initial evaluation and low-risk use cases. They typically provide limited classification, such as sessions that match supported malicious patterns and sessions where no supported malicious pattern was detected, without detailed enrichment, attribution, malware family/type labels, or downloadable reporting. Liability for Basic Analyses is excluded or limited as set out in Section 12.3.

Advanced Analyses are paid, credit-consuming analyses that provide richer enrichment (such as threat intelligence hits, Geo-IP breakdowns, malware family/type labels, and extended reporting). Liability for Advanced Analyses is capped as set out in Section 12.2.

The exact features included in each tier, and the types of Results and exports, are described in the Service interface and may be updated from time to time as the Service evolves.

BlackCrypt may improve, modify, or deprecate features of the Service from time to time, provided that any change does not materially deprive you of the core functionality of the tier you are using (Basic or Advanced) for the remaining duration of your current billing period or pre-purchased Credits.

Where a change materially reduces functionality of a paid feature, BlackCrypt will provide reasonable advance notice, and you may have the option to stop using that feature and avoid further charges related to it.

To use the Service, you must create an account and provide accurate, complete information. You are responsible for keeping your login credentials confidential and for all activity under your account, except where caused by a breach of BlackCrypt’s security obligations.

You must notify BlackCrypt promptly if you become aware of any unauthorised access to your account or suspected compromise of your credentials. BlackCrypt may require multi-factor authentication or other additional security measures for access to certain features.

If you use the Service on behalf of an organisation, you must ensure that only authorised personnel have access to the account and that access is revoked when they no longer need it. You remain responsible for ensuring that your users comply with these OST and any applicable policies.

You may not use the Service if you are located in, or are a national or resident of, any country or region subject to comprehensive trade sanctions or export restrictions applicable to BlackCrypt, or if you are listed on any applicable sanctions or denied-party list.

You represent that you will not use the Service for the benefit of any such sanctioned person or in violation of applicable export-control or sanctions laws.

Use of the Service, models, Results and Reports is subject to applicable export-control and sanctions laws, including EU dual-use rules, EU restrictive measures, Luxembourg implementing rules, and, where relevant to a transaction, other applicable regimes.

You represent that you are not a sanctioned or restricted party, are not owned or controlled by a sanctioned or restricted party, and are not located in an embargoed or comprehensively restricted territory. You must not permit access to or use of the Service from embargoed locations or by restricted parties.

You must not use the Service, Results or Reports for prohibited end uses, including weapons of mass destruction proliferation, restricted military end use, unlawful surveillance, or human-rights abuses. You must not route access through VPNs, proxies, or other means to evade screening or territorial controls.

BlackCrypt may conduct sanctions or export screening, request information, suspend or terminate access, refuse delivery, or withhold performance where required to comply with law or where an export licence or authorisation is required and not obtained. You must promptly notify BlackCrypt if your restricted-party or export-control status changes.

You may use the Service, Results and Reports solely for internal defensive security purposes, such as analysing network captures from your environment or from environments you are contractually responsible for securing.

You may use Results and Reports to support internal assessment, triage, investigation, defensive security actions, incident handling, risk review, and internal reporting.

Results and Reports are confidential. You may share them only on a strict need-to-know basis with your personnel, controlled affiliates, bound contractors, external counsel, auditors, MSSPs, consultants, and incident-response providers, provided they are subject to professional secrecy or written confidentiality obligations no less protective than these OST.

If disclosure is legally required by a regulator, court, or competent authority, you must disclose only what is necessary and, where legally permitted, notify BlackCrypt in advance.

You must not use the Service:

• to analyse captures obtained unlawfully or without appropriate authorisation;
• to attempt to deanonymise or re-identify individuals beyond what is necessary for legitimate defensive security purposes and permitted by applicable law;
• to circumvent technical or usage limits of the Service, or to interfere with its proper functioning;
• to publicly redistribute, publish, resell, sublicense, or commercialise Results or Reports;
• to use Results or Reports for marketing, public comparative benchmarking, vendor scorecards, or public claims about BlackCrypt or third parties without BlackCrypt’s prior written consent;
• to remove confidentiality notices, attribution, legal notices, report metadata, or verification information from Reports;
• to use BlackCrypt names, logos, trademarks, screenshots, Results, or Reports in public material without BlackCrypt’s prior written consent;
• to train, benchmark, evaluate, reverse engineer, or improve models, detection tools, or competing services using the Service, Results, Reports, or their contents, except where explicitly permitted in a separate written agreement with BlackCrypt;
• for prohibited end uses under applicable export-control or sanctions laws, including unlawful surveillance, human-rights abuses, weapons of mass destruction proliferation, or restricted military end use;
• in a way that violates applicable law, including export-control, sanctions, data-protection, telecommunications, cybercrime, or computer-misuse laws.

You are responsible for:

• ensuring that you have a valid legal basis to process any personal data contained in Customer Data through the Service;
• configuring capture scope so Customer Data is representative, lawful, accurate, and limited to what is necessary;
• reviewing Results critically and validating findings against internal context before enforcement, blocking, reporting, escalation, or containment;
• using safe change-management practices, including testing and rollback where appropriate;
• performing asset triage, incident response, regulatory assessment, and remediation under your own policies and procedures;
• restricting access to Results and Reports to need-to-know recipients and preventing unauthorised redistribution;
• ensuring that downstream vendors or processors handling personal data in Customer Data, Results or Reports are subject to appropriate GDPR-compliant contracts and safeguards;
• ensuring that your use of the Service, monitoring, disclosure, retention, and enforcement actions comply with applicable law, sector rules, and internal policies.

For Customer Data processed through the Service, Customer acts as controller or processor, as applicable. Where Customer acts as controller, BlackCrypt acts as processor. Where Customer acts as processor for an end customer, BlackCrypt acts as Customer’s sub-processor. Customer is responsible for ensuring that it has authority to appoint BlackCrypt and to issue processing instructions for the relevant Customer Data.

The DPA sets out the details of this processing, including subject matter, duration, nature, purpose, categories of data, categories of data subjects, security measures, sub-processors, transfers, assistance, deletion/return, and audit rights.

BlackCrypt will process Customer Data only as documented in the DPA and your instructions, which include your use of the Service and any configuration options you select. In the event of a conflict between these OST and the DPA on data-protection matters, the DPA prevails.

BlackCrypt will implement data-minimisation and retention measures as described in these OST, the DPA and the Privacy Policy. Uploaded PCAPs and capture-derived raw artefacts are deleted after the analysis completes or irrecoverably fails, subject only to technical backup cycles.

Derived analysis outputs, metadata and generated report artefacts are retained for 90 days by default while the analysis remains available in the Service, unless deleted earlier by Customer or retained longer where required by law, security investigation, dispute handling, or an agreed enterprise retention setting.

Security, abuse-prevention, support and audit logs are retained for up to 180 days by default, unless longer retention is required for legal, tax, security, incident-response, or dispute reasons. Deletion propagates to backups within 30 days according to the backup lifecycle, unless backup isolation is legally or operationally required.

BlackCrypt does not use Customer Data, PCAPs, derived Results, Reports, or personal data contained in Customer Data to train, retrain, fine-tune, benchmark, or evaluate general-purpose detection, AI, or machine-learning models reused across customers, except under a separate explicit written opt-in agreement.

BlackCrypt may use aggregated and de-identified service analytics, such as uptime, error rates, capacity metrics, queue statistics, and non-identifying product telemetry, to operate, secure and improve the Service, provided that such analytics do not identify Customer, Customer users, data subjects, or Customer Data.

Unless the Service interface clearly states otherwise before submission, one Credit runs one Advanced Analysis on one accepted PCAP. Basic Analyses do not consume Credits. BlackCrypt may introduce other paid metered features only where the applicable Credit consumption or price is displayed in the Service interface before use.

Credits are typically sold in bundles. Credits do not expire unless an expiry period is expressly stated at the time of purchase, in the Service interface before checkout, or in a separate signed agreement. Expired Credits cannot be used and are not refundable, except where required by mandatory law.

You agree to pay all fees and charges for Credits and any other paid features as described in the billing interface. Prices are exclusive of taxes unless stated otherwise. You are responsible for any applicable VAT, sales tax, or similar indirect taxes, except where BlackCrypt is required by law to collect and remit them.

Payments are processed through third-party payment processors. BlackCrypt does not store full payment card details and relies on those processors for secure transaction handling.

Unless otherwise stated in a separate signed agreement or required by mandatory law, Credits are non-transferable and non-refundable once purchased, even if unused.

Credits are consumed when an Advanced Analysis starts or when the Service accepts a paid metered request, as described in the Service interface. No Credit is consumed for inputs rejected before acceptance.

If an accepted Advanced Analysis irrecoverably fails before Results are delivered because of a platform error, queue/worker failure, or unsupported condition not caught before acceptance, BlackCrypt will re-issue the consumed service Credit unless a cash refund is required by mandatory law.

No refund or re-credit is owed for completed analyses; expected model uncertainty such as false positives or false negatives; invalid, corrupted, unauthorised, incomplete, unsupported, or out-of-scope inputs rejected before acceptance; inputs that contain no encrypted traffic required for the selected analysis; or third-party rate limits or outages outside BlackCrypt’s reasonable control.

To the maximum extent permitted by law, neither party will be liable to the other for any indirect, incidental, consequential, special, punitive, or exemplary damages, or for loss of profits, revenue, goodwill, or data, even if advised of the possibility of such damages and even if any limited remedy fails of its essential purpose.

For paid Advanced Analyses and other paid features, BlackCrypt’s aggregate liability arising out of or related to these OST (whether in contract, tort, or otherwise) will not exceed the greater of (a) the total fees paid by you to BlackCrypt for the Service during the twelve (12) months immediately preceding the event giving rise to the claim, or (b) EUR 10,000.

For free Basic Analyses, BlackCrypt’s liability is excluded to the maximum extent permitted by law. Where such exclusion is not permitted, BlackCrypt’s aggregate liability for Basic Analyses is limited to EUR 100.

The caps and exclusions in this Section 12 do not apply to (a) your payment obligations, (b) either party’s liability for gross negligence or wilful misconduct, or (c) any other liability that cannot be limited under applicable law.