Terms of service

Definitions

• Plan: one of the three plans section 3 describes, Free, Team or Team Plus.
• Personal Account: an account on the Free Plan, held by an individual for themselves.
• Team Account: an account on the Team Plan or the Team Plus Plan, held by an organisation.
• User: anyone who uses the Service.
• Billing Period: the month or the year a Team Account is billed for.
• Seat: a licence for one named individual, the Seat Holder, to open Protected Content.
• Administrator, Billing Manager and Auditor: the roles of those names on a Team Account.
• Training Content: the training codebases and their challenges, answers, hints and walkthroughs, open to every account.
• Protected Content: the assessment codebases and their challenges, answers, hints and walkthroughs, open only to a Seat Holder they are assigned to.
• Evidence Records: the assessment results, audit log entries and exports the Service produces for a Team Account.

1. The parties

For a Personal Account, the contract is with you. A Team Account is sold only to an organisation, for use in its business, and the contract is with the organisation named at purchase. The person who buys warrants that they have authority to bind it and that the purchase is for its business.

Accounts are for people aged 18 or over.

You are responsible for activity under your account. On a Team Account, the organisation is responsible for its people's use of the Service.

2. The Service

The Training Content and Protected Content are teaching and assessment material. They are drafted with the help of AI, and reviewed and approved by a senior security engineer before release.

They are not professional advice. A score or an Evidence Record is not a qualification, a certification or a guarantee of skill or compliance.

3. Plans and prices

• Free: the Training Content, for a Personal Account, at no charge.
• Team: 10 Seats included, with assessments, Evidence Records and optional AI help.
• Team Plus: everything in Team, with 100 Seats included, a lower price for each extra Seat, and single sign-on and directory sync, which Team does not include.

Prices are shown on the pricing page, in pounds sterling.

A move from the Team Plus Plan to the Team Plan is made only at renewal, on request through support, and single sign-on and directory sync end with it.

AI help is shared by the team, does not carry over from month to month, has no cash value, and may be changed or withdrawn at any time.

4. Seats and roles

Only a Seat Holder can open Protected Content. Administrators, Billing Managers and Auditors need no Seat for those roles. We may limit how many people hold those roles in proportion to the Seats bought, the Service shows any limit, and more can be asked for through support.

A Seat may not be shared, or rotated between people so that one Seat covers several. It may be reassigned when its Seat Holder leaves the organisation or no longer needs it, once they are off the Seat, and not more than once a calendar month. Releasing a Seat does not change your bill.

An increase in Seats is charged pro rata for the rest of the current Billing Period. A decrease takes effect at your next renewal, with no refund, and not below the Seats your Plan includes.

5. Billing and refunds

A Team Account is billed in advance for each Billing Period, monthly or annually, by card through Stripe. Every card payment has an invoice, which you can download from the billing page.

A Team Account on the Team Plus Plan, billed annually, can instead pay by invoice and bank transfer, where we agree it through support.

Prices exclude VAT, which is added where it is due.

These terms apply to every order. We quote a purchase order number on an invoice as a reference for you only. The terms of a purchase order, or of any other document of yours, do not apply.

A Team Account paid by card renews for the same Billing Period until you cancel it. A Team Account paid by invoice renews when we send the next invoice, at least 30 days before the Billing Period ends, due by the end of that Billing Period.

Cancellation takes effect at the end of the Billing Period you have paid for, and the Team Account ends then. If a payment is not made, the Team Account ends as section 6 describes.

We give no refund except where the law or these terms require one. Any other refund is at our discretion.

A change to our prices takes effect at your next renewal, and we email the Administrators on the Team Account at least 30 days before it.

6. If a payment fails

If a card payment fails, or an invoice is not paid by its due date, the Team Account keeps full access for seven days. If the payment is still outstanding after that, assessment access stops and the account ends.

7. Acceptable use

Users must not:

• use what they learn here against a system they are not authorised to test;
• misuse, disrupt, probe or attack the Service, or get round its limits or security controls, except in security research that follows our responsible disclosure policy;
• scrape Training Content or Protected Content, or extract answers from the Service other than by doing the challenges;
• share, resell or sublicense access, or share or rotate a Seat;
• sit an assessment for someone else;
• use the Service unlawfully.

We encourage you to discuss Training Content and to publish your own write-ups and videos of it, showing it on screen and quoting the code you need to explain it.

Protected Content stays private. Nothing from it may be recorded, copied, published, shared or redistributed.

A challenge's page says whether it is Training Content or Protected Content.

8. Evidence Records

We keep Evidence Records while the Team Account is active and for 90 days after it ends, or for an archive period of up to seven years if you set one, and then delete them. You can export them at no charge until then.

9. Your content

You keep the rights in what you and your people put into the Service, such as review notes, messages to support and anything typed into a free-text field, other than a challenge or codebase you send us. You allow us to use it only to provide the Service and to create the statistics described below. We do not use it to train AI models.

You are responsible for it. It must not include special category personal data (such as health, religion or ethnicity), criminal offence data, passwords or other secrets, or anything you do not have the right to share.

We may create anonymised, aggregated statistics from data about how the Service is used, such as which weaknesses reviewers find or miss, and use and publish them for any purpose. They will not identify any person or organisation.

If you send us a challenge or a codebase, you assign us the copyright in it and waive any right to be named as its author or to object to changes. We may use, change and publish it, or not use it, without paying you, and we may credit you. You promise it is your own work and contains no real personal data, credentials or secrets, and nothing that belongs to your organisation or anyone else.

We may use any feedback you send us, without paying or crediting you.

10. Intellectual property

We or our licensors own the Service, the Training Content and the Protected Content. While you hold an account we grant you a non-exclusive, non-transferable licence to use them for your own training or, on a Team Account, for your organisation's internal use. You may not copy, publish, resell or adapt the Training Content or Protected Content except as the Service allows or section 7 permits.

Your Evidence Records and exports are yours.

JustAppSec® is a registered trade mark of JustAppSec Limited, UK trade mark number UK00004239907. A write-up or video that section 7 permits may name JustAppSec and show our name and logo as they appear in the Service. Any other use of our name or marks needs our written permission.

11. Data protection

For a Team Account, the organisation is the controller of the personal data the data processing agreement covers, and we are its processor. That agreement forms part of these terms for a Team Account and is accepted by the purchase. We are the controller of the other personal data we hold, as the privacy notice explains.

12. Changes to the Service

We may change the Service, including by adding, changing or removing features. We use reasonable efforts to keep the Service available, but we offer no service level agreement and do not promise uninterrupted availability. If a change materially reduces what your Plan includes, you may end the subscription by asking through support within 30 days of the change, and we refund what you paid for the rest of the current Billing Period.

13. Warranties

To the extent the law allows, the Service, the Training Content, the Protected Content and Evidence Records are provided as is and as available, without any warranty, including as to accuracy or fitness for a particular purpose. We do not promise that you will pass any audit, assessment or regulatory review.

14. Liability

Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow to be limited or excluded. Subject to that:

• we are not liable for indirect or consequential loss, loss of profit, or loss of data you have not exported;
• on a Team Account, the most we will pay for all claims about events in any 12 month period, however the claim is made and including under the data processing agreement, is the fees, excluding VAT, you paid us in the 12 months before the first of those events;
• on a Personal Account, we are liable only for what the law does not allow us to exclude.

If a court finds the Team Account limit unenforceable, the most we will pay is the total fees, excluding VAT, you have paid us for that Team Account. If any part of this section is unenforceable, the rest of it still applies.

15. Indemnity and confidentiality

If you hold a Team Account, you indemnify us against third party claims arising from a breach of section 7 or section 9 by you or your people.

Each party will keep the other's confidential information confidential and use it only for the Service or as these terms allow, unless the law or legal process requires disclosure.

16. Suspension and ending

We may suspend or end access to the Service if you seriously or repeatedly break these terms, if the law requires it, or to protect the Service or others.

You may close a Personal Account at any time, and end a Team Account as section 5 describes.

When a Team Account ends, we delete its records as the data processing agreement sets out. We keep our contract with you, invoices, accounting records and correspondence for six years after the contract ends, and a record of what we delivered to you that names no person. We also keep the anonymous statistics section 9 describes.

17. Changes to these terms

We may change these terms to reflect changes in the law, in the Service or in how we provide it. A change the law requires takes effect when the law requires it.

Any other change that materially affects a Team Account takes effect at your next renewal after it is published, unless we ask you to accept it sooner. If we do and you do not accept it, you may end the subscription by asking through support within 30 days of our asking, and we refund what you paid for the rest of the current Billing Period.

Any other change takes effect when it is published. We may ask any User to accept a change before they carry on using the Service. If you do not accept a change, you may close your account.

18. Consumers

If you hold a Personal Account as a consumer (an individual acting for purposes wholly or mainly outside your trade, business, craft or profession), nothing in these terms affects your rights under the Consumer Rights Act 2015 or other consumer law. Section 14 applies to you only so far as that law allows, and you may bring a claim in the courts of the part of the United Kingdom where you live.

19. General

These terms are the whole agreement between us, together with the data processing agreement and the orders you place at checkout for a Team Account. They replace anything said or written before. Neither party relies on any statement not set out in them, but this does not limit liability for fraud.

If a court finds any part of these terms unenforceable, the rest still applies.

The Contracts (Rights of Third Parties) Act 1999 does not apply.

We may transfer this contract to anyone who takes over our business. You may transfer it only with our written consent.

Neither party is liable for a failure or delay, other than to pay, caused by events outside its reasonable control.

A delay in enforcing a term does not waive it.

Terms that by their nature should survive the end of this contract, including those on intellectual property, liability and indemnity, continue after it.

We send notices by email to the address on your account or to a Team Account's Administrators. Send yours to [email protected].

These terms are available in English only. We keep a copy of each version, and you can ask us for the one you accepted.

The law of England and Wales governs these terms and any dispute about them, including a non-contractual one, and the courts of England and Wales have exclusive jurisdiction, subject to section 18.