Terms and Conditions

1. These terms

These terms govern use of the Neotelix service, the console at api.neotelix.com, and the connectors we publish for Microsoft Sentinel, Splunk and other security platforms. They are between Neotelix and the organisation that holds the account, referred to here as you.

By creating an account, issuing an API key, or using the service, you accept these terms on behalf of your organisation. Where you have a separately signed agreement with us, that agreement governs and these terms fill any gaps in it.

2. What the service does

You submit an alert or an incident. Neotelix matches the observables in it against threat intelligence, resolves the MITRE ATT&CK techniques involved, and returns an analysis: a verdict, the intelligence that matched, the evidence behind it, and step by step investigation and response guidance. Where you have told us which security platform you run, the guidance carries queries written in that product's own language.

3. What the service does not do

Neotelix does not act in your environment. It does not contain, isolate, quarantine, block, remediate, delete, or change anything, anywhere. It holds no write access to your systems. It proposes, and your people decide and act.

Neotelix does not make your security decisions. Nothing it returns is a determination that an incident is or is not real, benign or malicious, contained or ongoing. Those are judgements for your analysts, who have the context we do not.

Neotelix does not replace your monitoring. It analyses what you send it. It does not watch your estate, and it will not tell you about something you did not submit.

4. Guidance, and who is responsible for it

Guidance is produced with the assistance of artificial intelligence. Some of it has been reviewed by a person and some has not, and the service labels which is which wherever it is shown. Guidance marked as unreviewed has not been checked by anybody at Neotelix.

You are responsible for reviewing guidance before acting on it, and for deciding whether to run any query it suggests. A query runs in your environment, against your data, with your permissions. Some guidance describes actions that change systems, such as isolating a host or resetting an account, and those actions are yours to take or refuse.

We do not warrant that guidance is correct, complete, or suitable for your environment, and you should not treat it as the only input to a response decision.

5. Your data

The material you submit remains yours. We process it to provide the service and for nothing else. We do not sell it, share it for advertising, or use one customer's incident material to serve another.

Each organisation's data is separated inside the database itself and not only by application code. You can export your organisation's data and you can have it erased. How personal information is handled is set out in our privacy policy, which forms part of these terms.

6. What data is sent, and who decides

What reaches Neotelix is set by the connector configuration, not by a choice your analysts make each time. We supply the connector, we write the queries it runs, and we install and configure it with you. So we are responsible for what the connector collects by default, and we will tell you what that is before it runs.

Your part is to authorise the connection, to approve the configuration, and to tell us about data that must not leave your environment at all, whether for legal, contractual or regulatory reasons. We will adjust the configuration to exclude it. You can change the configuration or switch the connector off at any time.

Where your own correlation searches decide which incidents are sent to us, those searches are yours and the rows they produce are what we receive. Keep personal information and secrets out of them where you reasonably can.

The service also strips identifiers on arrival, discarding anything shaped like an email address or a Windows account name, reducing a file path under a user's home directory to the bare filename, and reporting how many values it dropped. That protection is ours and it runs on every submission. It does not make it acceptable to send us a credential, a private key, or a customer's personal records, and it is not a reason to skip the configuration review above.

Tell us about material subject to handling restrictions. Where an analysis draws on intelligence marked as restricted under the Traffic Light Protocol, the service attaches the handling notice to the output, but it cannot enforce a restriction nobody has told it about.

7. Acceptable use

You may not:

• reverse engineer, decompile or disassemble the service, or attempt to derive its source code, models, prompts or methods, except where law does not allow this restriction;
• resell, sublicense or provide the service to a third party as your own, unless your agreement with us says you may;
• use the service to attack, probe or test a system you do not own or have written permission to test;
• attempt to reach another organisation's data, or to defeat the separation between organisations;
• submit material designed to manipulate the analysis or the model behind it into producing output that is not an answer to your incident;
• use automated means to extract the knowledge base or the guidance corpus in bulk.

8. Accounts and credentials

An API key is a credential and carries the permissions of the account it belongs to. Keeping keys secret is yours to do, and activity under your keys is treated as yours. Tell us promptly if a key is exposed and we will replace it.

A link to a completed analysis can be shared outside the console. That link is itself a credential: it expires, and it reaches exactly one analysis. Treat it as you would any other.

9. Limits

The service enforces limits, and they exist so that one caller cannot degrade the service for everybody:

• a submission carries at most 200 observables, and a larger one is capped rather than refused, with the number submitted reported back;
• some plans carry a maximum number of analyses per day;
• requests are rate limited;
• a request is closed by the hosting layer after 240 seconds. Where a first generation approaches that, the work still completes and the result appears in your history even though the waiting page reports a timeout.

We may change these limits. Where a change would reduce what your plan allows, we will tell you first.

10. Charges

There are two parts to what you pay. A one time subscription fee opens the account, and the account is then yours in perpetuity: there is no recurring licence fee and no renewal to miss. Usage is paid for separately with credit.

Credit is purchased in advance and then allocated by you to alert analysis and to behavioural analytics, and each spends only from its own allocation. Charges are drawn from credit you have already bought, so the billing document we produce is a statement of what was spent and not an invoice for payment.

When the allocation for alert analysis cannot cover an analysis, the service says so rather than performing work it cannot charge for. Depending on the balance it will either serve a reviewed answer from the knowledge base at that lower price, or refuse the request and name who to ask for more credit. We may extend an overdraft so that a response team is not cut off mid incident; an overdraft is a courtesy and not an entitlement.

Prices for your plan, and the one time fee, are those in your agreement with us. A charge already recorded is not repriced if rates change later. The subscription fee is not refundable once the account is open.

11. Availability

These terms carry no uptime commitment. The service runs in a single region with no standby deployment elsewhere, which covers the loss of an instance and not the loss of a region. Any availability target you require is a matter for a written agreement, and we will discuss one.

We may suspend the service to deal with a security problem, a legal requirement, or misuse under section 7. Where we can give notice we will.

12. Third parties we rely on

The service runs on Microsoft Azure. Guidance is generated with the assistance of a third party artificial intelligence provider, to which the submitted and sanitised incident context is sent. Email reaches us through an email provider. Those relationships are described in the privacy policy.

Threat intelligence comes from public and community sources, each named on the analysis that used it. Those sources are provided by their publishers on their own terms and we do not warrant their accuracy or completeness.

13. Intellectual property

The service, including its software, knowledge base, prompts and the guidance corpus, remains ours. Nothing in these terms transfers it to you. You get the right to use the service for your own security operations for as long as your account is in good standing.

The analysis produced for your incidents is yours to use inside your organisation, including in your own reports and records, without further permission from us.

Connectors we publish for security platforms are provided under the licence stated with each one.

14. Warranties and liability

The service is provided as it is. To the extent the law allows, we exclude implied warranties of merchantability, fitness for a particular purpose and non infringement.

We are not liable for indirect, incidental, special or consequential loss, for loss of profit, revenue, data or goodwill, or for any loss arising from a decision taken or not taken on the basis of guidance the service returned. Our total liability arising out of or in connection with the service is limited to the amount you paid us for it in the twelve months before the claim arose.

Nothing here excludes liability that cannot lawfully be excluded, including for fraud or for death or personal injury caused by negligence.

15. Term and termination

These terms apply while you hold an account. Either of us may end the relationship on notice as set out in your agreement, or at any time if there is no agreement in place. We may suspend or close an account for a serious or repeated breach of section 6 or section 7.

Because the account is perpetual, we will not close it for inactivity or for not buying further credit. An account with no credit simply cannot run a paid analysis until more is added.

When an account is closed, your data is removed from our systems. Ask before closure if you want an export, because removal is not reversible. Credit already spent is not refundable, and unspent credit is dealt with under your agreement.

16. Changes

We may change these terms when the service, our practices or our legal obligations change, and the date at the top will say when. Where a change is material we will say so on the website or in the service. Continuing to use the service after a change takes effect means you accept it.

17. Governing law

These terms are governed by the laws of Pakistan. The courts at Islamabad have exclusive jurisdiction over any dispute arising out of them.

18. Contact

Questions about these terms go to Meherzad Javed at meherzad.javed@neotelix.com.