Terms of Service

Last updated: 24 March 2026

1. Agreement to Terms

These Terms of Service ("Terms") govern your access to and use of the How's My Cyber platform ("HMC", "the Platform", "the Service"), operated by How's My Cyber Pty Ltd (ABN pending) ("we", "us", "our"). By creating an account or using the Service, you agree to be bound by these Terms. If you do not agree, do not use the Service.

2. Description of Service

HMC is a multi-tenant software-as-a-service (SaaS) cybersecurity management platform. The Service provides:

  • Cybersecurity posture assessment using the IDIA framework (Identity, Data, Infrastructure, Assurance)
  • Risk register and governance management
  • AI-assisted email threat analysis (PhishSee)
  • Domain, DNS, and certificate monitoring
  • Threat intelligence aggregation and analysis
  • Incident response management
  • Policy and compliance management
  • Security awareness training
  • Third-party vendor risk management
  • Reporting and benchmarking tools

3. Accounts and Registration

You must provide accurate and complete information when creating an account. You are responsible for maintaining the confidentiality of your login credentials and for all activities under your account. Each account is associated with a single tenant organisation. You must notify us immediately of any unauthorised use of your account.

4. Subscription Plans and Billing

The Service is offered under tiered subscription plans (Free, Starter, Professional, Enterprise). Each plan provides access to specific modules and features as described on our pricing page.

  • Paid subscriptions are billed monthly in advance via Stripe.
  • Prices are in USD and exclude applicable taxes.
  • We may offer free trials. At trial expiry, access to trial-only modules will revert to your base plan level.
  • We reserve the right to change pricing with 30 days' notice. Price changes do not apply to the current billing period.
  • You may cancel your subscription at any time. Cancellation takes effect at the end of the current billing period.
  • Refunds are not provided for partial billing periods.

5. Credit System

Certain features (including PhishSee email analysis, malware analysis, and scanning operations) consume credits. Credits are included with your subscription plan and may also be purchased separately. Unused purchased credits do not expire. Plan-included credits reset monthly and do not carry over.

6. Acceptable Use

You agree not to:

  • Use the Service for any unlawful purpose or to violate any applicable laws or regulations
  • Attempt to gain unauthorised access to other tenants' data or systems
  • Submit malicious content designed to attack or compromise the Platform
  • Use PhishSee or malware analysis features to process emails or files you do not have authority to analyse
  • Use the Red Team Engine or scanning tools against systems you do not own or have explicit written authorisation to test
  • Circumvent rate limits, access controls, or module gating mechanisms
  • Resell, redistribute, or sublicense access to the Service without our written consent
  • Interfere with or disrupt the Service or its underlying infrastructure
  • Reverse engineer, decompile, or disassemble any part of the Service

7. AI-Powered Features

The Service uses artificial intelligence and large language models for analysis, recommendations, and threat detection (including but not limited to PhishSee, AI Coach, AI Agents, and threat intelligence enrichment). You acknowledge and agree that:

  • AI outputs are advisory in nature and should not be relied upon as the sole basis for security decisions
  • AI analysis may produce inaccurate, incomplete, or misleading results
  • You are responsible for verifying AI-generated findings, recommendations, and classifications before acting on them
  • AI-generated content (such as policy drafts, risk assessments, or task descriptions) should be reviewed and edited by qualified personnel before adoption
  • We do not guarantee the accuracy, completeness, or fitness for purpose of any AI output

8. Data Ownership and Intellectual Property

You retain all rights to the data you submit to the Service ("Your Data"). You grant us a limited, non-exclusive licence to process Your Data solely to provide the Service. We do not use Your Data to train AI models or share it with third parties except as necessary to operate the Service (e.g., sending data to AI providers for analysis with appropriate data processing agreements in place).

The Platform, including its design, code, IDIA framework implementation, and documentation, is our intellectual property and is protected by applicable copyright and intellectual property laws.

9. Security and Tenant Isolation

The Platform employs multi-tenant architecture with strict data isolation between tenants. We implement reasonable security measures including encryption in transit and at rest, access controls, audit logging, and session management. However, no system is completely secure, and we cannot guarantee absolute security.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

  • THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
  • WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.
  • WE ARE NOT LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF DATA, LOSS OF PROFITS, BUSINESS INTERRUPTION, OR SECURITY BREACHES ARISING FROM USE OF THE SERVICE.
  • OUR TOTAL AGGREGATE LIABILITY FOR ANY CLAIMS ARISING FROM OR RELATED TO THE SERVICE SHALL NOT EXCEED THE AMOUNT YOU PAID US IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.
  • WE ARE NOT RESPONSIBLE FOR SECURITY INCIDENTS, DATA BREACHES, OR CYBER ATTACKS THAT OCCUR DESPITE THE USE OF THE SERVICE. THE SERVICE IS A MANAGEMENT AND ASSESSMENT TOOL, NOT A GUARANTEE OF SECURITY.

11. Indemnification

You agree to indemnify, defend, and hold harmless How's My Cyber Pty Ltd and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or related to: (a) your use of the Service; (b) your violation of these Terms; (c) your violation of any third party rights; or (d) your use of AI-generated outputs without appropriate verification.

12. Third-Party Services

The Service integrates with third-party services including Stripe (payments), Microsoft Azure AD (SSO), threat intelligence feeds, DNS providers, AI model providers, and analytics services (Google Analytics and Microsoft Clarity). We are not responsible for the availability, accuracy, or security of third-party services. Your use of third-party integrations is subject to those services' respective terms and conditions. For details on analytics data collection, see our Privacy Policy.

13. Termination

We may suspend or terminate your access to the Service at any time for violation of these Terms or for any other reason at our discretion, with or without notice. Upon termination, your right to use the Service ceases immediately. You may export Your Data before termination. We will retain Your Data for 30 days following termination, after which it will be permanently deleted.

14. Modifications to Terms

We may update these Terms from time to time. We will notify you of material changes via email or in-app notification at least 14 days before they take effect. Your continued use of the Service after changes become effective constitutes acceptance of the modified Terms.

15. Governing Law

These Terms are governed by and construed in accordance with the laws of Australia. Any disputes arising under these Terms shall be subject to the exclusive jurisdiction of the courts of Australia.

16. Contact

If you have questions about these Terms, please contact us at [email protected].