Terms of Service, Delivery & Cancellation

Oksa Security provides an external attack surface management (ASM) platform ("Service"). The Service continuously monitors the publicly visible digital perimeter of the domains you register, including subdomains, open network ports, TLS certificates, DNS security records, public cloud storage, and public source code repositories.

The Service uses read-only checks of publicly accessible sources and endpoints. Checks include network connections and HTTP requests to authorised targets; they are not limited to observing existing traffic. We collect publicly accessible technical observations. We do not attempt authentication, exploit vulnerabilities, execute payloads, or modify any customer or third-party systems.

The Service is a monitoring and awareness tool. It identifies publicly visible indicators that may represent security risk. The Service does not guarantee that your systems are secure, that all vulnerabilities will be detected, or that your organisation will not experience a security incident, data breach, or cyberattack.

Factors outside the scope of the Service include, but are not limited to:

• Internal networks, authenticated services, or systems not visible from the public internet.
• Zero-day vulnerabilities and novel attack techniques.
• Social engineering, phishing, and insider threats.
• Third-party services, supply chain vulnerabilities, and partner infrastructure.
• Application-layer vulnerabilities that require authenticated access to identify.
• Findings that arise between scheduled scans.

The Customer is responsible for evaluating findings in the context of its own environment, selecting and prioritising remediation, and implementing and testing changes to its systems. Findings support decision-making and are not instructions to make changes without the Customer's own assessment. The Customer is responsible for checking the effects of its chosen changes, including effects on availability and business operations. Use of the Service does not relieve the Customer of any security obligations under law, regulation, or contract.

To the maximum extent permitted by applicable law, Oksa Security shall not be liable for any direct, indirect, incidental, special, consequential, or exemplary damages, including but not limited to:

• Any security incident, cyberattack, data breach, or ransomware event affecting the Customer's systems, regardless of whether the Customer was using the Service at the time.
• Loss of data, revenue, profits, goodwill, or business opportunity.
• Regulatory fines, penalties, or third-party claims arising from a security incident.
• Damages resulting from the Customer's failure to act on findings reported by the Service.
• Damages resulting from findings not detected by the Service.

This limitation applies regardless of the theory of liability (contract, tort, negligence, strict liability, or otherwise) and even if Oksa Security has been advised of the possibility of such damages.

Where liability cannot be excluded by law, Oksa Security's total aggregate liability for all claims under or related to this agreement shall not exceed the total subscription fees paid by the Customer in the three (3) months immediately preceding the event giving rise to the claim.

This allocation of decision-making and implementation responsibilities does not transfer responsibility for Oksa Security's own acts, omissions or contractual obligations to the Customer. It does not exclude liability that cannot lawfully be excluded.

The Customer agrees to:

• Register only domains and assets that the Customer owns or has explicit written authorisation to monitor.
• Review findings and take appropriate remediation action in a timely manner.
• Maintain the confidentiality of login credentials and notify Oksa Security immediately upon suspected unauthorised access.
• Not use the Service to monitor third-party domains without authorisation.
• Comply with all applicable laws and regulations, including the NIS2 Directive, GDPR, and applicable Finnish law.

Subject to payment of the applicable subscription fee and compliance with these Terms, Oksa Security grants the Customer a non-exclusive, non-transferable, revocable license to access and use the Service solely for the Customer's internal security monitoring purposes during the subscription period.

The Customer may not sub-license, resell, or provide access to the Service to third parties without prior written consent from Oksa Security.

Prices are final amounts in euros. Simal Oy is not VAT-registered and does not charge VAT under the small-business exemption (Finnish Value Added Tax Act, section 3). No deductible VAT is included in the price.

• Subscriptions are billed in advance for each monthly or annual billing period. For an automatic renewal, the next period's payment is requested three days before the current paid period ends. Payment secures the next period, which follows the already-paid period.
• Annual renewal reminders are scheduled 14 days before the charge. An annual charge requires a reminder sent at least 7 and no more than 30 days beforehand. Monthly renewals require at least 3 full days of notice. If a reminder is delayed, the charge is postponed; the already-paid access period is not extended by the reminder.
• The subscription fee is as displayed at the time of purchase and may be updated with 30 days' advance notice.
• Subscription activation and automatic renewal use payment cards through Paytrail. The cards available for your transaction are displayed in Paytrail's checkout. With your consent, Paytrail stores the card for future automatic renewals; Oksa Security receives a card token, not your full card details. Separate one-off payments, such as package upgrades, use the payment methods offered in the Paytrail checkout for that transaction.
• You may cancel automatic renewal at any time in account settings. Cancellation stops future renewal attempts immediately, while access continues until the end of the already paid period. Cancellation does not automatically refund an already-paid period. Contact support about an incorrect charge or a refund request; this does not limit rights that cannot be excluded by applicable law.
• A higher package on the same billing cycle starts after successful payment of the price difference multiplied by the fraction of your paid period remaining at the quoted time, rounded to cents. The paid period does not restart. Review and accept the quoted amount and future recurring price before payment.
• Lower packages and changes between monthly and annual billing start at the end of the already-paid period, subject to successful payment for the next period. Scheduling a change does not itself charge a payment or refund the current period. The next period may be charged three days before it starts; your existing package remains available until its paid period ends.
• Before scheduling a lower domain limit, reduce monitored domains to that limit. The scheduled limit also applies to new domain additions. A plan change does not delete historical findings. You may cancel a scheduled change before payment processing locks it. Payments already submitted or made are resolved through support, not charged again automatically.
• A change in renewal price or billing cycle requires a new reminder. The minimum notice period may postpone payment and cause a gap in access after the paid period ends. A failed or unresolved upgrade payment does not grant the upgraded package.
• If a renewal payment fails, the next period is not activated until payment succeeds. Service access continues through the end of the already paid period.

The Service is delivered electronically through your Oksa Security account. There is no physical shipment and no separate delivery fee. Paid access is normally activated automatically when we receive and validate the payment confirmation from Paytrail. A pending or failed payment does not activate paid access.

After activation, sign in and add and verify your authorised domain to begin monitoring. Monitoring follows the selected package's schedule. Payment confirmation and domain verification may take time; if payment was successful but access remains unavailable, contact support@oksasecurity.com before starting another payment.

These subscriptions are sold only to businesses for business use. Automatic renewal can be cancelled in Settings → Plan. Paid access continues until the end of the paid period. Cancellation or a scheduled downgrade does not automatically refund the current period.

For an incorrect or duplicate charge, a service delivery problem, or another refund request, email support@oksasecurity.com with your company name, payment reference, payment date and a description of the issue. Do not send full card details, security codes or passwords. We review the payment and service records and respond with the outcome and any next steps. This policy does not exclude rights that cannot be limited by applicable law.

Approved refunds are processed through the payment provider to the original payment method. If that method can no longer receive a refund, we follow Paytrail's secure alternative procedure. We confirm when a refund has been initiated; the time until it appears depends on the payment method and bank. Requesting a refund or closing an account does not itself initiate a refund.

Paytrail Plc acts as a collecting payment service provider and is an authorized payment institution. Paytrail Plc will be shown as the recipient on your bank or credit card statement. Paytrail Plc will forward the payment to the merchant. For complaints, please contact the website where the payment was made.

Paytrail Plc
Innova 2
Lutakonaukio 7
40100 Jyväskylä
Phone: +358 207 181 830
Business ID 2122839-7
Paytrail — information about paying

These are the payment provider's contact details. Questions about your Oksa Security subscription, service or refund request should be sent to Simal Oy at support@oksasecurity.com.

All software, algorithms, data models, and visual designs comprising the Service are the exclusive property of Oksa Security. Nothing in these Terms transfers any intellectual property rights to the Customer.

Scan results generated from the Customer's registered domains are owned by the Customer. Oksa Security may use aggregated, anonymised findings to improve the Service.

Processing of personal data related to your use of the Service is governed by our Privacy Policy. Where Simal Oy processes personal data on your organisation's behalf, a separate Data Processing Agreement must be agreed before that processing begins. Contact us to arrange it; this privacy notice and these service terms do not replace that agreement.

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND. OKSA SECURITY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

OKSA SECURITY DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT ALL SECURITY FINDINGS AFFECTING THE CUSTOMER'S ASSETS WILL BE IDENTIFIED.

The Customer agrees to indemnify, defend, and hold harmless Oksa Security from any claims, losses, damages, liabilities, costs, and expenses (including reasonable legal fees) arising from: (a) the Customer's use of the Service in violation of these Terms; (b) the Customer's monitoring of domains without authorisation; or (c) any breach by the Customer of applicable law.

These Terms are governed by the laws of Finland. Any dispute arising from or related to these Terms that cannot be resolved amicably shall be submitted to the exclusive jurisdiction of the Helsinki District Court (Helsingin käräjäoikeus).

Oksa Security may update these Terms from time to time. Material changes will be notified by email at least 30 days in advance. Continued use of the Service after the effective date constitutes acceptance of the updated Terms. If you do not accept updated Terms, you may cancel your subscription before the effective date.

Questions regarding these Terms: use our contact form or email support@oksasecurity.com