Terms of Service

1. The agreement

These Terms of Service (the “Terms”) govern access to and use of the UMBREN service. They form an agreement between [Company legal name — to be completed], with its registered address at [Registered address — to be completed] (“UMBREN”, “we”, “us”), and the business that creates an organization on the Service or signs an order that refers to these Terms (the “Customer”, “you”).

The Service is offered to businesses. It is not offered to consumers. The person who accepts these Terms confirms that they have authority to bind the Customer.

If the Customer and UMBREN have signed a separate written agreement for the Service, that agreement takes precedence over these Terms wherever the two conflict.

2. Definitions

• Service. The UMBREN control plane, meaning the dashboard, the API, the verification agent and the documentation, and, where it has been activated for the Customer, the protection of Protected Endpoints.
• Customer Infrastructure. The servers, IP addresses and network services that the Customer registers with the Service.
• Origin. The address of Customer Infrastructure to which filtered traffic is delivered.
• Protected Endpoint. An address reserved on the network of an Upstream Provider that receives traffic for a registered service and forwards filtered traffic to the Origin.
• Upstream Provider. A third-party scrubbing network through which protection is delivered.
• Organization. The Customer's account on the Service. Members are the individuals the Customer admits to it.
• Plan. The subscription plan the Customer has selected, or the commercial terms of a signed order.

3. The Service

3.1 What the Service does

The Customer registers Customer Infrastructure by origin address, protocol and ports. After ownership has been verified and the conditions in section 3.3 are met, UMBREN provisions a Protected Endpoint with an Upstream Provider. Attack traffic is filtered on the Upstream Provider's network according to the mitigation policy the Customer has configured, and remaining traffic is forwarded to the Origin.

3.2 Staged availability

The control plane is available for evaluation. Protection of live traffic is activated for each customer individually, once Upstream Provider capacity for that customer has been confirmed. Creating an Organization, completing onboarding steps or subscribing to a Plan does not by itself oblige UMBREN to activate protection. Billing status alone never triggers provisioning.

[Treatment of fees paid where protection cannot be activated — to be completed]

3.3 Conditions for activation

Protection for an endpoint is activated only when all of the following hold at the moment of activation:

• ownership of the Customer Infrastructure has been verified;
• compatibility with a connected Upstream Provider and with the Customer's Plan has been established;
• Upstream Provider capacity has been confirmed by the reservation of an address;
• the Customer has confirmed that the Origin's firewall and routing accept filtered traffic;
• connection tests have passed;
• the Organization is active and its subscription is in good standing;
• a Member with activation rights has authorized the activation; and
• activation is available on the platform.

These conditions cannot be waived or overridden.

3.4 Evaluation features

The Service may offer a demo mode and, in evaluation environments, simulated providers. These are labelled as such. They show or use simulated data and provide no protection. An endpoint staged on a simulated provider is not a Protected Endpoint.

3.5 Planned features

Features described on the website or in the documentation as planned are not part of the Service until they are released. The Customer's decision to subscribe is not conditional on the delivery of any planned feature.

3.6 What the Service is not

UMBREN is not a VPN provider, a hosting provider or an operator of the Customer's services. UMBREN has no relationship with the Customer's own customers or end users, and does not handle their accounts, their keys or the contents of their communications.

4. Accounts and security

• The Customer must give accurate information when it creates an Organization and keep that information current.
• The Customer is responsible for everything done through its Organization, by its Members and with its API credentials, whether or not the Customer authorized it.
• The Customer must keep passwords, recovery codes, API credentials and webhook signing secrets confidential, and should enable two-factor authentication for every Member.
• The Customer must tell UMBREN without delay if it believes an account or credential has been compromised, at [Security contact email — to be completed].

5. Authorization to register infrastructure

5.1 The Customer's warranty

For every endpoint it registers, the Customer represents and warrants that it owns the Customer Infrastructure, or is authorized by its owner to register it with the Service and to direct its traffic through a Protected Endpoint.

5.2 Ownership verification

The Customer must complete ownership verification before an endpoint can progress. Entering an address is never accepted as proof. Verification is carried out with the verification agent, or by a manual request that UMBREN reviews. UMBREN may reject a verification, ask for further evidence, or require ownership to be verified again at any time.

5.3 No third-party infrastructure

The Customer must not register, or attempt to register, infrastructure that belongs to a third party without that party's authorization. Statements and documents submitted for manual verification must be true, complete and current.

5.4 Changes in ownership

If the Customer stops owning, or stops being authorized to register, any Customer Infrastructure, for example because an address has been reassigned, it must deactivate the affected endpoint without delay.

6. The Customer's responsibilities

The Customer is responsible for:

• the accuracy of the origin address, protocol and ports it registers;
• configuring the Origin's firewall and routing so that filtered traffic is accepted;
• directing its users to the Protected Endpoint, and away from it when protection ends;
• the mitigation policies it configures, including any effect those policies have on legitimate traffic, and the decision to enable automatic mitigation;
• operating, securing and backing up its own services;
• its relationship with its own customers and end users, and its compliance with the laws that apply to its services; and
• keeping its contact details and notification channels current, and securing the systems that receive its webhooks.

7. Acceptable use

The Customer must comply with the Acceptable Use Policy, which forms part of these Terms.

8. Upstream Providers

Protection is delivered through Upstream Providers. Traffic addressed to a Protected Endpoint passes through the network of the Upstream Provider that serves it. UMBREN's control plane does not carry Customer traffic.

The regions and capabilities available to the Customer depend on the Upstream Providers that are connected at the time. UMBREN may change the Upstream Provider that serves an endpoint. [Notice and consent requirements for a change of Upstream Provider — to be completed]

9. Fees and payment

• The fees for a Plan are those shown on the pricing page when the Customer subscribes, or those stated in a signed order.
• Payments are handled by a third-party payment processor. The Customer authorizes the charges that its Plan requires.
• Fees are exclusive of taxes unless stated otherwise. The Customer is responsible for the taxes that apply to its purchase.
• If a payment fails, UMBREN will notify the Customer and may suspend the Service under section 10 if the failure is not remedied.
• [Billing period, renewal, price changes and refunds — to be completed]

10. Suspension

UMBREN may place an administrative hold on an endpoint or on an Organization if:

• the Customer breaches, or UMBREN reasonably suspects that it has breached, the Acceptable Use Policy;
• there is reasonable doubt that the Customer owns or is authorized to register the Customer Infrastructure;
• the Customer's use threatens the security, integrity or availability of the Service, an Upstream Provider or another customer;
• an Upstream Provider, a court or a competent authority requires it, or the law does;
• fees remain unpaid after notice.

UMBREN will give notice of a hold, and the reason for it, where that is practicable and lawful. While a hold is in place, traffic to the affected Protected Endpoints may no longer be filtered or delivered.

When a hold is lifted, an endpoint returns to an earlier stage of onboarding. An endpoint that was active does not resume automatically. A Member with activation rights must authorize it again. Actions taken by UMBREN staff on an Organization are recorded in that Organization's audit log.

11. Term and termination

• These Terms apply from the date the Customer accepts them until they are terminated.
• The Customer may cancel its subscription. [Cancellation procedure and notice period — to be completed]
• Either party may terminate these Terms if the other commits a material breach and does not remedy it within [Cure period — to be completed] of written notice.
• UMBREN may terminate with immediate effect for a serious breach of the Acceptable Use Policy, including launching or facilitating attacks, registering infrastructure without authorization, or submitting false verification evidence.

On termination, protection is withdrawn and the reservations held with Upstream Providers are released. The Customer is responsible for directing its users back to its own infrastructure before termination takes effect. Customer data is then handled as described in the Privacy Policy. [Data return, retention and deletion after termination — to be completed]

12. Data protection

The Privacy Policy describes the personal data UMBREN processes and why. In operating the Service UMBREN processes account data, the configuration the Customer provides, telemetry about traffic to Protected Endpoints, and audit records of sensitive actions.

Where UMBREN processes personal data on behalf of the Customer, the parties will enter into a data processing agreement. [Data processing agreement — to be completed]

13. Confidentiality

Each party will keep confidential the non-public information it receives from the other in connection with the Service, use it only to perform or receive the Service, and protect it with at least reasonable care. This does not apply to information that is or becomes public without breach, that the recipient already held or independently developed, or that the recipient is required by law to disclose. Origin addresses and the configuration of Customer Infrastructure are the Customer's confidential information.

14. Intellectual property

• UMBREN and its licensors own the Service. For the duration of these Terms the Customer has a limited, non-exclusive, non-transferable right to use the Service for its own business purposes.
• The verification agent is licensed only for verifying ownership of Customer Infrastructure, on servers the Customer owns or is authorized to administer.
• The Customer owns its data and its configuration. UMBREN uses them only to provide, secure and support the Service.
• If the Customer gives feedback about the Service, UMBREN may use it without restriction or payment.
• Neither party will use the other's name or marks in publicity, or identify the other as a customer or supplier, without consent.

15. Service levels and disclaimers

No service level commitment applies unless a signed written agreement between the Customer and UMBREN states one. UMBREN does not publish capacity, coverage, latency or availability figures, and nothing on the website or in the documentation is a commitment of that kind.

DDoS mitigation reduces risk. It does not remove it. UMBREN does not warrant that the Service will detect or mitigate every attack, that mitigation will never affect legitimate traffic, or that the Service will be uninterrupted or free of error.

[Warranty disclaimer wording appropriate to the governing law — to be completed]

16. Limitation of liability

[Limitation of liability — to be completed by counsel: the cap on each party's total liability, the exclusion of indirect and consequential loss, and the liabilities that cannot be limited under the governing law]

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited.

17. Indemnity

The Customer will defend UMBREN against third-party claims, and pay the resulting losses and costs, to the extent a claim arises from:

• the registration of infrastructure the Customer did not own and was not authorized to register;
• a breach of the Acceptable Use Policy; or
• the Customer's own services, content, customers or end users.

[Indemnity scope, procedure and any indemnity given by UMBREN — to be completed]

18. Changes

UMBREN may change the Service as it develops. UMBREN may also change these Terms. The current version is published on this page. [Notice period for material changes and the Customer's rights on a change — to be completed]

19. Governing law and disputes

These Terms are governed by [Governing law — to be completed]. Disputes arising from them are subject to [Courts or dispute resolution forum — to be completed].

20. General

• Entire agreement. These Terms, the Acceptable Use Policy and any signed order are the whole agreement about the Service and replace earlier discussions about it.
• Assignment. Neither party may assign these Terms without the other's consent, except to a successor to its business. [Assignment terms — to be confirmed]
• Events outside reasonable control. Neither party is liable for a failure caused by events outside its reasonable control. [Force majeure scope, including failures of third-party networks — to be completed]
• Severability and waiver. If a provision is unenforceable the rest remains in effect. A failure to enforce a provision is not a waiver of it.
• Trade controls. The Customer must not use the Service in breach of applicable export control or sanctions law. [Sanctions and export control wording — to be completed]
• Notices. UMBREN gives notice to the Customer by email to the owners of the Organization. The Customer gives legal notice to UMBREN at [Contact email for legal notices — to be completed] and at [Registered address — to be completed].

21. Contact

Questions about these Terms can be sent through the contact page. Legal notices must be sent to the address in section 20.