Terms of Service

Seraph CTI (formerly PhishGuard) is operated by Seraph Cyber Limited, a company registered in Kenya ([TO CONFIRM: registration number and registered office]), whose address is Enwealth Business Centre, Ngong Lane, Nairobi, and whose KRA PIN is P052424601Q. “We” and “us” mean Seraph Cyber. “You” means the organization that signed up, not the individual who filled in the form.

By creating an account you confirm you are authorised to enter into this agreement for that organization.

Seraph CTI is a security awareness platform: simulated phishing campaigns, training assigned from their outcomes, a report button for your mailboxes, and threat intelligence and breach-exposure monitoring on the packages that include them. Which modules your package includes is shown on the pricing page and enforced by the platform.

We may change how a feature works, and we may add or remove features. If we remove something material from a package you are paying for, we will tell you before it happens and you may cancel under clause 9 without penalty.

You are responsible for who you give access to, for keeping credentials safe, and for everything done under your account. Enable multi-factor authentication; the platform supports it and, on the packages that include it, your own single sign-on.

You will load the details of the staff you want to protect. Those people are your employees, not our customers, and how we handle their data is set out in the Privacy Notice and the Data Processing Addendum. You confirm you have a lawful basis for putting them on the platform and for running simulations against them.

The product sends deceptive email on purpose. That makes the boundary important, and it is simple: you may run simulations only against people your organization employs or engages, on domains you control. You may not use Seraph CTI to target anyone else, to send real phishing, to harvest credentials for any purpose other than measuring your own staff’s response, or to test any system you are not authorised to test.

We may suspend an account immediately, without the notice period in clause 10, if we believe it is being used this way. That is the one case where we act before we discuss.

You are billed per seat — a member of staff in scope, not a login account. You may create as many administrator logins as least privilege calls for; they are not charged.

A seat count is measured at the close of each billing period, counting distinct staff who were not archived. Somebody who leaves and is archived stops being billed from the following period. Staff added mid-period are prorated from the day they were added, never backdated.

Where your package has a minimum billable quantity, that is the smallest number of seats it will bill, whatever your headcount. It is shown on the pricing page, in the seat calculator and on the signup form before you commit, and it appears as a single line on the invoice rather than as an adjustment.

If your headcount grows past what you committed to, we absorb the overage while it stays within 10% of the commitment. Beyond that, the excess is billed at your rate. We would rather absorb four hires than renegotiate over them.

Prices are in US dollars and are exclusive of VAT. VAT is added at the rate in force when the invoice is raised, currently 16%, and is shown as its own line. Where an invoice in dollars carries VAT reportable in shillings, the exchange rate used is recorded on the invoice and does not change afterwards.

The KRA eTIMS tax invoice for a supply is issued separately from the invoice we send you. Both describe the same supply and the same VAT.

We may change published prices. A change does not affect an invoice already issued, and where you are on a twelve-month commitment it does not affect your rate for the remainder of that term.

Unless we have agreed otherwise in writing, invoices are raised monthly in arrears: a period closes, your usage is measured, and an invoice for that period is issued. Payment is due within 30 days of issue unless the invoice says otherwise.

Some packages are sold pay-first. On those, an invoice for the remainder of the current month is raised when you sign up and the account is activated when it settles.

A twelve-month commitment buys a lower per-seat rate. It is a commitment to the term, not a change to the invoice cadence: you are still invoiced monthly.

You may pay by bank transfer, by M-Pesa, or by card. Payment details are on every invoice.

We will remind you before an invoice falls due, on the day, and then at 7, 14 and 30 days past due. These are automatic and go to the billing contact you give us.

If a balance stays unpaid, the account moves to a restricted state and, after a further grace period, to read-only. Read-only means exactly that: you keep access to your data and can export all of it. We do not delete anything for non-payment, and we do not hold your compliance records hostage. Access returns as soon as the balance clears.

On a monthly agreement you may cancel at any time, with effect from the end of the current billing period. You will be invoiced for that period; there is no charge after it.

On a twelve-month commitment, cancellation takes effect at the end of the term unless we agree otherwise. The lower rate is what the commitment paid for.

We do not refund periods already invoiced. Where we have got something wrong, the correction is a credit note against the invoice rather than an edit to it.

Either side may end this agreement on 30 days’ written notice. We may end it immediately for the misuse described in clause 4, or for non-payment that persists well beyond the ladder in clause 8.

When it ends, your data remains available for export for 30 days. After that it is purged. Ask us before that window closes and we will help you get it out.

We aim to keep Seraph CTI available continuously and we publish a status page. We do not currently offer a contractual uptime guarantee ([TO CONFIRM: whether an SLA is offered, and at what tier]). Planned maintenance is announced in advance where it will be noticeable.

You own your data — your staff records, campaign results, training outcomes and reports. We own the platform, the templates we supply, and the threat intelligence we produce.

Reports your staff submit through the report button contribute to a regional threat picture shared with other customers. What is shared is the threat — the lure, the infrastructure, the technique — never your organization’s identity and never the personal data of the person who reported it.

Each side will keep the other’s confidential information confidential and use it only for this agreement. Your security posture, your click rates and your incident data are confidential; so are our prices where they were negotiated rather than published.

Seraph CTI measures and improves how your staff respond to attack. It is not a control that prevents one, and it does not make you secure by itself.

Neither side excludes liability for fraud, for death or personal injury caused by negligence, or for anything else that cannot lawfully be excluded. Subject to that, and to the extent the law allows, neither side is liable for indirect or consequential loss, and each side’s total liability is limited to the fees paid or payable in the twelve months before the claim.

We may update these terms. Each version carries a version number and an effective date at the top of this page. If a change materially reduces what you get or increases what you owe, we will tell the billing contact at least 30 days beforehand, and you may cancel under clause 9 if you do not accept it.

This agreement is governed by the laws of Kenya, and the courts of Kenya have jurisdiction ([TO CONFIRM: governing-law and dispute-resolution wording preferred by counsel]). Before either side goes to court, we will both try to sort it out by talking.