legal

Terms of Service

Last updated: 2026-08-16. Governing law: Israel.

Terms of Service / End-User License Agreement (EULA) & Subscription Terms

These Terms of Service ("Terms") govern your access to and use of the EyalSec / es2 software-as-a-service platform, the web dashboard, the agent API, and the EyalSec agents (collectively, the "Service").

They form a binding agreement between you ("Customer", "you") and Eyal Gabay, an individual trading as "EyalSec", a sole proprietor (osek murshe) registered in Israel under registration number 211868450, of Yehoshua Stampfer 39, Petah Tikva, Israel ("EyalSec", "we", "us").

By creating an account, clicking "I agree", installing or running any Agent, or otherwise using the Service, you accept these Terms. If you are entering into these Terms on behalf of an organization, you represent that you have authority to bind that organization, and "you" means that organization.

1. Definitions

2. The Service and the Agents

The Service observes what a program you run actually does, and reports it to you. An Agent runs inside your own environment, on machines you own or are authorized to monitor, and sends Events to your dashboard. The Service is a monitoring and reporting aid. It is not a security guarantee, a firewall, an antivirus product, a compliance certification, or a substitute for a secure development lifecycle. See Section 11.

3. License grant and restrictions

Subject to your compliance with these Terms and payment of applicable fees, EyalSec grants you a non-exclusive, non-transferable, non-sublicensable, revocable license, for the term of your Subscription, to:

(a) access and use the hosted Service; and

(b) download, install and run the Agents on machines, browsers and services you own or are lawfully authorized to monitor (Sections 6 and 7), solely for your internal security-monitoring purposes.

This is a license to use, not a sale. EyalSec and its licensors retain all right, title and interest in and to the Service and the Agents, including all intellectual property rights. Open-source components within the Agents are licensed under their own terms; see /legal/licenses. Nothing in this Section restricts your rights under those open-source licenses, and where an open-source license grants you a right that this Section would restrict, that license prevails for that component.

Except as permitted by applicable mandatory law or an applicable open-source license, you may not:

4. Accounts and security

You must provide accurate registration information and keep your credentials confidential. You are responsible for all activity under your account, including activity of users you authorize and of any Agent running under a credential issued to you. Notify us promptly at eyal@eyalsec.com of any unauthorized use or suspected credential compromise. We offer two-factor authentication and API keys; you are responsible for enabling and safeguarding them.

5. Acceptable use

Your use of the Service is subject to the AUP (/legal/aup), which is part of these Terms. In summary: you must run the Agents only on systems you own or are authorized to monitor, must not use the Service to surveil third parties or attack third-party systems without authorization, and must comply with export-control and sanctions laws. We may suspend or terminate access for AUP violations (Section 16).

6. Customer responsibilities

You acknowledge and agree that:

(a) Authorization. You must own, or be lawfully authorized to monitor, every machine, browser, account and service on which you install or run an Agent. You are responsible for obtaining all authorizations required before installing an Agent.

(b) The Agents capture runtime data. To do their job, the Agents inspect runtime values in the monitored program. Event Payloads can therefore contain personal data and secrets (for example passwords, tokens, keys, or other sensitive values) drawn from your process memory. You are responsible for what you choose to monitor and for the lawful basis on which you do so. Where Event Payloads contain personal data, EyalSec acts as your data processor and the DPA applies; you are the controller.

(c) Configuration and minimization. You are responsible for configuring monitoring (including any taint, fuzzing, or code-load detection settings), filters, retention and suppression to your needs, and for minimizing the capture of unnecessary sensitive data. Configuration controls are provided in the dashboard; using them is your decision, not ours.

(d) Your own environment. You are responsible for the security, availability, backup and lawful operation of the systems on which you run an Agent, for testing an Agent in a non-production environment before deploying it to production, and for the consequences of any change in your environment's behavior after an Agent is installed.

(e) Lawful use. Your use of the Service must comply with all applicable laws, including data-protection, employment and workplace-monitoring, wiretap and interception, communications-privacy, computer-misuse, and export-control laws.

This Section is a material term. Read it before you deploy es-chromium.

es-chromium reports Browsing Data: the pages visited on the machines you monitor, values present in those pages, and related context. Depending on where you and your End Users are, deploying it may be regulated as employee monitoring, as interception of communications, or as processing of personal data, and may require notice, consent, a formal assessment, or consultation with an employee representative body before you begin.

You represent, warrant and covenant, on a continuing basis, that:

(a) Authorized deployments only. You deploy es-chromium only on browsers, profiles, devices and accounts that you own or administer, or that you are expressly and lawfully authorized to monitor.

(b) Notice and consent. Before monitoring begins, you have given every affected End User all notice required by applicable law, and have obtained every consent, authorization or permission required by applicable law, including where required:

(c) No covert or personal-device monitoring. You do not use es-chromium to monitor an End User covertly where the law requires that the monitoring be disclosed, and you do not deploy it on a personal or bring-your-own device without the device owner's informed consent.

(d) No consumer deployment. You do not distribute es-chromium to consumers or to the general public, and you do not deploy it on browsers used for the personal purposes of individuals outside your organization.

(e) You decide, we do not. EyalSec does not select what you monitor, does not determine whether your monitoring is lawful, and gives no advice on whether it is. Any description in our documentation of how monitoring may be configured is technical information, not legal advice, and is not a representation that a given deployment is lawful in your jurisdiction.

Your obligations under this Section are conditions of your license. A deployment that breaches this Section is outside the license granted in Section 3, is a material breach of these Terms, and is indemnified by you without limitation under Section 13.

8. Customer Data and privacy

As between the parties, you own your Customer Data. You grant us a limited, worldwide, non-exclusive license to host, process, transmit and display Customer Data solely to provide, secure and support the Service and to comply with law. Our handling of personal data is described in the Privacy Policy (/legal/privacy) and, for data we process on your behalf, the DPA (/legal/dpa). Sub-processors are listed at /legal/subprocessors. Our security measures are described at /legal/security.

We do not use Customer Data to develop, train or improve any product other than in the form of Aggregate Data as defined in Section 20.

9. Agent versions, updates and end of support

(a) You must run a current version. We publish updates to the Agents. You are responsible for installing the current published version of each Agent you run, promptly after we make it available. The dashboard indicates when a machine is running a superseded build.

(b) No support for superseded versions. We have no obligation to support, maintain, diagnose, or provide fixes (including security fixes) for any version of an Agent other than the current published version, and we may cease supporting a version, a platform, or an Agent entirely on reasonable notice.

(c) Known defects. Software of this kind carries defects. We may publish known issues for a given release; where we do, you are responsible for reading them before deploying that release and for deciding whether the release is appropriate for your environment.

(d) Vulnerability handling. We operate a coordinated vulnerability disclosure policy at /legal/vulnerability-disclosure. Report suspected vulnerabilities to security@eyalsec.com.

10. Third-party content, third-party software and browser-specific terms

(a) es-chromium is an instrument, not a consumer browser. es-chromium is supplied for security monitoring and testing on managed systems, by technical users, in environments you control. We do not warrant that it is suitable for general-purpose web browsing, for handling untrusted or high-risk web content, or for use by consumers, and we do not warrant that it offers the same hardening, update cadence, defensive posture or feature set as a mainstream consumer browser. You must not deploy it as the default or primary browser for general-purpose browsing, and you must run only the current published version (Section 9).

(b) es-solidity produces development builds only. A contract compiled with es-solidity is instrumented for testing: its gas costs and code hash differ from your production build. Never deploy an es-solidity build to a public network. You are solely responsible for ensuring that no artifact produced by es-solidity is deployed to any public or production network, and for any loss, of funds or otherwise, arising if one is. This restriction is a condition of your license to use es-solidity, and a breach of it is indemnified by you under Section 13.

(c) Configuration determines whether an Agent reports at all. Some Agents report nothing unless the monitored project is configured for them, and an Agent that is reporting nothing looks exactly like an Agent that has found nothing. An empty result is not a finding of safety. You are responsible for configuring each Agent as our documentation describes and for verifying that it is actually reporting before you rely on its output. See Section 11.

(d) Third-party content. Web content, browser extensions, packages, dependencies and external services reached through or analyzed by an Agent are third-party materials. We do not control them, do not endorse them, are not responsible for them, and give no warranty about them or about the accuracy of any analysis of them. Any report an Agent produces about a third-party component (including any extension audit) is an automated observation, not a certification, an accusation, or a statement of fact about that third party, and you are responsible for how you act on or repeat it.

(e) Open-source components. The Service and the Agents include open-source software licensed by third parties, listed at /legal/licenses. Those components are provided by their licensors under their own terms and, in most cases, without warranty. Nothing in these Terms adds a warranty or an indemnity from EyalSec in respect of an open-source component beyond what these Terms provide for the Service as a whole.

11. Warranty disclaimer

THE SERVICE AND THE AGENTS ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, including any implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade, to the maximum extent permitted by applicable law.

Without limiting the foregoing, we do NOT warrant that the Service or any Agent will detect all vulnerabilities, all malicious inputs, all injections, all cross-site scripting or other browser-side flows, or all instances of untrusted data reaching dangerous operations; that any finding it reports is accurate, complete, exploitable or correctly graded; that it will identify, prevent, block or remediate any security incident; or that it will secure any system. Findings may be incomplete, may be false positives, may be suppressed, and may be absent entirely for a flow the Agent cannot observe. You remain solely responsible for the security of your systems and data, and for any decision you take on the basis of a finding or the absence of one.

We do not warrant that the Service will be uninterrupted, timely, secure or error-free, that defects will be corrected, or that the Service will meet your requirements. No service level, uptime commitment or support response time is offered under these Terms unless we have agreed one with you in a signed written order.

Some jurisdictions do not allow the exclusion of certain warranties; in those jurisdictions some of the above exclusions may not apply to you, and your statutory rights (Section 18) are unaffected.

12. Limitation of liability

To the maximum extent permitted by applicable law, EyalSec's total aggregate liability arising out of or related to these Terms or the Service, whether in contract, tort (including negligence), strict liability, statute, or otherwise, shall not exceed the total fees you actually paid to EyalSec for the Service in the twelve (12) months immediately preceding the first event giving rise to the claim.

To the maximum extent permitted by applicable law, EyalSec shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for loss of profits, revenue, anticipated savings, goodwill, reputation, data, or business, or for the cost of substitute services, or for any security incident, breach, intrusion, data loss or regulatory action that the Service did not detect, prevent or report, even if advised of the possibility of such damages and even if a limited remedy fails of its essential purpose.

Time limit. To the maximum extent permitted by applicable law, and except for claims for non-payment, any claim arising out of or related to these Terms must be brought within twelve (12) months after the claimant knew or should have known of the facts giving rise to it.

Carve-outs. The limitations and exclusions in this Section do not apply to, and nothing in these Terms excludes or limits liability for: (a) gross negligence; (b) willful misconduct; (c) fraud or fraudulent misrepresentation; (d) death or personal injury caused by negligence; (e) your obligations under Section 13 (Indemnification), Section 14 (Fees) or Section 19 (Trade compliance); or (f) any other liability that cannot lawfully be excluded or limited, including liability under Directive (EU) 2024/2853 on liability for defective products and its national implementations, and non-waivable consumer rights (Section 18).

Allocation of risk. You acknowledge that the fees for the Service reflect this allocation of risk, that the Service would not be offered on these terms without it, and that this Section survives termination.

13. Indemnification

You will defend, indemnify and hold harmless EyalSec, and Eyal Gabay personally, against any third-party claim, demand, action, investigation, regulatory proceeding or enforcement action, and against all resulting losses, damages, liabilities, fines, administrative penalties, awards, settlements and reasonable legal and professional fees, arising out of or relating to:

(a) your installation or operation of an Agent on any machine, browser, profile, account or service that you did not own or were not lawfully authorized to monitor;

(b) any failure by you to give a notice, obtain a consent or authorization, complete an employee-representative or works-council process, or carry out an assessment or prior consultation required by law before monitoring, including any failure to comply with Section 7;

(c) any claim by an End User, employee, contractor, customer, worker representative, regulator or supervisory authority arising from your monitoring, from Browsing Data, or from the content of an Event Payload;

(d) Customer Data, including any claim that it infringes or misappropriates the rights of a third party, or that it was collected, transferred, retained or processed unlawfully;

(e) your use of, or reliance on, an automated report about a third-party component, including any republication of it (Section 10(d));

(f) your breach of the AUP, of Section 3 (license restrictions), of Section 7 (monitoring, notice and consent), or of Section 19 (trade compliance and sanctions); or

(g) your use of the Service in violation of applicable law.

The liability cap and the exclusion of indirect damages in Section 12 do not apply to your obligations under this Section 13.

We will notify you of any claim for which we seek indemnity, allow you to control the defense (except that you may not settle in a way that imposes any obligation, admission or unindemnified liability on us without our written consent), and give you reasonable cooperation at your expense. We may participate in the defense with our own counsel at our own expense.

This Section 13 does not apply to you where you use the Service as a consumer (Section 18).

14. Fees, subscription, renewal, cancellation, and refunds

(a) Paid access only. The Service is offered on paid access only; there is no free tier and no free trial, and registering an account does not by itself grant access to the Service. Paid access is priced on a metered basis (for example, by the number of monitored machines and reported events) as quoted to you; there are no fixed plan tiers. Current pricing is shown at /pricing.

(b) Fees and taxes. You agree to pay the fees for your plan as quoted or displayed at purchase. Unless stated otherwise, fees are exclusive of taxes, including Israeli VAT and any applicable foreign taxes, duties and levies, which you are responsible for. If you are required by law to withhold any tax from a payment, you will gross up the payment so that we receive the amount we would have received without the withholding, and will provide the withholding certificate.

(c) Metering. Our measurement of your usage, as recorded by the Service, is the basis for metered fees and is conclusive absent manifest error. You must not interfere with metering (Section 3).

(d) Late payment. Undisputed amounts not paid when due may accrue interest at the lower of 1.5% per month or the maximum rate permitted by law, from the due date until paid, and we may suspend the Service under Section 16.

(e) Renewal. Paid subscriptions renew automatically for successive periods equal to the then-current term unless cancelled before the end of the current period. We will give notice of material price changes before they take effect.

(f) Cancellation. You may cancel at any time as described in the Refund & Cancellation Policy (/legal/refund); cancellation takes effect at the end of the current billing period. You may also delete your account and all associated data via Settings (Section 17).

(g) Refunds. Except where required by mandatory law (including consumer rights; see Section 18) or as stated in the Refund & Cancellation Policy, fees are non-refundable and we do not provide credits for partial periods.

15. Confidentiality

Each party may receive non-public information of the other. The receiving party will use it only to perform under these Terms, will protect it with at least reasonable care, and will not disclose it except to those of its personnel and advisers who need it and are bound by confidentiality. This does not apply to information that is or becomes public without breach, was already known, is independently developed, or is lawfully received from a third party, and does not prevent a disclosure required by law or by a court or regulator (with prompt notice where lawful). Your Customer Data is your confidential information; the non-public elements of the Service, including its detection behavior, findings taxonomy and non-public documentation, are ours.

16. Term, suspension and termination

These Terms apply while you use the Service.

(a) Termination for breach. Either party may terminate for material breach not cured within thirty (30) days of written notice.

(b) Immediate suspension or termination. We may suspend or terminate access immediately, with or without notice depending on severity and applicable law, for: an AUP or Section 7 violation; an export-control or sanctions violation or risk (Section 19); non-payment; a security risk to the Service, to us or to another customer; or where required to comply with law or a lawful order. Where practicable and lawful, we will give notice and an opportunity to cure, and will limit a suspension to what is necessary.

(c) Effect. On termination, your license ends, you must stop using the Service and the Agents, and you must uninstall the Agents from every machine. We will delete or return Customer Data in accordance with the Privacy Policy, the DPA and Section 17. Termination for your breach does not entitle you to a refund.

(d) Survival. Sections that by their nature should survive do so, including 1, 3 (last paragraph), 8, 10, 11, 12, 13, 14(b) to (d), 15, 16(c), 17, 19, 20, 24 and 25.

17. Exit, data portability and switching

(a) Export at any time. During your Subscription you may export your Events through the dashboard and the API in a structured, commonly used, machine-readable format.

(b) Switching and termination assistance. You may terminate this agreement in accordance with Section 14(f), and in any event on no more than two (2) months' notice where the EU Data Act (Regulation (EU) 2023/2854) applies to you. We will not impose pre-commercial, commercial, technical, contractual or organizational barriers that prevent you from terminating, from retrieving your Customer Data, or from porting it to another provider or to your own infrastructure. On request during the notice period and for a retrieval period of at least thirty (30) days after termination, we will give you reasonable assistance to export your Customer Data. We are not obliged to reproduce our Service, its detection logic, or your environment on any destination system, and this Section does not require us to disclose anything proprietary.

(c) Self-serve deletion. You may delete your account and all associated data from Settings. Deletion cascade-deletes your machines, Events and filters. Deletion is irreversible; export anything you wish to keep first.

(d) Deletion after termination. After the retrieval period, we delete Customer Data in accordance with the DPA and our backup rotation.

18. Consumer rights

If you use the Service as a consumer (for purposes outside your trade, business, craft, or profession), you have statutory rights that these Terms do not exclude, restrict, or override, including:

Where any provision of these Terms (including the warranty disclaimer in Section 11, the liability cap and time limit in Section 12, the indemnity in Section 13, or the venue in Section 24) conflicts with a non-waivable consumer right, that statutory right prevails to the extent of the conflict, and the rest of these Terms remain in effect.

The Service is designed and sold for business use. If you use it as a consumer, you do so on your own initiative, and Sections 7, 13 and 15 are read subject to this Section.

19. Trade compliance, sanctions and anti-corruption

You represent, warrant and covenant, on a continuing basis, that:

(a) you will comply with all applicable export-control and economic-sanctions laws, including those of Israel, the United States (EAR and OFAC), the European Union and the United Kingdom;

(b) you will not access, use, download, export, re-export or transfer the Service or any Agent, directly or indirectly, in or to any comprehensively embargoed or sanctioned destination, or to any denied, restricted or sanctioned party, or for any prohibited end-use, as set out in the AUP (/legal/aup) and the export notice (/legal/export);

(c) you are not, and are not owned or controlled by or acting on behalf of, a denied, restricted or sanctioned party; and

(d) neither you nor anyone acting for you will offer, give, request or accept any bribe, kickback or improper payment in connection with these Terms, and you will comply with applicable anti-bribery and anti-corruption laws, including the Israeli Penal Law, 5737-1977, the US Foreign Corrupt Practices Act and the UK Bribery Act 2010.

We may screen you against applicable sanctions and denied-party lists before and during the relationship, and may suspend or terminate immediately on a match or a credible risk. A suspension or termination under this Section does not entitle you to a refund.

20. Feedback, publicity and aggregate data

(a) Feedback. If you give us suggestions, ideas, bug reports or other feedback about the Service, you grant us a perpetual, irrevocable, worldwide, royalty-free, sublicensable license to use it for any purpose without obligation, attribution or compensation to you. You are not required to give feedback, and you should not include your confidential information or personal data in it.

(b) Publicity. We will not use your name, logo or the fact that you are a customer in marketing without your prior written consent (email is sufficient). You may withdraw that consent for future use at any time.

(c) Aggregate Data. We may generate and use Aggregate Data: statistical and aggregated information derived from operation of the Service, in a form that does not identify you, any End User, any individual, or any of your systems, code or data, and from which no such identification can reasonably be made. We may use Aggregate Data to operate, secure, analyze, benchmark and improve the Service and to produce general statistics. Aggregate Data is not Customer Data and is not personal data. We do not use the content of your Event Payloads, your source code, your Browsing Data or your findings for any purpose other than providing the Service to you.

21. Beta and preview features

We may make features available marked as beta, preview, experimental, early access or similar. Those features are provided as is, without any warranty, support or service commitment, may change or be withdrawn at any time without notice, may not be covered by the DPA's full measures, and should not be used with production data or in a production-critical path. Our liability for a beta feature is excluded to the maximum extent permitted by applicable law. Where a beta feature and another provision of these Terms conflict, this Section prevails for that feature.

22. Force majeure

Neither party is liable for a delay or failure to perform (other than a payment obligation) caused by an event beyond its reasonable control, including act of God, natural disaster, fire, flood, epidemic, war, armed conflict, hostilities, mobilization, terrorism, civil unrest, strike or labor dispute, act of government or regulator, sanctions, embargo, failure or unavailability of a utility, telecommunications network, cloud provider or upstream supplier, denial-of-service or other attack, or a widespread internet or infrastructure failure. The affected party will notify the other and use reasonable efforts to resume. If the event continues for more than sixty (60) days, either party may terminate the affected Service on notice.

23. Changes to the Terms

We may modify these Terms. We will post the updated Terms and, for material changes, give reasonable advance notice (for example, by email or in-product). Changes take effect on the stated effective date; continued use after that date constitutes acceptance. If you do not agree, you may cancel before the change takes effect. We will not apply material changes retroactively to your detriment without your consent where the law requires it. We may make a change with immediate effect where it is required by law, by a regulator, or to address a security risk.

24. Governing law, venue, and disputes

These Terms are governed by the laws of the State of Israel, without regard to conflict-of-laws rules, and excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and the Uniform Computer Information Transactions Act. The competent courts of Tel Aviv-Jaffa, Israel have exclusive jurisdiction over disputes arising out of or relating to these Terms, and each party submits to that jurisdiction and waives any objection to it on grounds of venue or forum non conveniens.

Injunctive relief. Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or confidential information, without posting a bond.

Waiver of class proceedings. To the maximum extent permitted by applicable law, each party may bring claims only in its individual capacity and not as a plaintiff or class member in any purported class, collective or representative proceeding. This waiver does not apply where it is unenforceable, including under the Israeli Class Actions Law, 5766-2006 and comparable consumer-protection legislation.

Consumer note. If you are a consumer, mandatory law in your country of residence may give you the right to bring proceedings in, and to the protection of the laws of, your local courts; this Section does not deprive you of that right. EU consumers may also use the European Commission's online dispute resolution platform, although we are not obliged to participate in an alternative dispute resolution procedure.

25. General

Entire agreement. These Terms, together with the AUP, Privacy Policy, DPA, security page, export notice, licenses page, Refund & Cancellation Policy and any signed order, are the entire agreement between the parties regarding the Service and supersede all prior discussions. Any purchase-order or vendor-portal terms you issue are of no effect and are expressly rejected, even if we accept or fulfil the order.

Order of precedence. In case of conflict: (1) a signed written order between the parties; (2) the DPA, for the processing of personal data on your behalf; (3) these Terms; (4) the AUP and the other referenced policies.

Severability. If any provision is held unenforceable, it is modified to the minimum extent necessary to make it enforceable, or severed if it cannot be, and the rest remains in effect.

No waiver. A failure or delay in enforcing a provision is not a waiver of it.

Assignment. You may not assign or transfer these Terms, in whole or in part, without our prior written consent; we may assign them to a successor in interest or to an entity that takes over the business, including on incorporation of the business into a company. Any attempted assignment in breach of this paragraph is void.

Independent parties. The parties are independent contractors. Nothing here creates a partnership, joint venture, agency or employment relationship.

No third-party beneficiaries. These Terms create no rights for any person who is not a party, except that Eyal Gabay personally, and our personnel and sub-processors, may enforce Sections 12 and 13.

Notices. Notices to us go to eyal@eyalsec.com and to the registered address above. Notices to you go to the email address on your account and are deemed received on the day sent. You must keep that address current.

Language. These Terms are drawn up in English. Any translation is for convenience; the English version governs, except where mandatory local consumer law requires otherwise.

EyalSec Pricing Docs Security Login Book a live demo
TermsPrivacyDPAAcceptable UseSecurityLicensesRefund Python is a trademark of the Python Software Foundation. EyalSec is not affiliated with or endorsed by the PSF.