Terms & Policies.

Version 1.0 | Effective Date: October 29, 2026

1. About these terms

These terms govern the public pages of cyberdax.io and the content on them. By using the site, you agree to these terms. If you do not agree, please do not use it.

The site is for general information. If CyberDax invites you to a non-public demo or beta, our Beta & Demo Terms also apply to that access. These website terms do not create a subscription, support plan, or service level commitment.

2. Using the website

You may browse the public site for lawful informational purposes. Your use must also follow our Acceptable Use Policy, which is part of these terms for website use.

Public access does not give you permission to scan, test, scrape, exploit, or interfere with our site or systems. The Acceptable Use Policy explains these restrictions in more detail.

3. Our content and intellectual property

CyberDax and its licensors own the site and its original text, design, analysis, graphics, logos, and other content. You may view public content for ordinary informational use. You do not receive ownership of it.

Unless we give written permission, you may not redistribute or sell substantial portions of our content, remove ownership notices, or use it to build a competing product, service, dataset, or knowledge base. Third-party names and materials belong to their respective owners.

4. Cybersecurity information

Threat information and security analysis can be incomplete or change quickly. We do not promise that site content is accurate, complete, current, suitable for your environment, or able to identify every threat or vulnerability.

You are responsible for your own security decisions, testing, configurations, investigations, and response. Site content is not legal, compliance, incident response, managed security, or other professional advice, and it does not guarantee a security outcome. Nothing on this site authorizes access to or testing of anyone else's systems.

5. Links to other sites

We may link to third-party sites, research, tools, or services. We do not control them or take responsibility for their content, availability, security, privacy practices, or terms. Your use of them is subject to their own terms.

6. Availability and privacy

We may change, pause, or discontinue any public page or feature at any time. We do not promise uninterrupted access, uptime, ongoing support, or that the site will always be error-free or secure.

Our Privacy Policy describes how we handle personal information. Our cookie disclosures describe any cookies or similar technologies used on the site.

7. Disclaimers and liability

To the extent permitted by law, the site and its content are provided “as is” and “as available,” without express, implied, or statutory warranties, including warranties of merchantability, fitness for a particular purpose, title, and non-infringement.

To the extent permitted by law, CyberDax and its members, officers, employees, contractors, agents, licensors, and service providers are not liable for indirect, incidental, special, exemplary, punitive, or consequential damages, or for lost profits, revenue, business opportunities, goodwill, data, or business interruption arising from the site or its content, even if advised that such damages were possible.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, CYBERDAX WILL NOT BE LIABLE FOR LOSSES ARISING FROM RELIANCE ON PUBLIC WEBSITE CONTENT, THIRD-PARTY INFORMATION, THIRD-PARTY WEBSITES, OR DECISIONS MADE BASED ON SUCH CONTENT. NOTHING IN THESE TERMS EXCLUDES OR LIMITS LIABILITY THAT CANNOT LAWFULLY BE EXCLUDED OR LIMITED.

8. Disputes and governing law

Please contact support@cyberdax.io with a written description of any dispute and the relief you seek. Both sides will try to resolve it informally for at least 30 days after notice is received, unless they agree to another period.

If informal discussions do not resolve the dispute, both sides will try mediation before arbitration. If mediation fails, the dispute will be decided by binding arbitration administered by the American Arbitration Association under its applicable rules, except where applicable law requires a different process. The arbitration will take place in Nevada, unless the parties agree otherwise or applicable law requires another location. Remote participation may be used where the rules and arbitrator permit it. A court with jurisdiction may enter judgment on the award.

Either side may seek temporary or emergency court relief when reasonably needed to protect intellectual property, data, systems, security, or access rights while the dispute is pending. Nevada law governs these terms, without regard to conflict-of-law rules, except where applicable law requires otherwise. Any permitted court case will be brought in a court with jurisdiction in Nevada, unless applicable law requires another venue.

9. Changes and contact

We may update these terms. We will post the current version and its update date here. Continued use after updated terms take effect means acceptance where permitted by law.

If any provision cannot be enforced, the rest remains in effect to the extent permitted by law. Our failure to enforce a provision does not waive our right to enforce it later.

Questions or requests regarding the terms may be directed to:

The CyberDax Team
support@cyberdax.io

Version 1.0 | Effective Date: October 29, 2026

Version 1.0 | Effective Date: October 29, 2026

Rules governing authorized use of CyberDax websites services content and infrastructure

This Acceptable Use Policy ("AUP") governs access to and use of all websites, applications, portals, APIs, infrastructure, data, reports, detection content, and other online services owned, operated, or provided by CyberDax, LLC, collectively referred to as the "CyberDax Services."

The CyberDax Services include, without limitation, the public CyberDax website at cyberdax.io, CyberDax subdomains, authenticated CyberDax applications, customer portals, APIs, integrations, and associated systems and infrastructure.

This AUP applies whether access is public, authenticated, paid, unpaid, invited, trial, evaluation, beta, pilot, or otherwise. Public availability of a website, page, endpoint, resource, report, or other CyberDax system does not constitute authorization to test, probe, scan, scrape, exploit, interfere with, or otherwise use it in a manner prohibited by this AUP.

By accessing or using the CyberDax Services, you agree to comply with this AUP.

1. Authorized Use

You may use the CyberDax Services only for legitimate business, cybersecurity, research, evaluation, informational, or other lawful purposes consistent with any applicable written authorization, invitation, entitlement, agreement, or other permission provided by CyberDax.

Where an account is required, you are responsible for activity conducted through your account and for maintaining the confidentiality and security of your authentication credentials.

Access to CyberDax does not grant permission to perform activities prohibited by this AUP. Access also does not grant rights to download, implement, modify, adapt, redistribute, commercialize, or otherwise reuse CyberDax proprietary content except to the extent CyberDax expressly permits in a separate written agreement or written authorization.

2. Security Testing and Vulnerability Research

Any vulnerability assessment, penetration testing, security testing, scanning, fuzzing, exploitation, automated probing, load testing, stress testing, or similar security research involving any CyberDax website, application, API, endpoint, domain, subdomain, server, network resource, or supporting infrastructure requires express written authorization from CyberDax before the activity begins.

A subscription, account, trial, invitation, evaluation, public website visit, or other access to the CyberDax Services does not constitute authorization to conduct security testing.

The fact that a CyberDax resource is accessible without authentication does not constitute authorization to perform security testing or automated reconnaissance against that resource.

Without prior written authorization, you may not:

• probe, scan, enumerate, or test CyberDax systems for vulnerabilities;
• attempt to bypass authentication, authorization, tenant isolation, role restrictions, rate limits, or other security controls;
• attempt to access another customer's, organization's, or user's information;
• test or demonstrate a suspected vulnerability beyond what is reasonably necessary to recognize that a potential issue may exist;
• exploit, weaponize, persist through, or exfiltrate information using a suspected vulnerability;
• conduct denial-of-service, stress, load, or availability testing;
• use automated security-testing or reconnaissance tools against CyberDax infrastructure; or
• attempt to gain access to systems, resources, functions, or information beyond those intentionally made available to you.

If you unintentionally discover a potential security vulnerability, discontinue further testing and report the issue to CyberDax at support@cyberdax.io or through any dedicated security reporting channel CyberDax publishes for that purpose.

Reporting a potential vulnerability does not itself authorize continued testing, exploitation, persistence, data access, or attempts to reproduce the issue beyond what is reasonably necessary to describe the potential vulnerability.

3. Scraping Automated Collection and Data Harvesting

Unless expressly authorized in writing by CyberDax, you may not use automated, semi-automated, systematic, or coordinated methods to extract, collect, reproduce, index, download, aggregate, enumerate, or reconstruct CyberDax content or data.

Prohibited methods include, but are not limited to:

• unauthorized web scraping or crawling;
• unauthorized automated browser activity;
• bots, scripts, agents, automated browsers, or similar automated tools used for prohibited collection;
• systematic enumeration of reports, records, rules, identifiers, endpoints, or other resources;
• bulk downloading or bulk extraction;
• circumvention of technical restrictions intended to limit collection or access;
• repeated manual or automated activity intended to reconstruct a substantial portion of the CyberDax corpus; or
• automated collection intended to create a competing dataset, service, platform, knowledge base, or product.

This restriction does not prohibit ordinary interactive use of publicly available website content, authorized use of authenticated CyberDax Services, ordinary search-engine indexing performed in accordance with CyberDax's published technical directives, ordinary browser accessibility features, ordinary password-manager functionality, user-initiated browser or AI assistance that does not systematically collect or reconstruct CyberDax proprietary content, or automation expressly provided or authorized by CyberDax.

Whether activity is permitted depends on its authorization, purpose, scope, volume, persistence, and effect, not merely on whether software automation is involved.

4. Artificial Intelligence and Machine Learning

Unless expressly authorized in writing by CyberDax, you may not use CyberDax content, reports, detection rules, structured data, datasets, analyses, or other proprietary materials to:

• train or fine-tune an artificial intelligence or machine-learning model;
• create, populate, or expand a training dataset;
• systematically populate or enrich an external knowledge base, vector store, repository, or retrieval corpus;
• develop a competing intelligence dataset, knowledge base, platform, or service;
• systematically enrich another model, dataset, or knowledge repository with CyberDax proprietary content;
• use automated AI systems to reproduce or reconstruct substantial portions of CyberDax content; or
• develop a product or service designed to substitute for substantial functionality or proprietary content provided by CyberDax.

This restriction does not prohibit ordinary use of generally available AI productivity tools where the user is otherwise authorized to access the CyberDax content, the use is for legitimate internal productivity or cybersecurity purposes, CyberDax content is not systematically retained or accumulated for reuse beyond the authorized task, the content is not incorporated into a training dataset, the content is not used to train, fine-tune, or develop a model, the use does not reconstruct substantial portions of CyberDax proprietary content, and the output is not used to create a competing intelligence product, dataset, platform, or service.

CyberDax may separately authorize additional AI, API, integration, automation, or data rights under a separate written enterprise, data, API, licensing, evaluation, or customer agreement.

5. Intellectual Property and Redistribution

Access to or availability of CyberDax content does not transfer ownership of CyberDax intellectual property.

Unless permitted under a separate written agreement, you may not:

• resell or sublicense access to CyberDax;
• redistribute CyberDax reports, detection rules, datasets, analyses, or other proprietary content;
• publish substantial portions of CyberDax proprietary content;
• create or maintain a competing database, dataset, service, platform, or product using CyberDax proprietary content;
• remove or alter proprietary notices, copyright notices, or attribution;
• reverse engineer CyberDax systems for the purpose of recreating proprietary functionality, datasets, detection content, methodologies, or processes; or
• represent CyberDax proprietary content as your own original proprietary work.

No CyberDax content, detection rule, query, report, analysis, score, methodology, user interface, dataset, or derived intelligence may be redistributed, resold, sublicensed, published, commercialized, or used to build a competing product unless CyberDax expressly authorizes that activity in writing.

Third-party trademarks, vulnerability information, advisories, publications, research, and source materials referenced by CyberDax remain the property of their respective owners.

6. Account and Access Restrictions

Where accounts or authenticated access are provided, you may not:

• share authentication credentials with unauthorized persons;
• permit unauthorized persons to access CyberDax through your account;
• impersonate another person or organization;
• use another person's account without authorization;
• create accounts using false or materially misleading information;
• attempt to gain privileges beyond those assigned to you;
• circumvent account, organization, role, entitlement, licensing, subscription, or access restrictions;
• evade technical limits, query limits, rate limits, or usage controls; or
• use multiple accounts or identities to circumvent restrictions applied to another account.

You are responsible for taking reasonable measures to protect credentials issued to you and for promptly reporting suspected compromise or unauthorized access.

7. Interference With CyberDax Services

You may not disrupt, degrade, overload, damage, probe, interfere with, or attempt to gain unauthorized access to any CyberDax website, application, API, infrastructure, or supporting service, regardless of whether authentication is required to access the affected resource.

Prohibited conduct includes denial-of-service activity, deliberately excessive automated traffic, malicious or malformed requests, malware delivery, unauthorized availability testing, interference with another customer's or visitor's use, intentional exhaustion of compute, storage, bandwidth, query, or API resources, evasion of abuse-prevention mechanisms, or actions intended to impair the confidentiality, integrity, or availability of CyberDax systems.

Legitimate machine-originated traffic is permitted only when consistent with documented service limits and authorized functionality.

8. Unlawful or Harmful Use

You may not use CyberDax to facilitate unlawful activity, unauthorized intrusion, malicious exploitation, credential theft, unauthorized persistence, destructive activity, data theft, or attacks against third parties.

CyberDax threat intelligence, detection information, security analysis, detection logic, and related materials are provided for legitimate defensive, analytical, research, informational, and authorized security purposes.

Nothing in the CyberDax Services constitutes authorization to access, test, exploit, interfere with, or compromise a third-party system.

9. Monitoring and Enforcement

CyberDax may monitor and record activity involving the CyberDax Services for service and infrastructure security, fraud and abuse prevention, investigation of suspected policy violations, operational monitoring, product improvement, compliance, troubleshooting, protection of CyberDax intellectual property, and protection of CyberDax, its customers, users, and third parties.

CyberDax may use automated or manual methods to identify unusual access patterns, excessive querying, credential misuse, scraping, attempted enumeration, automated harvesting, unauthorized probing, suspicious API usage, attempts to evade technical controls, or other activity inconsistent with authorized or normal use.

Monitoring will be conducted consistent with applicable law and CyberDax privacy disclosures.

10. Suspension Restriction or Termination

CyberDax may restrict, suspend, block, or terminate access to the CyberDax Services when CyberDax reasonably believes that this AUP has been violated, activity presents a security or operational risk, an account or system is being used fraudulently or without authorization, activity threatens the availability, confidentiality, or integrity of CyberDax Services, activity threatens CyberDax intellectual property or user information, activity appears designed to circumvent technical or access controls, or immediate action is reasonably necessary to protect CyberDax, its customers, users, infrastructure, or third parties.

Where circumstances reasonably permit, CyberDax may provide notice or an opportunity to resolve the issue. CyberDax may immediately restrict access without advance notice where delay could reasonably increase security, operational, legal, intellectual-property, or user risk.

11. Pre Release and Evaluation Access

Certain CyberDax functionality may be provided for preview, evaluation, beta, pilot, or pre-release use. Such functionality may be incomplete, modified, suspended, restricted, or discontinued at any time and should not be relied upon as production-ready unless CyberDax expressly states otherwise.

Evaluation and pre-release access remain subject to this AUP and any applicable written evaluation, pilot, or customer agreement.

12. No Implied Authorization

Nothing about public accessibility of CyberDax systems, possession of an account, payment of a fee, participation in a trial, pilot, beta, or evaluation, receipt of an invitation, access to documentation, possession of technical knowledge regarding CyberDax, discovery of an endpoint or resource, or the absence of an immediate technical block constitutes implied authorization to engage in conduct otherwise prohibited by this AUP.

Authorization to conduct otherwise restricted activity must be provided expressly by CyberDax and, where required under this AUP, in writing before the activity begins.

Silence, non-response, technical accessibility, or failure to block an activity does not constitute authorization.

13. Relationship to Other Agreements

This AUP may be incorporated into applicable CyberDax terms, agreements, order forms, evaluation agreements, pilot agreements, enterprise agreements, or other written agreements.

A separate written agreement may provide specific permissions or restrictions that differ from this AUP. Where a separate written agreement expressly authorizes activity that would otherwise be restricted by this AUP, the specific written authorization controls within its stated scope.

Authorization for one activity does not imply authorization for another activity.

14. Changes to This Policy

CyberDax may update this AUP periodically as the CyberDax Services, security requirements, legal requirements, threat environment, technical capabilities, or business practices evolve.

The current version and effective date will be published with the policy. Where required by applicable law or agreement, CyberDax may provide additional notice of material changes.

15. Contact

Questions regarding this Acceptable Use Policy, requests for authorization, reports of suspected misuse, or potential security vulnerabilities should be directed to:

The CyberDax Team
support@cyberdax.io

Version 1.0 | Effective Date: October 29, 2026

Version 1.0 | Effective Date: October 29, 2026

CyberDax, LLC (“CyberDax,” “we,” “us,” or “our”) respects the privacy of visitors to our public website.

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit cyberdax.io and other publicly accessible webpages operated by CyberDax (collectively, the “Website”).

This Privacy Policy currently applies to the public CyberDax Website. It does not describe privacy practices for future authenticated CyberDax customer services, portals, accounts, or other products that may be subject to additional or updated privacy terms.

1. Information We Collect

Information You Provide to Us

We may collect information you voluntarily provide when you contact CyberDax or otherwise communicate with us through the Website or using contact information published on the Website.

Depending on how you contact us, this may include:

• your name;
• email address;
• company or organization;
• job title;
• information contained in your message; and
• any other information you choose to provide.

Please do not submit sensitive personal information through general Website contact channels unless it is reasonably necessary for your communication with CyberDax.

Information Collected Automatically

When you visit the Website, certain technical information may be processed automatically by Vercel, our Website hosting and infrastructure provider.

Depending on the nature of your visit, this information may include:

• IP address;
• browser type and version;
• operating system and device characteristics;
• pages and resources requested or visited;
• referring website or source;
• date and time of requests; and
• technical information necessary to operate, secure, and maintain the Website.

Where CyberDax enables additional interaction analytics, information may also include:

• links or elements selected;
• navigation or scrolling interactions; and
• searches performed on the Website, if applicable.

CyberDax also uses Vercel Web Analytics to obtain aggregated information about Website traffic, including page views, referring sources, approximate geographic location, and browser and device characteristics.

CyberDax uses this information to understand Website traffic, improve Website content and performance, identify technical issues, and protect the Website against misuse or unauthorized activity.

2. Cookies and Similar Technologies

The Website may use cookies or similar technologies where necessary for Website functionality, security, or operation.

CyberDax uses Vercel Web Analytics to understand Website traffic and visitor interactions. Vercel Web Analytics does not use analytics cookies or persistent browser identifiers to track visitors. Instead, it uses temporary, privacy-focused identifiers to generate aggregated Website statistics.

CyberDax does not currently use Google Analytics, advertising pixels, or behavioral advertising technologies on the public Website.

CyberDax does not intend to deploy non-essential analytics or advertising cookies as part of the current public Website.

Visitors may manage or restrict cookies through their browser settings.

If CyberDax introduces non-essential cookies or additional tracking technologies in the future, we will update this Privacy Policy and implement appropriate notice, consent, or preference mechanisms where required by applicable law.

3. How We Use Personal Information

CyberDax may use information collected through the Website to:

• provide and operate the Website;
• respond to inquiries or communications;
• understand Website traffic and usage;
• improve Website content, navigation, and performance;
• diagnose technical problems;
• maintain the security and integrity of CyberDax systems;
• prevent fraud, misuse, scraping, abuse, or unauthorized activity;
• comply with applicable law or legal process; and
• protect CyberDax, our systems, intellectual property, users, or third parties.

CyberDax does not use personal information collected through the Website for purposes materially unrelated to those described in this Privacy Policy without providing appropriate notice where required by law.

4. Legal Bases for Processing

Where the European Union General Data Protection Regulation (“GDPR”) or similar law applies, CyberDax processes personal information only where an appropriate legal basis exists.

Depending on the circumstances, those bases may include:

Consent. Where applicable law requires consent for non-essential cookies, analytics technologies, or similar processing, CyberDax will obtain consent and provide a means to withdraw it as required by law.

Legitimate interests. We may process limited information where reasonably necessary to operate, secure, understand, and improve the Website; prevent abuse; protect CyberDax systems and intellectual property; or respond to communications, provided those interests are not overridden by applicable privacy rights.

Steps requested by you. We may process information necessary to respond to inquiries or take steps you request before entering into a potential business relationship.

Legal obligations. We may process information where necessary to comply with applicable law, regulation, court order, or other legal requirement.

5. How We Share Information

CyberDax does not sell personal information collected through the Website.

CyberDax may disclose limited personal information to service providers that help us operate and secure the Website.

At present, this includes Vercel, which provides Website hosting, infrastructure, content delivery, and Web Analytics services. Vercel may process technical information associated with Website traffic and operation as described in Section 6 of this Policy.

CyberDax may also disclose information:

• when required by applicable law, regulation, subpoena, court order, or lawful government request;
• when reasonably necessary to investigate fraud, abuse, security incidents, or violations of applicable policies;
• when reasonably necessary to protect the rights, property, systems, or safety of CyberDax or others;
• in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, subject to applicable law; or
• where you direct or authorize us to do so.

CyberDax does not currently disclose Website visitor information to third parties for cross-context behavioral advertising.

6. Website Hosting and Analytics

The Website is hosted and delivered using Vercel.

Vercel may process technical information associated with Website requests, including IP addresses, browser and device information, request metadata, and related information necessary to deliver, operate, secure, and maintain the Website.

CyberDax uses Vercel Web Analytics to understand Website traffic and improve the usefulness, accessibility, and performance of publicly available content.

Vercel Web Analytics provides aggregated information concerning page views, referring websites, approximate geographic location, browsers, operating systems, and device characteristics.

Vercel Web Analytics does not use analytics cookies or persistent identifiers to track visitors across different websites. Visitor identification uses a temporary identifier derived from request information rather than a persistent browser cookie.

CyberDax does not currently use Google Analytics, advertising pixels, or behavioral advertising technologies on the public Website.

Vercel's applicable privacy documentation describes its processing practices.

7. Data Retention

CyberDax retains personal information only for as long as reasonably necessary for the purposes for which it was collected, to maintain the Website and its security, to respond to communications, to protect legitimate business interests, or to satisfy applicable legal requirements.

Retention periods may vary depending on the nature and purpose of the information.

Technical information processed by CyberDax's Website hosting and analytics providers may also be retained in accordance with their applicable agreements, service configurations, and data-retention practices.

Where applicable law requires a more specific retention period or deletion obligation, CyberDax will follow that requirement.

8. International Processing

CyberDax is based in the United States.

Information collected through the Website may therefore be processed or stored in the United States or other jurisdictions in which CyberDax service providers operate.

Where applicable privacy law requires safeguards for international transfers of personal information, such transfers will be handled using legally recognized mechanisms or other safeguards required by applicable law.

9. Your Privacy Choices

The Website uses Vercel Web Analytics, which does not require analytics cookies. Visitors may manage or restrict browser cookies through their browser settings.

If CyberDax introduces non-essential cookies or tracking technologies requiring additional privacy choices, we will provide appropriate consent or preference controls where required by applicable law.

You may also contact CyberDax regarding personal information you have provided directly to us.

Depending on the law applicable to you and your relationship with CyberDax, you may have rights regarding access, correction, deletion, restriction, portability, objection, or other treatment of your personal information.

CyberDax will respond to valid privacy requests to the extent required by applicable law.

CyberDax may need to verify a requester’s identity before acting on a privacy request.

10. European Economic Area Privacy Rights

If the GDPR applies to the processing of your personal information, you may have rights including:

• access to your personal information;
• correction of inaccurate information;
• deletion in circumstances provided by law;
• restriction of processing;
• data portability where applicable;
• objection to certain processing based on legitimate interests;
• withdrawal of consent where processing is based on consent; and
• the right to lodge a complaint with an applicable supervisory authority.

Withdrawal of consent does not affect processing lawfully performed before the withdrawal.

CyberDax, LLC is the controller of personal information for which CyberDax determines the purposes and means of processing through the Website.

Privacy requests may be submitted using the contact information at the end of this Policy.

11. California Privacy Information

California residents may contact CyberDax regarding personal information collected through the Website and may exercise rights provided to them by applicable California law.

CyberDax will provide access, correction, deletion, or other rights when required by applicable law.

CyberDax does not currently sell personal information collected through the Website.

CyberDax does not currently share personal information for cross-context behavioral advertising.

12. Do Not Track and Privacy Signals

Some browsers offer a “Do Not Track” (“DNT”) setting.

CyberDax does not currently operate a separate Website-level mechanism that independently responds to browser DNT signals.

CyberDax uses cookieless Website analytics and does not currently provide a separate Website-level cookie-preference panel for analytics. Visitors may manage cookies and other browser storage through their browser settings.

CyberDax does not currently sell personal information or share personal information for cross-context behavioral advertising.

If CyberDax later engages in activities subject to legally required browser-based opt-out mechanisms, including applicable universal opt-out signals, we will implement and describe those mechanisms as required by law.

13. Security

CyberDax uses administrative and technical measures intended to protect information collected through the Website against unauthorized access, misuse, alteration, or disclosure.

However, no Internet transmission, hosting platform, storage system, or security measure can guarantee absolute security.

Visitors should avoid sending highly sensitive information through ordinary Website communications unless necessary and appropriate.

14. Children’s Privacy

The Website is not directed to children under 13 years of age, and CyberDax does not intentionally operate the Website for the purpose of collecting personal information from children.

If CyberDax learns that personal information from a child has been collected in circumstances requiring parental consent or deletion under applicable law, CyberDax will take action as required by law.

15. Third-Party Websites and Content

The Website may contain links to third-party websites, publications, tools, videos, or other resources.

CyberDax does not control the privacy practices of third parties.

When you leave the CyberDax Website or interact with third-party services, their privacy policies and practices may apply.

16. Changes to This Privacy Policy

CyberDax may update this Privacy Policy as our Website, technology, legal requirements, or privacy practices change.

The current version and effective date will be posted with this Policy.

Where applicable law requires additional notice or consent for a material change, CyberDax will provide such notice or obtain such consent as required.

17. Contact

Questions or requests regarding this Privacy Policy or personal information associated with the Website may be directed to:

The CyberDax Team
support@cyberdax.io

Version 1.0 | Effective Date: October 29, 2026

Version 1.0 | Effective Date: October 29, 2026

1. When this notice applies

This Beta & Portal Privacy Notice explains how CyberDax, LLC (“CyberDax,” “we,” “us,” or “our”) collects, uses, and handles personal information when an authorized or invited user accesses app.cyberdax.io, participates in a CyberDax beta or evaluation, uses an invited CyberDax portal or API, or otherwise interacts with non-public CyberDax services (collectively, the “Portal”).

This notice is intended specifically for invited Portal, beta, demo, and evaluation users.

The separate CyberDax Website Privacy Policy applies when you visit the public cyberdax.io website or public legal pages hosted there.

2. Information we collect

CyberDax may collect information that you provide directly, information associated with your CyberDax account or organization, and information generated when you use the Portal.

3. Account and identity information

This may include:

• your name;
• email address;
• authentication-provider identifiers;
• CyberDax user identifiers;
• account status;
• authentication and session information;
• multifactor authentication or passkey status, where applicable; and
• information necessary to authenticate and secure your account.

CyberDax uses Clerk to provide authentication and user-management functionality for the Portal.

4. Organization and access information

CyberDax may collect and maintain information concerning:

• the organization associated with your account;
• organization membership;
• assigned roles;
• permissions;
• access rights;
• entitlements;
• administrative relationships; and
• account or membership status.

This information is used to control which CyberDax resources and functionality you are permitted to access.

5. Portal activity information

CyberDax may record information about how authorized users interact with the Portal.

This may include:

• searches performed;
• reports viewed;
• detection content or rules viewed;
• features used;
• navigation and feature interactions;
• administrative actions;
• exports or downloads, where available;
• API or integration activity, where applicable;
• date and time of activity;
• user and organization identifiers associated with activity; and
• related technical metadata.

CyberDax may associate Portal activity with an identified user and the organization through which that user accesses CyberDax.

6. Security and abuse information

CyberDax may collect and analyze information necessary to secure the Portal and detect unauthorized or abusive activity.

This may include:

• IP address;
• browser and device information;
• operating system information;
• authentication events;
• failed sign-in attempts;
• session information;
• network and request information;
• requested resources or endpoints;
• request timestamps;
• response or error information;
• unusual request volume;
• excessive querying;
• suspected scraping;
• attempted enumeration;
• suspected automated harvesting;
• suspicious automated behavior;
• credential misuse;
• attempts to bypass access controls, rate limits, or technical restrictions; and
• other activity reasonably relevant to protecting CyberDax, its users, or its systems.

CyberDax may use automated and manual methods to identify unusual or potentially unauthorized activity.

7. Why we collect Portal information

CyberDax may use information collected through the Portal to:

• authenticate users;
• provide and operate beta, demo, and evaluation functionality;
• manage organizations, roles, and access rights;
• maintain account and security records;
• secure the Portal;
• detect fraud, abuse, scraping, enumeration, and unauthorized automation;
• enforce the CyberDax Acceptable Use Policy and other applicable terms;
• investigate suspected misuse or security incidents;
• troubleshoot technical problems;
• understand how Portal features are used;
• improve CyberDax functionality and content;
• provide organization administration capabilities;
• respond to communications or support requests;
• protect CyberDax intellectual property;
• comply with applicable law or legal process; and
• protect CyberDax, its users, organizations, systems, or third parties.

8. Organization administrators

If you access CyberDax through an organization, certain account, access, security, and usage information associated with your Portal activity may be available to authorized administrators of that organization.

Depending on the functionality made available by CyberDax, organization administrators may be able to see information such as:

• your name and account identity;
• organization membership;
• assigned role or permissions;
• account status;
• security or access events;
• Portal usage information; and
• activity reasonably necessary to administer or secure the organization’s CyberDax access.

The specific information available to organization administrators may vary based on Portal functionality, organizational configuration, and assigned permissions.

CyberDax does not represent that every organization administrator will have access to every individual activity event.

9. Information you provide during beta or evaluation

Unless CyberDax expressly agrees otherwise in writing, beta and evaluation users should use sample or synthetic data when submitting information through evaluation features.

Do not submit passwords, authentication secrets, production credentials, regulated personal information, or another party’s confidential information unless CyberDax has expressly agreed in writing to receive that information.

You are responsible for ensuring that you have the rights and authorization necessary to provide information you submit.

If you provide permitted information, CyberDax may use it as reasonably necessary to provide, secure, troubleshoot, administer, and evaluate the Portal.

10. Feedback

If you voluntarily provide feedback, suggestions, ideas, or comments concerning CyberDax, CyberDax may use that feedback to evaluate or improve the Portal.

Feedback should not include sensitive or confidential information that you are not authorized to disclose.

11. Service providers

CyberDax uses third-party technology providers to operate the Portal.

12. Clerk

CyberDax uses Clerk for authentication and user-management functionality.

Clerk may process information necessary to create and authenticate accounts, maintain sessions, provide authentication features, and help protect accounts against unauthorized access.

13. Vercel

CyberDax uses Vercel to host and deliver the Portal frontend.

Vercel may process technical information associated with Portal traffic and operation, such as IP addresses, request information, device or browser information, system information, and related network or infrastructure data.

14. PythonAnywhere

CyberDax uses PythonAnywhere for backend, API, and related application infrastructure.

Information transmitted to CyberDax backend systems may therefore be processed using infrastructure provided by PythonAnywhere.

15. Public Website and Legal Pages

CyberDax uses Vercel to host and deliver its public website at cyberdax.io, including publicly accessible legal documents.

Vercel may process technical information associated with public website requests, including network, browser, device, and request information necessary to operate and secure the website.

If you follow a link from the Portal to the public CyberDax website or its legal pages, your visit is governed by the separate CyberDax Website Privacy Policy, which describes applicable website hosting, analytics, and privacy practices.

16. Cookies, sessions, and authentication technologies

The Portal may use cookies, browser storage, session identifiers, and similar technologies where necessary to:

• authenticate users;
• maintain secure sessions;
• prevent unauthorized access;
• remember appropriate application settings; and
• provide Portal functionality.

Authentication providers and infrastructure providers may also use cookies or similar technologies as necessary to provide their services.

CyberDax does not currently use the Portal for behavioral advertising.

17. How we share information

CyberDax does not currently sell personal information associated with Portal users.

CyberDax does not currently share Portal-user personal information for cross-context behavioral advertising.

CyberDax may disclose information to service providers that assist with:

• authentication;
• hosting;
• application infrastructure;
• database or storage infrastructure;
• security;
• operational monitoring;
• communications; or
• other services necessary to operate the Portal.

CyberDax may also disclose information:

• when required by applicable law or lawful legal process;
• when reasonably necessary to investigate security incidents, fraud, abuse, or policy violations;
• when reasonably necessary to protect CyberDax, its systems, intellectual property, users, organizations, or third parties;
• at the direction of an authorized user or organization;
• to authorized administrators of the organization through which a user accesses CyberDax; or
• in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, subject to applicable law.

18. Data retention

CyberDax retains Portal information for as long as reasonably necessary for the purposes for which it was collected.

This may include periods reasonably necessary to:

• maintain Portal access;
• operate beta or evaluation services;
• maintain security and audit records;
• investigate or prevent abuse;
• administer organizations and accounts;
• troubleshoot technical problems;
• protect CyberDax systems or intellectual property;
• resolve disputes;
• enforce applicable agreements; or
• comply with applicable legal requirements.

Retention periods may vary depending on the type of information and its purpose.

CyberDax may retain appropriate security, audit, or access records after beta or evaluation access ends where reasonably necessary for security, abuse prevention, dispute resolution, or legal purposes.

CyberDax does not promise a specific retention period unless CyberDax separately agrees to one in writing or applicable law requires one.

19. International processing

CyberDax is based in the United States.

Personal information associated with the Portal may be processed or stored in the United States or other jurisdictions in which CyberDax service providers or their subprocessors operate.

Where applicable privacy law requires safeguards for international transfers, CyberDax will use legally recognized mechanisms or other safeguards required by applicable law.

20. Legal bases for processing

Where the General Data Protection Regulation (“GDPR”) or similar privacy law applies, CyberDax may process personal information based on:

Performance of a contract or steps requested by you, where processing is necessary to provide requested Portal, beta, demo, or evaluation access.

Legitimate interests, including operating and securing the Portal, preventing fraud and abuse, maintaining appropriate audit records, protecting CyberDax systems and intellectual property, administering organizational access, understanding Portal usage, and improving CyberDax.

Consent, where applicable law requires consent for particular processing.

Legal obligations, where processing is necessary to comply with applicable law, regulation, legal process, or other legal requirements.

21. Your privacy rights

Depending on applicable law, you may have rights concerning personal information associated with you.

These may include rights to:

• access personal information;
• correct inaccurate personal information;
• request deletion where applicable;
• restrict certain processing;
• object to certain processing;
• receive portable information where applicable; and
• withdraw consent where processing is based on consent.

CyberDax will respond to valid privacy requests to the extent required by applicable law.

CyberDax may take reasonable steps to verify a requester’s identity, authority, or organizational relationship before acting on a request.

22. European privacy rights

Where the GDPR applies, you may also have the right to lodge a complaint with an appropriate supervisory authority.

CyberDax, LLC is the controller where CyberDax determines the purposes and means of processing personal information associated with Portal users.

23. California privacy information

California residents may exercise rights provided by applicable California privacy law.

CyberDax will provide access, correction, deletion, or other rights where required by applicable law.

CyberDax does not currently sell personal information associated with Portal users.

CyberDax does not currently share Portal-user personal information for cross-context behavioral advertising.

24. Do Not Track and privacy signals

Some browsers provide “Do Not Track” or other privacy signals.

CyberDax does not currently operate a separate Portal-level mechanism that independently responds to traditional browser Do Not Track signals.

CyberDax does not currently sell personal information or share personal information for cross-context behavioral advertising.

If CyberDax later engages in processing for which applicable law requires recognition of a universal opt-out mechanism or similar signal, CyberDax will implement and describe that mechanism as required by law.

25. Security

CyberDax uses administrative and technical measures intended to protect information associated with the Portal against unauthorized access, disclosure, alteration, misuse, or destruction.

These measures may include authentication controls, organization- and role-based access controls, logging, monitoring, infrastructure protections, and other safeguards appropriate to the Portal.

No Internet-connected application, hosting provider, authentication system, storage system, or security measure can guarantee absolute security.

Users are responsible for protecting their authentication credentials and should promptly notify CyberDax of suspected unauthorized access.

26. Children’s privacy

The Portal is intended for professional and organizational cybersecurity use and is not directed to children.

CyberDax does not knowingly provide Portal accounts to children under 13.

If CyberDax learns that personal information concerning a child has been collected in circumstances requiring deletion, consent, or other action under applicable law, CyberDax will take action as required by law.

27. Changes to this notice

CyberDax may update this Beta & Portal Privacy Notice as Portal functionality, beta features, data practices, infrastructure, security practices, or legal requirements change.

The current version and effective date will be published with the notice.

Where applicable law requires additional notice or consent for a material change, CyberDax will provide such notice or obtain such consent as required.

28. Contact

Questions or requests regarding this Beta & Portal Privacy Notice or personal information associated with the CyberDax Portal may be directed to:

The CyberDax Team
support@cyberdax.io

Version 1.0 | Effective Date: October 29, 2026

Version 1.0 | Effective Date: October 29, 2026

1. When these terms apply

These terms apply when CyberDax, LLC (“CyberDax,” “we,” “us,” or “our”) invites you to view a non-public demo, try a beta or evaluation feature, use an invited portal or API, or receive non-public CyberDax reports, analysis, or detection content.

They apply whether or not you have an account. They supplement our Acceptable Use Policy and, where applicable, our Website Terms of Use.

If you accept these terms on behalf of an organization, you represent that you have authority to bind that organization. Otherwise, you accept these terms personally.

Access is by invitation and at no charge. These terms do not create a subscription, purchase obligation, support commitment, or obligation for CyberDax to offer paid or continuing access.

2. Your evaluation access

CyberDax gives you limited, non-exclusive, non-transferable, revocable permission to use the invited materials or features solely for your own internal evaluation.

You may not share an account, invitation, access credential, API credential, or non-public demo link with anyone CyberDax has not authorized.

CyberDax may limit, modify, pause, restrict, or end evaluation access at any time.

The beta or demo is provided for evaluation purposes only and is not intended for production reliance. CyberDax does not promise ongoing access, support, a service level, continued availability, or any particular feature or functionality.

3. CyberDax content

CyberDax and its licensors retain ownership of their software, reports, analyses, data, detection content, detection logic, methodologies, scoring, interfaces, designs, and other proprietary materials.

You may review non-public CyberDax material for the invited evaluation and make reasonable internal notes relating to that evaluation.

Unless CyberDax gives you prior written permission, you may not:

• record a non-public demonstration;
• share, publish, distribute, or publicly disclose non-public CyberDax materials;
• copy substantial portions of CyberDax materials;
• download, implement, tune, translate, adapt, retain, or deploy CyberDax detection content;
• resell, sublicense, or redistribute CyberDax materials;
• reconstruct a substantial portion of the CyberDax corpus; or
• use CyberDax materials to develop a competing product, service, dataset, knowledge base, or platform.

Your invitation does not grant production, implementation, deployment, redistribution, or commercial-use rights. Any such rights require separate written authorization from CyberDax.

Third-party materials, trademarks, vulnerability information, advisories, research, or other source materials referenced by CyberDax remain the property of their respective owners.

4. Rules for using the beta

The CyberDax Acceptable Use Policy applies to beta access, evaluation access, demos, APIs, and non-public CyberDax materials.

An invitation, account, demo, visible endpoint, discovered resource, or technical accessibility does not authorize:

• vulnerability testing;
• penetration testing;
• scanning or probing;
• exploitation;
• scraping or automated collection;
• systematic enumeration;
• corpus reconstruction;
• AI or machine-learning training;
• attempts to bypass technical or access controls; or
• other activity restricted by the Acceptable Use Policy.

You also may not use CyberDax materials to access, attack, test, exploit, or interfere with a third party’s systems without appropriate authorization from that third party.

5. Information you provide and feedback

Use sample or synthetic data for evaluation unless CyberDax expressly agrees in writing to receive real data.

Do not submit passwords, authentication secrets, regulated personal information, production credentials, or another party’s confidential information unless CyberDax has expressly agreed in writing to receive that information.

You are responsible for ensuring that you have the rights and authorization necessary to provide any material you submit.

If you submit permitted material, you authorize CyberDax to use it as reasonably necessary to provide, secure, troubleshoot, administer, and evaluate the beta, subject to applicable law and CyberDax privacy disclosures. You retain ownership of materials you provide. If you voluntarily provide feedback, suggestions, ideas, comments, or recommendations regarding CyberDax, CyberDax may use that feedback without payment, attribution, restriction, or obligation to implement it.

6. Pre-release information and risk

Beta features, demonstrations, threat intelligence, security analysis, detection content, and other evaluation materials may be incomplete, inaccurate, experimental, or subject to change.

CyberDax does not promise that a beta feature, report, detection rule, analysis, or recommendation will:

• identify every threat or vulnerability;
• detect every malicious activity;
• prevent a security incident;
• function correctly in your environment;
• remain current or complete; or
• be suitable for production deployment.

You are responsible for independently validating CyberDax information and for your own security decisions, configurations, testing, investigations, operations, and responses.

Unless CyberDax separately agrees otherwise in writing, beta, demo, and evaluation materials are provided “as is” and “as available.”

To the maximum extent permitted by applicable law, CyberDax disclaims all warranties, whether express, implied, statutory, or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.

7. Ending access and liability

CyberDax may suspend, restrict, or end evaluation access when CyberDax reasonably believes:

• these terms or the Acceptable Use Policy have been violated;
• continued access creates a security or operational risk;
• access is being used fraudulently or without authorization;
• activity threatens CyberDax systems, information, intellectual property, users, or third parties; or
• the evaluation has ended.

CyberDax may act immediately where delay could reasonably increase security, operational, legal, intellectual-property, or other risk.

When your permission ends, you must stop accessing and using non-public CyberDax materials except to the extent a separate written authorization expressly permits continued use.

Previously obtained CyberDax proprietary materials remain subject to applicable confidentiality, intellectual-property, redistribution, and use restrictions.

These terms do not promise export, migration, retention, or continued availability of beta or evaluation information.

Applicable privacy law and any separate written data terms continue to apply where relevant.

To the maximum extent permitted by applicable law, CyberDax and its members, officers, employees, contractors, agents, licensors, and service providers will not be liable for indirect, incidental, special, exemplary, punitive, or consequential damages, or for loss of profits, revenue, business opportunities, goodwill, data, or business interruption arising from or relating to the beta, demo, evaluation access, or associated materials, even if advised that such damages were possible.

To the maximum extent permitted by applicable law, CyberDax’s aggregate liability arising from or relating to the beta, demo, evaluation access, or these terms will not exceed the amounts actually paid to CyberDax for the applicable beta or evaluation access, if any.

Nothing in these terms excludes or limits liability that cannot lawfully be excluded or limited.

9. Disputes and governing law

Before beginning formal dispute proceedings, a party must send a written description of the dispute and the relief sought to support@cyberdax.io.

The parties will attempt in good faith to resolve the dispute informally for at least 30 days after the notice is received, unless they agree to another period.

If informal discussions do not resolve the dispute, the parties will attempt in good faith to resolve it through mediation.

If mediation does not resolve the dispute, the dispute will be resolved through final and binding arbitration administered by the American Arbitration Association under its applicable rules, except where applicable law requires another process or the parties agree otherwise in writing.

Either party may bring a claim in small claims court where the claim qualifies and applicable law permits it.

Unless the parties agree otherwise or applicable law requires another location, arbitration will take place in Nevada. Proceedings may be conducted remotely where permitted by the applicable rules and the arbitrator.

Either party may seek temporary, preliminary, or emergency court relief where reasonably necessary to protect intellectual property, confidential information, data, systems, security, or access rights while the underlying dispute is pending.

These terms are governed by the laws of the State of Nevada, without regard to conflict-of-law principles, except where applicable law requires otherwise.

Any court proceeding permitted under these terms will be brought in a court with appropriate jurisdiction in Nevada, unless applicable law requires another venue.

A court with jurisdiction may enter judgment on an arbitration award.

**10. Changes and contact

CyberDax may update these terms from time to time.

The current version and effective date will be published with the terms.

Where required by applicable law, CyberDax will provide additional notice of material changes.

Continued use of beta, demo, or evaluation access after updated terms become effective constitutes acceptance where permitted by law.

If any provision of these terms is determined to be invalid or unenforceable, the remaining provisions will remain effective to the fullest extent permitted by law.

CyberDax’s failure to enforce a provision does not waive its right to enforce that provision or another provision later.

Questions regarding evaluation access or these terms may be directed to:

The CyberDax Team
support@cyberdax.io

Version 1.0 | Effective Date: October 29, 2026