The Agreement
These Terms of Service are between Kickflip Grødahl, organisation number 937 657 269 (“Rogue”), and the organisation that signs up for Rogue (“Customer”). The person who signs up accepts these terms on the Customer’s behalf by ticking the box at sign-up, and confirms they have authority to do so. Rogue keeps a record of when the Customer completed sign-up and accepted these terms.
The Service is for businesses and other organisations only, not for consumers.
If the Customer has signed a separate order form with Rogue, the order form takes precedence where it conflicts with these terms. The Data Processing Agreement takes precedence on data protection matters.
Definitions
- Service: the Rogue platform, its API and related documentation.
- User: a person the Customer authorises to use the Service.
- Customer Data: data the Customer or its Users submit to the Service or connect to it, including exposure data from connected platforms.
- Output: threat cards, rationales, recommendations and other results the Service produces.
The Service
Rogue matches published threat intelligence against the Customer’s own exposure and shows which threats are likely to matter to the Customer next, with the reasoning and recommended checks.
Rogue is a decision-support tool. It is not a security monitoring service, does not detect or stop attacks and does not replace the Customer’s own security controls or judgement.
While this agreement runs, Rogue gives the Customer a non-exclusive, non-transferable right for its Users to use the Service for the Customer’s internal business.
We may improve and change the Service over time. We will not remove a core function the Customer pays for without 30 days’ notice.
Accounts and Access
- The Customer is responsible for who it gives access to and for what its Users do in the Service.
- Users keep their sign-in details secure and do not share accounts.
- The Customer tells us promptly about any unauthorised access it becomes aware of.
Customer Data and Connections
The Customer owns its Customer Data. The Customer gives Rogue the right to process Customer Data only to provide, secure and support the Service.
Rogue may use data about how the Service is used to improve the Service. This does not include Customer Data.
When the Customer connects a platform such as Microsoft Defender Vulnerability Management, it confirms that it is entitled to share that data with Rogue. Rogue reads from connected platforms and does not change them, unless the Customer turns on a feature that says otherwise.
The Customer’s Users can connect Rogue to an AI assistant they use, such as Claude. Rogue then sends Customer Data to that assistant when they ask for it. The assistant’s provider is the Customer’s own provider, not Rogue’s subprocessor. The Customer decides which assistants its Users may connect and is responsible for that provider’s terms, including whether the provider may use the data to train its models.
Rogue processes personal data in Customer Data under the Data Processing Agreement, which forms part of these terms.
Acceptable Use
The Customer and its Users may not:
- use the Service to attack, probe or gain unauthorised access to any system,
- connect data they have no right to share,
- reverse engineer, copy or resell the Service,
- interfere with the Service or test its security without our written permission,
- use the Service in breach of law or export controls.
Suspension
We may suspend access, in whole or in part, if the Customer or its Users break the acceptable use rules, if fees are more than 30 days overdue after a reminder, if access poses a security risk to the Service or other customers, or if the law requires it. We tell the Customer why, limit the suspension to what is needed and restore access once the reason is resolved.
AI-Generated Content
Parts of the Output are written by AI. Output can be incomplete or wrong. The Customer should check it before acting on it, especially before changing production systems, and is responsible for the decisions it takes based on Output.
Rogue does not use Customer Data to train AI models.
Fees and Payment
The free plan is free: it has no fees and Rogue never invoices for it. If Rogue introduces paid or usage-based pricing, it will update these terms first and the Customer chooses whether to take it up.
For a paid plan, fees and the billing period are set out in the Customer’s order form. Fees are in Norwegian kroner (NOK) unless the order form says otherwise, and exclude value added tax (MVA), which is added where applicable. Rogue invoices in advance for each billing period, and invoices are due 30 days after the invoice date. Late payments accrue interest under the Norwegian Late Payment Interest Act (forsinkelsesrenteloven). Rogue may change its prices by notifying the Customer at least 30 days before the next billing period starts.
Prepaid fees are not refunded, except where these terms or the Data Processing Agreement say otherwise.
Intellectual Property
Rogue owns the Service and everything it is built from. The Customer may use the Output for its own internal security work. If the Customer sends us feedback, we may use it to improve Rogue without obligation.
Confidentiality
Each party keeps the other’s non-public information confidential, uses it only for this agreement and protects it at least as well as its own. This does not apply to information that is public, already known, rightfully received from a third party or independently developed, or that must be disclosed by law.
This duty lasts while the agreement runs and 3 years after it ends. When the agreement ends, each party returns or deletes the other’s confidential information on request, unless law requires it to keep it.
Warranties and Disclaimers
Rogue will provide the Service with reasonable skill and care. Apart from that, the Service is provided “as is”. Rogue does not promise that the Service will identify every relevant threat or prevent any incident.
Limitation of Liability
Neither party is liable for indirect or consequential loss, lost profits or lost data. On a paid plan, each party’s total liability under this agreement is limited to the fees the Customer paid in the 12 months before the claim. On the free plan, the Service is provided as is, and Rogue’s liability is limited as far as Norwegian law allows.
These limits do not apply to the Customer’s obligation to pay fees, to a breach of Acceptable Use or of Rogue’s intellectual property, or to loss caused by gross negligence or wilful misconduct.
Term and Termination
This agreement runs for as long as the Customer has an account. On the free plan, the Customer may end it at any time by deleting its organisation, and Rogue may end it with 30 days’ notice. On a paid plan, either party may end it with effect from the end of the current billing period.
Either party may end it straight away by written notice if the other party materially breaches it and does not fix the breach within 30 days of being told, or at once if the breach cannot be fixed or the other party becomes insolvent.
The Customer can ask Rogue for a copy of its Customer Data at any time before termination and up to 30 days after it, free of charge, in CSV format. The copy covers the organisation profile, connected-platform settings (without credentials), assets and their software and vulnerabilities, threat cards and the activity log. Rogue then deletes Customer Data as described in the Data Processing Agreement. If the Customer deletes its organisation in the Service, Rogue deletes Customer Data at once and cannot provide a copy afterwards.
Changes to These Terms
We may update these terms. We will notify the Customer’s account admins by email at least 30 days before a material change takes effect. If the Customer does not accept the change, it may end the agreement before the change takes effect and receive a refund of prepaid fees for the remaining period. Continuing to use the Service after that date means accepting the new terms.
General
- Assignment: neither party may transfer this agreement without the other’s consent, except Rogue may transfer it to a buyer or successor of its business.
- Force majeure: neither party is liable for delay or failure caused by events outside its reasonable control.
- Notices: Rogue sends notices to the Customer’s account admins by email. The Customer sends notices to dpo@rogue.no.
- Entire agreement: these terms, the order form and the Data Processing Agreement are the whole agreement between the parties.
- Severability: if a clause is invalid, the rest of the agreement still applies.
- Survival: clauses that by their nature should continue after termination, such as confidentiality, liability and data deletion, do so.
Governing Law
This agreement is governed by Norwegian law. Disputes go to Oslo District Court (Oslo tingrett).
Contact
Kickflip Grødahl
Nils Bays vei 18, 0876 Oslo, Norway
dpo@rogue.no