Terms of Service

IMPORTANT — PLEASE READ CAREFULLY BEFORE INSTALLING OR USING THE ARRAC PLATFORM.

These Terms of Service ("Terms") constitute a legally binding agreement between Slawomir Kuprowski, an individual trading as ARRAC.IO ("ARRAC", "we", "us", "our"), of [Business Address, United Kingdom], and the entity or individual accepting these Terms ("Customer", "you").

ARRAC.IO is offered directly by Slawomir Kuprowski as an individual under the jurisdiction of England and Wales, until further notice. It is not, at this time, offered by a separate limited company. This structure may change; where it does, these Terms will be updated and Customers notified.

By installing, activating, or using the ARRAC platform, you confirm that you have read, understood, and agree to be bound by these Terms. These Terms govern business customers only. ARRAC does not provide services to consumers.

1. Definitions

"Platform" means the ARRAC software application, including the backend API, dashboard, AI investigation engine, autonomous containment capabilities, and all associated services.

"Autonomous Actions" means containment actions the Platform executes automatically where the Customer has configured Tier 2 (Assisted Automation), Tier 3 (Autonomous Containment), or Tier 4 (Full Autonomous Response).

"Customer Data" means all data, content, and information the Customer or its Authorised Users input into or generate through the Platform, including security event data and incident records.

"Authorised User" means an individual authorised by the Customer to access the Platform on the Customer's behalf.

"Subscription Term" means the period for which the Customer has purchased access to the Platform, as set out in the applicable order or trial confirmation.

2. Grant of Licence

Subject to these Terms and payment of applicable fees, ARRAC grants the Customer a non-exclusive, non-transferable, revocable licence to access and use the Platform during the Subscription Term solely for the Customer's internal business security operations.

• Copy, modify, or create derivative works of the Platform
• Reverse engineer or attempt to derive the source code
• Sublicense, sell, or make the Platform available to third parties other than Authorised Users
• Use the Platform as a managed service without a separate MSP Partner Agreement
• Use the Platform in violation of applicable law

3. Autonomous Actions — Specific Provisions

The Platform provides four configurable autonomy tiers: Suggest (no autonomous execution — every action requires Customer approval), Assisted Automation (low-risk actions execute automatically), Autonomous Containment (standard containment auto-executes within Customer-defined boundaries), and Full Autonomous Response (maximum autonomy within Customer-defined limits).

The Customer acknowledges that enabling Tier 2, 3, or 4 autonomy is the Customer's explicit decision and constitutes the Customer's instruction to ARRAC to execute the relevant actions automatically. ARRAC is not liable for operational consequences of autonomous actions executed strictly in accordance with the Customer's configured autonomy tier and defined boundaries.

All containment actions are designed to be reversible — the Platform isolates and contains suspected threats (for example, revoking a session or an application permission) rather than permanently deleting or destroying data, accounts, or resources. The Customer remains responsible for reviewing autonomous actions and making final remediation decisions.

All autonomous actions are logged to an immutable audit trail. The Customer agrees not to attempt to modify, delete, or circumvent the audit log.

4. Fees and Payment

Fees are payable monthly or annually in advance, as set out in the applicable order. All fees are non-refundable except as expressly set out in these Terms. Subscriptions renew automatically unless cancelled with 30 days' notice before renewal. ARRAC may suspend access after 14 days' non-payment following 7 days' written notice. Trial access, where offered, is free of charge for the stated trial period and carries no payment obligation unless the Customer elects to convert to a paid subscription.

5. Customer Obligations

The Customer is responsible for maintaining the technical environment required by the Platform, including a compatible Microsoft 365 tenant with required permissions and correct Azure App Registration configuration. The Customer is responsible for ensuring that the individual completing onboarding holds sufficient administrative privilege in its own Microsoft 365 tenant to grant the permissions the Platform requests, and for the accuracy of any information it provides during onboarding.

The Customer is responsible for configuring the autonomy tier appropriate to its own risk tolerance and for promptly reviewing any actions the Platform recommends where a lower autonomy tier is in use.

6. Data and Privacy

Processing of personal data by ARRAC on behalf of the Customer is governed by the Data Processing Agreement. The Customer is the data controller in respect of Customer Data. ARRAC processes such data as a processor, on the Customer's documented instructions, as further described in the DPA and the Privacy Policy.

The Platform uses third-party sub-processors, including AI processing and communications providers, to deliver its functionality. A current list of sub-processors is maintained in the DPA.

7. Intellectual Property

All right, title, and interest in and to the Platform, including all underlying software, architecture, methodologies, and documentation, are and remain the exclusive property of ARRAC (Slawomir Kuprowski). Certain aspects of the Platform's autonomy framework are the subject of a pending patent application. Nothing in these Terms transfers any intellectual property right to the Customer beyond the limited licence granted in Section 2.

Customer Data remains the property of the Customer. ARRAC claims no ownership interest in Customer Data and will not use it for any purpose other than providing the Platform to the Customer, except as set out in the DPA.

8. Confidentiality

Each party agrees to keep confidential all non-public information disclosed by the other party in connection with these Terms, and to use such information solely to perform its obligations under these Terms. This obligation does not apply to information that is or becomes publicly available other than through breach of this clause, is independently developed without reference to the disclosing party's confidential information, or is required to be disclosed by law or regulatory authority.

9. Warranties and Disclaimers

ARRAC warrants that it will perform the services described in these Terms with reasonable skill and care. Except as expressly stated in these Terms, the Platform is provided "as is" and "as available", without warranties of any kind, whether express or implied, including any implied warranty of satisfactory quality, fitness for a particular purpose, or non-infringement, to the fullest extent permitted by law.

No security product, service, or platform — including ARRAC — can guarantee the prevention or detection of every threat, or the complete elimination of security risk. ARRAC is one control among several the Customer should maintain as part of a layered security strategy, and does not warrant that use of the Platform will prevent all unauthorised access, data loss, or security incidents.

10. Limitation of Liability

ARRAC's total aggregate liability arising out of or in connection with these Terms, whether in contract, tort (including negligence), or otherwise, shall not exceed the total fees paid by the Customer in the 12 months preceding the event giving rise to the claim. Neither party is liable for indirect, special, consequential, or punitive damages, or for loss of profits, revenue, business, or anticipated savings, even if advised of the possibility of such loss.

Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be limited or excluded.

Because ARRAC.IO is offered by Slawomir Kuprowski as an individual rather than through a limited company, the Customer acknowledges that liability under these Terms is personal to Slawomir Kuprowski, subject always to the limitations set out in this Section 10.

11. Term and Termination

These Terms commence on the date the Customer first accesses the Platform and continue for the Subscription Term, renewing automatically as set out in Section 4 unless terminated earlier in accordance with this Section.

Either party may terminate these Terms for the other party's material breach if such breach remains uncured 30 days after written notice. ARRAC may suspend or terminate access immediately where the Customer's use of the Platform poses a security risk to ARRAC, to other customers, or to any third party.

On termination, the Customer's right to access the Platform ends immediately. The Customer may request export of its Customer Data within 30 days of termination, after which ARRAC will delete or anonymise Customer Data in accordance with the DPA, save where retention is required by law.

12. Indemnification

The Customer agrees to indemnify and hold ARRAC harmless from any claim, loss, or expense (including reasonable legal fees) arising from the Customer's breach of these Terms, misuse of the Platform, or violation of applicable law, except to the extent caused by ARRAC's own breach of these Terms or negligence.

13. Governing Law

These Terms are governed by and construed in accordance with the laws of England and Wales. Each party submits to the exclusive jurisdiction of the courts of England and Wales.

14. General

If any provision of these Terms is found unenforceable, the remaining provisions continue in full force. These Terms, together with the DPA and Privacy Policy, constitute the entire agreement between the parties and supersede any prior agreements relating to their subject matter. ARRAC may update these Terms from time to time; material changes will be notified to active Customers by email or in-Platform notice at least 30 days before taking effect.