1. Who we are and what these Terms cover
1.1 The AdverseMonitor service (the "Service") is operated by AdverseMonitor ("we", "us", "our"), operating from Malaysia and online at adversemonitor.com. You can reach us at any time at support@adversemonitor.com, which is the address for notices under clause 22.1. We will publish our registered business name, registration number and correspondence address on this page once our company registration is completed, and will update the version history below when we do.
1.2 These Terms, together with your order and our Privacy Policy at https://adversemonitor.com/terms, form the agreement between you and us for your use of the Service, including the platform at https://platform.adversemonitor.com and the free domain scan and any other record-lookup tool we make available at https://adversemonitor.com. Where these Terms and any other page conflict, these Terms prevail.
1.3 How this agreement is formed. You accept these Terms by ticking the acceptance box at sign-up or checkout, or by using the Service. When you purchase a plan you also authorise us, through our payment processor, to charge the applicable fee on the purchase date and automatically on each renewal date under clause 8.4, until you cancel under clause 9. We retain a record of your acceptance and of that authorisation.
1.4 Free scan. The free domain scan is offered without an account. By using it you agree to clauses 3, 6.2, 15, 16 and 21, which apply to your use of it and to any result it returns. A scan result is a count of unverified third-party claims held in our index. It is not a statement by us that any organisation has been compromised, and must not be used or published as one. You may use it only for a domain or organisation you represent or are authorised to act for.
1.5 Our other published pages — including /security, /methodology, /api, /editorial and our blog — are provided for information. They are not contractual commitments, warranties or specifications.
1.6 Contact: support@adversemonitor.com for support, data protection and complaint matters; info@adversemonitor.com for billing; security@adversemonitor.com for vulnerability reports.
2. Who may use the Service
2.1 The Service is offered for business use only. By accepting these Terms you confirm you are using the Service for purposes related to your trade, business, craft or profession, and not as a consumer.
2.2 You must be at least 18 years old and able to form a binding contract. If you accept on behalf of an organisation, you confirm you are authorised to bind it, and "you" means that organisation.
2.3 You may permit your employees and contractors ("Authorised Users") to use the Service under your account. You are responsible for their acts and omissions as if they were your own.
3. What the Service does — and its limits
This clause 3 describes material characteristics of the Service. Please read it. Our pricing reflects these limits.
3.1 What we provide. The Service receives third-party cyber-incident records from an upstream collection layer, makes the received records searchable, and records dashboard matches when newly received records meet criteria in an alert profile.
3.2 Records are unverified third-party claims. Records originate from criminal and other third-party sources. They may be false, exaggerated, incomplete, out of date, misattributed, or fabricated. We do not verify their accuracy and we do not endorse them. A match is an investigation lead, not proof that any organisation has been compromised. You must verify independently before relying on, acting on, or communicating any record. Records are displayed with attribution to the source that published them and, where known, the identity of the party making the claim.
3.3 Coverage is incomplete. We do not claim to collect every relevant record, monitor every source, or detect every exposure. The absence of a match does not mean you are unaffected, and must never be represented as evidence that an organisation is secure or uncompromised.
3.4 No backfill. An alert profile is compared only against records collected after that profile is created. Profiles are never run backwards over records already held. To review existing records, use the search function.
3.5 Delivery is best-effort. There is an indeterminate and variable delay between a third party publishing material and our collecting it. Matching runs on a periodic cycle. We do not guarantee that any alert will be generated, delivered, delivered intact, or delivered within any period. We offer no service level agreement and no uptime commitment.
3.6 Not professional advice. The Service is not legal, security, forensic, investigative or incident-response advice, and is not a substitute for your own security controls, monitoring, or professional judgment.
4. Plans, trial and entitlements
4.1 Free trial. We may offer a 14-day trial without payment details. Trial entitlements are limited and may change. We may modify or withdraw trials at any time. Trial access ends automatically unless you purchase a plan.
4.2 Plans. Current plans, prices and entitlements — including alert profile limits, data windows, export and API access — are published at https://adversemonitor.com/pricing and shown at checkout.
4.3 Entitlements are limits, not guarantees. Rate limits, key limits, profile limits and data windows are ceilings on use, not commitments to deliver any volume of records or alerts.
4.4 API. Where your plan includes API access, you must use issued keys only as documented, keep them confidential, and stay within published rate limits. We may throttle, suspend or revoke keys to protect the Service.
5. Your account
5.1 You must provide accurate registration details and keep them current.
5.2 You are responsible for safeguarding credentials, passkeys and API keys, and for all activity under your account. Notify us promptly at security@adversemonitor.com if you suspect compromise.
5.3 We may require multi-factor or passkey authentication for some features.
6. Acceptable use
6.1 Permitted purpose. You may use the Service to monitor, investigate and respond to exposure affecting your own organisation, or a client organisation that has engaged you to do so.
6.2 Prohibited conduct. You must not, and must not permit any person to:
(a) use the Service, or any record obtained through it, to extort, threaten, harass, intimidate, defame or pressure any organisation or individual;
(b) contact, re-identify, profile or target individuals named in records, except as strictly necessary and lawful in a legitimate investigation;
(c) resell, sublicense, republish, redistribute or commercially exploit the records or any derivative dataset, or use them to build a competing product;
(d) state or imply that an absence of matches demonstrates that any organisation is secure, uncompromised or free of exposure;
(e) use the Service to facilitate, negotiate or fund a ransom payment in breach of applicable law or sanctions;
(f) scrape, bulk-extract or circumvent rate limits, access controls or authentication;
(g) process personal data obtained through the Service unlawfully, or in breach of your own obligations as a controller or, where you act for a client organisation, as its processor;
(h) use the Service to breach any law, infringe any right, or violate any third party's privacy; or
(i) probe, penetration-test or attack the Service without our prior written consent;
(j) publicly disclose, publish or attribute a record to a named organisation you do not represent or act for, unless you have independently verified it and you attribute the claim to its original source and not to us;
(k) use a record, or the presence or absence of a record, as a factor in any decision about an individual's eligibility for credit, insurance, employment, tenancy or any similar benefit. We are not a consumer reporting agency, credit reference agency or background-screening provider, and records are not consumer reports or credit references; or
(l) continue to rely on, or further disclose in its withdrawn form, any record we have notified you we have suppressed, withdrawn or corrected.
6.3 Security research. Report suspected vulnerabilities to security@adversemonitor.com. Do not access other customers' data, degrade the Service, or publish details before we have had a reasonable opportunity to remediate.
6.4 Enforcement. We may investigate suspected breaches and take action under clause 10.
7. Alert destinations you configure
7.1 You may direct alerts to email addresses, Slack or Microsoft Teams webhooks, browser push subscriptions and outbound webhooks that you supply.
7.2 You are solely responsible for the destinations you configure, for having authority to send data to them, and for their security. Records may contain sensitive third-party information; sending them to a destination is your decision.
7.3 Once data leaves our systems for a destination you nominated, it is subject to that third party's terms and controls, not ours. We are not responsible for a destination that fails, is misconfigured, is unavailable, or discloses data. This clause allocates responsibility between you and us. It does not affect either party's obligations to any data subject or regulator.
8. Fees, billing and renewal
8.1 Annual billing. Plans are billed annually in advance in US dollars unless your order states otherwise. Payment is due on the date of purchase and each renewal date.
8.2 Payment processing. Payments are processed by Stripe. We do not store full card details. Your use of Stripe is subject to Stripe's terms.
8.3 Taxes. Fees exclude taxes. You are responsible for all applicable taxes, duties and withholdings, other than taxes on our income.
8.4 Automatic renewal. Your subscription renews automatically for successive twelve-month terms unless cancelled under clause 9. We will email you a renewal reminder at least 30 days before each renewal date, and a confirmation after each purchase and renewal. The reminder will state your plan, the renewal date, the amount that will be charged, and how to cancel. Renewal is at the then-current price for your plan, as notified under clause 8.5.
8.5 Price changes. We may change prices for a renewal term by giving at least 30 days' notice before the renewal date. If you do not accept the new price, you may cancel under clause 9 before the renewal takes effect.
8.6 Failed payment. If payment fails we may retry, and may suspend access after reasonable notice. You remain liable for amounts properly due. Overdue amounts bear interest at 1.5% per month or the maximum rate permitted by law, whichever is lower, and you must reimburse our reasonable costs of collection.
9. Cancellation and term
9.1 You may cancel at any time through the billing portal or by emailing info@adversemonitor.com. Cancellation is self-serve, takes effect on request, and does not require you to speak to us or complete any additional step.
9.2 Cancellation takes effect at the end of your current subscription term. You keep access until then. Cancellation does not produce a refund of fees already paid — see clause 10.
9.3 You may upgrade at any time; the price difference is charged on upgrade. Downgrades take effect at your next renewal date.
10. Fees are non-refundable
10.1 No refunds. The fee for each subscription term is earned in full at the start of that term and is non-refundable, in whole or in part. No refund, credit, set-off or pro-rata adjustment is available for unused time, partial periods, cancellation, downgrade, non-use, or your dissatisfaction with the Service.
10.2 In particular, no refund is payable because: you cancel part-way through a term; you no longer need the Service; your organisation is restructured, acquired or ceases trading; you disagree with the coverage, accuracy or completeness of the records; a record you expected was not present; no alert was generated because clause 3.4 (no backfill) applied; an alert was delayed, duplicated or undelivered; a destination you configured failed; or you exceeded a plan entitlement.
10.3 Exceptions. Notwithstanding clause 10.1, we will refund:
(a) amounts charged in error, or charged after a valid cancellation took effect;
(b) the unexpired portion of your current term, calculated on a daily pro-rata basis, if we terminate for convenience under clause 11.2 or if you terminate for our material breach that we have failed to cure under clause 11.3; and
(c) the pro-rata amount provided for in clause 20.1 (material adverse change to the Service); and
(d) any amount we are required to refund by applicable law.
10.4 Statutory rights. Nothing in these Terms excludes, restricts or modifies any right or remedy that applicable law does not permit to be excluded, restricted or modified. If you are found to be a consumer despite clause 2.1, your statutory rights — including any applicable cancellation or withdrawal right — apply in full and prevail over this clause 10 to the extent of any conflict. Where you exercise a statutory withdrawal right after asking us to begin providing the Service during the withdrawal period, you must pay a proportionate amount for the Service supplied up to the point of withdrawal.
10.5 Payment disputes. You will contact us at info@adversemonitor.com and allow us 5 business days to respond before initiating a dispute with your card issuer. Nothing in this clause affects any right you have to raise a dispute with your issuer. If you initiate a dispute for an amount validly due under these Terms, we may recover our reasonable costs of responding and may suspend access until it is resolved.
11. Suspension and termination
11.1 Suspension. We may suspend your access, in whole or part, where we reasonably believe it is necessary to address a security risk, a breach of clause 6, non-payment, or a legal requirement. Where practicable we will give notice and an opportunity to remedy, and will restore access promptly once the cause is resolved. If we suspend you for a reason not attributable to you and the suspension continues for more than 7 consecutive days, we will on request credit or refund a pro-rata amount for the period of suspension. No refund is due for a suspension attributable to you.
11.2 Termination for convenience by us. We may terminate on 30 days' notice, in which case clause 10.3(b) applies.
11.3 Termination for breach. Either party may terminate if the other commits a material breach and fails to cure it within 30 days of written notice. We may terminate immediately for a serious breach of clause 6 where cure is not possible.
11.4 Effect of termination. Access ends. You must stop using the Service and any records obtained through it, except records you have lawfully exported and still need for a legitimate investigation you began during your subscription.
11.5 Export window. Where your plan included export, you may request an export of your configuration and alert history for 30 days after termination, unless we terminated for a serious breach of clause 6. We may delete your data after that period.
11.6 Survival. Clauses 3.2–3.6, 6, 8 (for accrued amounts), 10, 11.4–11.6, 12, 13, 14, 15, 16, 17, 18, 19, 21 and 22 survive termination.
12. Intellectual property and licences
12.1 Our rights. We own the Service, the software, our compilation of the records, and all associated intellectual property. No rights are granted except as expressly stated.
12.2 Your licence. During your subscription we grant you a non-exclusive, non-transferable, revocable right to access and use the Service, and to use records and outputs for the permitted purpose in clause 6.1, including in reports you provide to a client organisation that has engaged you.
12.3 Your data. You retain ownership of the configuration and content you submit. You grant us, and our hosting and infrastructure providers acting on our behalf, a non-exclusive licence for the term of your subscription and any backup retention period described in our Privacy Policy, to host, process and use it to provide, secure and improve the Service.
12.4 Feedback. If you give us suggestions, we may use them without restriction or obligation.
13. Privacy and data protection
13.1 Our handling of personal data relating to you, your Authorised Users and your account is described in our Privacy Policy at https://adversemonitor.com/terms.
13.2 We act as an independent controller in respect of (a) the records we collect from leak sites and other third-party sources, and (b) our own account, billing, security and product-activity data. We collect the records and make them available to customers in reliance on our legitimate interests in detecting and reporting criminal data exposure. Because the records are obtained from third-party sources and not from the individuals named in them, we rely on the exception in applicable law for notice that would involve disproportionate effort, and we operate the complaint and removal route in clause 14 in its place. Where you submit personal data that we process only on your instructions — including alert destination details and the contents of alerts routed to them — we act as your processor and clause 13.4 applies.
13.3 Records may contain personal data relating to third parties that we did not obtain from those individuals. You must ensure that your own use of that data is lawful, and you are independently responsible as controller for that use. This includes establishing and recording a lawful basis, complying with any notice obligation you owe, honouring data subject rights owed by you, and applying appropriate safeguards.
13.4 Where we act as your processor under clause 13.2, our data processing agreement governs that processing and is incorporated into these Terms by reference. The current version is available from support@adversemonitor.com. If you require it executed as a separate signed document, or require standard contractual clauses for international transfers, contact support@adversemonitor.com.
14. Complaints and removal requests
14.1 Any person — customer or not, including an organisation or individual named in a record — may raise a complaint or removal request at support@adversemonitor.com. An account is not required.
14.2 We will acknowledge within 5 business days and aim to confirm the outcome, with our reasons, within 30 days. Where fabrication, misidentification or unlawful content is credibly alleged, we may suppress the record pending review. We may also mark a record as disputed and record the response of the organisation or individual named in it. Where we suppress, withdraw or correct a record after an alert or export has been issued, we will use reasonable efforts to notify the customers concerned.
14.3 This clause reflects our commitment to correcting our corpus and does not limit any legal right you may have.
15. Disclaimers
15.1 To the fullest extent permitted by law, the Service and all records are provided "as is" and "as available", and we disclaim all warranties, conditions and representations, express or implied, including any implied warranty of merchantability, satisfactory quality, fitness for a particular purpose, accuracy, completeness, non-infringement and uninterrupted or error-free operation.
15.2 Without limiting clause 15.1, we do not warrant that records are accurate, complete, current or truthful; that any exposure will be detected; that any alert will be generated or delivered; or that the Service will identify every relevant event.
15.3 We hold no certification such as SOC 2 or ISO 27001, and make no representation that we do. Our current security posture is described, with its limitations, at /security.
15.4 Nothing in these Terms excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded.
16. Limitation of liability
16.1 Subject to clause 15.4, neither party is liable for indirect, special, incidental, consequential, exemplary or punitive damages, or for loss of profit, revenue, business, goodwill, anticipated savings or data, however arising, even if advised of the possibility.
16.2 Subject to clause 15.4, our total aggregate liability arising out of or in connection with these Terms and the Service, whether in contract, tort (including negligence), statute or otherwise, is limited to the greater of (a) the fees you paid us in the 12 months immediately before the event giving rise to the claim, and (b) USD $100.
16.3 You acknowledge that the limits in this clause 16 reflect the fees charged, the nature of the Service described in clause 3, and the fact that records are unverified third-party claims, and that we would not provide the Service on these prices without them.
16.4 Each party must take reasonable steps to mitigate its losses.
17. Indemnity
17.1 You will indemnify us against losses, damages, liabilities, costs and reasonable legal fees arising from (a) your breach of clause 6, (b) your use, disclosure or republication of any record, including any claim by a person or organisation named in a record, and (c) your breach of clause 13.3. You have no obligation under this clause to the extent the claim arises from our own breach of these Terms, negligence or wilful misconduct.
17.2 We will notify you promptly of any claim, allow you to control the defence with counsel reasonably acceptable to us, and provide reasonable cooperation at your expense. You may not settle a claim in a way that imposes an obligation or admission on us without our consent. We may participate in the defence with our own counsel at our own expense, and may assume conduct of the defence where the claim concerns the accuracy, provenance or lawfulness of a record, or where you have not assumed the defence within 20 business days of notice — in which case you remain liable under clause 17.1 for our reasonable costs. You may not settle any claim on terms that include an admission or public statement about the accuracy or provenance of any record without our prior written consent.
17.3 Your total liability under clause 17.1 is limited to the greater of (a) three times the fees you paid us in the 12 months before the claim, and (b) USD $10,000. This limit does not apply to a claim arising from your breach of clause 6.2(a), (b), (c), (e), (j) or (k), or from your deliberate or unlawful misuse of a record, for which your liability under clause 17.1 is unlimited.
18. Confidentiality
18.1 Each party will protect the other's confidential information with reasonable care and use it only for purposes of this agreement.
18.2 This does not apply to information that is public through no breach, independently developed, lawfully received from a third party, or required to be disclosed by law or a competent authority, provided reasonable notice is given where lawful.
19. Export control and sanctions
19.1 You confirm you are not located in, organised under the laws of, or ordinarily resident in a country or territory subject to comprehensive sanctions, and are not a person with whom dealing is prohibited under applicable sanctions or export control laws.
19.2 You must not make the Service available to any such person, or use it in breach of those laws.
20. Changes
20.1 To the Service. We may modify, add to or discontinue features. If we make a change that materially and adversely reduces core functionality for your plan, you may terminate within 30 days of notice and receive a pro-rata refund of the unexpired portion of your term.
20.2 To these Terms. We may amend these Terms. We will give at least 30 days' notice by email or in-product of any material change, and it will take effect at the start of your next subscription term, or on the stated date for non-material changes. If you do not accept a material change, you may cancel before it takes effect. Continued use after that date constitutes acceptance. Where a change is required by law, by a regulator or by our payment processor, we may make it on shorter notice and it takes effect on the date we state.
20.3 Version history. The current version and its effective date appear at the top of this page. Superseded versions are available on request.
21. Governing law and disputes
21.1 These Terms and any dispute arising out of or in connection with them are governed by the laws of Malaysia, without regard to conflict of laws rules.
21.2 The courts of Malaysia have exclusive jurisdiction, except that either party may seek injunctive or other equitable relief in any competent court to protect its intellectual property or confidential information.
21.3 Before commencing proceedings, the parties will attempt in good faith to resolve the dispute through discussion between senior representatives for 30 days after written notice of the dispute, except that neither party must observe this clause before seeking injunctive or other equitable relief under clause 21.2.
21.4 Nothing in this clause deprives a person who is in law a consumer of the protection of mandatory provisions of the law of their habitual residence, or of the right to bring proceedings there.
22. General
22.1 Notices. Notices to you are given by email to your registered address or in-product, and are deemed received on the next business day after sending. You must keep a monitored email address on your account; we are not responsible for notices, including renewal reminders under clause 8.4, that fail because your address is inaccurate or unmonitored. Notices to us must be sent to info@adversemonitor.com and, for formal legal notices, to our registered address in clause 1.1.
22.2 Assignment. You may not assign or transfer this agreement without our written consent, not to be unreasonably withheld. We may assign it to an affiliate or in connection with a merger, acquisition or sale of assets, on notice to you.
22.3 Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control. If such an event continues for more than 60 days, either party may terminate and clause 10.3(b) applies.
22.4 Severability. If any provision is held invalid or unenforceable, it is modified to the minimum extent necessary or severed, and the remainder continues in force.
22.5 Waiver. A failure or delay in enforcing a right is not a waiver of it.
22.6 Entire agreement. These Terms, your order and the Privacy Policy are the entire agreement between the parties on this subject and supersede all prior discussions. Neither party relies on any statement not set out in them. Nothing in this clause limits liability for fraud or fraudulent misrepresentation.
22.7 No partnership. Nothing creates a partnership, joint venture, agency or employment relationship.
22.8 Third party rights. No person other than you and us has any right to enforce these Terms, other than clause 14, on which any person may rely.
22.9 Language. These Terms are in English. Any translation is for convenience only, and the English version prevails.
Questions about these Terms: support@adversemonitor.com