Terms of service.

1. Parties

These Terms are an agreement between Permus Information Technology LLC, a company registered in Dubai, UAE ("we", "Permus") and the entity that signs up for an IronCastle subscription ("you", "Customer"). By creating an account, you confirm you have authority to bind your organisation.

2. The service

IronCastle is a managed cybersecurity platform that combines an AI-powered detection engine with a human Security Operations Centre (SOC). Specific capabilities are described on platform.html and depend on your plan.

We provide the service "as available". We will use reasonable efforts to deliver consistent uptime per the SLA in section 7, but the service may be temporarily unavailable for maintenance, scaling, or events outside our control.

3. Your account

• You are responsible for safeguarding your account credentials. Use SSO where available. Use MFA.
• You are responsible for the actions of users you authorise on your tenant.
• You may not share credentials with anyone outside your organisation, or with third parties not formally engaged by you.
• We may suspend access for security reasons (suspected compromise, abuse, non-payment over 30 days) with prior notice where feasible.

4. Fees and billing

• Fees are per-endpoint per-month, listed on pricing.html, billed annually by default.
• Monthly billing is available on Keep and Citadel with a 15% surcharge.
• All prices are in USD unless otherwise specified. Local currency invoicing available for AED, AUD, EUR, GBP.
• Taxes (VAT, GST) are added where applicable. We provide tax-compliant invoices.
• Late payment carries interest at 1.5% per month after a 30-day grace period.
• We will give 60 days' written notice before any price change. You may terminate at the renewal date without penalty if you don't accept the change.

5. Term and termination

The initial term is 12 months from your activation date unless otherwise agreed in writing. The contract renews annually unless either party gives 30 days' written notice of non-renewal.

Either party may terminate immediately for material breach if the breach isn't cured within 30 days of written notice. We may terminate for non-payment after 60 days of overdue invoices.

On termination, you have 30 days to export your data. After 30 days, we delete your data per the retention schedule in our Privacy Policy and the DPA.

6. Your data

You own your data. We are a processor of it; you are the controller. Detailed processing terms are in our Data Processing Agreement, which is incorporated by reference.

We will not access, view, or use customer data except as necessary to deliver the service or as you instruct.

7. Service level agreement

• Portal uptime: 99.9% monthly (Watchtower), 99.95% (Keep), 99.99% (Citadel).
• Detection ingest: 99.99% — we do not lose security events.
• First analyst response: 30 min (Watchtower), 15 min (Keep), 5 min (Citadel) for critical incidents.
• Service credits: 10% of monthly fee for each 0.1% below SLA, up to 100% of the monthly fee.

Credits are the sole remedy for SLA misses. Request them at [email protected] within 30 days of the incident.

8. Warranties & disclaimers

We warrant that the service will perform materially as described in our documentation, that we hold the certifications listed on trust.html, and that our staff are background-checked and trained appropriately.

The service is provided "as is" beyond the express warranties above. We do not warrant that the service will detect every threat — no security product can. We are part of a defence-in-depth strategy, not a guarantee.

9. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, consequential, or punitive damages, or for lost profits, revenue, or data.

Each party's total aggregate liability under this agreement is capped at the fees paid by you to us in the twelve months preceding the claim.

This cap does not apply to: indemnification obligations, breach of confidentiality, gross negligence, wilful misconduct, or amounts owed under the SLA service credit mechanism.

10. Intellectual property

We own the IronCastle platform, agents, detection rules, and all derivative works. You own your data, your configurations, and any custom rules you author.

We grant you a worldwide, non-exclusive, non-transferable licence to use the service during your subscription term.

Feedback you provide to us is non-confidential and we may use it to improve the service without obligation.

11. Acceptable use

You may not use IronCastle to: violate law, infringe IP, send spam, host malware, run pen-tests against systems you don't own, attempt to circumvent the service's security controls, reverse-engineer our software (except as permitted by law), or share access credentials.

12. Confidentiality

Each party will protect the other's confidential information using the same standard of care it uses for its own (not less than reasonable care). Confidential information includes pricing, security architecture, incident details, and personal data covered by the DPA.

13. Governing law & disputes

This agreement is governed by the laws of the Dubai International Financial Centre (DIFC). Disputes will be resolved in the DIFC Courts.

Customers in the EU, UK, or Australia may instead elect the courts of their home jurisdiction by notifying us in writing at contract signing. Customers on Citadel may negotiate a different forum.

14. General

• Entire agreement: these Terms + Privacy Policy + DPA + Order Form (if any) form the whole agreement.
• Severability: if any term is unenforceable, the rest stays in force.
• Assignment: you may not assign this agreement without our written consent. We may assign to an affiliate or in a corporate transaction.
• Force majeure: neither party is liable for failures caused by events beyond reasonable control.
• Notices: in writing to [email protected] (us) or the billing contact on your account (you).

Questions? Email [email protected]. For changes to these terms, see the version history at the top of this page.