Terms of Service

LAST UPDATED · 24 SEPTEMBER 2026

1. Acceptance

These terms are an agreement between you and Calyra, which operates Custodis. When you create a Custodis account or use the service in any way, you agree to these terms. If you do not agree, do not create an account and do not use the service. If you are signing up on behalf of an organization, you confirm that you have the authority to bind that organization to these terms, and references to "you" throughout this document mean both you personally and the organization you represent. We may update these terms from time to time; material changes will be announced in-product and by email at least fourteen days before they take effect, and your continued use of the service after that date constitutes acceptance of the revised terms.

2. The Service

Custodis is a cyber risk monitoring platform. It checks the internet-facing assets of the domains you register, calculates a graded risk score from what it observes, surfaces prioritized issues, and alerts you when material changes occur. It can also monitor the domains of organizations you work with, as described in section 4. The service is provided on an "as is" and "as available" basis, without warranties of any kind, express or implied. We may add, modify, or remove features at any time, and we may impose reasonable rate limits or scan-frequency caps to maintain service quality. We do not guarantee that scans will identify every issue or that the platform will be uninterrupted or error-free.

3. Your Account & Organization

A Custodis account can belong to one or more organizations, and each organization's data is kept separate from every other's. You are responsible for all activity that occurs under your account, including actions taken by users you invite and the roles you grant them. You must keep your login credentials and API keys confidential, choose a strong password, and use multi-factor authentication where available. You must notify us promptly at security@custodis.app if you suspect unauthorized access to your account, credential compromise, or any other security incident affecting your organization. You are responsible for ensuring that the users you invite are entitled to access your organization's data.

4. Scanning & Permitted Use

Custodis checks domains in two ways. Passive checks — DNS lookups, TLS connections to port 443, and a request for the home page over HTTPS and HTTP — run on every domain being monitored. They are ordinary client requests, except that some of the TLS connections offer only outdated protocol versions or cipher suites, to learn whether the server still accepts them, and end once the server has answered. Active checks — connection attempts to a fixed list of common service ports — run only on a domain you have proven you control by publishing a DNS TXT verification record, and only after you have turned them on for that domain.

You may register domains you own or are authorized to assess. You may also add the domains of organizations you have a genuine business relationship with, such as suppliers, vendors and partners, for passive monitoring; active checks can never be enabled on a domain you have not verified. By adding a domain you confirm that you have a legitimate reason to monitor it and that doing so does not violate applicable law. Monitoring organizations you have no relationship with, attempting to evade our rate limits, or misrepresenting ownership of a domain is misuse and will result in termination of access. See our Responsible Scanning Policy for exactly what is checked and how a domain owner can opt out.

5. Data & Privacy

We process scan results and account information as described in our Privacy Policy. You own the data your organization generates and the configuration you enter. You can export your findings as CSV and your rating as a PDF report from the dashboard at any time. We keep your scan history for as long as your organization exists, and we delete your organization and its data when you ask us to at privacy@custodis.app. We do not sell your data and we do not use the contents of your scans to train models. Industry benchmarks shown in the product combine many organizations' ratings into ranges, and no individual organization's rating is ever shown to another.

6. Subscriptions & Billing

Paid plans are invoiced monthly in advance, and access runs to the end of the period you have paid for. New organizations receive a fourteen-day trial at the limits of the Garrison plan that does not require a card. When a trial or a paid period ends without renewal, your organization becomes read-only: scanning stops and changes are disabled, but your findings and history remain readable for as long as the organization exists, so nothing is lost if you renew. To start, renew or change a plan, write to sales@custodis.app. Refunds are issued at our discretion, typically only for billing errors on our side.

7. Acceptable Use

You agree not to reverse engineer, decompile, or attempt to extract the source code of the service; not to resell, sublicense, or provide Custodis to third parties without our prior written consent; and not to attempt to circumvent rate limits, access controls, or the separation between organizations. You must not use the service to store or transmit malware, to conduct denial-of-service activity, or to probe other organizations' data. We may suspend or terminate accounts that violate this section without prior notice, and we will cooperate with law enforcement where required.

8. Limitation of Liability & Termination

To the maximum extent permitted by law, neither party shall be liable for indirect, incidental, consequential, special, or punitive damages, and our aggregate liability arising from the service is limited to the fees you paid us in the twelve months preceding the event giving rise to the claim. You may cancel at any time; your access continues to the end of the period you have paid for and no further invoices are issued. We may end the service for convenience with thirty days' written notice, and we may terminate or suspend access immediately for material breach of these terms, non-payment after a fifteen-day cure period, or use of the service in violation of applicable law. Sections 5 and 8 survive termination.