Parties and structure
These software licence terms ("Terms") are between Fluence Security - Paweł Mierzwa, NIP 9571182795 ("FluenceSecurity") and the organisation identified in an order form, quotation or agreement that references these Terms ("Customer"). The order form sets the commercial details: edition, number of protected endpoints and organisations, term, fees and support level. In case of conflict, the order form prevails over these Terms.
Where FluenceSecurity processes personal data on the Customer's behalf, the data processing agreement applies in addition to these Terms.
Definitions
- Platform: the XenXDR software, including the console, ingest pipeline, detection and automation engines, customer portal and related components, in object code form, together with documentation.
- Agent: the XenXDR endpoint agent installed on Customer's endpoints.
- Self-hosted deployment: the Platform installed and operated on infrastructure controlled by the Customer.
- Hosted tenant: a dedicated instance of the Platform operated by FluenceSecurity for the Customer.
- Endpoint: a physical or virtual computer on which the Agent is installed or from which telemetry is collected.
- Organisation: a tenant configured in the Platform, typically corresponding to one legal entity the Customer protects.
- Content pack: detection rules, playbook templates and similar content supplied with the Platform.
Licence grant
Subject to payment of the fees and compliance with these Terms, FluenceSecurity grants the Customer a non-exclusive, non-transferable licence, for the term stated in the order form, to:
- for a self-hosted deployment, install and run the Platform on Customer-controlled infrastructure and install the Agent on the number of Endpoints and for the number of Organisations stated in the order form;
- for a hosted tenant, access and use the Platform through the tenant provided by FluenceSecurity, and install the Agent on the licensed number of Endpoints;
- use the documentation and the Content pack in connection with the Platform;
- if the order form designates the Customer as a managed security service provider, use the Platform to provide services to the Customer's own clients within the licensed number of Organisations.
Restrictions
The Customer must not, and must not allow anyone else to:
- copy the Platform except for backup and the operation of the licensed deployment;
- modify, translate or create derivative works of the Platform, other than configuration, rules and playbooks created through its intended interfaces;
- reverse engineer, decompile or disassemble the Platform, except to the extent expressly permitted by applicable law notwithstanding this restriction, and then only after asking FluenceSecurity for the information sought;
- rent, lease, sublicense or resell the Platform, except as an MSSP under the licence grant above;
- remove or alter any proprietary notice;
- use the Platform to monitor persons where the Customer lacks a lawful basis, or in breach of applicable law.
Detection rule conditions, prompts and tuning data supplied with the Platform are confidential information of FluenceSecurity even where they are readable in the product.
Customer responsibilities
The Customer is responsible for:
- lawful use of the Platform, including complying with employment law when monitoring staff. In Poland this includes the obligation to inform employees about monitoring under art. 22² and 22³ of the Labour Code and to define its scope and purpose in workplace regulations or a collective agreement;
- the accuracy of data it sends to the Platform and the lawfulness of collecting it;
- for self-hosted deployments, the security and availability of the infrastructure, backups, upgrades and the model endpoint it configures;
- managing its own users, roles and organisation grants;
- decisions taken on the basis of Platform output. AI verdicts, summaries and recommendations are advisory; the Customer decides whether and how to act on them.
Updates and telemetry
FluenceSecurity may provide updates to the Platform, the Agent and the Content pack. Agent updates are signed and verified against a key pinned at installation; the Customer controls when updates are applied. The Platform does not transmit Customer data to FluenceSecurity. The only outbound connections are those the Customer configures, such as a model endpoint, threat intelligence feeds or notification channels, and connections needed to download updates.
Hosted tenants
For hosted tenants FluenceSecurity operates the infrastructure, applies updates, performs backups and monitors availability. Service levels for hosted tenants are stated in the order form. The Customer retains ownership of its data and may export it at any time in the documented formats. On termination FluenceSecurity provides an export on request and deletes the tenant's data within 30 days, subject to legal retention obligations.
Support
Support is provided as described in the order form. Unless stated otherwise, support covers the current release and the one before it, during Polish business hours, by email and the customer portal.
Fees
Fees are stated in the order form and are exclusive of VAT. Fees are based on the licensed number of Endpoints and Organisations; the Customer must notify FluenceSecurity if either is exceeded, and the excess is invoiced at the rates in the order form. Invoices are payable within 14 days unless the order form states otherwise.
Intellectual property
The Platform is licensed, not sold. FluenceSecurity and its licensors retain all rights in the Platform, the documentation and the Content pack. The Customer retains all rights in its data, its own detection rules and playbooks, and its reports. The Platform incorporates open-source components under their own licences, listed in the documentation; those licences apply to the components in question.
Confidentiality
Each party keeps the other's confidential information secret, uses it only for the purposes of the agreement and protects it with at least reasonable care, for the term of the agreement and five years afterwards. Confidential information does not include information that is public without breach, independently developed or lawfully received from a third party.
Warranties and disclaimer
FluenceSecurity warrants that the Platform will perform materially as described in the documentation for the licensed version. The Customer's exclusive remedy for breach of this warranty is repair, replacement or, if neither is achieved within a reasonable time, termination and a pro-rata refund of prepaid fees.
The Platform is currently offered in an early access phase. FluenceSecurity does not warrant that the Platform will detect every threat, that it is error-free, or that any integration marked as "coming soon" will become available by a given date. Except as expressly stated, the Platform is provided without other warranties, express or implied, including fitness for a particular purpose.
Liability
Neither party is liable for indirect or consequential loss, including loss of profit, revenue or data, except in cases of wilful misconduct or gross negligence. Each party's total liability under the agreement is limited to the fees paid or payable by the Customer in the twelve months preceding the event giving rise to the claim. These limits do not apply to breaches of confidentiality, infringement of intellectual property, or liability that cannot be limited under applicable law.
Term and termination
The agreement runs for the term in the order form and renews for successive terms of the same length unless either party gives notice at least 30 days before the end of the current term. Either party may terminate for material breach not cured within 30 days of written notice. On termination the licence ends; the Customer must stop using the Platform and uninstall the Agent, and may export its data as described above.
Export control and sanctions
The Customer confirms it is not subject to sanctions of the EU, the United Nations or the United States and will not use the Platform in breach of export control law.
Audit
On 30 days' notice and no more than once a year, FluenceSecurity may ask the Customer to confirm the number of Endpoints and Organisations in use. The Platform's own inventory is the basis for this confirmation; no on-site inspection is required.
General
These Terms are governed by the law of the Republic of Poland, with disputes resolved by the common court competent for FluenceSecurity's registered office. Neither party may assign the agreement without the other's consent, except to a successor of its business. If any provision is invalid, the remainder stays in force. Changes require written form.