Terms and conditions for Cybereinforce services.

Scope of Application

These Terms and Conditions apply to all contracts between Cybeurope, operating the Cybereinforce service, and the customer for the use of Cybereinforce Threat Enforcement, Cybereinforce Brand Protection, Cybereinforce Email Security including PhishSecure, the Cybereinforce browser extensions and Outlook add-in, customer administration portals, integrations, support, and any associated paid or trial service offerings.

These Terms apply whether the customer purchases the service through the website, the customer administration portal, the Microsoft commercial marketplace, a partner, a written order, a purchase order, a quote, or any other documented commercial agreement. Customer terms and conditions that conflict with these Terms shall not apply unless expressly accepted in writing by Cybeurope.

Conclusion of the Contract

Product and service descriptions on the website do not constitute a binding offer. They describe the service and invite the customer to request access, place an order, or conclude a separate service agreement.

• A contract may be concluded when Cybeurope confirms an order in writing or by email.
• A contract may also be concluded when Cybeurope activates a tenant, issues paid access, or begins service delivery after an order.
• When the customer creates a tenant or buys a licence in the customer administration portal, the customer accepts these Terms and the Customer Service Agreement shown there.
• When the customer buys through the Microsoft commercial marketplace, the contract is concluded when the customer activates the purchase on the Cybereinforce activation page.
• Quotes, order forms, and purchase orders become binding only when accepted by Cybeurope.
• The contractual language is English unless otherwise agreed in writing.

Customers are responsible for ensuring that all company, billing, and contact details submitted during order processing are correct and kept up to date.

Description of the Services

Cybereinforce is a browser-centric security platform that helps customers prevent access to malicious or unwanted URLs, manage security policies, enroll protected endpoints, and review security events. Depending on the service tier, the platform may also provide Microsoft integration workflows, event export, IOC processing, administrative APIs, dashboards, and other security operations features.

Cybeurope may improve, modify, or update the service where reasonable, especially for security, legal, operational, or technical reasons, provided the essential contractual purpose of the service is not materially undermined.

Trials, Plans, and Service Tiers

Cybereinforce may be offered on a trial, standard, SME, corporate, or other plan basis. The features, device limits, log retention periods, support scope, and integration rights available to the customer depend on the selected plan.

• Trial access may be limited in duration, scope, retention, device count, mailbox count, PhishSecure time, or integrations.
• Each organisation may use one free trial per product. Deleting a tenant and registering again, or registering from another Microsoft 365 tenant or account of the same organisation, does not start a new trial. Cybeurope may extend a trial at its discretion.
• Paid plans may include different commercial and technical entitlements.
• Certain integrations or export features may only be available in SME or higher tiers.
• Email Security is offered as a single package. Its price depends on the number of protected mailboxes, and every plan includes all detection features and a monthly PhishSecure time allowance.
• Cybeurope may suspend or restrict features when the customer exceeds licensed limits or uses expired trial access.

Prices, Billing, and Payment

Unless otherwise agreed, all prices shown by Cybeurope are net prices plus applicable statutory taxes, including German value-added tax where required. Pricing may depend on the selected tier, number of devices, number of mailboxes, contract term, and any separately agreed services.

Where the customer buys through the Microsoft commercial marketplace, Microsoft invoices and collects the charges, and Microsoft's terms govern billing, renewal, and cancellation of that purchase. The licensed quantity and licence period follow the Microsoft subscription, and the licence ends if Microsoft suspends or cancels it. The service itself is provided by Cybeurope under these Terms.

• Invoices are due on the payment date stated on the invoice.
• Cybeurope may require advance payment for initial subscriptions or custom work.
• Recurring subscriptions may renew automatically for the agreed term unless cancelled in time.
• Customers remain responsible for taxes, banking charges, and mandatory withholding obligations unless the law requires otherwise.

Provision and Delivery of the Service

Cybereinforce is delivered digitally. There is no physical shipment of goods unless separately agreed. Access is usually provided by activating the customer tenant, administrative portal, enrollment capability, or other agreed digital resources.

• Provision dates are target dates unless expressly agreed as binding.
• The customer must provide all information reasonably required for onboarding, integration, and billing.
• Delays caused by missing customer information, third-party dependencies, or force majeure extend delivery periods accordingly.
• Cybeurope may provide services in stages where technically or operationally appropriate.

Right to Cancel

Cybereinforce is intended primarily for business customers. Where the customer qualifies as a consumer under mandatory law and the contract is concluded through distance selling means, statutory cancellation rights may apply.

Where the customer expressly requests immediate performance before the end of the cancellation period, the customer acknowledges that the right to cancel may expire, in whole or in part, once the service has been fully performed or digital access has been activated to the extent permitted by law.

Customer Obligations and Acceptable Use

• Use the service only in environments, browsers, devices, and tenants that the customer owns or is authorised to manage.
• Keep login credentials, tokens, and integration secrets secure.
• Review configuration choices carefully before enforcing policies broadly.
• Not reverse engineer, bypass, disable, or intentionally abuse security controls, licensing mechanisms, or platform protections.
• Not use the service in a way that violates law, third-party rights, export control rules, or applicable sanctions.
• Ensure internal end users are informed of the customer’s own organisational rules, monitoring policies, and lawful basis for deployment.
• Involve employee representatives, such as a works council, where the law requires it before deploying the browser extensions, Email Security, or the Outlook add-in.
• Grant Microsoft 365 or Microsoft Entra ID consent to Cybereinforce applications only through a person authorised to do so for the customer.
• Not use PhishSecure to access content unlawfully, to attack third parties, or to enter credentials or personal data on pages the user does not trust.

Availability, Maintenance, and Support

Unless a separate service level agreement is signed, Cybereinforce is provided on a commercially reasonable basis. Cybeurope may carry out maintenance, deploy security patches, rotate credentials, or implement emergency safeguards where necessary.

Planned maintenance windows, third-party outages, Internet disruptions, browser changes, Microsoft 365 or cloud infrastructure incidents, or customer environment issues may affect availability. Cybeurope will make reasonable efforts to reduce disruption.

Warranty and Liability for Defects

The customer must notify Cybeurope without undue delay of any reproducible defect. Cybeurope may first attempt to remedy the issue through correction, workaround, replacement functionality, or reasonable re-performance.

Insignificant deviations, issues caused by customer systems, unsupported environments, or misuse do not constitute a defect of the service.

Limitation of Liability

Cybeurope is liable without limitation in cases of intent, gross negligence, injury to life, body, or health, and where liability cannot be excluded under mandatory law.

In cases of slight negligence, Cybeurope is liable only for the breach of essential contractual obligations, and only for typical, foreseeable damage. Essential contractual obligations are those whose fulfilment makes the proper performance of the contract possible in the first place.

Except where mandatory law provides otherwise, Cybeurope is not liable for indirect damages, lost profits, lost data, business interruption, reputational losses, or damages caused by third-party services, unsupported environments, customer misconfiguration, or the customer’s failure to act on security alerts or configuration guidance.

Intellectual Property and Use Rights

All rights in the Cybereinforce software, website, APIs, documentation, branding, designs, workflows, and related materials remain with Cybeurope or its licensors. The customer receives only the limited, non-exclusive, non-transferable right to use the service during the contract term for its own internal business purposes in accordance with the contract.

Customers may not reproduce, resell, sublicense, modify, or publicly distribute the service except as expressly permitted in writing.

The customer's data remains the customer's. Domains, URLs, and other technical indicators of threats observed through the service may be added to Cybereinforce threat intelligence and used to protect all Cybereinforce customers. Such indicators never include email content, attachments, or information identifying the customer's users.

Data Protection and Confidentiality

Data protection matters are governed by the applicable privacy policy and, where relevant, a separate data processing agreement. Each party shall protect confidential information received from the other party and use it only for the contractual purpose.

Where Cybeurope processes personal data on the customer's behalf, it does so as a processor, only to provide the service and according to the customer's instructions. The customer's data is stored in the data region chosen when the tenant was created, which cannot be changed later.

The customer acknowledges that the service relies on subprocessors and infrastructure providers to operate the platform, as described in section 15.

Email Security, PhishSecure, and the Outlook Add-in

These terms apply in addition to the rest of these Terms when the customer uses Cybereinforce Email Security. Where they differ, this section prevails for Email Security.

Access to Microsoft 365.

• A Global Administrator of the customer's Microsoft 365 tenant grants the Cybereinforce Email Security application permission to read and change mail in the protected mailboxes and to read the list of users. Without this consent the service cannot scan email.
• The customer confirms that it has a lawful basis to have its users' email analysed, and that it informs its users as the law requires.
• The customer may withdraw consent at any time in Microsoft Entra ID. The service then stops scanning email. Withdrawing consent does not end the contract or any obligation to pay.

Licences.

• Email Security is licensed per protected mailbox. Mailboxes beyond the licensed number are not protected. Where the customer chooses to protect every user, new mailboxes are added automatically until the licensed number is reached.
• Each licence includes a monthly PhishSecure time allowance that depends on the number of licensed mailboxes. Unused time does not carry over. A trial includes 10 minutes of PhishSecure in total.

Email data.

• Emails are analysed in the customer's data region. The content of an email is not kept after analysis, except as quarantined below.
• When an email is quarantined, a complete copy is stored in the customer's data region so that it can be reviewed and released. Copies are deleted automatically after 7 days.
• To recognise first-time senders, the service keeps a list of sender addresses and domains, built from the last 180 days of the protected mailboxes' Inbox and Sent Items when they are first connected, and from new email afterwards. This list does not contain email content.
• Verdicts, actions, and PhishSecure activity are recorded as security events for the customer's tenant and kept for the retention period of the customer's plan.

PhishSecure.

• PhishSecure opens an email and its links in an isolated browser that runs in the cloud, in a region matched to the customer's tenant. Each session lasts up to 3 minutes and is destroyed when it closes.
• Sessions are not recorded, downloads are blocked inside the session, and the email's content is not written to Cybereinforce storage. Pages opened in a session are checked by Cybereinforce threat intelligence, and malicious pages are blocked.

Outlook add-in.

• The customer's administrator may deploy the Cybereinforce Outlook add-in through the Microsoft 365 admin center. It adds a PhishSecure button to Outlook and acts only on the email the user opens it on.

Third-Party Services and Analytics

Cybeurope uses carefully selected providers to operate the service. They process data only to provide their part of the service, under contracts that require appropriate security and confidentiality. Customers can request the current list of subprocessors at info@cybereinforce.com.

• Cloud hosting and storage for the platform, portals, and customer data, in the customer's data region.
• An isolated remote browser service that runs PhishSecure sessions.
• Domain and URL reputation services. These receive domains and URLs to check, never email content or users' identities.
• Public internet data, such as certificate transparency logs, domain registration data, and DNS, used to detect threats and look-alike domains.
• Email delivery for service notices, alerts, and invoices.
• Microsoft services that the customer chooses to connect, such as Microsoft 365, Microsoft Entra ID, Microsoft Defender, Microsoft Sentinel, and the Microsoft commercial marketplace. The customer's own agreements with Microsoft govern those services.

Website analytics. The public Cybereinforce website uses Google Analytics to understand how it is used, as described in the Cookie Policy and Privacy Policy. Analytics cookies are set only with the visitor's consent. Google Analytics is not used in the customer administration portals, the browser extensions, Email Security, or PhishSecure.

Term, Renewal, and Termination

• Unless otherwise agreed, the contract begins on activation or written acceptance.
• Fixed terms renew only if agreed. Recurring subscriptions renew according to the commercial terms selected by the customer.
• Either party may terminate for cause if the other party materially breaches the contract and fails to remedy the breach within a reasonable cure period.
• Cybeurope may suspend or terminate access in cases of abuse, unlawful use, non-payment, or serious security risk.
• A purchase through the Microsoft commercial marketplace is cancelled through Microsoft and ends with the Microsoft subscription.

The customer may delete its tenant in the customer administration portal. Cybeurope then deletes the tenant's data, including Email Security data, except purchase orders, contract acceptances, and audit records that it keeps for accounting, tax, and dispute purposes. Deleting a tenant does not cancel a purchase made through Microsoft.

Law and Jurisdiction

These Terms are governed by the law of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods.

If the customer is a merchant, a legal entity under public law, or a special fund under public law, the exclusive place of jurisdiction for all disputes arising out of or in connection with the contract shall be the competent court at Cybeurope’s registered place of business, unless mandatory law provides otherwise.