1. Parties and Acceptance

These Credential Validation and Testing Service Terms (“Service Terms”) are entered into between Hack Notice, Inc., a Delaware Corporation, (“HackNotice”) and the customer identified in the applicable order form, online enrollment, or account (“Customer”). In these Service Terms, “we,” “us,” and “our” mean HackNotice, and “you” and “your” mean Customer. By signing an order form that references these Service Terms, clicking to accept them, enabling credential testing, submitting credentials or endpoints for testing, or using the Service, Customer agrees to these Service Terms.

The individual accepting these Service Terms represents and warrants that they have authority to bind Customer and to authorize the testing described below. Customer’s acceptance constitutes Customer’s express written authorization for HackNotice to perform the authorized testing within the approved scope.

2. Credential Validation and Testing Service

The “Credential Validation and Testing Service” or “Service” supplements HackNotice’s threat intelligence, first-party, research, and end-user services. The Service may take username/password pairs, email/password pairs, or similar authentication data identified through HackNotice threat intelligence or supplied or approved by Customer (“Credentials”) and test whether those Credentials authenticate successfully to Customer-designated systems, applications, portals, websites, APIs, identity providers, remote-access services, or other authentication interfaces (“Authorized Endpoints”).

The purpose of the Service is to help Customer identify Credentials that appear capable of accessing an account so Customer can investigate, reset credentials, disable accounts, strengthen controls, or take other defensive action. A successful validation indicates only that the tested Credential produced the configured success signal at the time of testing. It does not establish who used the Credential, whether an attacker accessed the account, whether data was viewed or taken, or whether any other account or system is secure.

Compromised Credentials can permit unauthorized persons to access Customer systems and may lead to account takeover, unauthorized transactions, exposure, alteration, destruction, or loss of data, malware or ransomware deployment, business interruption, fraud, regulatory investigations, notification obligations, litigation, reputational harm, and substantial response and recovery costs. By identifying Credentials that still authenticate, the Service is designed to help Customer act before or after misuse by disabling exposed accounts, resetting passwords, enforcing multifactor authentication, reviewing logs, narrowing access, preserving evidence, and improving security controls. Prompt testing and remediation may reduce the likelihood, scope, and duration of unauthorized access and help Customer protect its systems, data, personnel, customers, and operations, but the Service does not prevent all attacks or guarantee security.

3. Customer Ownership, Control, and Authority

For every Authorized Endpoint, Customer represents, warrants, and covenants that:

(a) Customer owns, controls, manages, or administers the Authorized Endpoint, or has received express written authority from the owner or controlling party to authorize HackNotice’s testing;

(b) Customer has authority to permit authentication attempts using the Credentials and to authorize HackNotice to process and test those Credentials;

(c) the testing will not violate any law, court order, contract, platform rule, third-party right, employment restriction, privacy obligation, or security policy binding on Customer;

(d) any necessary approval from a hosting provider, cloud provider, managed service provider, identity provider, affiliate, client, employee, union, works council, regulator, or other party has been obtained before testing begins; and

(e) Customer will not designate an Endpoint, account, tenant, environment, or Credential outside the scope of its authority.

Customer must promptly notify HackNotice if its authority changes or if any Authorized Endpoint or Credential should no longer be tested. HackNotice may rely on Customer’s representations without independently verifying ownership, control, or authority.

4. Express Authorization to Test

Customer expressly authorizes HackNotice and its personnel, systems, contractors, and service providers, solely for purposes of providing the Service, to:

(a) possess, store, normalize, transmit, and process Credentials provided or approved for testing;

(b) connect to each Authorized Endpoint from HackNotice-designated infrastructure;

(c) submit the applicable Credentials through the Authorized Endpoint’s normal authentication process;

(d) observe and record technical response data reasonably necessary to determine whether authentication appears successful, unsuccessful, blocked, challenged, rate-limited, or otherwise inconclusive;

(e) repeat an attempt when reasonably necessary to confirm a result or address a transient error, subject to the testing configuration and reasonable safeguards;

(f) create, retain, and provide Customer with validation results, timestamps, endpoint information, and related logs; and

(g) use reasonable technical methods necessary to perform the foregoing activities within the approved scope.

This authorization is affirmative, knowing, and intended to establish that testing within scope is permitted by Customer. It remains effective while the Service is enabled or until Customer revokes it as described below.

5. Scope and Testing Instructions

Customer will identify or approve the Authorized Endpoints and any applicable account, tenant, protocol, environment, schedule, rate, source-address, or other testing restrictions through the Service, an order form, or another written method accepted by HackNotice. HackNotice may require separate scope confirmation before testing a new Endpoint or materially changing the testing method.

HackNotice will not knowingly test an Endpoint that is not within the approved scope. Customer is responsible for ensuring that hostnames, IP addresses, URLs, tenant identifiers, and other scope information are accurate and continue to resolve only to systems Customer is authorized to test. If an Authorized Endpoint redirects, proxies, federates, or delegates authentication to another system, Customer’s authorization includes that authentication flow only to the extent Customer is legally authorized to include it. Customer must disclose third-party or federated components before testing.

6. Customer Enablement and Allowlisting

Customer will fully enable authorized testing and will, as reasonably requested:

(a) allowlist HackNotice-provided IP addresses, user agents, identifiers, domains, email addresses, telephone numbers, or other testing indicators;

(b) configure firewalls, web application firewalls, bot-management systems, fraud controls, intrusion-prevention systems, identity providers, logging tools, and other security controls so approved tests can reach the Authorized Endpoints;

(c) establish internal change tickets, maintenance approvals, monitoring exceptions, and security-operation notifications needed to prevent approved testing from being treated as hostile activity;

(d) coordinate with Customer’s affiliates, vendors, carriers, hosting providers, managed security providers, and other relevant parties;

(e) provide accurate technical contacts who can respond to questions or incidents; and

(f) promptly update allowlists and scope information when HackNotice changes testing infrastructure or Customer changes an Authorized Endpoint.

HackNotice is not responsible for incomplete or inaccurate results caused by Customer’s failure to enable testing, allowlisting errors, endpoint changes, third-party blocking, rate limits, multifactor authentication, CAPTCHA, bot protection, network controls, service outages, or other conditions outside HackNotice’s control.

7. Testing Safeguards and Limits

Unless separately agreed in writing, the Service is limited to credential validation. HackNotice will not intentionally use a successful authentication to read messages or files, access customer content, change settings, create persistence, move laterally, elevate privileges, bypass multifactor authentication, exploit a vulnerability, perform password spraying beyond the approved Credential set, or conduct denial-of-service activity.

HackNotice may stop, delay, throttle, or refuse testing if it detects unexpected access, instability, excessive lockouts, sensitive data exposure, scope uncertainty, third-party complaints, legal concerns, or risk to HackNotice, Customer, users, or others. These safeguards do not create a warranty that testing will be error-free or will not produce lockouts, alerts, blocks, or other effects.

8. Operational Effects and Assumption of Risk

Customer understands and accepts that credential testing may trigger account lockouts, password resets, multifactor challenges, fraud or bot controls, security alerts, incident-response actions, rate limits, IP or domain blocks, provider complaints, carrier inquiries, abuse reports, reputational signals, user notifications, service degradation, or other operational effects. Customer assumes these risks and is responsible for preparing its systems, personnel, users, vendors, and providers.

Customer will not characterize authorized in-scope testing as malicious, unauthorized, fraudulent, abusive, or unlawful. If any employee, user, vendor, provider, carrier, platform, authority, or other party raises a complaint or inquiry, Customer will promptly confirm HackNotice’s authorization, provide supporting documentation, withdraw or correct inaccurate abuse reports, request removal of blocks or negative reputation entries, and otherwise cooperate to resolve the matter. Customer will reimburse HackNotice for reasonable out-of-pocket costs resulting from Customer’s failure to obtain authority, enable testing, or timely provide such cooperation, subject to the Agreement and applicable law.

9. Credential Sources and Customer Instructions

Credentials may originate from HackNotice threat intelligence, Customer, or another source authorized by Customer. Customer authorizes HackNotice to associate relevant Credentials with Customer’s domains, users, accounts, and Authorized Endpoints for defensive validation.

Customer will not direct HackNotice to test Credentials that Customer knows or should know were unlawfully obtained by Customer, fabricated, altered, or unrelated to an account Customer is authorized to test. HackNotice’s possession or testing of a Credential does not transfer ownership of an account or data and does not authorize any activity beyond the limited validation described in these Service Terms.

10. Results and Customer Response

HackNotice may classify a result as valid, invalid, blocked, challenged, inconclusive, error, or another status supported by the Service. Results are point-in-time observations and may be affected by endpoint behavior, redirects, risk scoring, device recognition, multifactor authentication, password changes, user state, geo-restrictions, network controls, or inaccurate scope information.

Customer is solely responsible for evaluating results and taking remediation action, including credential resets, account disablement, user notification, investigation, log review, legal analysis, regulatory reporting, and incident response. HackNotice does not guarantee that a result is correct or that remediation is necessary or sufficient. Customer should independently verify material findings before taking consequential action.

11. BEST-EFFORT SERVICE; NO DETECTION GUARANTEE

HACKNOTICE WILL USE COMMERCIALLY REASONABLE, BEST-EFFORT METHODS TO PERFORM AUTHORIZED TESTING. HACKNOTICE DOES NOT GUARANTEE THAT IT WILL IDENTIFY OR OBTAIN EVERY EXPOSED CREDENTIAL; TEST EVERY CREDENTIAL; REACH EVERY AUTHORIZED ENDPOINT; BYPASS BLOCKING CONTROLS; DISTINGUISH EVERY VALID, INVALID, OR INCONCLUSIVE RESULT; IDENTIFY EVERY VALID ACCOUNT; DETECT PRIOR MISUSE; OR PRODUCE ANY PARTICULAR VOLUME OR QUALITY OF RESULTS.

THE SERVICE IS NOT CONTINUOUS PENETRATION TESTING, A VULNERABILITY ASSESSMENT, A COMPLIANCE AUDIT, AN IDENTITY-GOVERNANCE REVIEW, OR A CERTIFICATION THAT CUSTOMER’S ACCOUNTS OR SYSTEMS ARE SECURE.

12. Security and Handling of Credentials

Customer acknowledges that Credentials are highly sensitive. HackNotice may use reasonable administrative, technical, and organizational measures to protect Credentials and testing records consistent with the Agreement and HackNotice’s applicable security practices. Customer authorizes the transmission of Credentials to Authorized Endpoints and to HackNotice service providers reasonably necessary to operate the Service.

Customer will restrict access to results and Credentials to personnel with a legitimate need to know and will protect them against unauthorized use or disclosure. Customer must not export, reuse, or test Credentials except as permitted by law and its own authority. Retention, deletion, security, and incident-notification obligations will be governed by the Agreement, applicable data-processing terms, and HackNotice’s then-current Service procedures.

13. Revocation, Suspension, and Termination of Authorization

Customer may revoke authorization for an Authorized Endpoint prospectively by disabling testing through the Service or sending written notice to [email protected] and following any verification process HackNotice reasonably requires. Revocation is effective after HackNotice has had a reasonable opportunity to process it and does not affect testing already performed.

HackNotice may suspend or terminate testing immediately if Customer’s authority is uncertain; scope information is inaccurate; Customer fails to allowlist or cooperate; testing creates unexpected risk; a third party objects; HackNotice reasonably suspects unlawful, misleading, or abusive use; or Customer breaches the Agreement or these Service Terms.

14. Customer Responsibility for Authorization and Instructions

Customer is solely responsible for the legality, accuracy, and completeness of its authorization, endpoint designations, testing instructions, allowlisting, and use of results. HackNotice may rely on those directions. Customer bears responsibility for claims, losses, investigations, penalties, outages, lockouts, blocks, reputation impacts, or other consequences arising from an Endpoint Customer lacked authority to include, inaccurate scope information, Customer’s failure to coordinate with a third party, or Customer’s use or disclosure of results.

HackNotice does not assume Customer’s legal, employment, privacy, regulatory, contractual, or security obligations and is not responsible for determining whether Customer must notify users, employees, clients, providers, regulators, law enforcement, insurers, or other parties.

15. Disclaimer of Warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE.” HACKNOTICE DISCLAIMS ALL EXPRESS, IMPLIED, STATUTORY, AND OTHER WARRANTIES, INCLUDING WARRANTIES OF ACCURACY, COMPLETENESS, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, SECURITY, UNINTERRUPTED OPERATION, AND ERROR-FREE TESTING. HACKNOTICE DOES NOT WARRANT THAT TESTING WILL FIND EVERY VALID ACCOUNT, AVOID LOCKOUTS OR ALERTS, REMAIN UNBLOCKED, OR PRODUCE ANY PARTICULAR SECURITY OR BUSINESS OUTCOME.

16. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY LAW, HACKNOTICE AND ITS AFFILIATES, PERSONNEL, CONTRACTORS, AND SERVICE PROVIDERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES; LOSS OF REVENUE, PROFITS, BUSINESS, GOODWILL, REPUTATION, DATA, OR OPPORTUNITY; ACCOUNT LOCKOUTS; PASSWORD RESETS; SECURITY ALERTS; SERVICE INTERRUPTION; IP, DOMAIN, EMAIL, TELEPHONE, OR PROVIDER BLOCKING; ABUSE REPORTS; CARRIER OR PROVIDER ACTION; USER OR THIRD-PARTY COMPLAINTS; OR ANY CONSEQUENCE OF CUSTOMER’S AUTHORIZATION, INSTRUCTIONS, ENDPOINTS, CREDENTIALS, ALLOWLISTING, FAILURE TO COOPERATE, OR USE OF RESULTS.

HACKNOTICE’S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE WILL NOT EXCEED THE LESSER OF (A) THE FEES PAID OR PAYABLE FOR THE SERVICE DURING THE THREE MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM OR (B) $1,000. THESE LIMITATIONS APPLY REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE, SUBJECT TO LIABILITY THAT CANNOT LAWFULLY BE LIMITED.

17. CUSTOMER INDEMNITY

TO THE MAXIMUM EXTENT PERMITTED BY LAW, CUSTOMER WILL DEFEND, INDEMNIFY, AND HOLD HARMLESS HACKNOTICE AND ITS AFFILIATES, PERSONNEL, CONTRACTORS, CARRIERS, AND SERVICE PROVIDERS FROM THIRD-PARTY CLAIMS, DEMANDS, COMPLAINTS, ABUSE REPORTS, INVESTIGATIONS, PROCEEDINGS, DAMAGES, JUDGMENTS, SETTLEMENTS, PENALTIES, COSTS, AND REASONABLE ATTORNEYS’ FEES ARISING OUT OF OR RELATING TO:

(A) CUSTOMER’S LACK OF OWNERSHIP, CONTROL, AUTHORITY, PERMISSION, OR CONSENT FOR ANY ENDPOINT, ACCOUNT, TENANT, CREDENTIAL, OR TEST;

(B) CUSTOMER’S SCOPE INFORMATION, TESTING INSTRUCTIONS, ALLOWLISTING, FAILURE TO COORDINATE, OR FAILURE TO COOPERATE;

(C) ANY ALLEGATION THAT AUTHORIZED IN-SCOPE TESTING WAS UNAUTHORIZED, ABUSIVE, FRAUDULENT, UNLAWFUL, OR VIOLATED A CONTRACT, POLICY, PRIVACY RIGHT, OR OTHER THIRD-PARTY RIGHT;

(D) ACCOUNT LOCKOUTS, ALERTS, BLOCKING, BLACKLISTING, SERVICE EFFECTS, PROVIDER OR CARRIER ACTION, OR REPUTATIONAL EFFECTS ATTRIBUTABLE TO THE AUTHORIZED TESTING; OR

(E) CUSTOMER’S ACCESS TO, USE OF, DISCLOSURE OF, OR FAILURE TO ACT ON CREDENTIALS OR RESULTS.

CUSTOMER MAY NOT SETTLE A CLAIM IN A MANNER THAT ADMITS WRONGDOING BY, IMPOSES AN OBLIGATION ON, OR RESTRICTS HACKNOTICE WITHOUT HACKNOTICE’S WRITTEN CONSENT. THIS SECTION SHOULD BE CONFORMED BY COUNSEL TO THE AGREEMENT’S INDEMNIFICATION PROCEDURES, CONTROL-OF-DEFENSE TERMS, AND EXCLUSIONS.

18. No General Agency or Professional Services

The parties are independent contractors. Customer’s authorization permits HackNotice to perform the specific testing described in these Service Terms, but does not create a general agency, fiduciary, partnership, joint venture, attorney-client, investigator-client, or employment relationship. HackNotice cannot bind Customer to a contract, waive Customer’s rights, make legal admissions for Customer, or act outside the authorized testing scope.

The Service does not constitute legal advice, digital forensics, incident response, penetration testing beyond the described validation, compliance advice, or a guarantee of security. Customer should engage qualified legal, privacy, security, and forensic professionals as appropriate.

19. Fees, Term, and General Terms

Fees, subscription term, testing volume, supported Endpoints, usage limits, and additional charges are stated in the applicable order form or plan description. The Agreement’s provisions concerning payment, term, termination, confidentiality, data protection, intellectual property, governing law, venue, dispute resolution, notices, assignment, force majeure, severability, waiver, entire agreement, and amendment apply to these Service Terms.

Customer may not assign the Agreement or these Service Terms without HackNotice’s prior written consent.

The Agreement, these Service Terms, and any applicable order form or purchase order constitute the entire agreement between the parties concerning the Service and govern the parties’ relationship with respect to the Service. They supersede all prior or contemporaneous oral or written communications, proposals, representations, promises, and understandings concerning the Service. No such communication, proposal, representation, promise, or understanding is binding unless it is expressly incorporated into the Agreement or these Service Terms or is reflected in an applicable purchase order.

Provisions that by their nature should survive—including Customer representations, responsibility for authorization, handling restrictions, disclaimers, liability limitations, indemnity, and general terms—survive suspension or termination. If no Agreement governs the Service, counsel should add complete standalone provisions addressing those matters before release.

20. Governing Law; Venue; Dispute Resolution

These Service Terms and any dispute, claim, or action arising out of or relating to these Service Terms or the Service will be governed by and construed in accordance with the laws of the State of Texas. Before commencing any legal action, the parties must first attempt in good faith to resolve the dispute through the Dispute Resolution Center in Travis County, Texas. Any dispute, claim, or action that is not resolved through that process will be brought and resolved in Travis County, Texas.

21. Electronic Acceptance and Records

Customer agrees that electronic acceptance, electronic records, and electronic signatures may be used for these Service Terms and related scope authorizations. HackNotice may retain records showing the accepted version, accepting user, Customer account, timestamp, approved Endpoints, and related order or enrollment. Questions or legal notices concerning these Service Terms may be sent to [email protected].

Last updated: August 28, 2026