DMARC Vision General Terms

1. Parties and scope of application

These general terms (the “Terms”) apply between Nansec Software AB, company registration number 559602-3696, Blackevägen 56, 417 16 Göteborg, Sweden (the “Supplier”), and the organisation named as customer in an Order (the “Customer”). The Supplier and the Customer are together the “Parties” and each a “Party”.

An “Order” is an order or quotation that refers to the Terms and that both Parties have signed or approved in writing. The Order and the Terms with their appendices together form the “Agreement”.

The service is provided only to businesses, public authorities and other organisations for use in their operations. The Customer confirms that it enters into the Agreement in the course of its operations and not as a consumer.

2. Scope of the Agreement

The Supplier provides the cloud-based DMARC Vision service (the “Service”). The main function of the Service is to collect, analyse, visualise and alert on information related to email and domain security.

The current scope of the Service is set out in Appendix 1 – Service description and in the Order. In the event of conflict, the documents apply in the order set out in clause 31.

3. Right of use

During the term of the Agreement, the Customer receives a limited, non-exclusive and non-transferable right to use the Service for its own operations and for domains that the Customer owns, administers or otherwise has the right to monitor.

The Customer may not, without the Supplier’s written approval, sell, sublicense, resell or make the Service available to third parties as its own service.

4. Customer accounts and permissions

The Customer is responsible for ensuring that only authorised persons are given access, that roles and permissions are appropriate, and that accounts are removed when access is no longer needed.

The Supplier may temporarily suspend an account or access if reasonably required to handle suspected misuse, a security incident, or a risk to the Service or other customers.

5. Customer domains and configuration

The Customer is responsible for having the right to register and monitor the domains added to the Service. The Supplier may require technical domain verification.

The Customer is responsible for changes to its own DNS, email and identity systems. Recommendations, alerts and analyses in the Service are decision support; the Customer is responsible for its own change decisions.

6. Supplier obligations

The Supplier shall provide the Service in a professional manner, take appropriate technical and organisational security measures, and provide support according to the Customer’s subscription and Appendix 3.

The Supplier may continuously maintain and develop the Service, provided that the agreed core functionality is not materially impaired.

7. Availability and maintenance

Availability, support hours, priorities and any service credits are governed by Appendix 3 – SLA and support.

Planned maintenance shall, where practicable and where it may have a material impact, be announced in advance. Emergency maintenance may be carried out without prior notice when required for security or operational reasons.

8. Customer Data

The Customer retains the rights to data that the Customer supplies to the Service or that is processed on the Customer’s behalf (“Customer Data”). The Supplier may process Customer Data to the extent required to deliver, secure and administer the Service and to meet legal obligations.

The Supplier may use anonymised or aggregated information for statistics and capacity planning, provided that the information cannot reasonably be linked to the Customer or to an identifiable natural person. Customer Data is not sold to third parties.

9. Personal data

When the Supplier processes personal data on the Customer’s behalf, the Customer is the controller and the Supplier is the processor, unless the actual processing indicates otherwise. Such processing is governed by Appendix 4 – Data processing agreement.

The Supplier may be an independent controller for processing carried out for the Supplier’s own administrative or legal purposes, for example concerning contact persons, contract administration, invoicing and compliance with legal obligations.

10. Location of processing

Customer Data processed by the Supplier or by sub-processors engaged by the Supplier within the scope of the Service is, as a main rule, stored and processed within the EU/EEA. The Supplier’s support access to Customer Data takes place within the EU/EEA.

This commitment covers the processing of Customer Data carried out as part of the Supplier’s provision of the Service and does not cover processing or transfers carried out through systems, services or providers that the Customer itself uses, administers or engages outside the Service.

The following exceptions apply and are described in more detail in Appendix 5:

(a) The Supplier’s website and portal are distributed through Amazon CloudFront, which is part of the Amazon Web Services global content delivery network. When the website or the portal is used, certain traffic and user data, such as IP address and, where applicable, the user’s name and email address, may be processed in CloudFront nodes outside the EU/EEA. Amazon Web Services EMEA SARL is a sub-processor under Appendix 5. For transfers to third countries without an adequacy decision, the European Commission’s standard contractual clauses (SCCs) apply through the AWS Data Processing Addendum together with, where required, supplementary measures.

(b) when the Customer requests an original RUF report, it is sent as an encrypted archive file by email through Proton AG in Switzerland. The password to the archive file is provided separately through the Service’s support function.

If any other transfer of personal data to a third country becomes relevant within the scope of the Supplier’s processing, such transfer shall comply with applicable data protection law, use an applicable transfer mechanism, and take place after notice in accordance with Appendix 4, clause 9.

11. RUF and particularly sensitive report data

DMARC failure/forensic reports (RUF) may contain personal data or message information. If the Customer enables RUF functionality, the specific storage, access and protection measures in Appendices 1, 4 and 5 apply.

12. Information security

The Supplier shall maintain appropriate technical and organisational measures with regard to risk, the nature of the processing and the sensitivity of the information. The main controls are described in Appendix 5 – Information security and sub-processors.

13. Security incidents

The Supplier shall have procedures for identifying, handling and documenting security incidents. Personal data breaches relating to processing on the Customer’s behalf are handled under Appendix 4.

14. Subcontractors

The Supplier may engage subcontractors for the delivery. Sub-processors that process personal data on the Customer’s behalf are governed by Appendix 4. A current list is set out in Appendix 5.

15. Intellectual property

All intellectual property rights in the Service, software, design, documentation, analysis models and other parts created by the Supplier belong to the Supplier or its licensors. The Customer retains the rights to Customer Data and to its own trademarks and domains.

The Supplier may use feedback and suggestions for improvement without separate compensation, provided that the Customer’s confidential information is not disclosed.

16. Third-party services and external data sources

The Service may integrate with or retrieve information from external services, such as DNS, email systems, cloud services, SIEM, webhook and messaging services, and public security data sources. The Supplier is not responsible for errors, outages or changes at third parties that are beyond the Supplier’s reasonable control.

17. Fees and payment

The Customer shall pay fees according to the Order and Appendix 2. Unless the Order states otherwise, subscriptions are invoiced annually in advance with thirty (30) days’ payment terms.

In the event of late payment, the Supplier is entitled to default interest under the Swedish Interest Act and statutory fees. After a written reminder, the Supplier may restrict access if payment is still not made.

18. Price changes

The Supplier is entitled to change prices ahead of a new contract period. Price changes shall be notified to the Customer no later than sixty (60) days before the end of the current contract period.

If the Customer does not accept the price change, the Customer is entitled to terminate the Agreement with effect from the end of the current contract period. Such termination shall be made in writing no later than thirty (30) days before the end of the contract period.

If the Customer does not terminate the Agreement within this time, the new prices apply from the next contract period.

19. Term and renewal

The Agreement enters into force on the date stated in the Order, or otherwise when both Parties have approved the Order, and runs for an initial twelve (12) months unless the Order states otherwise. It then renews automatically for twelve (12) months at a time unless terminated in writing no later than sixty (60) days before the end of the current period.

The ordinary notice period under this clause does not apply to termination on account of a price change under clause 18.

20. Early termination

A Party may terminate the Agreement with immediate effect if the other Party materially breaches the Agreement and does not remedy the breach within thirty (30) days of a written request, or is declared bankrupt, enters liquidation or can otherwise be assumed to be insolvent.

The Supplier may immediately restrict access to the extent required in the event of serious misuse or an acute security risk.

21. End of the Agreement and export

When the Agreement ends, the Customer’s right to use the Service ends.

During the term of the Agreement and until the Agreement ends, the Customer may request an export of such Customer Data as is available through the Service’s export functions. Return of personal data and available original reports, and the subsequent deletion of Customer Data, take place under Appendix 4, clause 15.

Information that must be retained by law may be stored for the period required by applicable law. Personal data in backups and in technical security and system logs is handled under Appendix 4, clause 15.

22. Confidentiality

A Party may not disclose confidential information without the other Party’s consent. Confidential information includes Customer Data, security information, technical information, business information and individually agreed commercial terms.

Confidentiality does not apply to information that is publicly known without breach of the Agreement, that the receiving Party can show it already knew, or that must be disclosed by law or by a binding decision of an authority or court. The confidentiality obligation survives the end of the Agreement.

23. Warranties and nature of the Service

The Supplier shall perform its obligations with reasonable care and skill. The Customer understands that the Service is analysis, monitoring and decision support, and that the Supplier does not warrant that all security threats, errors or anomalies will be detected or that external reports and data sources are complete or correct.

Alerts, risk indications and recommendations are decision support and do not warrant that an incident or risk does or does not exist. The Service does not in itself guarantee regulatory compliance.

24. Liability and limitation of liability

A Party is liable for direct loss caused by breach of contract, negligence or intent. Neither Party is liable for indirect loss, such as loss of profit, loss of production, loss of business opportunity, loss of goodwill or other consequential loss. A Party’s total liability under the Agreement during a period of twelve (12) months is limited to an amount equal to the fees that the Customer has paid or is to pay for the Service during the same period. The limitations of liability above do not apply in cases of intent or gross negligence, or to the extent that liability cannot lawfully be limited. For the processing of personal data, the allocation of liability under applicable data protection law and Appendix 4 – Data processing agreement also applies.

25. Force majeure

A Party is released from liability for failure to perform an obligation caused by circumstances beyond its reasonable control, such as war, government action, widespread disruption to society, natural events, labour disputes, major internet or telecommunications outages, or an exceptional cyberattack. The affected Party shall inform the other Party as soon as reasonably possible.

26. Changes to the Service

The Supplier may continuously change and develop the Service. Features may be added, changed or removed provided that this does not materially impair the agreed core functionality. Material changes shall be announced within a reasonable time.

27. Changes to the Terms

The Supplier may change the Terms when justified by law, regulatory requirements, security, technical development or changes to the Service. A change is made by publishing a new version of the Terms with a version number and date. Material changes shall be announced to the Customer within a reasonable time and normally take effect from the next contract period, unless earlier effect is required by law or for security reasons.

The current version and all previous versions of the Terms are available at dmarcvision.eu. Until a new version has taken effect for the Customer, the version stated in the Order applies.

28. Assignment

The Customer may not assign the Agreement without the Supplier’s written approval. The Supplier may assign the Agreement within its group of companies or in connection with a transfer of the Service or the business, provided that the Customer’s contractual rights are not materially impaired.

29. Notices

Formal notices shall be given in writing to the contact details stated in the Order or later notified by the Parties to each other. The Customer is responsible for keeping contact and invoicing details up to date.

30. Entire agreement

The Agreement constitutes the Parties’ entire agreement on the matters it covers and supersedes previous oral and written undertakings on the same matters, unless expressly agreed otherwise.

31. Order of precedence

In the event of conflict, the documents apply in the following order: (1) the Order, (2) this main agreement, (3) Appendix 1 – Service description, (4) Appendix 2 – Prices and subscriptions, (5) Appendix 3 – SLA and support, (6) Appendix 4 – Data processing agreement, (7) Appendix 5 – Information security and sub-processors. For matters specifically concerning the processing of personal data, Appendix 4 takes precedence.

32. Governing law and disputes

The Agreement shall be interpreted and applied in accordance with Swedish law.

Disputes arising from the Agreement shall first be resolved through negotiation between the Parties.

A Party wishing to start negotiations shall notify the other Party in writing and briefly describe the nature of the dispute and the basis of its claim. The Parties shall then, without undue delay, appoint representatives with authority to try to resolve the dispute.

Negotiations shall begin no later than ten (10) working days after the written notice has been received.

If the Parties have not reached a solution within thirty (30) days of receipt of the notice of dispute, or within such other time as the Parties agree in writing, either Party may refer the dispute to the Swedish general courts with the Gothenburg District Court (Göteborgs tingsrätt) as the court of first instance.

33. Conclusion of the Agreement

The Agreement is concluded when both Parties have signed or approved the Order in writing. Signature and approval may be electronic and in separate counterparts.

1. Purpose

DMARC Vision is a cloud-based SaaS service for overview, analysis and monitoring of an organisation’s email and domain security. The Service combines an overview, drill-down, alerts and integrations so that the Customer does not have to watch a separate portal manually.

2. Core features

• Receipt, normalisation and analysis of DMARC aggregate reports (RUA).
• Receipt and analysis of SMTP TLS Reporting (TLS-RPT).
• Support for DMARC failure/forensic reports (RUF) when the feature is enabled.
• Overview of sending sources, SPF and DKIM results, and DMARC alignment.
• Monitoring of relevant DNS and policy data for registered domains.
• Alerts on selected changes, anomalies or security indicators.
• History, reporting and drill-down to relevant report and source data.
• Export, API and integrations according to the subscription and the Order.

3. Domain and DNS monitoring

• DMARC policy and reporting addresses.
• SPF records and changes to them.
• DKIM-related checks where the selector or configuration is known or available.
• MX, MTA-STS, TLS-RPT, BIMI and other email-related DNS checks that the Supplier supports from time to time.
• Policy or configuration drift between measurements.

4. Alerts and notifications

The available alert types are continuously developed and may include changed DMARC policy, new or unusual senders, authentication failures, policy and DNS drift, reporting gaps and other relevant indicators. Alerts are delivered in the portal and, depending on the subscription, by email, webhook, Teams, Slack or other integrations.

5. RUF

RUF reports may contain personal data, technical header data and message information and are therefore handled in a separate processing and storage flow, with restricted access and a shorter retention period than aggregate report data.

Original reports are not made available in the Service’s customer portal and are not part of the regular analysis view. The original report is stored separately in protected object storage and is accessible only through specially access-controlled handling.

• RUF is disabled by default. The Service receives RUF only for the domains or subdomains for which the Customer has expressly enabled the feature by configuring a RUF address that points to the Service.
• RUF can be enabled or disabled separately per domain or subdomain. For example, the Customer may choose to receive RUF for a particular subdomain without enabling RUF for the parent domain.
• The Customer may at any time stop receiving RUF for a particular domain or subdomain by removing or changing the relevant RUF configuration.
• In processing for regular analysis, only the data in the RUF report that is needed for the Service’s analysis and reporting is extracted. Only this extracted and, where applicable, pseudonymised metadata is used in the regular Service.
• In the stored RUF metadata, the following data is pseudonymised with keyed HMAC-SHA256:
  • the local part of the address in the original message’s From,
  • the local part of the envelope sender from Return-Path, with Original-Mail-From as the fallback source,
  • the local parts of email addresses in Reply-To,
  • the local parts of recipient addresses in To and Cc,
  • the entire value of Subject,
  • the entire value of Message-ID, and
  • the entire value of Original-Envelope-ID.
• A separate HMAC key is used for each customer company. The key material used to generate or derive the HMAC key is customer-specific and separated between customers. This makes it possible to recognise recurring identifiers within the same customer environment without corresponding identifiers being correlated between different customers.
• Domain names and the reported source IP address are stored in readable form in the RUF metadata.
• Original-Rcpt-To is not stored in the metadata and is removed instead of being pseudonymised.
• The pseudonymisation applies only to the metadata extracted from the RUF report. Any message text or other content in the original report is not stored as part of the regular analysis data, but may remain in the original report.
• The original report is stored separately from the regular analysis data as restricted evidence, protected by encryption and strict access control, for fourteen (14) days from receipt. It is then deleted automatically.
• During the retention period, an authorised customer representative may request the original report through support. The report is delivered by email as an encrypted archive file with AES-256 encryption. The password is provided separately through the Service’s support function.
• The Customer is responsible for ensuring that enabling and using RUF is lawful for the Customer’s processing.

6. Data location

The Service is operated and its data stored in the AWS region eu-north-1 (Stockholm, Sweden). Customer Data is stored and processed within the EU/EEA, with the exceptions set out in clause 10 of the main agreement. Sub-processors and processing locations are listed in Appendix 5.

7. Retention periods

8. Data export at the end of the Agreement

On request, the Customer may, within the period set out in clause 21 of the main agreement, export Customer Data supported by the Service’s export features. The Supplier is not obliged to recreate data already deleted according to the agreed retention period.

9. Limitations

• The Service is not an email gateway and does not in itself block email traffic.
• The Service is not a guarantee against spoofing, phishing or other attacks.
• Results depend on reports and data from external senders, receivers, DNS and other data sources.
• Some features require the Customer to configure DNS, reporting addresses, API permissions or other integrations.

10. Customer technical responsibilities

• Configure the necessary DNS records and reporting addresses according to the Supplier’s instructions.
• Ensure that the Customer may monitor the domains it connects.
• Manage the Customer’s internal email, identity and DNS environment.
• Assess and carry out recommended changes in the Customer’s own environment.

1. Subscription and price

The Customer’s subscription level, annual fee and plan limits are stated in the Order. The Supplier’s current price list is on the pricing page at dmarcvision.eu. All prices are in Swedish kronor (SEK) excluding VAT.

Plan limits cover the number of sending top-level domains, analysed message volume, users and retention period. Sending subdomains are included under their connected top-level domain and do not count as separate top-level domains. Parked, defensive or non-sending domains are monitored under fair use and do not count as sending domains.

2. Overuse and fair use

If the Customer’s use persistently exceeds the agreed volume or scope, the Supplier shall first contact the Customer to adjust the subscription. The Supplier shall not charge retroactively for overuse without support in the Order or a separate agreement.

3. Additional services

4. Payment terms

• Annual invoicing in advance unless the Order states otherwise.
• Payment terms: 30 days.
• All prices exclude VAT.
• Price changes are handled under clause 18 of the main agreement.

1. Scope

This appendix governs availability, incident prioritisation and support for the Service. Individual terms may be set out in the Order and then take precedence.

2. Support level and service hours

The support level follows the Customer’s subscription: Standard for Starter, Priority for Business and Enterprise for Enterprise, unless the Order states otherwise.

Security incidents are reported to support@dmarcvision.eu at every level, and for Enterprise also through an agreed channel.

3. Priority classes

4. First response targets

Times are counted within service hours. A working day is a Swedish working day, excluding public holidays.

5. Availability target

The availability target is 99.5% per calendar month for the portal and core API functions controlled by the Supplier. A different target may be set in the Order.

Availability is calculated as: (total measured time – unavailable time) / total measured time × 100. The calculation excludes the exceptions in section 6.

6. SLA exceptions

• Planned maintenance announced under section 9.
• Emergency security maintenance reasonably required to protect the Service or Customer Data.
• Faults in the Customer’s systems, DNS, email environment, identity provider or internet connection.
• Faults or outages at external services or data providers beyond the Supplier’s reasonable control.
• Force majeure.
• Suspension resulting from the Customer’s breach of contract or request.

7. Service credits

Service credits apply only if expressly stated in the Order. If service credits are agreed without another model, the following applies.

8. Limit on service credits

A service credit, if agreed, is the Customer’s sole financial compensation for insufficient availability and may never exceed 20% of the monthly fee for the month concerned. With annual invoicing, the monthly fee is one twelfth of the annual fee.

9. Planned maintenance

Where practicable, the Supplier shall schedule disruptive maintenance outside service hours and notify the Customer at least 48 hours in advance when the impact is expected to be significant.

10. Security incidents

Suspected or confirmed security incidents are prioritised by risk and impact. Personal data breaches are handled under Appendix 4 and are not governed solely by the ordinary support times above.

1. Permitted use

• Use the tools only for domains and email that you have the right to test.
• Do not try to overload the tools, bypass their limits or gain unauthorised access to them.
• Do not send messages with sensitive content to the Email Security Check.

2. No warranties

The tools are provided free of charge and as is. Results are decision support and may be incomplete; a check that could not be completed is reported as not determined. The Supplier may change, limit or close the tools without prior notice.

3. Liability

To the extent permitted by law, the Supplier is not liable for loss arising from use of the free tools, except in cases of intent or gross negligence.

4. Personal data

How data in the tools is processed is described in the privacy policy.