WaystoSecure WAYSTOSECURE

Terms of contract · Basic plan terms · Radar terms · Guard terms

Download as PDF

Guard terms

Version of 2 November 2026

1. Who provides the service

Josep Maria Bella, sole trader, domiciled in Sabadell · info@waystosecure.com (hereinafter, "WaystoSecure"). For formal notices, write to this email address; the full tax details appear on the invoice and we will give them to you on request.

2. The Guard

The Guard is a monthly service designed for companies: everything the Radar includes, for the domains and addresses set out in your particular terms, plus offensive testing every month on the infrastructure you authorise us to test. The services are obligations of means, not of result: testing and monitoring reduce risk, but no provider can guarantee the complete absence of incidents.

3. This document and your particular terms

This document contains the terms that govern your plan. You must accept them before you take out the plan (for the Basic plan, when you create your account): the portal shows you the full text, you mark it as read and accepted, and you can download it as a PDF. We record which version you accepted, when, and from which IP address, and you can always download it again under "My plan" in the portal.

If the terms change, we publish a new version, dated at the top, and the next time you log in to the portal we will show it to you for acceptance. Until you accept it, in the portal you will only be able to read it, cancel your subscription, close your account or log out. Corrections that do not change anything you have contracted (a typo, for example) do not require a new acceptance.

What the website and the portal say about what each plan includes forms part of these terms. If you take out a different plan, that plan's terms apply, and you will accept them before paying.

Your particular terms (the monthly price, the domains and email addresses included and the version of the authorisation in force) are shown to you in the portal before you pay; they form part of this document and are accepted with it. If they change (for example, the price, because you extend your infrastructure), we will show them to you so that you can accept them again.

4. How to contract

You ask us for a meeting from the website. There we agree the scope and the price, which depends on your infrastructure, and we sign the testing authorisation (section 5). We then register you in the portal: you will receive an email to create your password, and in the portal you accept these terms together with your particular terms and complete payment on Stripe's secure gateway. WaystoSecure neither sees nor stores card details. The subscription is activated on payment, and you expressly request that provision begins at that moment.

If you already have the Radar, when you move to the Guard you keep everything you have (domains, alerts and history), and the Radar ends on the day the Guard is activated (section 13).

5. The written authorisation

We do not carry out any offensive test without your signed authorisation (the rules-of-engagement document, "RoE"). The authorisation sets the scope (domains and IP addresses), the time windows, the contact person and what we do not do. You sign it on behalf of the company and declare that you are entitled to authorise tests on all the assets it lists (section 16). If your infrastructure changes, we first update the authorisation and then test what is new. The authorisation in force is always in your portal, and it ceases to be in force on the day the Guard ends.

6. The tests

The tests are automated and AI-assisted, reviewed by people, and carried out from outside, without installing anything on your systems. They are only carried out within the authorised scope and time windows. Under no circumstances do we carry out denial-of-service or destructive actions, and we do not deceive your team (for example, with a simulated phishing campaign) without prior agreement. Any test on production systems carries a residual risk, which you accept when signing the authorisation; if a test caused an interruption, we would stop it immediately and let the contact person know.

The tests find what is vulnerable at the time they are run and with the agreed techniques: we do not guarantee that we will find every vulnerability or that new ones will not appear. Fixing what we find is up to you (or whoever looks after your systems): the report tells you what to fix and how.

7. What is and is not included

In addition to everything the Radar includes, every month:

  • the report on the tests, with the remediation plan, delivered before the 10th of the following month (the first one is the pilot test report);
  • one in-depth study of leaked credentials, which you request from the portal and which does not carry over from one month to the next;
  • the reporting of fake domains;
  • three reputation clean-ups, which do not carry over either;
  • the initial setup, including that of any domains you add;
  • a named contact person, with a reply within one working day;
  • and, once a year, an awareness session for your team.

Included orders are opened from the portal without paying anything; once the month's allowance is used up, they are paid for like any other order (section 10). Not included: takedowns of fake domains (section 10) and the pen test with AI agents (section 11), which are purchased separately.

8. Reports and confidentiality

We deliver the reports to you encrypted in the portal. We send you the password for each report by email and the platform does not keep it. If you lose it, we encrypt the report again with a new password. You have access to the reports while the subscription is active (including until the end of the period already paid if you cancel): download them if you want to keep them. We keep an encrypted copy of each report for as long as the Guard lasts and one year more, so that we can deliver it to you again; after that it is deleted.

The findings are yours and confidential: we do not share them with anyone, except where required by law, and we only access them to prepare the report and provide the service.

9. Price and billing

The price is the one in your particular terms, without VAT; the applicable VAT (currently 21 %) is added at payment, and the invoice breaks it down. It is charged in advance in monthly cycles, with automatic renewal. If the price changes (for example, because you extend your infrastructure), we will notify you by email at least 30 days in advance, with your new particular terms; the new price applies from the first cycle starting after that period, never to cycles already paid, and you can cancel before then at no cost.

10. Orders ("We do it for you")

Orders are tasks that a WaystoSecure technician carries out for you, one at a time, at a fixed price shown on the page of each order, plus VAT, which is locked in at the time of purchase. Which orders you can place depends on your plan, as shown on each order's page. Payment is made in advance on Stripe's secure page; if you close the payment page without paying, no charge is made and the request expires after 24 hours.

A technician picks up the order within 2 working days of payment and writes to you at every change of status; you can follow it under "My orders". If we need something from you to do the work (for example, a change to your DNS), we will ask you for it and the order will wait for your reply. We will never ask you for passwords: when your accounts or your DNS need to be changed, you will do it yourself following our instructions or in a screen-sharing session.

Orders are charged for the work, not the result. Whether a fake domain goes down, a blocklist removes your IP or an email provider delivers your messages to the inbox depends on third parties we do not control, and we do not guarantee it. We never pay third parties for express "takedowns" or "removals". For the takedown of a fake domain, if the domain becomes active again within 90 days of the case being closed, we reopen it at no cost.

Refunds. We refund the full amount if we have not yet started the work, or if at the first review we find that it cannot be done (for example, because the reported domain is not malicious). Once the work has started, it is not refunded. Refunds are made to the same card, through Stripe.

Your statements. To report a domain or request its takedown, you declare that the domain is not yours and that you have not authorised it. Reporting a legitimate domain by mistake can have legal consequences: that is why no report is automatic and a technician always checks it first. If the statement were false, you are liable for any resulting damage.

If you are a consumer. When placing an order, you expressly request that the work begin within the 14-day withdrawal period and you acknowledge that, once the work has been completed, you lose the right of withdrawal. If you withdraw before the work is completed, you will be refunded the amount less the proportional part of the work already done.

11. The pen test with AI agents

The pen test with AI agents is a one-off offensive testing exercise on your infrastructure, with a single payment of 850 €, plus VAT. Only clients with an active Radar or Guard can purchase it.

The rules of engagement. No test starts without a rules-of-engagement document signed by both parties with a qualified electronic certificate. In the portal you describe the scope (up to 5 domains and 32 IP addresses) and the time windows (up to 5, of no more than 8 hours each, between 5 days and 6 months ahead), and you declare that you are authorised to have those systems tested. We review the document and, if a change is needed, we send it back to you; when it is correct, we generate the PDF, sign it, and you sign it. Tests are only carried out within the signed scope and time windows, with the techniques and limits set out in the document; under no circumstances do we carry out denial-of-service or destructive actions. Any test on production systems carries a residual risk, which you accept when signing; if a test caused an interruption, we would stop it immediately and let you know.

The report. When we finish, we deliver an encrypted report with the findings: we send you the key by email and we do not keep any copy of it. If you lose it, we encrypt the report again with a new key. The findings are yours: we do not share them with anyone, except where required by law.

Refunds and withdrawal. We refund the full amount if the exercise has not started (for example, if we do not get as far as signing the rules-of-engagement document). Once testing has started, it is not refunded. If you are a consumer, the same applies as for orders (section 10).

12. Service limits and third-party sources

The limits of your Guard (the domains and email addresses monitored) are those in your particular terms; sending tests, 10 per day.

Monitoring draws on third-party information sources (leak databases, domain registries, blocklists, reputation services). If a source changes its terms, stops working or ceases to be available, WaystoSecure may replace it with an equivalent one or withdraw the function that depends on it, notifying you in advance where possible, without this giving rise to any refund as long as the service as a whole is maintained.

You can switch off any monitoring block from the settings. Switching off a block does not change the price. When you mark an alert as "I know, leave it as is", you accept that risk, and that point does not appear in the dossier among the things that are done.

The dossier. The dossier you issue from the portal describes what we have monitored and what is done; it is not an audit and does not guarantee the absence of incidents. Each dossier carries a code: for two years from issue, anyone who has it can check on our website that we issued it and what it said (the company and tax ID shown, the date, the scope and the summary), even if you later close your account. Issuing it means accepting this. The verification page does not say whether you are still a client.

13. Term and cancellation

The subscription is monthly and can be cancelled at any time from the portal, without penalty and without giving reasons. On cancellation, the service remains active until the end of the period already paid, and no further charges are made. When the Guard ends, the authorisation ceases to be in force and testing stops; you keep access to the portal and to the Basic plan until you decide to delete your account (section 14).

If you move from the Radar to the Guard, the Radar subscription and those of the additional domains end on the day the Guard is activated, without any automatic refund of the part of the cycle already paid.

14. Account deletion

You can delete your account from "My account › Close your account", confirming with your password. Deletion is immediate: we stop monitoring you, your access is closed and, if you have an active subscription, it is cancelled at once without refund of the part of the cycle already paid. If you change your mind, you have 7 days to write to us and stop it. What happens to your data is described in the Privacy policy, section "Retention and erasure".

If you have the Guard, on deleting your account the authorisation ceases to be in force that same day and you lose access to the reports: if you want a copy, download them first.

15. Right of withdrawal

The Guard is designed for companies and professionals: if you take it out for your professional activity, the consumer right of withdrawal does not apply.

If you are a consumer, you have 14 calendar days from contracting to withdraw without giving reasons, by writing to info@waystosecure.com with an unequivocal statement (you may use the model form in the annex to the Spanish General Law for the Protection of Consumers and Users). As provision begins immediately at your request, in the event of withdrawal the amount paid will be refunded less the proportional part of the service already provided up to the date of the communication. For orders and the pen test, see sections 10 and 11.

16. Your obligations

You verify only assets that are your own or for which you hold authorisation, and you are responsible for that authorisation; you safeguard your credentials and make lawful use of the service. The email addresses you add to monitoring must be yours or belong to people who have consented: each address receives a message to confirm it. If you delegate the mta-sts subdomain of your domain to us so that we host the MTA-STS policy, you can withdraw the delegation whenever you wish; when we stop hosting it, we publish a neutral policy ("none") for 30 days before removing it. Leaked passwords in clear text can only be opened with your portal password: WaystoSecure cannot read or recover them; if you lose your password, that content is no longer accessible. WaystoSecure may suspend the service in the event of fraudulent use or use contrary to these terms, notifying you in advance where possible.

For the Guard, in addition: you declare that you are entitled to authorise the tests on all the assets listed in the authorisation and, if any of them belongs to a third party (for example, a server with a hosting or cloud provider), that you have its permission or that its terms allow it; you give us a contact person available during the testing windows, and you let us know before any change to the authorised infrastructure.

17. Availability and liability

Availability. The service runs continuously, but we do not guarantee that it will be available at all times: there may be interruptions for maintenance or for reasons beyond our control (providers, network, third-party sources). When an interruption is planned, we try to let you know in advance.

Liability. WaystoSecure is liable for damage caused by wilful misconduct or gross negligence. In all other cases, and to the extent permitted by law, its liability for any claim relating to the service is limited to the amount you have paid for it during the 12 months before the event giving rise to the claim, and does not include indirect damage or loss of profit. WaystoSecure is not liable for incidents that the monitoring does not detect, for those caused by third parties, or for the decisions you make with the information we give you. If you are a consumer, this limitation does not affect the rights the law grants you.

For the Guard, in addition: what we do not guarantee about the tests is set out in section 6, and you accept the residual risk of the tests when signing the authorisation.

18. Data protection

The processing of personal data is governed by the Privacy policy.

The findings may include personal data of third parties (for example, addresses or usernames of your employees): we process them only to prepare the report and provide the service. If you need a data processing agreement (Article 28 GDPR), we will sign one with you.

19. Law, language and notices

These terms are governed by Spanish law. If you are a consumer, you may bring proceedings before the courts of your place of residence. If you contract as a business or professional, the parties submit to the courts of WaystoSecure's place of business.

Language. These terms are published in Catalan, Spanish and English, and you accept those in your language. All three say the same; in the event of any discrepancy, the Catalan version prevails.

Notices. We write to you at your account's email address, and notices that affect the service also appear in the portal. For any formal notice, write to info@waystosecure.com.