Terms of contract · Basic plan terms · Radar terms · Guard terms
Radar terms
Version of 4 November 2026
1. Who provides the service
Josep Maria Bella, sole trader, domiciled in Sabadell · info@waystosecure.com (hereinafter, "WaystoSecure"). For formal notices, write to this email address; the full tax details appear on the invoice and we will give them to you on request.
2. The service
The Radar is WaystoSecure's managed cybersecurity subscription: continuous monitoring of the assets you verify (email addresses, domains), alerts on detected threats, step-by-step protection guides and diligence documentation. The website and the portal set out exactly what it includes. The services are obligations of means, not of result: monitoring reduces risk and shortens reaction time, but no provider can guarantee the complete absence of incidents.
Answering your questions about what the monitoring finds is included in the Radar; doing the work for you is an order (section 7). The pen test with AI agents is purchased separately (section 8).
3. This document
This document contains the terms that govern your plan. You must accept them before you take out the plan (for the Basic plan, when you create your account): the portal shows you the full text, you mark it as read and accepted, and you can download it as a PDF. We record which version you accepted, when, and from which IP address, and you can always download it again under "My plan" in the portal.
If the terms change, we publish a new version, dated at the top, and the next time you log in to the portal we will show it to you for acceptance. Until you accept it, in the portal you will only be able to read it, cancel your subscription, close your account or log out. Corrections that do not change anything you have contracted (a typo, for example) do not require a new acceptance.
What the website and the portal say about what each plan includes forms part of these terms. If you take out a different plan, that plan's terms apply, and you will accept them before paying.
4. How to contract
You create an account (in doing so, you accept the Basic plan terms), choose the Radar and, before paying, accept these terms. You complete payment on Stripe's secure gateway: by card or, if you subscribe as a company, by bank direct debit (SEPA Direct Debit). WaystoSecure neither sees nor stores card or bank account details. By card, the subscription is activated immediately after payment. By direct debit, it is activated once the bank confirms the first payment, which usually takes a few business days: in the meantime, the portal shows that the payment is in progress, and if the bank does not confirm it, the subscription is not activated and you are not charged. In both cases, you expressly request that provision begins at the moment of activation.
Direct debit. If you choose direct debit, on Stripe's gateway you sign a direct debit mandate (SEPA mandate) authorising WaystoSecure, through Stripe, to debit your account with the amount of each renewal until you cancel the subscription. You can ask your bank to refund a debit under the terms of your agreement with your bank. If a debit cannot be collected, we will let you know by email so that you can change the payment method; if you ask your bank to refund it, we will get in touch with you to settle it.
5. Prices and billing
Prices are shown without VAT; the applicable VAT (currently 21 %) is added at payment, and the invoice breaks it down. Subscriptions are charged in advance in monthly cycles, with automatic renewal at the end of each cycle. The invoice is available to you in the portal and by email. We will notify you of any change to the regular price by email at least 30 days in advance, and it will only apply from the first cycle starting after that period; if you do not agree, you can cancel the subscription before it applies, at no cost.
Radar price. The regular price of the Radar is 9.99 € per month, plus VAT.
Logo discount (companies). If you subscribe to the Radar as a company for the first time and authorise us to show your logo and your name on our website as a client, you pay 6.99 € per month, plus VAT, for the first 12 monthly cycles (3 € less than the regular price); after that, the regular price. The discount applies once per client: it is not available to anyone who has already had a paid subscription with WaystoSecure, or who cancels and subscribes again. We review the logo before publishing it and may decide not to publish it or to remove it (for example, if it is not a logo, does not display well or is not appropriate); if we remove it because it is not appropriate, the discount also ends, from the next invoice. It is shown while you have an active paid plan. You can withdraw the authorisation at any time from "My plan" or by writing to us: we remove the logo from the website and the discount ends from the next invoice, at no other cost. The authorisation has its own text, which you accept when uploading the logo and which is recorded with the date.
Launch offer. If you subscribed to the Radar with the launch offer (withdrawn for new subscriptions), you keep it on the terms under which you subscribed, until the cycles shown under "My plan" are completed.
6. Additional domains
The Radar includes monitoring of one verified domain. You can add further domains at 8.99 € per month each, plus VAT, with the same coverage as the first. Each additional domain is a separate monthly subscription, which you can cancel whenever you wish from the portal, independently of the others: we stop monitoring that domain and you stop seeing its information at the end of the cycle already paid. What we had found about that domain is kept for one year in case you take it out again: if you do so within that year, you get the history back; after the year, it is deleted. If you cancel the Radar, the additional domains are cancelled with it. The Radar discounts (the launch one and the logo one) do not apply to additional domains.
If you move from the Radar to the Guard, your additional domains become part of the Guard: you keep all their history and stop paying for them separately.
7. Orders ("We do it for you")
Orders are tasks that a WaystoSecure technician carries out for you, one at a time, at a fixed price shown on the page of each order, plus VAT, which is locked in at the time of purchase. Which orders you can place depends on your plan, as shown on each order's page. Payment is made in advance on Stripe's secure page; if you close the payment page without paying, no charge is made and the request expires after 24 hours.
A technician picks up the order within 2 working days of payment and writes to you at every change of status; you can follow it under "My orders". If we need something from you to do the work (for example, a change to your DNS), we will ask you for it and the order will wait for your reply. We will never ask you for passwords: when your accounts or your DNS need to be changed, you will do it yourself following our instructions or in a screen-sharing session.
Orders are charged for the work, not the result. Whether a fake domain goes down, a blocklist removes your IP or an email provider delivers your messages to the inbox depends on third parties we do not control, and we do not guarantee it. We never pay third parties for express "takedowns" or "removals". For the takedown of a fake domain, if the domain becomes active again within 90 days of the case being closed, we reopen it at no cost.
Refunds. We refund the full amount if we have not yet started the work, or if at the first review we find that it cannot be done (for example, because the reported domain is not malicious). Once the work has started, it is not refunded. Refunds are made to the same card, through Stripe.
Your statements. To report a domain or request its takedown, you declare that the domain is not yours and that you have not authorised it. Reporting a legitimate domain by mistake can have legal consequences: that is why no report is automatic and a technician always checks it first. If the statement were false, you are liable for any resulting damage.
If you are a consumer. When placing an order, you expressly request that the work begin within the 14-day withdrawal period and you acknowledge that, once the work has been completed, you lose the right of withdrawal. If you withdraw before the work is completed, you will be refunded the amount less the proportional part of the work already done.
8. The pen test with AI agents
The pen test with AI agents is a one-off offensive testing exercise on your infrastructure, with a single payment of 850 €, plus VAT. Only clients with an active Radar or Guard can purchase it.
The rules of engagement. No test starts without a rules-of-engagement document signed by both parties with a qualified electronic certificate. In the portal you describe the scope (up to 5 domains and 32 IP addresses) and the time windows (up to 5, of no more than 8 hours each, between 5 days and 6 months ahead), and you declare that you are authorised to have those systems tested. We review the document and, if a change is needed, we send it back to you; when it is correct, we generate the PDF, sign it, and you sign it. Tests are only carried out within the signed scope and time windows, with the techniques and limits set out in the document; under no circumstances do we carry out denial-of-service or destructive actions. Any test on production systems carries a residual risk, which you accept when signing; if a test caused an interruption, we would stop it immediately and let you know.
The report. When we finish, we deliver an encrypted report with the findings: we send you the key by email and we do not keep any copy of it. If you lose it, we encrypt the report again with a new key. The findings are yours: we do not share them with anyone, except where required by law.
Refunds and withdrawal. We refund the full amount if the exercise has not started (for example, if we do not get as far as signing the rules-of-engagement document). Once testing has started, it is not refunded. If you are a consumer, the same applies as for orders (section 7).
9. Service limits and third-party sources
The Radar sets out its limits on the website and in the portal: number of domains, number of email addresses monitored outside the domain (5) and number of sending tests per day (10).
Monitoring draws on third-party information sources (leak databases, domain registries, blocklists, reputation services). If a source changes its terms, stops working or ceases to be available, WaystoSecure may replace it with an equivalent one or withdraw the function that depends on it, notifying you in advance where possible, without this giving rise to any refund as long as the service as a whole is maintained.
You can switch off any monitoring block from the settings. Switching off a block does not change the price. When you mark an alert as "I know, leave it as is", you accept that risk, and that point does not appear in the dossier among the things that are done.
The dossier. The dossier you issue from the portal describes what we have monitored and what is done; it is not an audit and does not guarantee the absence of incidents. Each dossier carries a code: for two years from issue, anyone who has it can check on our website that we issued it and what it said (the company and tax ID shown, the date, the scope and the summary), even if you later close your account. Issuing it means accepting this. The verification page does not say whether you are still a client.
10. Term and cancellation
The subscription is monthly and can be cancelled at any time from the portal, without penalty and without giving reasons. On cancellation, the service remains active until the end of the period already paid, and no further charges are made. Cancelling the subscription does not close the account: you keep access to the portal and to the Basic plan until you decide to delete it (section 11).
If you move from the Radar to the Guard, the Radar subscription and those of the additional domains end on the day the Guard is activated, without any automatic refund of the part of the cycle already paid.
11. Account deletion
You can delete your account from "My account › Close your account", confirming with your password. Deletion is immediate: we stop monitoring you, your access is closed and, if you have an active subscription, it is cancelled at once without refund of the part of the cycle already paid. If you change your mind, you have 7 days to write to us and stop it. What happens to your data is described in the Privacy policy, section "Retention and erasure".
12. Right of withdrawal
If you are a consumer, you have 14 calendar days from contracting to withdraw without giving reasons, by writing to info@waystosecure.com with an unequivocal statement (you may use the model form in the annex to the Spanish General Law for the Protection of Consumers and Users). As provision begins immediately at your request, in the event of withdrawal the amount paid will be refunded less the proportional part of the service already provided up to the date of the communication. For orders and the pen test, see sections 7 and 8.
13. Your obligations
You verify only assets that are your own or for which you hold authorisation, and you are responsible for that authorisation; you safeguard your credentials and make lawful use of the service. The email addresses you add to monitoring must be yours or belong to people who have consented: each address receives a message to confirm it. If you delegate the mta-sts subdomain of your domain to us so that we host the MTA-STS policy, you can withdraw the delegation whenever you wish; when we stop hosting it, we publish a neutral policy ("none") for 30 days before removing it. Leaked passwords in clear text can only be opened with your portal password: WaystoSecure cannot read or recover them; if you lose your password, that content is no longer accessible. WaystoSecure may suspend the service in the event of fraudulent use or use contrary to these terms, notifying you in advance where possible.
14. Availability and liability
Availability. The service runs continuously, but we do not guarantee that it will be available at all times: there may be interruptions for maintenance or for reasons beyond our control (providers, network, third-party sources). When an interruption is planned, we try to let you know in advance.
Liability. WaystoSecure is liable for damage caused by wilful misconduct or gross negligence. In all other cases, and to the extent permitted by law, its liability for any claim relating to the service is limited to the amount you have paid for it during the 12 months before the event giving rise to the claim, and does not include indirect damage or loss of profit. WaystoSecure is not liable for incidents that the monitoring does not detect, for those caused by third parties, or for the decisions you make with the information we give you. If you are a consumer, this limitation does not affect the rights the law grants you.
15. Data protection
The processing of personal data is governed by the Privacy policy.
16. Law, language and notices
These terms are governed by Spanish law. If you are a consumer, you may bring proceedings before the courts of your place of residence. If you contract as a business or professional, the parties submit to the courts of WaystoSecure's place of business.
Language. These terms are published in Catalan, Spanish and English, and you accept those in your language. All three say the same; in the event of any discrepancy, the Catalan version prevails.
Notices. We write to you at your account's email address, and notices that affect the service also appear in the portal. For any formal notice, write to info@waystosecure.com.