Terms of Service | Malwagon

1. This agreement

This document is a binding agreement between you and the operator of Malwagon, and you accept it by using the service in any way.

1.1 Using the service is acceptance: You accept these terms when you submit anything for analysis, create an account, view a report, call the REST API or connect to the MCP server. That includes a single anonymous free scan run without an account: there is no account to sign, so the act of submitting is the acceptance. If you do not accept these terms, do not use the service.
1.2 Accepting on behalf of an organisation: If you use Malwagon for an employer, a client or any other organisation, you accept these terms both personally and on that organisation's behalf, and you represent and warrant that you have the authority to bind it. In that case "you" means both you and that organisation, and both are jointly and severally responsible under these terms to the maximum extent permitted by applicable law.
1.3 These terms take precedence: These terms govern your use of the service. Any conflicting or additional term you send us, in a purchase order, a vendor onboarding form, a procurement portal, a supplier questionnaire, an email footer or a click-through of your own, is expressly rejected and has no effect, whether or not we object to it and whether or not we perform after receiving it. The only exception is a separate written agreement signed by an authorised representative of the operator, which prevails to the extent of a conflict with these terms.
1.4 Documents that form part of this agreement: The privacy policy forms part of this agreement. The pricing page sets out what each plan includes, the documentation and the API reference describe how the service works, and the security page describes how to report a security issue. Those pages describe the service; they do not create commitments beyond what is written here.
1.5 Who "we" and "you" mean: "We", "us" and "our" mean the operator of Malwagon, identified below. "You" and "your" mean the person or organisation using the service. "Submission" means anything you send for analysis. "Report" means the analysis output produced from a submission.

The operator of Malwagon is Malwagon itself: the service described on this site, run by the person who operates the hardware it detonates on. It is not incorporated as a company, so there is no registered company name, registration number or registered office to state, and none should be inferred. Every reference to the operator in these terms means that service. Notices and enquiries reach it at [email protected].

2. Eligibility

You may use Malwagon only if you are legally able to enter into this agreement and are not barred from using the service by law or by these terms.

2.1 Minimum age: You must be at least 18 years old, or older if the age of legal majority where you live is higher. The service is not directed at children, it is not designed for them, and we do not knowingly make it available to them. If we learn that an account belongs to somebody below the minimum age we will terminate it.
2.2 Capacity: You must have the legal capacity to enter into a binding contract, and you must not be barred from receiving the service under any applicable law.
2.3 Sanctions and export control: You represent and warrant that you are not named on, and are not owned or controlled by anybody named on, any applicable sanctions or restricted-party list; that you are not located in, ordinarily resident in, or acting on behalf of anybody in a territory subject to a comprehensive embargo under any applicable law; and that you will not access, use, export, re-export or make the service or its output available in breach of any applicable sanctions, export control or trade law. You are responsible for your own compliance with those laws, and we may refuse or terminate access to comply with them.
2.4 Competitors and benchmarking: You must not access or use the service if you operate, or are acting for somebody who operates, a competing malware analysis, sandboxing or threat intelligence product, where the purpose of your access is benchmarking, competitive analysis, feature comparison, or building or improving such a product. Access for that purpose requires our prior written permission.
2.5 We may ask you to prove it: We may ask for reasonable evidence that you meet the conditions in this section, and we may refuse, suspend or terminate access where we are not satisfied that you do.

3. Your account

An account is personal to one human being, and everything done under it is treated as done by the account holder.

3.1 Register accurately: Register with an email address you control and keep your details accurate and current. We use that address to reach you about your account, including about security and about changes to these terms. An address we cannot reach is an account we cannot help with.
3.2 Look after your credentials: Your password, your two-factor secret, your API tokens and your MCP tokens all act as you. Keep them confidential, do not embed them in public code or shared documents, and rotate them if you suspect exposure. Tell us promptly at [email protected] if you believe a credential or an account has been compromised.
3.3 One human per account, no sharing: An account belongs to a single named person and must not be shared, sold, lent, transferred or used by more than one person. Where several people need access, a team plan gives each of them their own seat with their own credentials.
3.4 No automated or bulk account creation: You must not create accounts by script, in bulk, or through disposable or fabricated identities, and you must not create additional accounts to obtain allowances you are not entitled to or to evade a suspension or termination.
3.5 Activity under your account is attributed to you: To the maximum extent permitted by applicable law, you are responsible for all activity that occurs under your account and with your credentials, whether or not you authorised it, and you accept that such activity is attributed to you for the purposes of these terms. This does not make you responsible for activity that results from our own failure where applicable law does not permit that responsibility to be passed to you.
3.6 Suspension of an account: We may suspend an account, which blocks sign-in until the suspension is lifted, in the circumstances described in section 7. A suspension does not by itself delete anything.

4. Licence to use the service

We grant you a narrow permission to use Malwagon while this agreement is in force, and nothing beyond it.

4.1 What you are granted: Subject to your compliance with these terms and, on a paid plan, to payment of the applicable fees, we grant you a limited, revocable, non-exclusive, non-transferable, non-sublicensable and personal licence to access and use the service and the reports it produces for your own internal security analysis purposes, within the limits of your plan.
4.2 The licence is revocable: The licence may be revoked, narrowed or suspended by us at any time in accordance with section 7 or section 16, and it ends automatically when this agreement ends.
4.3 All other rights are reserved: All rights not expressly granted in these terms are reserved by the operator and its licensors. Nothing in these terms grants you any right, title or interest in the service by implication, estoppel, exhaustion or otherwise, and no licence is granted to any trade mark, name or logo.
4.4 No rights in our detection content: The licence covers use of the service. It does not grant you any right in the platform's own detection logic, scoring model, baselines, rule content or report format beyond reading the reports produced for you and using the exports the service offers you.

5. What you submit

You are solely responsible for everything you submit, you must have the lawful right to submit it, and on the free tier the resulting report is published to the world.

5.1 You warrant that you may submit it: You represent and warrant that, for every submission, you have all rights, licences, consents and authority necessary to submit it to us and to have it stored, executed, analysed and, where the scan is a public one, published in derived form; that doing so breaches no law, no contract, no confidentiality obligation and no right of any third party; and that the submission is provided for legitimate security analysis.
5.2 The licence you grant us: You grant us a worldwide, non-exclusive, royalty-free, fully paid, transferable licence, sublicensable only to the suppliers whose infrastructure we use to run the service, to receive, store, copy, transmit, execute, detonate, decompile, disassemble, instrument, analyse, index and create derived data from your submissions, and to publish the report and derived results where the scan is a public one. That licence exists so that we can provide the service you asked for, operate and improve the platform, meet a legal obligation, and establish or defend a legal claim, and it lasts as long as is necessary for those purposes.
5.3 Free-tier reports are public, and publication cannot be undone: A scan submitted through the anonymous free tier produces a report that anyone can view and that is listed in the public analyses index. The submission form states this before you submit. Publication is irrevocable in practice: once a report has been published, other people, search engines, archives and automated collectors may have read, copied, indexed or cached it, and we have no ability to recall those copies and no responsibility for them. Do not use the free tier for anything you are not willing to publish. Private scans require a paid plan.
5.4 Derived data and detection content are retained: We may retain and use indefinitely, including after a sample, a scan, a report or your account has been deleted, the data derived from an analysis: hash values, indicators, behavioural summaries, telemetry statistics, model and baseline inputs, generated detection signatures, and aggregate or de-identified metrics. Deleting a scan removes its stored artifacts and its analysis records and makes a public report unreachable; it does not withdraw derived data that has already been incorporated into detection content, statistics or system backups, and it does not oblige us to alter or delete that derived data.
5.5 What you must not submit: Do not submit personal data beyond what is strictly necessary for the analysis you are asking for, and never on the free tier, where the report is public. Do not submit material you are under a duty to somebody else to keep confidential. Do not submit anything that is unlawful for you to possess, transmit or disclose, or that is subject to rights you do not hold. Do not submit special category personal data, health records, payment card data or government identity documents.
5.6 Samples stay on our infrastructure: The sample itself and its raw content are analysed on hardware we operate and are not uploaded to any third-party service. Only hash values and indicators derived from an analysis, such as domains and addresses, are sent to third-party reputation and intelligence services in order to enrich a report, and the AI narrative layer receives locally derived summaries rather than sample bytes. This is a design rule of the platform, and it is described further in the privacy policy.
5.7 You keep your own rights: Submitting something does not transfer ownership of it to us. You keep whatever rights you had in it, subject to the licence in 5.2.
5.8 You are solely responsible: You are solely responsible for the content, the legality and the consequences of everything you submit, and for any decision anybody takes on the basis of a report produced from it. To the maximum extent permitted by applicable law, we accept no responsibility for a submission or for its consequences.
5.9 We are not a storage service: Malwagon is an analysis service, not a backup or archive service. We give no commitment to store, preserve, return or reproduce a submission or a report, and we may delete either in accordance with section 7. If a scan or a report matters to you, export it.

6. Acceptable use

You must not use Malwagon to cause harm, and the list below is what that means in practice; it is a list of examples and it is not exhaustive.

6.1 No unauthorised access, attack or probing: Do not use the service to attack, probe, scan, target, disrupt or gain access to any system, network, device, service or account that you do not own or that you do not have explicit written authorisation from its owner to test. A detonation environment with an egress path is not permission to reach somebody else's infrastructure through it, and the burden of proving authorisation is yours.
6.2 No malware development, refinement or evasion testing: Do not use the reports, the generated detection content, the telemetry or the detonation environment to write malicious software, to make existing malicious software harder to detect, to measure whether a sample evades this platform or any other security product, or to develop, harden or validate anti-analysis, anti-sandbox or anti-forensic techniques.
6.3 No content that is unlawful to possess or distribute: Do not submit content whose possession, transmission or distribution is unlawful. To state it plainly: where we identify or reasonably suspect child sexual abuse material, or other content whose possession or distribution is a criminal offence, we report it to the competent law enforcement authorities and to the relevant reporting bodies, we preserve the material and the associated records as those authorities require and for as long as they require, and the account behind it is terminated immediately and permanently without refund. We may do this without notice to you.
6.4 No escaping the analysis environment: Do not attempt to break out of an analysis virtual machine; to reach the hypervisor, the host, the management network or the storage behind it; to reach another user's scans, samples, reports or account; to reach our source code, credentials, keys or internal services; or to interfere with the instrumentation, the telemetry pipeline or the live view. Submitting something whose purpose is to attempt any of that is itself a breach of these terms.
6.5 No circumventing quotas, rate limits or metering: Do not work around the free-tier allowance, plan quotas, credit metering, concurrency limits or rate limits. That includes rotating source addresses, using proxies, VPNs, relays or anonymising networks in order to defeat per-address counting, registering multiple or fabricated accounts, sharing credentials, tampering with a credit ledger or a client-side limit, and any other means of obtaining more of the service than your plan allows.
6.6 No scraping, bulk extraction, resale or sublicensing: Do not scrape, crawl, harvest or bulk-download the site, the public analyses index or the reports; do not republish a substantial part of them; and do not resell, rent, sublicense, redistribute or otherwise pass on access to the service or its output, or operate a service of your own on top of ours, without our prior written agreement.
6.7 No reverse engineering: Do not reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, models, detection logic, scoring, baselines or internal design of the service, and do not probe it in order to discover a trade secret. This restriction does not apply to the extent that applicable law prohibits it, for example where a mandatory statutory right to decompile for interoperability applies, and in that case you must first ask us in writing whether we will supply the information you need.
6.8 No building a competing product: Do not use the service, the reports, the telemetry or any derived output to design, build, train, benchmark or improve a competing malware analysis, sandboxing, detection or threat intelligence product or model.
6.9 No automated access outside the documented API: Automate only through the documented REST API and MCP server, with your own credentials, within the published limits. Do not drive the web interface with a script, a headless browser or a robot, do not fabricate or replay session cookies, and do not access undocumented endpoints.
6.10 Nothing that degrades the service for others: Do not place a load on the platform that degrades it for other users, deliberately or through carelessness. That includes denial of service, resource exhaustion, submitting material designed to exhaust or crash the analysis pipeline rather than to be analysed, and holding capacity you are not using.
6.11 No impersonation or falsification: Do not impersonate any person or organisation, misrepresent your affiliation, or alter, forge or misrepresent a report, a verdict or a score, or present one as ours when it is not.
6.12 Nothing unlawful, and nothing that exposes us to liability: Do not use the service for any unlawful purpose, in breach of any applicable law, or in a way that infringes the rights of any person.
6.13 Catch-all: Do not use the service in any way that we consider harmful, abusive, deceptive, or likely to expose us, our suppliers or our users to liability, loss or reputational damage. We decide, at our sole discretion, whether a given use falls within this section, and our decision is final for the purposes of this agreement. This does not affect any right you have under applicable law to challenge that decision. You are also responsible for ensuring that anybody using the service through your account complies with this section.

7. Enforcement rights

Everything in this section is a right we reserve, not a promise we make, and we may exercise any of it at any time or not at all.

7.1 We may refuse, throttle, suspend, remove or delete: We may refuse, delay, throttle, suspend, quarantine, unpublish, remove or delete any submission, scan, report, export, API token, MCP token, account or organisation, at any time, with or without notice, with or without giving a reason, and without liability to you to the maximum extent permitted by applicable law. We may do so where we believe these terms have been or may be breached, where we believe the platform, a user or a third party is at risk, where the law requires it, or for any other reason we consider sufficient.
7.2 We may preserve and disclose: We may preserve submissions, reports, derived data, account records and logs, and disclose them to law enforcement, a regulator, a court or another third party, where we believe in good faith that the law or legal process requires it, or that doing so is reasonably necessary to enforce these terms, to investigate a suspected breach, to detect or prevent fraud or abuse, to protect the service, the operator, our users or a third party from harm, or to respond to an emergency involving a risk to a person's life or safety. Where the law permits and it is reasonable to do so, we will tell you.
7.3 We may report suspected criminal activity: We may report suspected criminal activity to the competent authorities, on our own initiative, and provide them with the material and records connected to it.
7.4 We have no obligation to monitor: We are under no obligation to monitor, review, screen, filter or moderate submissions, reports or user activity, and we do not undertake to do so. If we review something on any occasion, that does not create a duty to review it or anything else again, does not make us responsible for material we did not review, and does not mean we knew of any particular content. Nothing in these terms makes us a publisher, editor or endorser of anything a user submits.
7.5 We have no obligation to preserve: Equally, we give no commitment to keep any submission, report or record, and nothing in this section obliges us to retain material for you.
7.6 These rights are cumulative: The rights in this section are in addition to every other right and remedy available to us at law or under these terms. Exercising one, or choosing not to exercise one, does not waive any other.

8. Analysis results

An analysis result is automated, probabilistic evidence for a human analyst to weigh, and it is never a certification that anything is safe.

8.1 How a result is produced: Every score, verdict, rule match, indicator and narrative in a report is produced by automated tooling from what a sample did in one run, in one environment, for a limited time, against detection content and intelligence data as they stood at that moment. Automated analysis is imperfect in both directions: it misses malicious behaviour, and it flags benign behaviour.
8.2 A clean verdict is not a clearance: A low score or a clean verdict means only that this run produced no evidence of malicious behaviour. It is not a statement that a file, a URL, a command or a document is safe, benign, clean or fit to run. A sample can detect that it is being analysed and stay quiet, wait for a date, a reboot or a user action the run never reaches, require infrastructure that was offline, or target an operating system or configuration the run did not use. Free-tier scans in particular run network isolated with no internet egress, so anything that needs egress will not appear at all.
8.3 A malicious verdict is not a legal determination: A high score or a malicious verdict is an automated technical observation. It is not a finding of fact, a legal determination, an accusation against any author, vendor, publisher or person, and it is not evidence of wrongdoing by anybody. Detection rules match patterns and can match benign software.
8.4 Do not rely on a single report: You must not rely on a single Malwagon report, score or verdict as the sole basis for any security, employment, disciplinary, financial, procurement, insurance, legal or safety decision, and you must not treat a low score as clearance to execute anything. Use a report as one input alongside your own judgement, your own tooling and your own context.
8.5 No professional advice: Nothing produced by the service and nothing on this site is legal, regulatory, financial, insurance or other professional advice, and using the service creates no advisory, fiduciary or professional relationship between us.
8.6 Results change: Detection content, intelligence feeds, analysis images and scoring change over time. The same sample submitted again may produce a different result, and a report is accurate only as a record of the run that produced it. We do not undertake to keep a report current or to tell you when a verdict would now differ.
8.7 Generated detection content is a starting point: Detection rules that the platform generates from your scans, and the exports built from a report, are drafts for an analyst to review. They are not tested, tuned or validated for deployment in your environment, and you are responsible for testing anything you deploy.

9. Availability

The service is provided "as is" and "as available", and we may change, suspend, degrade or discontinue any part of it at any time.

9.1 No availability commitment: We make no commitment as to uptime, availability, throughput, queue time, analysis duration, concurrency, capacity, support response time or data retention. The status page reports the current state of components; it is a report, not a promise.
9.2 We may change or withdraw anything: We may add, change, restrict, degrade, suspend or withdraw any part of the service, including modules, analysis images, operating systems, plans, quotas, limits, endpoints, the REST API and the MCP server, at any time, with or without notice, and without liability to you to the maximum extent permitted by applicable law.
9.3 Downtime will happen: The service will be unavailable from time to time, for planned maintenance and for unplanned outages, including outages caused by hardware, by suppliers or by events outside our control. We give no advance notice of maintenance and no commitment about its duration.
9.4 The free tier may be withdrawn entirely: The anonymous free tier is provided without charge and creates no entitlement of any kind. We may reduce its allowance, restrict it, rate limit it, block an address or a region, or withdraw it entirely, for one visitor or for everybody, at any moment and without notice.
9.5 Scans can fail or return incomplete results: A scan can fail, time out, or return a partial result for reasons including sample behaviour, guest instability, supplier failure and capacity. A failed or incomplete scan is not a breach of these terms by us.
9.6 No data recovery commitment: We give no commitment to restore data that is lost, deleted or destroyed, whether by you, by us, by a fault or by a supplier. Export what matters to you.

10. Third parties

Parts of the service depend on third parties, and we are not responsible for them or for what they return.

10.1 Third-party infrastructure: The service runs on and depends upon hardware, networks, hosting, connectivity, payment processing and other services provided by third parties. We do not control them, we do not warrant them, and to the maximum extent permitted by applicable law we are not liable for their acts, omissions, outages, errors, security incidents or changes.
10.2 Third-party intelligence sources: Reports may include reputation, feed and threat intelligence data obtained from third-party sources on the basis of hash values and derived indicators. That data is theirs, we do not independently verify it, we make no representation or warranty as to its accuracy, completeness, currency, provenance or lawfulness, and to the maximum extent permitted by applicable law we are not liable for it or for any decision taken on the basis of it.
10.3 Content that comes out of a sample: A report may contain URLs, domains, addresses, strings and extracted content that originate from the submitted sample rather than from us. Their presence is an observation, not an endorsement, a recommendation or a warning about any named party, and to the maximum extent permitted by applicable law we do not control and are not responsible for anything they point to.
10.4 Your own third-party arrangements: If you connect the REST API or the MCP server to another product, tool or model, your use of that product is a matter between you and its provider, on their terms, and to the maximum extent permitted by applicable law we are not responsible for it, for what it does with your data, or for whether it works with our service.

11. Intellectual property

We own the platform and everything we put into it, and you receive no ownership in any of it.

11.1 What we own: The operator and its licensors own all intellectual property rights in the service: the software, the analysis pipeline, the interface, the design, the documentation, the platform's own detection content, heuristics, scoring model and baselines, the structure, layout and format of a report, the databases behind them, and the names, logos and marks associated with the service.
11.2 You get nothing beyond the licence: Your rights are limited to the licence in section 4. You must not copy, modify, adapt, translate, frame, mirror, create derivative works from, or remove or obscure any proprietary notice on any part of the service.
11.3 Your submissions remain yours: Section 5 governs your submissions. Nothing in this section takes ownership of them.
11.4 Feedback: If you send us a suggestion, idea, feature request, bug report, benchmark, review or other feedback, it is not confidential, and you grant us a perpetual, irrevocable, worldwide, royalty-free, fully paid, transferable and sublicensable licence to use, reproduce, modify and exploit it for any purpose, without attribution, obligation, restriction or compensation, to the maximum extent permitted by applicable law. Where applicable law gives you a moral right or another right in feedback that cannot be waived or licensed, that right is unaffected and this clause applies to the rest.

12. Plans, credits and fees

Paid plans are metered in credits, credits expire at the end of the billing period in which they are granted, and amounts paid are non-refundable to the maximum extent permitted by applicable law.

12.1 Plans: What each plan includes, and what it costs, is set out on the pricing page. Your entitlements, including concurrency, maximum run duration, private scans, API access and MCP access, are those of the plan in force on your account at the time of use. This page states no price, currency, billing cycle length, trial period or refund window, and none should be inferred from it.
12.2 Credits are a metering unit: Scans are metered in credits. Credits are a unit of account for measuring use of the service. They are not money and not a stored-value instrument, they have no cash value, and they cannot be exchanged, transferred between accounts, sold, or redeemed for cash except where applicable law requires it.
12.3 Credits expire with the billing period: A plan's credit allowance is granted for a billing period. Unused credits expire at the end of the billing period in which they were granted and do not carry over, unless we state otherwise in writing. Credits remaining when a plan is cancelled, downgraded or terminated are forfeited to the maximum extent permitted by applicable law.
12.4 Prices and plan contents may change: We may change prices, plan contents, credit allowances, quotas and limits. A change to what you pay takes effect from your next billing period after we notify you, and continuing to use a paid plan after that date is acceptance of the change. If you do not accept it, cancel before it takes effect.
12.5 Taxes: Unless stated otherwise, amounts are exclusive of taxes, duties and levies. You are responsible for all such amounts arising from your purchase, other than taxes on our income.
12.6 Non-payment: If an amount is unpaid or a payment is reversed, we may suspend or downgrade your plan and withhold access until it is settled, and we may recover the amount together with any reasonable cost of recovering it that applicable law allows.
12.7 Amounts are non-refundable: To the maximum extent permitted by applicable law, all amounts paid are non-refundable, and no refund or credit is given for a partial billing period, for unused credits, for a downgrade, for a period during which you did not use the service, for a scan that failed or returned an incomplete result, or on suspension or termination for breach. Nothing in this clause affects any refund, cancellation or withdrawal right that applicable consumer law gives you and that cannot lawfully be excluded, and where such a right applies we will honour it.

13. Disclaimer of warranties

To the maximum extent permitted by applicable law, the service is provided without warranty of any kind, and section 13.5 says what we do not attempt to disclaim.

13.1 As is, as available: The service, the reports, the detection content, the exports, the documentation and everything else we make available are provided "as is" and "as available", with all faults, and without warranty of any kind.
13.2 Warranties disclaimed: To the maximum extent permitted by applicable law, we disclaim all warranties, conditions, representations and terms of any kind, whether express, implied, statutory or arising from a course of dealing or trade usage, including any implied warranty or condition of merchantability, satisfactory quality, fitness for a particular purpose, non-infringement, title, quiet enjoyment, accuracy, completeness, reliability, currency, security and freedom from error or malicious code.
13.3 No warranty about the analysis: Without limiting 13.2, we do not warrant that the service will be uninterrupted, timely, secure or error-free; that defects will be corrected; that any verdict, score, rule match, indicator or narrative is accurate, complete or current; that a sample identified as clean is safe or that a sample identified as malicious is malicious; that any threat will be detected; or that generated detection content will detect anything or will not produce false positives.
13.4 No warranty arises from anything we say: No advice or information, oral or written, obtained from us, from our staff or through the service creates any warranty not expressly stated in these terms.
13.5 What cannot lawfully be disclaimed: Some jurisdictions do not allow the exclusion of certain warranties or of a consumer's implied statutory rights. Where that is so, the disclaimers above apply only to the extent that the applicable law permits, and for the shortest period that law permits, and your mandatory statutory rights remain in full force. This section does not exclude liability for death or personal injury caused by our negligence, or for fraud or fraudulent misrepresentation. The rest of this section continues to apply.

14. Limitation of liability

Our liability to you is excluded and limited to the fullest extent applicable law allows, and section 14.7 sets out the liabilities we do not attempt to exclude because the law does not permit it.

14.1 Categories of loss excluded: To the maximum extent permitted by applicable law, we are not liable for any indirect, incidental, special, consequential, exemplary or punitive damages arising out of or in connection with these terms or your use of, or inability to use, the service, on any basis of liability, whether in contract, tort (including negligence), breach of statutory duty, restitution or otherwise.
14.2 Heads of loss excluded: To the maximum extent permitted by applicable law, we are not liable for loss of profits, loss of revenue, loss of anticipated savings, loss of business, loss of contracts or opportunity, loss of goodwill or reputation, loss of or damage to data, corruption or unavailability of data, business interruption, wasted expenditure, regulatory fines, or the cost of procuring substitute goods or services, in each case whether direct or indirect, whether or not foreseeable, and whether or not we were advised that such loss was possible.
14.3 Losses specific to this service: To the maximum extent permitted by applicable law, and without limiting 14.1 and 14.2, we are not liable for loss arising from reliance on a verdict, score or report; from a missed detection or a false positive; from acting or failing to act on a report; from the execution or the behaviour of a sample you submitted; from a scan that failed, timed out or returned an incomplete result; from the publication of a free-tier report; from the suspension, removal or deletion of a submission, report or account; from unavailability of the service; or from third-party infrastructure or third-party data.
14.4 Aggregate cap: To the maximum extent permitted by applicable law, our total aggregate liability arising out of or in connection with these terms and your use of the service, whether in contract, tort (including negligence), breach of statutory duty or otherwise, and whether from one event or a series of connected events, is limited to the greater of (a) the total amounts you actually paid us for the service in the twelve months immediately before the event giving rise to the claim, and (b) the fixed sum stated by the operator immediately below. All connected claims are treated as a single claim for the purpose of this cap.
14.5 Free-tier use carries no charge: The anonymous free tier is provided without any charge. Where you have paid us nothing, the amount under 14.4(a) is zero and the cap is the fixed sum under 14.4(b). The absence of a charge, and the corresponding allocation of risk in this section, are part of the basis on which we make the free tier available at all, and the fees for paid plans are set on the same basis.
14.6 The limits survive a failed remedy: The exclusions and limitations in this section apply even if a limited remedy stated in these terms is found to have failed of its essential purpose, and they apply to the maximum extent permitted by applicable law regardless of the form of action.
14.7 What we do not exclude: Nothing in these terms excludes or limits our liability for death or personal injury caused by our negligence; for fraud or fraudulent misrepresentation; for gross negligence or wilful misconduct where applicable law does not permit their exclusion; for a breach of any term implied by law that cannot lawfully be excluded, including a consumer's mandatory statutory rights and a data subject's rights under applicable data protection law; or for any other liability that cannot lawfully be excluded or limited. If any part of this section is held unenforceable, section 19.1 applies to that part alone and the remainder of this section continues in full force.

No fixed sum is set for limb (b), so the aggregate cap in 14.4 is limb (a) alone: the total you have paid for the service in the twelve months before the claim. Where the law that applies to you does not permit a cap in that form, or does not permit the exclusions above, that law applies instead of this clause and the rest of it stands.

15. Indemnity

If a claim is brought against us because of what you submitted or what you did, you cover it.

15.1 What you indemnify us against: To the maximum extent permitted by applicable law, you will indemnify, defend and hold harmless the operator and its affiliates, and their officers, directors, employees, contractors, suppliers and agents, from and against any claim, demand, action, proceeding, investigation, liability, loss, damage, fine, penalty, cost and expense, including reasonable legal fees, arising out of or connected with (a) your submissions, (b) your use of the service or of any report or export, (c) your breach of these terms, (d) your violation of any law or of any right of a third party, including intellectual property, privacy, confidentiality and data protection rights, and (e) any activity under your account.
15.2 We may take over the defence: We may, at our option, assume the exclusive control and conduct of the defence and settlement of any matter subject to this indemnity, at your expense. You will cooperate fully with us in that defence and provide the information and assistance we reasonably request. Our doing so does not relieve you of any obligation under this section.
15.3 No settlement without our consent: You will not settle, compromise or consent to the entry of judgment in any matter subject to this indemnity in a way that imposes any obligation, payment, restriction, admission or liability on us, without our prior written consent.
15.4 Notice: We will use reasonable efforts to notify you of a claim to which this section applies. A failure or delay in notifying you does not relieve you of your obligations except to the extent you are materially prejudiced by it.
15.5 Consumers: Where you use the service as a consumer and applicable mandatory law limits or prohibits an indemnity of this kind, this section applies only to the extent that law allows, and the rest of these terms is unaffected.

16. Termination

Either of us may end this agreement at any time.

16.1 You may end it: You may stop using Malwagon at any time. You can delete an individual scan from the console, delete every scan you own in one action, cancel a paid plan, and ask us to erase your account and everything attached to it. The privacy policy describes the erasure flow.
16.2 We may end it: We may suspend or terminate your access to the service, in whole or in part, at any time, with or without notice, with or without cause, including for breach or suspected breach of these terms, for risk to the platform or to other users, where the law or an authority requires it, or because we have decided to stop offering the service or your plan. Termination for a breach of section 6 may be immediate, permanent and without notice.
16.3 What happens on termination: The licence in section 4 ends immediately, your access ends, and we may deactivate your credentials and tokens and remove, unpublish or delete your scans, reports, exports and account data. We are not obliged to retain, return or reproduce anything after termination, and we may delete it at any time thereafter.
16.4 What happens to your data: Deleting a scan removes its stored artifacts and analysis records and makes a public report unreachable. Derived data and detection content are retained as described in 5.4, and material we are required to preserve under 7.2 is preserved for as long as required. Data that has been deleted or destroyed cannot be recovered, by you or by us. Export anything you need before you leave.
16.5 No refund on termination: To the maximum extent permitted by applicable law, termination or suspension does not entitle you to any refund, credit or compensation, including for a part-used billing period or for unused credits, except where applicable law requires a refund, in which case we will provide it to the extent required.
16.6 What survives: The provisions listed in section 19.3 continue to apply after termination.

17. Changes to these terms

We may amend these terms at any time, and the date at the top of this page is always the version in force.

17.1 How we change them: We amend these terms by publishing a revised version on this page and updating the date shown at the top. The revised version takes effect when it is published, unless it says otherwise or unless applicable law requires a notice period.
17.2 Continued use is acceptance: Continuing to use Malwagon after a revised version takes effect is your acceptance of it. Where applicable law requires your express agreement to a particular change, we will ask for it.
17.3 If you do not accept a change: Stop using the service, export and delete your data, and cancel any paid plan before the change takes effect. That is your remedy for a change you do not accept.
17.4 No promise of advance notice: Except where applicable law requires notice, we give no commitment to announce a change in advance or through any particular channel. Check this page before you rely on any part of it.
17.5 Changes to the service itself: Changes to plans, prices, quotas, features and availability are governed by sections 9 and 12 rather than by this section.

18. Governing law and disputes

The law that governs this agreement, the courts that hear a dispute about it and the procedure for resolving one are stated by the operator below, and nothing else on this page should be read as choosing any of them.

No governing law is chosen here and no court or arbitral forum is given exclusive jurisdiction. A dispute is therefore governed by the law that applies where there is no choice, and may be brought wherever that law allows. Any mandatory protection you have where you live continues to apply in full, and nothing on this page removes it or asks you to give it up.

18.1 Governing law and venue: This agreement, and any dispute or claim arising out of or in connection with it, its subject matter or its formation, including a non-contractual dispute or claim, is governed by the law and subject to the jurisdiction stated by the operator above, to the exclusion of conflict of law rules that would apply another law.
18.2 Time limit for bringing a claim: To the maximum extent permitted by applicable law, any claim arising out of or relating to these terms or the service must be brought within the shortest period that the applicable law permits a limitation period to be shortened to by agreement, and in any event within one year after the claim first arose, failing which it is permanently barred. Some jurisdictions do not allow a statutory limitation period to be shortened by agreement; where that is so, this clause does not apply to you and the statutory period applies instead.
18.3 Consumers keep their local rights: If you use the service as a consumer, nothing in this section deprives you of the protection of any mandatory provision of the law of the country in which you are habitually resident, including any right to bring proceedings before, or to have a dispute heard by, the courts of that country, and including any right of access to an out-of-court dispute resolution body that the law gives you.
18.4 Urgent relief: Regardless of anything else in this section, either party may apply to any court of competent jurisdiction for interim or injunctive relief to protect its intellectual property, its confidential information or the security and integrity of the service, and doing so is not a waiver of this section.
18.5 International sale of goods: To the extent applicable law permits, the United Nations Convention on Contracts for the International Sale of Goods does not apply to this agreement.

19. General terms

These are the provisions that make the rest of the document work, and 19.1 and 19.2 are what keep it enforceable.

19.1 Severability and blue-pencil: If any provision of these terms, or any part of a provision, is held to be invalid, illegal or unenforceable by a court, tribunal or authority of competent jurisdiction, that provision or part is deemed modified and applied to the minimum extent necessary to make it valid, legal and enforceable while giving the fullest effect the law allows to its original intent. If it cannot be so modified, it is severed and treated as deleted, and the remaining provisions and the remainder of the affected provision continue in full force and effect. An exclusion or limitation that is unenforceable in one respect, for one category of loss, or in one jurisdiction remains fully effective in every other respect, for every other category, and in every other jurisdiction.
19.2 Your mandatory rights are preserved: Nothing in these terms excludes, restricts or modifies any right or remedy you have under applicable law that cannot lawfully be excluded, restricted or modified, including a consumer's mandatory statutory rights and a data subject's rights under applicable data protection law. Every exclusion, limitation, disclaimer, reservation and waiver in these terms applies only so far as applicable law permits, and where one would otherwise be void it takes effect in the narrowest form the law permits rather than not at all.
19.3 Survival: The following survive termination or expiry of this agreement, for as long as they are capable of applying: section 1.5 (definitions), section 5 (what you submit, including the licence in 5.2 and the retention in 5.4), section 6 in respect of use before termination, section 7 (enforcement rights), section 8 (analysis results), section 10 (third parties), section 11 (intellectual property), section 12 in respect of amounts due and credits forfeited, section 13 (disclaimer of warranties), section 14 (limitation of liability), section 15 (indemnity), sections 16.3 to 16.5, section 18 (governing law and disputes), this section 19, and section 20. Any other provision that by its nature is intended to survive also survives.
19.4 No waiver: A failure or delay by either party in exercising a right or remedy is not a waiver of it, and a single or partial exercise of a right does not prevent its further exercise. A waiver is effective only if given in writing, and a waiver of one breach is not a waiver of any other.
19.5 Assignment: We may assign, novate, transfer, charge or subcontract any or all of our rights and obligations under these terms freely, without your consent and without notice, including to an affiliate or in connection with a merger, acquisition, reorganisation or sale of assets. You may not assign, novate or transfer any of your rights or obligations without our prior written consent, and any attempt to do so without it is void.
19.6 Entire agreement: These terms, together with the documents referred to in 1.4, constitute the entire agreement between you and us about the service, and supersede all prior and contemporaneous understandings, proposals, representations and communications, whether written or oral. You confirm that in entering into this agreement you have not relied on any statement, representation, assurance or warranty that is not set out in it. Nothing in this clause limits or excludes any liability for fraud or fraudulent misrepresentation.
19.7 Force majeure: Neither party is liable for a failure or delay in performing an obligation, other than an obligation to pay, that is caused by an event beyond its reasonable control, including natural disaster, fire, flood, epidemic, war, terrorism, civil unrest, industrial action, failure of power, telecommunications, internet, hosting or an upstream provider, cyber attack, embargo, and any act, order or requirement of a government or regulator.
19.8 Notices: We may give you notice by email to the address on your account, or by publishing it on this site or in the console, and such a notice is treated as received when it is sent or published. Formal legal notice to us must be given in writing to the address in section 20 and is effective on actual receipt.
19.9 No third-party beneficiaries: This agreement is between you and us. No other person has any right to enforce any of its terms, except that our affiliates and our and their officers, directors, employees, contractors, suppliers and agents may enforce sections 13, 14 and 15. Where any law would otherwise confer enforcement rights on a third party, they are excluded to the maximum extent permitted by that law. You and we may vary or rescind this agreement without the consent of any third party.
19.10 Relationship of the parties: Nothing in these terms creates a partnership, joint venture, agency, franchise, fiduciary or employment relationship between you and us.
19.11 Interpretation: Headings and section numbers are for convenience and do not affect interpretation. "Including", "for example" and "such as" mean "including without limitation" and introduce examples rather than an exhaustive list. A reference to a law includes that law as amended or replaced.
19.12 Language: These terms are written in English. If we publish a translation, the English version prevails to the extent applicable law permits.

20. Contact and legal notice

General questions about these terms and reports of abuse go to [email protected], and formal legal notice must go to the address stated below.

20.1 General contact: Write to [email protected] or use the contact page. Please say which scan, report or account a message is about so that it can be dealt with quickly. Security issues in Malwagon itself go through the security page, and questions about personal data go through the privacy policy.
20.2 Formal legal notice: A notice served under 19.8, and any legal process, must be sent in writing to the entity and address stated immediately below. A notice sent anywhere else, including to a support mailbox or a social media account, is not effective service.

Formal notice reaches the operator by email at [email protected]. No postal address for service is published, so email is the route the operator accepts and the address above is the one to use.