Terms of Service

Access to the paid Nullbrick application is provisioned after a customer agreement is signed. The signed agreement and applicable order form govern the customer’s subscription, commercial terms, and service obligations. These Terms supplement that agreement only to the extent incorporated or otherwise validly accepted. In a conflict, the signed agreement controls; an applicable data processing agreement controls personal-data processing matters within its scope.

An authorized user must be at least 18, act within the customer’s authorization, and comply with applicable access and use restrictions. These website Terms do not themselves authorize application access or retroactively amend an existing customer agreement.

Nullbrick provides vulnerability visibility, SBOM information, image catalog and lineage capabilities, and remediation recommendations. Available functions depend on the purchased scope, supported workflows, and configuration.

Nullbrick offers shared SaaS infrastructure and dedicated application deployment and database options according to the customer agreement. A dedicated deployment does not by itself establish a separate AWS account, exclusive hardware, or a particular assurance level.

Nullbrick creates accounts after the customer agreement is signed. Users can sign in using email and password or company SSO, as configured. MFA is handled by the customer’s SSO provider; Nullbrick does not provide separate MFA for email-and-password accounts. User roles restrict access and permitted actions.

Customers must identify authorized users, maintain accurate contact information, safeguard account credentials, manage their own SSO policies and user permissions, and notify secure@nullbrick.ai promptly of suspected account compromise. Each party remains responsible for its obligations under the signed agreement and applicable law.

Customers may submit findings, upload SBOMs, or configure assessment workflows only for assets they own or are authorized to assess. They are responsible for obtaining required permissions, providing lawful instructions, and ensuring that their use complies with third-party terms and applicable law.

Any customer-side agent or integration must be reviewed for permissions and operational impact before use. The customer is responsible for authorizing its deployment and selecting the intended asset scope. These Terms do not authorize attacks on Nullbrick or unauthorized testing of third-party systems.

Customers retain their rights in submitted scan findings, uploaded SBOMs, infrastructure metadata, and related customer content (“Customer Data”). Customers permit Nullbrick to process Customer Data as needed to provide the contracted service, carry out lawful instructions, protect the service, and meet applicable legal obligations.

The current service does not receive or store customer source code or complete container images, including temporarily for scanning, and does not store customer integration credentials. Do not upload secrets, unrelated personal information, or data outside the agreed scope.

Nullbrick does not use Customer Data to train or fine-tune AI models and does not sell personal information or share it for advertising. The Privacy Policy at https://nullbrick.ai/privacy describes handling of personal information. Customer-controlled processing is also subject to the signed agreement and any applicable data processing agreement.

Nullbrick provides recommendations for customers to review and apply. It does not automatically change customer systems or deploy fixes. Customers are responsible for deciding whether to act, verifying underlying evidence, testing proposed changes, and managing deployment, backups, and rollback in their own environments.

AI-assisted CVE information is generated using AWS Bedrock with public CVE details only. Customer scan findings, uploaded SBOMs, source code, and other customer data are not sent to Bedrock under the current workflow.

Findings and AI outputs may be incomplete, inaccurate, or outdated. Coverage depends on available intelligence, supported components, configuration, and the evaluated conditions. A clean scan does not establish that an asset is free of vulnerabilities. A finding described as unreachable may become reachable after a change. A reported fix must be validated in the intended artifact and deployment.

Outputs do not constitute legal advice, certification, or a guarantee of compliance or security. Subject to third-party rights and the customer agreement, customers may use outputs produced for their account for their business purposes. Nullbrick does not acquire ownership of Customer Data merely because it appears in an output.

You must not use the website or service unlawfully; infringe others’ rights; access assets without authorization; bypass account, tenant, or usage restrictions; steal credentials or information; introduce malicious code; disrupt service availability; or conduct abusive scanning or exploitation.

You must not reverse engineer proprietary components except where applicable law permits despite this restriction. Open-source software remains governed by its applicable licenses. Testing Nullbrick itself requires written authorization or another expressly authorized scope.

Third-party integrations, software, packages, base images, vulnerability intelligence, and other materials may be subject to separate terms and licenses. Customers must review relevant rights, redistribution conditions, attribution requirements, and compatibility before use.

An image catalog entry, SBOM, hardening check, or reference to CIS, STIG, or FIPS does not alone establish certification, complete benchmark coverage, cryptographic validation, or the security of a deployed application. Any assurance must be supported by its actual scope and evidence.

Nullbrick is a paid service. Customers pay by invoice and bank transfer. Pricing, taxes, payment dates, subscription duration, renewal, cancellation, refunds, and any usage limits are specified individually in the customer agreement or order form.

These website Terms do not independently create automatic renewal, nonrefundable fees, or an overdue-payment suspension deadline. Any related rights and notice requirements follow the signed agreement and applicable law.

Confidentiality, authorized data use, security responsibilities, and any incident-notification obligations are governed by the signed agreement, any applicable data processing agreement, and mandatory law. Information on current practices is available at https://nullbrick.ai/security.

Nullbrick support access to customer data is restricted to authorized staff, requires customer approval, is time-limited, and is logged. A controlled emergency exception permits narrowly scoped access for an urgent security incident, with logging and customer notification under the customer agreement. Public security information does not establish an unstated uptime or incident-response service-level agreement.

Scan findings and uploaded SBOMs are retained for 30 days, subject to the customer agreement. Customers can download available findings and SBOMs during an active subscription. No additional export-access period is provided after the subscription ends; customers should export required records before that date.

The scan-data retention period does not establish a deadline for deleting account, billing, correspondence, security-log, or backup records. Deletion requests and any post-termination obligations follow the customer agreement, the Privacy Policy, and applicable law.

Subscription changes, service availability obligations, suspension, termination, breach remedies, and any period to remedy a breach are governed by the signed agreement and applicable law. These Terms do not supply an unagreed cure period or alter an existing termination right.

Nullbrick may restrict activity to the extent permitted by the applicable agreement and law when necessary to address unauthorized use, unlawful activity, or an urgent service-security risk. Any contractual notice and cooperation obligations remain applicable.

Nullbrick and its licensors retain their rights in proprietary service software, documentation, and branding. Customers receive the access and usage rights specified in their agreement. No ownership is transferred except as expressly agreed.

Voluntary feedback may be used to improve the service without an obligation to pay for the feedback, but this does not authorize disclosure of customer confidential information or broader use of Customer Data.

Any express warranties, remedies, liability caps, exclusions, indemnities, and exceptions are those agreed in the signed customer agreement, subject to mandatory law. These website Terms do not introduce a new monetary liability cap, customer indemnity, or exclusion that overrides the customer agreement.

For public website material, to the extent permitted by law, information is provided “as is” and “as available” without a warranty of uninterrupted availability or completeness. Nothing in these Terms excludes any liability, warranty, or right that cannot lawfully be excluded.

Governing law, dispute venue, and any dispute-resolution procedure for the paid service are determined by the signed customer agreement and applicable law. These website Terms do not select a jurisdiction or impose arbitration or a class-action waiver. Questions or concerns can be raised at secure@nullbrick.ai.

Nullbrick will send material policy updates by email to the designated customer contact and identify the current version through the dates above. Changes operate prospectively and do not amend signed agreements or accrued rights except through the process those agreements and applicable law permit.

Questions about these Terms, support, privacy requests, and security reports may be sent to secure@nullbrick.ai. Legal correspondence may also be mailed to: Nullbrick LLC, 2050 Cherrywood Ln, Cumming, GA 30041, USA. Email: secure@nullbrick.ai.