Terms of Service

These terms are an agreement between CTRL 18 Private Limited (“CTRL 18”, “we”), a company incorporated in India (CIN U58201KA2026PTC225545), and the organisation that uses Kritis (“Customer”, “you”). By creating an account or using Kritis, you confirm that you accept them on your organisation's behalf and have the authority to do so.

If your organisation has signed an order form or master agreement with us, that document takes priority where it differs from these terms.

Kritis is a cyber decision platform. It includes guided assessments, external scans of internet-facing assets, read-only scans of systems you connect, risk estimates, compliance mapping, reports and Kritis AI summaries. The Kritis on-premise appliance, where supplied, is also covered by your order form. We may improve and change features over time; we will not remove a core feature you are paying for during your subscription without notice.

• You are responsible for the people you invite and for what is done under your organisation's accounts.
• Keep sign-in details confidential, and turn on multi-factor authentication. Tell us promptly at hello@ctrl18.com if you suspect unauthorised access.
• Account information you give us must be accurate.

You can connect systems such as Microsoft Entra ID, Microsoft 365, Azure, AWS and network devices by granting Kritis read-only access. You confirm that you are authorised to grant that access.

Kritis is built to read configuration and settings; it does not change your systems. You decide which permissions to grant, and you can revoke them at any time in the connected system. Any permission beyond what we ask for is your choice and your responsibility.

Only ask Kritis to scan domains and IP addresses that you own or are authorised to test. Kritis scans passively: it does not exploit vulnerabilities or attempt to break in.

You are responsible for having that authorisation. We may refuse or stop a scan if we believe it targets assets you are not authorised to test.

You must not:

• use Kritis to break the law or to harm anyone;
• try to access another customer's data or any part of Kritis you are not permitted to use;
• probe, overload or test the security of Kritis without our written agreement;
• upload malicious code;
• copy, reverse engineer or resell Kritis, except as the law expressly allows or we agree in writing.

You own the data you enter and the data Kritis reads from your connected systems (“Customer Data”). You give us permission to process it only to provide, secure and support Kritis for you. Our Privacy Policy explains how we handle it.

We may use aggregated data that cannot identify you or any person to improve Kritis.

You can export your reports at any time. When your subscription ends, we delete Customer Data as set out in the Privacy Policy.

Scores, findings and financial loss estimates come from probabilistic models and the information available to Kritis at the time. They are estimates to support your decisions, not guarantees, and they are not financial, legal, insurance or audit advice.

Mapping your results to a framework or regulation does not certify that you comply with it. Framework names such as CIS Controls, NIST CSF, ISO/IEC 27001, SEBI CSCRF and DPDPA belong to their owners; CTRL 18 is not affiliated with or endorsed by them.

Kritis AI summaries are generated automatically and can be incomplete or wrong. Review them before relying on them.

Fees, billing periods and payment terms are set out in your order form or on our pricing page. Fees exclude applicable taxes such as GST, which you pay in addition. Pilots and trials are free for the period we agree in writing.

Each of us will keep the other's non-public information confidential, use it only for this agreement, and protect it with at least reasonable care. This does not apply to information that is public through no fault of the receiver, was already known to it, or must be disclosed by law.

CTRL 18 owns Kritis, including its software, the Kritis Risk Engine, the Kritisches Denken cost model, content and trademarks. These terms give you the right to use Kritis during your subscription and nothing more. If you send us feedback, we may use it without obligation to you.

Systems you connect, such as Microsoft or AWS services, are governed by their providers' terms. We are not responsible for their availability or for changes they make that affect what Kritis can read.

We work to keep Kritis available and secure, and we may schedule maintenance. Service levels and support response times apply only where your order form sets them out.

• These terms apply for as long as your organisation uses Kritis, and your subscription runs for the term in your order form.
• We may suspend access immediately if needed to protect Kritis, other customers or you, for example after a security incident or a serious breach of section 6. We will tell you why.
• Either of us may end the agreement if the other materially breaches it and does not fix the breach within 30 days of written notice.
• When the agreement ends, access stops. You have 30 days to export your reports, after which Customer Data is deleted as the Privacy Policy describes.

We will provide Kritis with reasonable skill and care. Apart from that and anything your order form says, Kritis is provided “as is”, and we do not promise that it will find every risk or vulnerability or run without interruption.

Neither of us is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill or data, however it arises.

Each party's total liability under this agreement is limited to the fees you paid for Kritis in the 12 months before the claim.

• You will defend and compensate CTRL 18 against third-party claims arising from scans of assets you were not authorised to test, or from data you had no right to give us.
• We will defend and compensate you against third-party claims that Kritis, as we provide it, infringes their intellectual property.

These terms are governed by the laws of India. The courts at Bengaluru, Karnataka have exclusive jurisdiction.

We may update these terms. We will post the new version here and give account administrators at least 30 days' notice of a significant change by email or in Kritis. If you do not agree, you may end your subscription before the change takes effect.

CTRL 18 Private Limited, 249, 2nd Main, 2nd Cross, Domlur 2nd Stage, Domlur, Bengaluru 560071, Karnataka, India. Email hello@ctrl18.com.