Terms of Service

1. Who we are and who these terms are for

WatchTower is a trading name of Nikah AI Ltd. In these terms “we”, “us” and “WatchTower” mean Nikah AI Ltd, a company registered in England and Wales with company number 17199968, registered office Office 1216, 60 Tottenham Court Road, London W1T 2EW. You can reach us through the contact form, by email at info@nikah-ai.com, or by post at the registered office.

WatchTower is sold to businesses and other organisations (companies, sole traders acting for their business, charities, schools and public bodies). “You” means the organisation that creates the workspace. The person who signs up confirms they are authorised to accept these terms for that organisation. WatchTower is not offered to consumers for personal or household use. If you nevertheless buy as a consumer, the rights described in the Refunds & Cancellation Policy under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and the Consumer Rights Act 2015 apply, and nothing in these terms takes them away.

2. The service

WatchTower is endpoint security software delivered as a hosted service: an agent you install on devices you manage, a web console, detection of suspicious activity, optional automatic response, data-loss prevention and an audit log. Features vary by plan and are described on the pricing and features pages.

Every new workspace starts with a 14-day free trial with every feature switched on. We may improve or change the service; we will not materially reduce the core detection features of a plan you have paid for during the period you have paid for.

WatchTower is software, not a managed security service. We do not watch your alerts for you, there is no 24/7 security operations centre, and we do not respond to incidents on your behalf unless we agree that separately in writing.

3. How automatic response works, and your responsibility for it

WatchTower can take actions on your devices that interrupt work: stopping (killing) a process, quarantining a file, isolating a device from the network and locking its screen. These are powerful controls and they can affect legitimate software.

• Default. A new workspace starts in detect only mode with automatic isolation switched off. In that mode WatchTower raises alerts and does not stop processes or isolate devices by itself.
• Detect and block. If an administrator switches the workspace to detect and block, WatchTower will, without asking first, take the actions your settings specify for findings of the chosen severity. This includes stopping processes and, for some detections such as a tripped ransomware canary or credential dumping, isolating the device.
• Manual actions. Anyone with the right role in your console can isolate a device, stop a process or run an approved script, and the action is carried out on the device as instructed.
• Mistakes happen. Detection is based on behaviour and rules and will sometimes flag legitimate activity (a false positive). An automatic action taken on a false positive can stop a business application, database or service, or cut a device off the network.

Because you control these settings, you are responsible for: choosing them; testing detect-and-block on a small, representative group of devices before using it across your estate; adding business-critical software to the allowlist; keeping backups and a way to recover devices; and checking the audit log and alerts. Do not enable automatic response on systems where an unexpected stop could put people, safety or critical services at risk.

4. What WatchTower does not promise

No security product detects or prevents every threat, and WatchTower does not guarantee that it will. It does not replace backups, patching, staff training, other security controls or professional incident response. Alerts sent by email depend on email delivery and on you giving a working notification address. Protection on a device depends on the agent being installed, running and able to reach our servers; if it is stopped, removed or offline, detection that relies on the server stops.

We aim to keep the service available but provide it on an “as available” basis, without a service-level commitment unless one is agreed in writing. To the extent the law allows, we exclude terms implied by statute or common law about the service, including as to satisfactory quality and fitness for a particular purpose.

5. Acceptable use

You must not, and must not let anyone else:

• install the agent on any device you do not own or are not authorised to manage, or use WatchTower to monitor anyone in a way that breaks employment, data protection, privacy or human rights law, including covert monitoring that the law does not permit;
• send phishing simulations to anyone other than people in your own organisation whom you are authorised to test, on email domains your organisation controls, with the approval of someone in your organisation who is entitled to give it;
• use WatchTower to access, scan or test any computer, network or account without the owner’s authorisation (which may be an offence under the Computer Misuse Act 1990), or to deploy malware other than harmless test files on your own devices;
• use WatchTower on systems whose failure could cause death, personal injury or serious environmental damage, including medical devices, industrial control or life-support systems. WatchTower is not designed or tested for those uses;
• use or export WatchTower in breach of UK export control or sanctions law, or make it available to a sanctioned person;
• try to break or bypass the security of the service or other customers’ workspaces, reverse engineer it except where the law allows, or resell it without our written agreement.

We may suspend a workspace immediately, and report to the relevant authorities, if we reasonably believe it is being used unlawfully or in breach of this section.

6. Your data and monitoring of people

For the personal data WatchTower processes about the users of your devices and your console, you are the controller and we are your processor. The Data Processing Terms form part of these terms and set out how we handle that data, including our sub-processors.

Endpoint monitoring is monitoring of people. Before you deploy the agent you must: have a lawful basis for the monitoring; carry out a data protection impact assessment where the law requires one; and tell your staff and other device users, clearly and before monitoring starts, what is monitored, why, and how the information is used, in line with the Information Commissioner’s guidance on monitoring workers. Features that go beyond security telemetry (activity and time tracking, document and window titles, full web addresses, which are off by default, and remote screen viewing, which is available unless you turn remote support off) are yours to justify before you use them. Our monitoring notice explains what the agent collects and you may use it when informing people.

You are responsible for the lawfulness of the instructions you give us and of any data you choose to send to third-party services you connect, such as your own AI provider or threat-intelligence accounts.

7. Fees, trial and billing

Plans are priced per enrolled device per month, in GBP. The price shown is the total you pay. Payment is taken through Stripe.

• You do not need a card to start the trial. If you choose a plan, your card is taken at Stripe Checkout. If your trial is still running you are not charged until it ends.
• Your subscription then renews automatically every month and you are charged in advance for the number of devices set at checkout, until you cancel. You can change the device count or plan in the billing portal; Stripe adjusts the next invoice pro rata.
• Each plan has the device limit shown on the pricing page. Enrolling a device beyond it is refused. If you move to a plan with a lower limit, devices beyond it (the most recently enrolled) stay visible and can still be isolated from the console, but their telemetry is refused, so server-side detection and alerting stop for those devices until you raise the limit or remove devices.
• If a payment fails, Stripe retries it. After a grace period the console becomes read-only: you can still see alerts, isolate devices and export data, but paid features such as threat hunting and custom rules stop working until payment is made.
• We may change prices for future billing periods by giving you at least 30 days’ notice by email or in the console. You can cancel before the change takes effect.

8. Cancellation and refunds

You can cancel at any time in the billing portal. Cancellation takes effect at the end of the month you have paid for. The refunds we give, and how to ask, are in the Refunds & Cancellation Policy, which forms part of these terms. If you are a consumer, your rights under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 are described there and are not affected by anything in these terms.

9. Our liability to you

• Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded by law.
• Subject to that, we are not liable for: loss of profits, revenue, business, contracts, anticipated savings or goodwill; loss or corruption of data (except that we will use reasonable efforts to restore data from our backups where we caused the loss); or any indirect or consequential loss.
• Subject to that, we are not liable for loss or disruption caused by a response action (automatic or manual) carried out as your settings or your users instructed, or for a threat that WatchTower did not detect or block, unless it was caused by our breach of these terms or our negligence.
• Subject to that, our total liability to you arising out of or in connection with WatchTower, whether in contract, tort (including negligence) or otherwise, is limited in each 12-month period starting on the date you first subscribed to the greater of £100 and the total fees you paid us in the 12 months before the event giving rise to the claim.

These limits reflect that WatchTower is priced per device per month, that you control how it is configured and deployed, and that you can protect yourself with backups, testing and insurance. If you are a consumer, this section does not limit our liability for breaching your statutory rights.

10. Your responsibility to us

If you are a business, you will reimburse us for reasonable losses, costs (including reasonable legal costs) and liabilities we incur because of a claim by a third party (including your staff or the users of your devices) arising from your breach of section 5 or section 6, such as monitoring people unlawfully, installing the agent without authority or misusing phishing simulations. We will tell you promptly about any such claim and let you take part in handling it.

11. Suspension, ending the agreement and your data

Either of us may end this agreement if the other commits a material breach and does not fix it within 30 days of written notice. We may suspend access immediately where continued use poses a security or legal risk. You may end it at any time by cancelling and, if you wish, asking us to delete your workspace.

When your subscription ends the workspace stays read-only so you can export your data, and detailed telemetry keeps being deleted on its normal schedule. We delete the whole workspace when you ask us to, and in any case no later than 12 months after your subscription or trial ends; copies in our backups are overwritten within a further 30 days. Uninstall the agent from your devices when you stop using WatchTower.

12. Changes to these terms

We may update these terms. For a change that materially affects you we will give at least 30 days’ notice by email or in the console before it takes effect; if you do not accept it you may cancel before then and the current terms continue to apply until your paid period ends. Changes needed to meet a legal requirement or fix a security problem may take effect sooner. The date at the top shows when these terms last changed.

13. General

• These terms, the Data Processing Terms and the Refunds & Cancellation Policy are the whole agreement between us about WatchTower and replace anything said before. Neither of us relies on any statement not set out in them, but this does not limit liability for fraud.
• Neither of us is responsible for delay or failure caused by events outside our reasonable control.
• You may not transfer this agreement without our consent. We may transfer it to a company that takes over WatchTower, and will tell you if we do.
• No one else has any right to enforce these terms under the Contracts (Rights of Third Parties) Act 1999.
• If any part of these terms is found unenforceable, the rest remains in force.
• These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except that a consumer living in Scotland or Northern Ireland may bring proceedings in their local courts.

Contact

Questions about these terms: use the contact form or email info@nikah-ai.com. Post: Nikah AI Ltd, Office 1216, 60 Tottenham Court Road, London W1T 2EW.