Terms of service

Version 3 · effective 14 November 2026

1. Who we are, and these terms

Cybernocs is operated by JITTERCAT (Pty) Ltd ("we", "us"). Our full details are in section 30.

"You" means the business (or person) that signs up. "Your team" means the people you invite to your account. The "service" is Cybernocs and everything in it. A "domain" means a website or email address name such as yourbusiness.co.za. A "scan" is one run of the checks described in section 4. A "finding" is anything a scan reports.

The agreement between us is made up of these terms, our privacy policy, and the plan details on the pricing page. If we sign a separate written agreement with you, that agreement wins where it differs from these terms.

You accept these terms by ticking the acceptance box, creating an account or using the service. We record when and which version you accepted. This is an electronic agreement and is as binding as a signed one. The person who accepts confirms that they are allowed to bind the business.

The service is made for businesses. If you are protected by the Consumer Protection Act, nothing in these terms takes away a right that law gives you (see section 26).

2. What the service does

Cybernocs looks at your business the way an outsider would, using free public sources and ordinary requests to your own website, and shows what it finds with plain-language steps to fix each item. The service has these parts:

• Eleven scan areas: exposed credentials in public code, ransomware leak-site listings, look-alike domains and certificates, your external attack surface (addresses, certificates, domain registration, website security settings, exposed files), known vulnerabilities in software your website shows, public data breaches, malware and botnet lists, government advisories, cloud and test systems, supplier risk, and email fraud protection (SPF, DMARC, DKIM).
• Alerts and reports: the findings dashboard, change tracking between scans, alerts on your dashboard, and downloadable reports.
• Incident response plan builder.
• Staff exit checklists.
• EDAN early warning (optional, where it is available). EDAN stands for Early Detection And Notification. You add one DNS record that points a decoy address, which nothing in your business uses, at Cybernocs. If anyone asks for that address, we record the request and email you.
• Team accounts with owner, editor and viewer roles.

Everything above is included in the one plan. The pricing page lists what is included.

3. What the service is not

• It is not a penetration test, vulnerability assessment by a security professional, security audit, digital forensics, incident response, managed detection and response, certification, insurance, or legal, regulatory, financial or professional advice. It does not replace any of these.
• It cannot prevent a cyber attack, and we do not promise to detect one. A business with a perfect score can still be attacked.
• Findings are leads to verify. They show what we could see at the moment of the scan, from the outside. They are indicative and not exhaustive. A clean result does not mean your business is safe, and a finding does not prove that something is wrong. We do not guarantee that the service will find every problem or that it will keep your business safe. Cybernocs reads public information, so what it reports is a lead, not a guarantee. You must investigate and decide what to do.
• Ransomware listings, breach records and similar entries are claims or records published by other people. We cannot verify them.
• Software versions are read from what your website shows and can be out of date or hidden. The service cannot see inside your network, devices, cloud accounts or email.
• We do not monitor your systems for attacks, respond to incidents, or fix anything for you.
• EDAN only notices that a decoy address was requested. It cannot see most scanning, cannot tell a scanner from a researcher or a mistake, cannot stop anything, and will sometimes alert for harmless reasons. No alert does not mean you are not being scanned or attacked, and an alert does not mean anyone got in. Alert emails can be delayed, filtered or lost, and a very busy decoy is only recorded up to a set number of requests an hour.
• Where we explain what a finding may mean, we describe possible situations. We do not know your setup, so what we say may not apply to you.

4. What we do when we scan

So there are no surprises, this is what a scan does.

• Domains you add. We read public security and registry information about them, such as certificate records, domain registration, DNS records, breach and ransomware lists, malware lists and government advisories. We also send ordinary read-only requests to the domain and its subdomains, including subdomains we find in public certificate records. We load the home page and up to five script files that the page loads from your own domain. We ask for around 80 well-known page and file addresses, such as backup, configuration and administration pages, to see whether they are publicly readable. We test whether a limited number of old addresses of your domain, found in a public web archive, are still publicly readable. We look up the DNS names and addresses that belong to your domain, and the public records of the plugins and software your website shows. If your site redirects visitors to someone else's website, we do not follow it.
• Email domains you add. We look up their public DNS records, such as mail servers and email-protection settings. We do not send email to test them.
• Brands and company names you add. We match them against public ransomware and breach lists, public certificate records and public code-hosting sites. We test whether look-alike versions of your domain names are registered, using public DNS and registry lookups. We do not open or visit those look-alike sites.
• IP addresses and ranges you add. We check them against public malware and botnet lists and read their public registry records. We do not connect to them, scan their ports or test them in any way.
• Suppliers you add. We match their names and domains against public ransomware, breach and botnet lists. We do not scan them or send any request to their systems.
• Gentle and identifiable. Requests are spaced out and sent a few at a time. They carry a scanner name so that your host or IT person can recognise them.

What we never do:

• We never log in, ask for passwords or keys, or need access to your accounts.
• We never run exploits, guess passwords, submit forms, try to get around a protection, intercept traffic or deliberately overload anything.
• We never store the contents of an exposed file. Where a file or public source suggests that a secret may be exposed, we record only where it was seen. We never display a password.

Our scans are non-intrusive. They are not invisible: our requests appear in your server logs and may be noticed by your security tools. See section 5.

5. Your permission and your promises

1. Our permission. When you add a domain, email domain, brand, IP address or range, or supplier, and (for a domain) prove you control it, you instruct and authorise us to carry out, for it, every check described in section 4, including the read-only requests to your domain, its subdomains, and the websites and servers that serve them, for as long as monitoring is on. You give this permission for yourself and for everyone else whose permission is needed. You confirm this permission each time you add and prove a domain, and we keep a record of who gave it and when.
2. You have the right to give it. You promise that you will add only domains, email domains, brands, IP addresses and ranges that you own or control, or for which the owner has given you written permission to have them checked, and suppliers that you have a genuine business reason to monitor. You promise that you will never add anything you are not entitled to add. You also promise that you have any permission needed from the people who run the systems behind it, such as your web host, cloud provider or security provider, and that you have read their rules about testing. If a domain belongs to a subsidiary or associated business, you promise that you are allowed to act for it, and you must be able to show this when we ask.
3. Suppliers, brands and other names. Suppliers, brands and company names you add are only matched against public lists. We do not scan suppliers or anyone else. Adding a supplier, or its domain, does not give you or us permission to scan it, and you must not add a domain or IP address that is not yours as a way of scanning it.
4. Your security tools. Our requests may appear in logs, trigger alerts, be rate-limited or be blocked by your host, firewall or security provider. It is your job to tell whoever looks after those tools, and you may ask us for the scanner name. If requests are blocked, some results may be incomplete. We are not responsible for alerts, blocks, notices or costs caused by scans that you authorised and that we ran as described in section 4.
5. Load and fragile systems. Our requests are few and light. Even so, any request can in rare cases have an unexpected effect on a fragile, misconfigured or very small system. You accept this risk. You are responsible for keeping backups. Tell us if a system must not be requested, or must only be requested at certain times, and we will exclude it.
6. EDAN decoys. You will only add a decoy under a domain you have proved you own. You will choose a name that nothing real uses, and you will not publish it or use it for a real service. You will use what an alert shows only to look after your own systems. An IP address does not identify a person, so you will not accuse, contact or take action against anyone on the strength of an alert alone. We may remove a decoy that is being misused.
7. Stopping. You can remove a domain or switch monitoring off at any time. If you tell us in writing to stop scanning something, we will stop within two business days.
8. Proof. We may ask you to show your authority over any domain, IP address or range at any time. We may stop scanning it, and may suspend the service, if you cannot, or if its real owner or host objects.
9. If you had no right. If you add something you were not entitled to add, you alone are responsible for it, and you will be liable for any claim, complaint, fine, investigation or legal action that follows, as set out in section 22. The permission to scan comes only from you. We have no way of knowing who really owns a system, and we rely on your promise and on the proof in section 6. Jittercat, its owner, directors, employees and contractors are not responsible for any scan that you were not entitled to authorise.
10. Authorities and complaints. If the owner or host of a system complains, or the police, a court or a regulator asks us, we may tell them what we scanned, when, and who authorised it, and we may give them our records of your acceptance of these terms and of your permission. We will cooperate with lawful requests.
11. Clients from anywhere. We welcome clients from across the world. South African law governs this agreement and your use of the service, wherever you are (see section 29). If you use the service from another country, or for domains in another country, you are responsible for following the laws there that apply to you.

6. Proving you own your domains

Before we scan a domain you must prove you control it by adding a short text record to its DNS settings, which we show you inside your account. We scan only domains you have proved, and domains covered by them. You may not add domains that belong to someone else, or IP addresses and private network names. We may re-check the record at any time and may stop scanning if it is removed. We may remove anything that does not meet these rules.

7. Scans, limits and fair use

• Scans run automatically every 24 hours, and you can also start a scan yourself. To protect the free public sources we depend on, each account may start up to 10 manual scans in any 24 hours. Scheduled scans continue automatically.
• We may change these limits, and may slow or pause scans that put unreasonable load on us or on the public sources.
• We may share lookup results between customers, because the underlying public information is the same, and we keep them for a short time to avoid asking the public sources again.
• You may not use the service to scan anyone but yourself, to resell or republish the results as your own service, or to copy or extract the service's content or methods in bulk.

8. Findings, scores and reports

• Results describe one moment in time. Two scans a few hours apart can give different results, because sources change and sometimes cannot be read.
• The health score is our own indicative number. It is not a certification, an independent rating, or proof of security or compliance. Do not present it to anyone as any of these.
• You may share reports with others, such as your insurer, customers, auditors or advisers. That is your decision and your responsibility. We owe no duty to anyone you share a report with, and they may not rely on it against us.
• You may not change a result, score or report and present it as ours, or describe it as a penetration test, an audit, a certification or an independent rating. You may add your own logo or notes to a report you print, provided the findings stay as we produced them.
• If you think a finding is wrong, you can dismiss it, and you can tell us. We will look at reasonable reports and fix real errors, but we are not obliged to change a result.

9. Third-party sources and data

• We rely on free public sources run by others. They can be slow, change, limit requests, stop working or stop being free, without notice. We do not control what they collect or publish.
• Their data can be incomplete, out of date or wrong. Results can differ between scans. A missing result does not mean a threat does not exist.
• When a source cannot be read, the result says so, and we do not present an unread source as "clear".
• Breach and ransomware entries are claims or records by third parties. A listing is not proof that you were attacked, and no listing is not proof that you were not.
• Software and vulnerability matches are indicators based on what your website shows. They do not confirm that something can be exploited.
• We are not responsible for the accuracy, availability or terms of third-party sources. Some data is used under the source's own licence, and its credit appears where required. If a source's licence does not allow our use, we will stop using it.

10. Supplier monitoring

Supplier results are information from public lists. They do not show that a supplier has been compromised, and they do not show that it has not. Check with the supplier before you act on one, and before you say anything about a supplier to anyone else. You are responsible for what you say or do about a supplier.

11. Incident response plan and staff exit checklists

• The incident response plan is a planning aid built from your own answers. It is not legal advice and does not file anything with a regulator. It does not say you comply with any law. Laws differ by country and change over time. The plan covers breach-reporting rules under South African law (including POPIA and financial-sector standards, and the Cybercrimes Act reporting duty if and when it comes into force), EU law (GDPR and NIS2) and UK law (UK GDPR), plus the notice duties in your insurance policy and contracts. It does not cover other countries, US state laws, PCI DSS, DORA or sanctions rules on ransom payments.
• Your own lawyer or adviser must review and approve any plan before you rely on it.
• We do not check that your answers are true, and we do not decide for you whether an incident must be reported.
• The staff exit checklist is a to-do list. We do not connect to your systems, so it does not remove anyone's access, change any password or recover any device or document, and we cannot confirm that any item was done. We do not give employment-law advice. Take advice from an attorney or labour adviser before dismissing anyone, and on final pay, restraint of trade and personal devices.
• You are responsible for the names and details you record, and for having a lawful reason to record them.

12. Your account and your team

• You must give us accurate details and keep them up to date.
• You are responsible for your sign-in details and for everything done under your account, including by people you invite. Keep passwords private, use two-step sign-in, and remove people who leave your business.
• Owners and editors can change settings and data. Viewers can only read. You decide who has which role.
• Tell us straight away if you think your account has been used by someone else.
• Who may use the service. The service is for businesses and organisations, and for lawful security monitoring of their own assets. You may not use it if you, or anyone who will use it on your behalf, have been convicted of a computer-related or internet-related crime such as unauthorised access, fraud or misuse of data; if the law or sanctions forbid us to supply you; or if you cannot show that you have the right to scan what you add when we ask. We may refuse or end the service on these grounds.
• If we suspect misuse of the service or of someone else's system, you will cooperate with our reasonable investigation and give us the information we ask for.

13. Your information and our use of it

You keep ownership of the information you enter and of your scan results. You give us permission to process them to provide the service. We use your information to run scans, show results, show alerts, secure and improve the service, and reply to you. We may also produce anonymous, combined statistics that do not identify you or your business. We do not sell your information. Our privacy policy explains what we collect and your rights, and forms part of these terms.

14. Personal information we process for you

Where you enter personal information about other people, such as staff names in an exit checklist or contacts in a plan, you are the responsible party under POPIA and we are your operator. For that information we agree to the following.

• We process it only to provide the service to you, and in line with your instructions as given by your use of the service.
• We treat it as confidential, and allow access only to people who need it to run the service.
• We keep appropriate security safeguards in place. These include keeping each customer's data separate, protected password storage, two-step sign-in, role-based access and encrypted connections.
• We use other companies to host the service and send email. We make sure they are bound to protect information, and where information is processed outside South Africa we rely on the protections POPIA allows. Our privacy policy lists the kinds of providers we use.
• If we find that personal information you gave us has been accessed or taken by someone who should not have it, we will tell you as soon as reasonably possible, with what we know, so that you can meet your own duties to the Information Regulator and the people affected.
• We will help you answer requests from people about their information, where you ask us to and where the service holds it.
• When the agreement ends we will return or delete it as set out in section 24.
• On reasonable request, we will give you information that shows we follow this section.

You promise that you have a lawful reason to enter that information, and that people have been told what is needed.

EDAN visitors. If you use EDAN, we record the details of each request for your decoy address: the time, the visitor's IP address, an approximate country, the page asked for, and the name the browser or tool gives itself. We record this to tell you, and to keep the service and your systems secure. We show it only to your account, keep it for 30 days and then delete it, and do not sell it or use it for advertising. Our privacy policy tells these visitors what we hold and how to ask about it.

15. If Cybernocs has a security incident

If our own systems are compromised in a way that affects your information, we will tell you as soon as reasonably possible, explain what we know, and tell you what we recommend you do. Our telling you is not an admission that we are at fault.

16. Acceptable use

You may not:

• monitor domains or organisations you are not authorised to monitor, or use the service to investigate or profile other people or businesses;
• use the service to harass, threaten, defraud or harm anyone;
• try to break into, overload, disrupt or reverse-engineer the service, or get around its limits or ownership checks;
• build a competing service from it, or use it to test or benchmark against other services;
• upload anything unlawful or malicious; or
• use the service, or what it shows you, to plan or carry out an attack.

You agree that we may test the security of our own service. If you find a security problem in Cybernocs, please email us with details and give us reasonable time to fix it before you tell anyone else. Do not access other customers' data.

17. Our service and our rights

We own the service, its software, design, wording, guides, scoring and methods. We give you a limited, non-exclusive right to use it for your own business while your account is active. You may print and keep the reports and plans you create for your own use. These terms do not give you any other rights in our material. If you send us ideas or suggestions, we may use them without paying you. If you give us suggestions or feedback about the service, we may use them to improve it without paying you or crediting you.

18. Availability, changes and things outside our control

• We work to keep the service running and to keep it accurate, but we do not promise it will always be available, error-free or complete. We have no service-level commitment.
• We may do maintenance, and may update, change, add or remove features, sources and checks. We will give notice of changes that materially reduce what the plan includes.
• We are not responsible for delay or failure caused by something outside our reasonable control, including outages at our hosting or email providers, internet failures, power cuts, changes by a data source, government action, or attacks on us despite reasonable safeguards. If this lasts longer than 30 days, either of us may end the agreement and we will refund any fee paid for a period you cannot use.

19. Prices and payment

• The service is one plan at R899 per month, with every feature included. Prices shown in another currency are an estimate based on a recent exchange rate, and you are billed in rand unless we agree otherwise.
• We are not currently registered for VAT, so no VAT is added. If this changes, we will tell you before it applies to you.
• You pay monthly in advance. The plan renews each month until you cancel. Payments are processed by a payment provider, which we will name when you pay. We do not store your card details.
• If a payment fails, we will try again and tell you. If it is still unpaid after 7 days, we may suspend the service. If it is still unpaid after 30 days, we may close the account under section 23.
• We will give you at least 30 days' notice of a price increase. If you do not want to pay the new price, you may cancel before it applies.
• You can cancel at any time (section 23). Fees already paid for the current month are not refunded, except where the law requires, where section 18 applies, or where we end the agreement without cause.
• You pay the fees in full, without deducting or setting off any amount, unless the law says otherwise.
• We do not currently offer a free trial. If we do, its rules will be shown when it is offered.

20. Disclaimer

To the extent the law allows, the service is provided "as is" and "as available". We give no promise that it will find every weakness, exposure or threat, that its results are complete, current or correct, that it will be uninterrupted, or that following its guidance will prevent an incident. A result that shows nothing found does not mean nothing exists. Security decisions, and the consequences of them, remain yours.

21. Limit of liability

• To the extent the law allows, we are not responsible for indirect or consequential loss, or for loss of profit, revenue, business, savings, data or goodwill.
• To the extent the law allows, we are not responsible for loss caused by a weakness or attack we did not report, by something the service could not see, by a third-party source being wrong, late or unavailable, by a false or misleading lead, by a decision you made or did not make after reading a result, or by a legal or regulatory outcome.
• Our total liability to you for everything arising out of or in connection with the service, in total, is limited to one month's subscription fee, which is the monthly fee that applied when the event happened (currently R899).
• None of this limits liability that the law does not allow to be limited. This includes fraud, gross negligence, wilful misconduct, and rights you may have under the Consumer Protection Act.
• We owe no duty to anyone other than you. The limits in this section also protect the owner, directors, employees and contractors of Jittercat.

22. Your responsibility and indemnity

You are responsible for what you add to the service and for how you use it. You agree to protect Jittercat, its owner, directors, employees and contractors (together, "we") against every claim, demand, complaint, investigation, fine, penalty, loss, damage and cost (including legal costs on the attorney-and-own-client scale) that arises from:

• you adding a domain, email domain, brand, IP address or range, or any other system that you did not own and were not authorised to have checked, or breaking a promise in section 5;
• any claim by an owner, host, provider, customer or other person of a system that you asked us to check, whether it is civil, criminal or regulatory, including legal action brought against us because of a scan that you authorised;
• you misusing the service or breaking section 16; or
• information you enter that breaks someone's rights or the law.

We are not liable to you or to anyone else for any consequence of a scan of something that you had no right to add. If we are sued or investigated because of it, you will pay our costs of dealing with it, and you will cooperate and give us the proof of your authority.

This does not apply to the extent that the loss was caused by our own fraud, gross negligence or wilful misconduct. We will tell you promptly about any such claim, and we will not settle it without talking to you first.

23. Suspending and ending the agreement

• You may stop using the service and cancel at any time, from your account or by email. Cancellation takes effect at the end of the month you have already paid for, and you keep access until then.
• We may suspend part or all of the service if we reasonably believe that it is being used against section 5 or 16, puts the service or other people at risk, or is not paid for, or if a court, the police or a regulator lawfully requires it. Where we reasonably can, we will tell you first and give you a chance to put it right. We will suspend only what is needed, and restore it once the problem is fixed.
• We may end the agreement if you seriously break it and do not fix the problem within 7 days of our telling you, or straight away if the breach is unlawful or cannot be fixed. We may also end it for any reason by giving you 30 days' notice, and we will refund any fee you paid for the period after it ends.
• Sections that by their nature should continue (including 3, 5, 8, 13, 14, 20, 21, 22 and 25) continue after the agreement ends.

24. After the agreement ends

After your account closes you may ask for a copy of your reports and plans for 30 days. After that we delete your data from the live service, except what we must keep by law, and it is removed from our backups as they expire, in any case within 90 days. If you ask us to delete your data earlier we will do so, subject to what the law requires us to keep.

25. Complaints and disputes

• If you have a complaint, email us with the details. We will reply within 5 business days and try to resolve it within 30 days.
• If we cannot resolve it, either of us may take it to a court in South Africa that has jurisdiction. You agree to the jurisdiction of the courts for the area of our registered office as recorded with the Companies and Intellectual Property Commission (CIPC), even if you are outside South Africa. We may also claim unpaid fees in any competent court.
• This does not stop you from going to the Information Regulator, the National Consumer Commission or any other body that the law gives you access to.

26. Laws that protect you

These terms must be read together with the law. Nothing in them is meant to take away a right that the Consumer Protection Act, POPIA, the Electronic Communications and Transactions Act or any other law gives you and that cannot be given up. If a part of these terms would do that, that part does not apply to you to that extent, and the rest stays in force.

27. Changes to these terms

We may update these terms. We will post the new version here and tell you about significant changes by email or in your account at least 30 days before they apply, unless the change is needed sooner by law or to keep the service safe. If you keep using the service after a change takes effect, you accept it. If you do not accept a change, you may cancel before it applies and the old terms continue until then.

28. Notices

We may send notices to the email address on your account or show them in your account. You can send notices to us at the email address in section 30. Each of us chooses the address in this agreement (your account email, and our registered office as recorded with the CIPC) for formal notices and legal documents.

29. General terms

• These terms, and any dispute about them or the service, are governed by the laws of South Africa, wherever you are in the world. To the extent the law allows, South African law prevails over any other law that might otherwise apply.
• If any part of these terms is found unenforceable, the rest stays in force.
• If we do not enforce a right straight away, we have not given it up.
• These terms, the privacy policy and the details on your plan are the whole agreement between us about the service. Nothing said outside them, including in marketing, changes them.
• You may not transfer your account to someone else without our written permission. We may transfer the agreement to a successor to our business and will tell you if we do.
• Only you and we have rights under this agreement.
• The agreement is in English.

30. About us and how to reach us

• Name: JITTERCAT (Pty) Ltd
• Registration number: 2026/570232/07
• Email: hello@cybernocs.co.za