Turvix

These Terms of Service ("Terms") govern use of the Turvix application and related content and services (the "Service"). The Service is provided by Turvix Oy ("Turvix").

1. Scope and Business Use

The Service is intended for companies, public bodies, associations, and other organizations, and for use in a trade or profession. By using the Service, User confirms that they are acting in the course of a trade or profession or on behalf of an organization, and not as a consumer.

"Customer" means the organization on whose behalf the Service is acquired or which is represented by an organization created in the Service. "User" means an individual whom Customer authorizes to use the Service.

By creating an account or organization, purchasing a subscription, accepting these Terms, or using the Service on Customer's behalf, User represents that User has authority to bind Customer to these Terms. Customer is responsible for its Users and their compliance with these Terms. Each User is also personally bound by the obligations concerning account security and acceptable use. If User lacks the necessary authority, User must not use the Service.

2. The Service and Nature of Information

Turvix provides a digital tool that helps Customer develop its information security and privacy practices through guidance, checks, scores, recommendations, alerts, templates, and generated documents.

The Service and its content are general information-management and decision-support tools. They are not legal advice, an information-security or privacy audit, certification, penetration test, continuous monitoring service, managed security service, or other professional service based on Customer's particular circumstances. The Service does not guarantee compliance with any law, regulatory guidance, contractual obligation, or standard, including the GDPR, NIS2 requirements, or ISO standards.

Laws, regulatory guidance, standards, technology, and the threat environment change continuously. Information in the Service may be incomplete, outdated, inaccurate, or unsuitable for Customer's circumstances. Unless separately agreed in writing, Turvix has no duty to monitor Customer's environment or notify Customer of every change, threat, or deficiency.

Customer is solely responsible for:

assessing its risks, obligations, and required safeguards
reviewing Service results, recommendations, and documents before using them
selecting, configuring, implementing, testing, monitoring, and maintaining safeguards
backups, business continuity, disaster recovery, and security-incident management
obtaining qualified legal, technical, information-security, or privacy advice where needed.

Customer remains responsible for its decisions, including where they are based on the Service or its content. Implementing guidance cannot guarantee prevention of security or privacy incidents, data loss, unauthorized access, contractual breaches, claims, fines, or other harm.

3. Accounts and Customer Responsibilities

Use of the Service requires a User account. Sign-in may use a magic link sent by email or another method offered by Turvix.

Customer must:

provide accurate, current, and sufficient information
manage Users, invitations, roles, access rights, and administrators
permit access only to authorized Users within the agreed User limit
protect accounts, magic links, and credentials and promptly report suspected misuse
ensure that its use of the Service and data submitted to the Service are lawful
assess whether information is necessary and appropriate for processing in the Service before submitting it.

Accounts and credentials must not be shared. Customer is responsible for activity under its accounts unless caused by a security breach for which Turvix is responsible.

By submitting a domain name, email address, or other monitoring target to the Service, Customer represents that it owns or controls the target or has appropriate authorization to monitor it. Customer is responsible for required notices and lawful bases for processing and must remove the target when its authority to monitor it ends. Turvix may request reasonable evidence of Customer's authority and suspend monitoring where there is reasonable cause to doubt it.

4. Subscriptions and Payment

Subscription features, User limits, price, taxes, any trial period, and billing interval are displayed before purchase in the Service, an order form, or the payment provider's checkout ("Order Details"). Order Details form part of the agreement and prevail over these Terms only for those commercial details.

A paid subscription is recurring and automatically renews for successive monthly or annual periods of the same length unless the Order Details state otherwise or the subscription is canceled before the next charge. A trial converts to a paid subscription as described in the Order Details unless canceled before the trial ends.

Customer authorizes Turvix and the payment provider to charge the agreed fees. Customer is responsible for current billing and payment information and for applicable taxes as shown in the Order Details. Failure to pay may result in suspension or termination. Overdue amounts may accrue statutory late-payment interest under Finnish law and reasonable collection costs.

Customer may cancel through the Service's billing portal or as described in the Order Details. Cancellation takes effect at the time stated in the billing portal. Fees already charged and portions of a current billing period are non-refundable unless otherwise agreed in writing or required by mandatory law.

Turvix may change prices for future billing periods. A new price applies only to later periods. Customer may cancel before the new price is charged.

5. License and Turvix Intellectual Property

The Service and its software, source and object code, user interface, design, databases, data structures, workflows, methods, taxonomies, checks, scores, templates, text, graphics, documentation, trademarks, and other materials, together with their modifications, derivatives, and improvements ("Turvix Materials"), are owned by Turvix or its licensors. All rights not expressly granted to Customer are reserved.

During the agreement, Turvix grants Customer a limited, revocable, non-exclusive, non-transferable, and non-sublicensable right to permit its authorized Users to use the Service and Turvix Materials solely for Customer's internal business operations in accordance with these Terms and the Order Details.

Customer receives a perpetual, non-exclusive right to use, copy, and adapt documents expressly generated for Customer through the Service in its internal operations and to disclose them to its advisers, accountants, auditors, certifiers, authorities, counterparties, and customers to the extent reasonably necessary. Turvix retains all rights in the underlying templates, structures, methods, content library, and Service logic. Customer is responsible for reviewing, adapting, and using generated documents.

Customer and Users must not, without Turvix's prior written permission:

copy, publish, sell, lease, sublicense, or distribute the Service or Turvix Materials except as expressly permitted above
provide the Service to third parties as a service or use it to develop a competing product, content library, database, or service
modify the Service, create derivative works, decompile, reverse engineer, or attempt to discover source code, except to the limited extent mandatory law expressly permits
use robots, indexing, data mining, bulk downloading, or another automated method to collect the Service or its materials
bypass technical controls, usage limits, or security measures
remove copyright, trademark, or other proprietary notices
use the Service or Turvix Materials to train, fine-tune, test, or evaluate an artificial-intelligence or machine-learning model.

Turvix may use voluntary feedback and suggestions to develop the Service without payment or obligation to Customer, provided Turvix does not publish Customer's Confidential Information or identify Customer without permission.

Third-party materials may be subject to the relevant rights holder's terms.

6. Customer Content and Data Protection

"Customer Content" means data and content submitted, uploaded, or provided to the Service by Customer or a User. Customer retains its rights in Customer Content.

Customer grants Turvix and its service providers a non-exclusive right during the agreement to host, copy, transmit, transform, and otherwise process Customer Content only as needed to provide, maintain, secure, and support the Service, prevent misuse, enforce the agreement, and comply with legal obligations.

Customer represents that it has all rights, permissions, notices, and lawful bases required to provide Customer Content and issue processing instructions. Customer must not submit unlawful content or confidential, special-category personal data, or other exceptionally sensitive information unless it is necessary for the agreed use of the Service and its processing has been appropriately agreed.

Turvix may use aggregated and anonymized Service-usage data for analytics, security, and Service development if it cannot identify Customer, a User, or another individual.

Processing of personal data is described in the Privacy Notice. When Turvix processes personal data on Customer's behalf, that processing is governed by the Data Processing Agreement, which is incorporated into these Terms. The Data Processing Agreement prevails over these Terms for its subject matter.

7. Confidentiality

A party's "Confidential Information" means information marked confidential or that reasonably should be understood as confidential given its nature or the circumstances of disclosure. Turvix Confidential Information includes non-public Service features, technology, security information, pricing, plans, and Turvix Materials. Customer Content is Customer's Confidential Information.

The receiving party may use Confidential Information only to perform the agreement and must protect it with at least the same care used for its own similar information and always with reasonable care. It may disclose Confidential Information only to employees, advisers, and subcontractors who need to know it and are bound by equivalent confidentiality obligations.

Confidential Information does not include information the recipient demonstrates is public without breach, was lawfully known without a duty of confidentiality, was lawfully received from a third party, or was independently developed. Disclosure required by law or authority is permitted; the recipient must give advance notice where legally allowed.

The confidentiality obligations survive for three (3) years after termination and, for trade secrets, as long as the information remains a trade secret. Personal data remains subject to data protection law and any data processing agreement.

8. Acceptable Use

Customer and Users must not:

use the Service for unlawful, harmful, deceptive, or rights-infringing activity
break into the Service or related systems or test their vulnerabilities without written permission
disrupt, damage, or unreasonably overload the Service
distribute malware or other harmful code
impersonate another person or organization or access another customer's account or data without authorization
monitor, investigate, or check a third party's domain, email address, or other target without appropriate authorization
circumvent usage limits or exceed the agreed User limit.

9. Availability, Third Parties, and Service Changes

Unless expressly agreed in a separate service-level agreement, no service level or uninterrupted availability is guaranteed. The Service may be temporarily unavailable for maintenance, updates, faults, security measures, or causes beyond Turvix's reasonable control.

The Service may include third-party services, links, integrations, or materials. Third-party terms apply to them, and Turvix is not responsible for their availability, content, or operation to the extent an issue is not caused by Turvix's breach.

Preview, beta, and experimental features may be changed or removed at any time and are provided without service-level commitments.

Turvix may develop, modify, or discontinue Service features. If Turvix discontinues the paid Service entirely for a reason other than Customer's breach, Turvix will refund prepaid fees attributable to the unused Service.

10. Service Standard and Warranties

Free use and trial, preview, and beta features are provided without a warranty of error-free or uninterrupted availability.

Paid Service is provided with reasonable skill and care. To the extent permitted by mandatory law, Turvix does not warrant that the Service or its content is free from errors, accurate, complete, current, fit for a particular purpose, compatible, or uninterrupted, that it does not infringe third-party rights, or that it will produce any particular result.

No information system or safeguard is completely secure. Turvix does not warrant that the Service, Customer's environment, or measures implemented using the Service will prevent every vulnerability, incident, malware infection, data loss, or unauthorized access.

11. Limitation of Liability

To the maximum extent permitted by mandatory law, Turvix, its affiliates, licensors, employees, and subcontractors are not liable for indirect loss, including loss of profit, revenue, savings, business opportunity, reputation, or goodwill; business interruption; loss or corruption of data or content; cost of substitute services; a regulatory fee, fine, or penalty; or a third-party claim, regardless of the theory of liability or foreseeability.

In particular, Turvix is not liable for a Customer decision, act, or omission based on the Service or its content, or for Customer's failure to achieve a desired security, privacy, compliance, audit, or certification outcome. This applies even where Customer followed guidance or a recommendation in the Service.

The aggregate liability of Turvix for all claims arising from or relating to the Service, these Terms, or the parties' relationship, regardless of the theory of liability, is limited to the amount Customer paid to Turvix during the twelve (12) months preceding the event giving rise to the claim. Multiple events or claims do not increase the limit.

These limitations are an essential part of the parties' allocation of risk and the pricing of the Service.

The limitations above do not apply to liability that cannot lawfully be limited or to loss caused by Turvix intentionally or through gross negligence. Nothing in these Terms limits a data subject's rights under data protection law.

Customer must notify Turvix of any claim in writing without undue delay and no later than twelve (12) months after Customer knew or should have known of the basis for the claim. This time limit does not apply to the extent prohibited by mandatory law.

12. Customer Indemnity

Customer will defend and indemnify Turvix and its affiliates against reasonable damages, costs, and legal fees arising from a third-party claim to the extent based on:

Customer Content or an allegation that Customer Content infringes a third party's rights
unlawful, unauthorized, or Terms-violating use by Customer or a User
monitoring of a target without the authority required by Section 3.

Turvix will give reasonable notice of a claim and a reasonable opportunity for Customer to participate in the defense. Customer must not settle a claim without Turvix's written consent if the settlement admits liability by Turvix or imposes a non-monetary obligation on Turvix.

13. Suspension and Termination

Turvix may immediately suspend all or part of the Service if:

Customer or a User breaches these Terms or the Order Details
a payment is overdue
use creates or may create a security risk, harm to the Service or a third party, or legal liability for Turvix
suspension is required by law, an authority, or a third-party service provider.

Where reasonable in the circumstances, Turvix will notify Customer of the suspension and provide an opportunity to cure.

Either party may terminate the agreement if the other materially breaches it and fails to cure a curable breach within fourteen (14) days after written notice. Turvix may terminate immediately if a breach cannot be cured, use is unlawful or harmful, or Customer becomes insolvent, enters bankruptcy, or ceases business.

Customer may stop using a free Service at any time and cancel a paid subscription under Section 4. Deleting a User account does not itself cancel Customer's subscription.

Upon termination, the right to use the Service and Turvix Materials ends immediately, but the license to Customer-generated documents under Section 5 survives. Turvix may delete Customer Content after termination in accordance with the Privacy Notice and any data processing agreement. Turvix has no obligation to retain or return Customer Content except as required by the data processing agreement or mandatory law.

Provisions intended by their nature to survive remain effective, including payment obligations, intellectual property, confidentiality, warranty and liability disclaimers, indemnity, and dispute resolution.

14. Force Majeure

Turvix is not liable for delay or failure caused by circumstances beyond its reasonable control. These may include telecommunications or power failure, cloud or other provider outage, labor dispute, natural event, epidemic, war, government action, or a cyberattack that could not reasonably have been prevented. Force majeure does not excuse Customer's payment obligations incurred before the event.

15. Changes to These Terms

Turvix may update these Terms as the Service, law, security needs, or business develops. The current Terms are published in the Service. Turvix may require acceptance of updated Terms in the Service. A change required by law or an urgent security need may take effect immediately.

If Customer does not agree to a change, Customer must stop using the Service and cancel its subscription. Continued use after the effective date constitutes acceptance of the updated Terms.

16. Governing Law and Disputes

These Terms and the parties' relationship are governed by the laws of Finland, excluding its conflict-of-laws rules.

The parties will first attempt to resolve disputes through negotiation. If a dispute is not resolved within thirty (30) days after written notice of the dispute, it is subject to the exclusive jurisdiction of the Helsinki District Court as the court of first instance.

17. General

Customer may not assign the agreement or its rights without Turvix's written consent. Turvix may assign the agreement to an affiliate or in connection with a transaction involving the Service or a material part of Turvix's business.

Turvix may use subcontractors to perform its obligations and remains responsible for them as required by the applicable agreement and law.

These Terms, the Order Details, any data processing agreement, and any separately signed agreement form the entire agreement concerning the Service and supersede prior discussions and representations on the same subject. A separately signed agreement prevails where it expressly overrides these Terms. A data processing agreement prevails only for its subject matter.

If a provision is invalid, the remaining provisions remain effective, and the invalid provision will be replaced by a valid provision that most closely reflects its purpose. Failure to exercise a right is not a waiver. These Terms confer no rights on third parties.

Turvix may send contractual notices in the Service or to the email address provided by Customer. Customer is responsible for keeping its contact information current. An electronic notice is deemed received on the next business day after sending.

If the Finnish and English versions conflict, the Finnish version prevails.

18. Contact

Questions about these Terms: support@turvix.fi

Turvix Oy
Last updated: 14 September 2026