Terms of service

The agreement between Feint Security and the organizations that use Feint.

These terms are the agreement between Feint Security ("we") and the organization using Feint ("you"). Feint creates decoy credentials, places none of them, and tells you when one is used. By creating an organization on Feint or using it on an organization's behalf, you accept these terms for that organization.

The service#

Feint mints decoy credentials on platforms we control, each built to grant nothing, and watches those platforms for any use of them. You decide where each decoy goes. When a decoy is used, Feint records what the platform reports and raises an alert in the console, by email to the addresses you nominate, and to the webhook endpoints you register. The customer API offers the same.

Your side#

• Authority. Place a decoy only where you have the authority to do so: your own systems, repositories, documents and devices, or those of a client who has engaged you to do it. Never place one where a third party could be harmed by finding it.
• Lawful use. Use Feint in compliance with the law and with the terms of the platforms a decoy lives on. Do not use it to entrap, harass or attack anyone, or to gain access to systems you are not entitled to.
• Your account. You are responsible for the people you admit to your organization, for your API keys and webhook endpoints, and for everything done with them. Tell us promptly if a key or endpoint is compromised.
• Accurate information. Keep your contact and billing details current. Alerts go where you say they should.

What detection is and is not#

A decoy raises an alert when a platform reports its use. Platforms report with delay and granularity of their own: GitLab records a token's last use at most once every few minutes, and CloudTrail delivers its records some minutes after the fact. Feint polls, reads and delivers as fast as the platforms allow, and we do not promise any particular time to alert, that every use will be recorded, or that every alert will be delivered. Feint tells you that someone reached a place they should not have; what to do about it is your decision. Feint is one signal in a security program and is not a substitute for access control, monitoring or incident response, and nothing in it is legal or professional advice.

Plans and payment#

Feint has a Free plan, a Pro plan, and plans arranged by agreement.

• Free has the limits shown on the pricing page and costs nothing.
• Pro is billed monthly in advance by card through Stripe at the price shown on the pricing page when you subscribe, plus any applicable taxes. It renews each month until cancelled. Cancel at any time from the billing page; the plan runs to the end of the period already paid and does not renew. Payments are not refunded except where the law requires or we choose to.
• Design Partner and MSSP arrangements are set out in their own order or agreement, invoiced on its terms, and take precedence over this section where they differ.

If a payment fails, Stripe retries it; if it keeps failing the subscription is marked unpaid and the organization returns to the Free plan's limits. Existing decoys keep working and stay watched, but no more can be made until the plan is restored. We may change prices with at least 30 days' notice by email to your administrators; changes take effect at your next renewal.

Limits and fair use#

Each plan has limits on members and active decoys, enforced when something new is created. Requests to the API and the site are rate limited per address. We may suspend or limit an organization that threatens the service, other customers, or the platforms the decoys live on, and we will tell you when we do unless the law or the circumstances prevent it.

Your data#

Everything you put into Feint and everything a decoy records for you belongs to your organization. You give us the permission needed to store it, process it and show it back to you, to deliver it where you ask, and to keep the service running and safe. Our privacy policy says what is held, who processes it, and for how long. We keep your information confidential and use it for no other purpose.

Our rights#

Feint, its software, its documentation and its name are ours. These terms give you the right to use the service, not to copy, resell or reverse engineer it. If you send us suggestions, we may use them without owing you anything.

Ending the agreement#

You can stop at any time by deleting your organization from the console. We can end the agreement with 30 days' notice, or at once if you break these terms or do not pay. When the agreement ends, the decoys are revoked at their platforms, access to the console and API stops, and the organization's data is deleted within 30 days, except what the law requires us to keep.

Warranty and liability#

Feint is provided as it is and as it is available. To the extent the law allows, we make no warranties, including of merchantability, fitness for a purpose or non-infringement, and we are not liable for indirect, incidental, special or consequential losses, lost profits, or losses that result from a missed, late or undelivered alert or from where you chose to place a decoy. Our total liability to you for all claims in any twelve months is limited to the fees you paid us in the twelve months before the claim. You will defend and compensate us for claims that arise from your use of Feint in breach of these terms or of the law.

Law and disputes#

These terms are governed by the law of the State of Washington, United States, without regard to its conflict-of-laws rules. Disputes that cannot be settled between us go to the state or federal courts for King County, Washington, and both sides accept that venue.

Changes to these terms#

We will post changes here with a new date and, for anything material, tell your administrators by email at least 30 days before they take effect. Using Feint after that date accepts the new terms.

Contact#

Feint Security, Washington, United States. [email protected].