Terms of Service

These Terms of Service (“Terms”) govern your access to and use of the FDIE (Firmware Delta Intelligence Engine) platform, operated by Magdox Private Limited (“Magdox,” “we,” “us,” or “our”), a company incorporated under the laws of India with registered address at St No. 8, Arabinda Nagar, Barbani, Bardhaman, Hindustan Cables, West Bengal 713335, India. These Terms constitute an electronic record under the Information Technology Act, 2000, and are published in accordance with Rule 3(1)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. By accessing or using the Service, you agree to these Terms. If you are agreeing on behalf of an organization, you confirm that you have the authority to bind that organization. The Service is intended for users who are at least 18 years old. If you are under 18, you may not use the Service.

1. How These Terms Fit Together

For Enterprise customers, these Terms are supplemented by an Order Form and, where applicable, a Data Processing Agreement (DPA). If a signed Order Form or Master Service Agreement (MSA) conflicts with these Terms, the signed document controls for that customer.

These Terms incorporate our Refund Policy, Privacy Policy, and Information Security Addendum by reference. You should read all of them.

2. What FDIE Is

FDIE is a cloud-hosted Software-as-a-Service (SaaS) platform for automated firmware security analysis. It provides:

• CVE detection with CVSS and EPSS scoring
• SBOM (CycloneDX and SPDX), CBOM, and VEX document generation
• A deterministic security test suite
• Compliance scoring across multiple regulatory frameworks
• Cross-version Delta Intelligence

FDIE is offered under two cloud deployment tiers:

• SaaS Business: a hosted, multi-tenant cloud service accessed over the internet. Details are on our Pricing page.
• SaaS Enterprise: a hosted cloud deployment with dedicated workspace options, custom rate limits, and enterprise integrations.

3. Your Account

To use the Service, you must register for an account and provide accurate, current information. You are responsible for:

• Keeping your account credentials confidential
• Configuring authentication options (including multi-factor authentication) appropriately for your organization
• All activity that happens under your account

If you suspect unauthorized access, tell us immediately at [email protected].

4. User Representations

By using the Service, you represent and warrant that:

• All registration information you submit is true, accurate, current, and complete, and you will promptly update it as it changes
• You have the legal capacity to agree to these Terms and are not a minor in the jurisdiction where you reside
• You will not access the Service through automated or non-human means, including bots or scripts, except through our documented REST API in accordance with your plan’s usage limits
• Your use of the Service will not violate any applicable law or regulation

If any information you provide is untrue, inaccurate, or incomplete, we may suspend or terminate your account.

5. Acceptable Use

You agree not to:

• Upload firmware or other content you do not have the legal right to analyze
• Use the Service to develop, test, or distribute malware or other malicious code
• Reverse-engineer, decompile, or attempt to extract the source code of the Service itself
• Circumvent rate limits, usage quotas, or other technical restrictions, or abuse the Service in a way that degrades it for other customers
• Use the Service in violation of applicable export control or economic sanctions laws (see Section 21)
• Systematically retrieve data from the Service to build a separate collection, compilation, or database, other than through your own account’s normal use of our documented API
• Trick, defraud, or mislead us or other users, including attempting to obtain another user’s account credentials
• Circumvent, disable, or otherwise interfere with security-related features of the Service
• Impersonate another user, or access or use another user’s account without authorization
• Upload or transmit viruses, spyware, tracking pixels, or similar material intended to collect information about other users or to interfere with the Service’s operation
• Use the Service to build, operate, or support a product or service that competes with FDIE

We reserve the right to suspend accounts that violate this policy.

6. Subscriptions, Billing, and Payment

The Service is offered under the subscription plans described on our Pricing page. Subscriptions automatically renew at the end of each billing period unless you cancel before renewal.

Payment processing, subscription billing, tax calculation, and order fulfillment are powered by 2Checkout (Verifone) acting as our authorized Merchant of Record and payment gateway provider. Refunds and cancellation terms are in our Refund Policy, which is part of these Terms.

7. Free Trial

We offer a free trial of the Business plan for 15 days. Enterprise customers may request a 30-day proof-of-concept trial.

To start a trial, you must provide payment details through our payment gateway at signup. Your account does not automatically convert to a paid subscription when the trial ends and you will not be charged without your authorization. If you do not subscribe to a paid plan before the trial ends, access is suspended. There is no free tier after the trial ends.

Enterprise proof-of-concept terms are set out in the applicable Order Form.

8. Intellectual Property

Magdox retains all right, title, and interest in the Service, including the FDIE platform, its underlying software, and its documentation.

You retain all rights to the firmware images, configuration data, and other content you upload, as well as the analysis results, reports, and SBOM, CBOM, and VEX documents generated from that content (“Customer Data”).

FDIE’s analysis engine performs deterministic, rule-based static analysis. It does not use generative AI or machine learning to produce findings. Customer Data is never used to train any model, whether operated by Magdox or a third party, and is not shared with any third party except as described in our Privacy Policy and DPA.

Feedback. If you send us feedback, suggestions, or ideas about the Service (“Submissions”), you agree that we may use them for any purpose, including to improve the Service, without any obligation to compensate you. Submissions do not include Customer Data, which remains governed by the ownership and confidentiality terms above.

9. Third-Party Websites and Services

The Service links to or references third-party websites, tools, and data sources, including public vulnerability databases (NVD, OSV.dev, the CISA KEV catalogue), integration partners (for example, VirusTotal, Shodan, MalwareBazaar), and our payment processor, 2Checkout (Verifone). We do not control and are not responsible for the content, accuracy, or practices of these third parties. Your use of any third-party website or service linked from or referenced by the Service is at your own risk and governed by that third party’s own terms, not these Terms.

10. Confidentiality

Each party agrees to protect the other’s confidential information with the same degree of care it uses for its own confidential information of a similar nature, and in any event no less than a reasonable standard of care. Each party agrees not to disclose the other’s confidential information except as necessary to provide or use the Service, or as required by law.

Your firmware and the findings derived from it are treated as your confidential information.

This Section survives termination of these Terms for five (5) years, except for trade secrets, which remain protected for as long as they retain trade secret status.

Nothing in this Section restricts either party’s use of general knowledge, skills, or experience retained in the unaided memory of personnel who had access to the other party’s confidential information, provided that use does not involve disclosure of the confidential information itself.

11. Force Majeure

Neither party will be liable for any failure or delay in performing its obligations under these Terms (except for payment obligations) to the extent caused by events beyond its reasonable control, including natural disasters, acts of God, war, terrorism, riots, cyberattacks, denial-of-service attacks, cloud infrastructure or telecommunications outages, power failures, or governmental restrictions (“Force Majeure Event”). The affected party will make reasonable efforts to mitigate the impact of any such event.

12. Data Protection and Security

Our collection and use of personal data is described in our Privacy Policy. If you need a Data Processing Agreement, see our DPA.

The technical and organizational security measures we implement (encryption, access control, secrets management, and audit logging) are described in our Information Security Addendum, which is incorporated into these Terms by reference.

The Service is hosted in India. If you access the Service from a jurisdiction with data protection laws or other requirements that differ from India’s, your continued use of the Service means you are transferring your data to India, and you consent to that transfer and to the processing of your data there, subject to the safeguards described in our Privacy Policy and, where applicable, our DPA.

13. Service Availability

We aim to maintain high availability of the SaaS Service. Enterprise customers may be offered a contractual uptime SLA (target: 99.9% monthly uptime) with associated service credits, as set out in their Order Form. Where SLA credits apply to Business and Enterprise plans, the terms are described in our Refund Policy, Section 7.

14. Services Management & Emergency Suspension

We may monitor the Service for violations of these Terms and may restrict, suspend, or remove content that is unlawful or infringes third-party rights.

Notwithstanding any cure period in Section 19, Magdox reserves the right to immediately suspend or restrict access to any account without prior notice if we reasonably determine that the account is being used to launch security attacks, abuse API limits, distribute malicious code, or pose an active threat to the Service or other customers.

15. What FDIE Can and Cannot Do

15.1 Static Analysis Only

FDIE performs static binary analysis of firmware images. The Service does not execute firmware, run dynamic tests, perform fuzz testing, or simulate runtime behaviour. Results reflect what can be determined by inspecting binary content without execution.

15.2 Vulnerability Database Timing

CVE and vulnerability data comes from the NIST National Vulnerability Database (NVD), OSV.dev, CISA’s KEV catalogue (actively-attacked vulnerabilities), and EPSS scoring data. These databases are synchronized on a schedule (NVD: daily; KEV: every six hours). The Service does not provide real-time vulnerability data.

A vulnerability published after the most recent database sync may not appear in analysis results until the next scheduled sync. Each SBOM exported by FDIE includes the age of the NVD cache at the time of export so you can assess how current the data is.

15.3 Detection Limitations

The Service identifies firmware components through ELF dynamic-linking metadata, binary string extraction, version banner matching, and known component signature databases. The Service cannot guarantee detection of components or vulnerabilities in these situations:

• Firmware images that are encrypted, compressed with an unsupported algorithm, or packed using custom or proprietary packaging formats
• Components that are statically compiled into a monolithic binary without version strings or recognizable identifiers
• Components distributed under vendor-specific or private names that differ from the canonical product names used in public vulnerability databases
• Components whose vulnerabilities are described in vendor-specific security advisories not indexed by the databases FDIE queries

15.4 SBOM, CBOM, and VEX Completeness

SBOMs, CBOMs, and VEX documents generated by the Service reflect the components, cryptographic assets, and vulnerabilities identified by static analysis at the time of the analysis run. They are not a complete or authoritative inventory of all software present in a firmware image.

Each exported SBOM includes two properties:

• fdie:analysis_method: identifies the document as the product of static analysis
• fdie:nvd_last_sync_days: indicates the age of the vulnerability database used

15.5 Regulatory Compliance Is Your Responsibility

The Service provides analysis results, compliance scoring, and document artifacts to help you with your regulatory and supply-chain security programmes. Using the Service does not, by itself, make you compliant with any regulatory framework. This includes, but is not limited to:

• EU Cyber Resilience Act (CRA)
• ETSI EN 303 645
• NIST 800-193
• IEC 62443
• OWASP FSTM

You remain solely responsible for:

• Validating analysis results against your specific products and supply chains
• Determining whether and how analysis results trigger reporting obligations under applicable law, including CRA Article 14 mandatory incident reporting to ENISA
• Taking corrective action in response to identified vulnerabilities
• Ensuring that SBOMs, CBOMs, and VEX documents you submit to regulators, customers, or other third parties meet those recipients’ requirements

15.6 Not a Substitute for Professional Assessment

The Service is an automated analysis tool. It does not replace professional penetration testing, manual code review, or expert security assessment. For high-assurance or safety-critical applications, you should supplement FDIE outputs with appropriate professional review.

16. Corrections

The Service, including our website, may contain typographical errors or inaccuracies, including in pricing, plan descriptions, or feature availability. We reserve the right to correct these errors and to change or update information on the Service at any time, without prior notice.

17. Disclaimers and Limits on Liability

THE SERVICE IS PROVIDED “AS IS” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

General cap. To the maximum extent permitted by law, each party’s total liability arising out of or related to these Terms will not exceed the amount you paid for the Service in the twelve (12) months before the claim.

Enhanced cap for confidentiality and security breaches. The general cap above does not apply to these two categories. Instead, each party’s total liability for (a) breach of the confidentiality obligations in Section 10, or (b) breach of its own security obligations that results in unauthorized access to the other party’s confidential information, will not exceed two (2) times the fees you paid for the Service in the twelve (12) months before the claim.

Carve-outs: what the caps do not limit. Neither cap applies to:

• A party’s indemnification obligations under Section 18
• Damages arising from a party’s fraud, gross negligence, or willful misconduct
• A party’s infringement of the other party’s intellectual property rights outside the scope of the license granted in these Terms

Nothing in this Section limits liability that cannot be limited or excluded under applicable law.

IN PARTICULAR, MAGDOX MAKES NO WARRANTY THAT THE SERVICE WILL DETECT ALL VULNERABILITIES, COMPONENTS, OR COMPLIANCE GAPS IN ANY FIRMWARE IMAGE. MAGDOX IS NOT LIABLE FOR REGULATORY PENALTIES, FINES, OR THIRD-PARTY CLAIMS ARISING FROM UNDETECTED VULNERABILITIES OR INCOMPLETE ANALYSIS RESULTS, TO THE EXTENT PERMITTED BY APPLICABLE LAW.

18. Mutual Indemnification

18.1 Your Indemnity to Us

You agree to indemnify, defend, and hold Magdox harmless from third-party claims arising out of:

• Your breach of these Terms
• Your misuse of the Service
• Content you upload in violation of Section 5 (Acceptable Use)

18.2 Our Indemnity to You

Magdox will indemnify, defend, and hold you harmless from third-party claims alleging that the Service, as provided by Magdox and used in accordance with these Terms, infringes that third party’s intellectual property rights. We will pay resulting damages finally awarded or agreed to in settlement.

This obligation applies only if you:

• Promptly notify us of the claim
• Give us sole control of the defense and settlement
• Provide reasonable cooperation

If such an infringement claim arises or is likely to arise, Magdox may at its option and expense: (a) procure the right for Customer to continue using the Service; (b) replace or modify the Service so it becomes non-infringing; or (c) terminate the subscription and refund any prepaid, unearned fees.

This obligation does not apply to claims arising from:

• Your Customer Data or third-party materials
• Modifications to the Service not made by Magdox
• Use of the Service in combination with products or services not provided by Magdox, where the infringement would not have occurred without that combination

19. Termination

Either party may terminate the Service for convenience at the end of the current billing period, or immediately for a material breach that remains uncured for 30 days after written notice.

When the Service ends, you will have a reasonable window (at least 30 days) to export your Customer Data. After that, we will delete it from our systems as described in our Privacy Policy.

20. Electronic Communications and Signatures

By using the Service, you consent to receive communications from us electronically, including by email and through notices posted on the Service. You agree that these electronic communications satisfy any legal requirement that such communications be in writing, and that, to the extent permitted by applicable law, electronic signatures and records have the same legal effect as physical signatures and records.

21. Export Compliance and Sanctions

The Service, and firmware analyzed using it, may be subject to export control and economic sanctions laws. You confirm that you are not located in, and are not a national or resident of, any country subject to a comprehensive U.S., EU, or UN embargo. You also confirm that you are not on any restricted-party list maintained by those authorities.

You agree not to use the Service to analyze or export firmware in violation of applicable export control laws.

22. Governing Law and Disputes

These Terms are governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000 and rules thereunder, without regard to conflict-of-laws principles. Any disputes arising under these Terms will be resolved in the competent courts of West Bengal, India.

Enterprise customers may negotiate an alternative governing law and venue in their Order Form or MSA. This Section does not override any separately negotiated governing-law clause in an Enterprise Order Form or MSA.

23. Changes to These Terms

We may update these Terms from time to time. Material changes will be communicated via the website or by email to registered account holders. The “Last updated” date at the top of this page reflects the most recent revision. Prior versions of these Terms are archived and available on request.

24. General

These Terms, together with the Privacy Policy, DPA (where applicable), and any Order Form, are the entire agreement between the parties about the Service. They replace all prior agreements on the subject matter.

Failure by either party to enforce any provision of these Terms will not be deemed a waiver of future enforcement. If any provision is held unenforceable, the remaining provisions stay in full force and effect.

Notices under these Terms should be sent to the contact addresses in Section 25.

25. Contact

Questions about these Terms can be sent through our Contact page, or directly to:

Magdox Private Limited St No. 8, Arabinda Nagar, Barbani, Bardhaman, Hindustan Cables, West Bengal 713335, India Phone: +91 82175 75982 Email: [email protected]