Terms of service

Version 1.0 · in force from 3 November 2026

1. Who you are contracting with

Velnomix Kft.
2310 Szigetszentmiklós, Arany János utca 5/A, Hungary
Company registration number
13-09-222866
EU VAT identification number
HU32091324
Represented by
Simon Levente, managing director (ügyvezető)
Contact
support@dether.net

Dethernety is a European Union trade mark registered to Velnomix Kft. under No. 019281262, registered on 8 March 2026 for software and for IT security services. “BYODt” is a trading name and is not registered. Velnomix Kft. is “we” and “us” throughout. These details are also our disclosure under the Hungarian electronic commerce act (Act CVIII of 2001).

2. What these terms cover

We supply content packages that your own Dethernety deployment subscribes to and fetches over the internet. A package is a set of modules; a module is a set of technology classes. For each class, a subscription entitles your deployment to the configuration form, the accompanying guidance, and evaluation of the attributes you configure.

These terms do not cover the Dethernety platform itself. The platform is open-source software, licensed separately and free of charge, and nothing here restricts your rights under that licence or makes your use of it conditional on a subscription.

What you subscribe to is the cloud content service, and nothing else. You deploy and run the platform yourself, on your own machine, under your own control. This is what crosses the line between your deployment and us:

That is the whole of it, and the rest stays with you. Your models, your graph, your notes, your dispositions and your logs stay on your machine: nothing we serve names an element or a model, and an evaluation request has no field for either. We have no access to that machine and no channel into it. What your deployment does locally is yours, including its own logs and any third-party components you run alongside it.

Free evaluation by invitation. We may give a person or a team access to the service free of charge, by personal invitation, so that they can evaluate it. You then use it in your professional capacity, not as a consumer. Nothing is charged, and your access does not depend on giving us feedback or any data beyond what running your account needs. The evaluation ends on the date the invitation gives, if it gives one, and either of us may end it earlier at any time. The service is provided as it is, without warranty, and its results are not to be relied on as an assessment. When the evaluation ends, the evaluation account is deleted unless it has by then become part of a paid subscription; nothing converts into a paid plan. Feedback is voluntary, and if you give it, we may use it freely; please do not include anyone else's confidential information in it. Where this paragraph differs from the rest of these terms, it governs a free evaluation, in place of the term, renewal and cancellation in section 9 and the commitments on defects in section 13; the rest of these terms apply as far as they fit, and sections 7 and 8, on price, payment and changes to what you hold, do not apply.

3. How the contract is formed

You accept these terms in the portal: the first time you open your account there, you are asked to accept them before you can use it. We record the version you accepted and the time you accepted it. A subscription is formed separately, when you complete a purchase and we confirm it; showing a package or a price is an invitation to purchase, not an offer.

Who may buy. We sell only to a business established in a country our checkout offers, or as we agree with you in writing. Whoever buys declares, for the business, that it is buying for the purposes of its trade, business or profession. The business's tax number is checked against the register that issued it where that register can be asked, by us where it cannot, and where no such register exists, as in the United States, it is taken as given. A purchase may wait for a check, and no payment is taken while it waits. A refusal follows the register's answer, and a person reviews it on request: write to support@dether.net.

Keeping the business details current. A change of business details goes through support@dether.net. While you are a customer the number is checked again: monthly with the register, where it was checked with one; yearly by us, where it was checked by hand or the business is in Australia; and not again where it was taken as given. If it is no longer valid, it is taken off your invoices, so that VAT is charged where the business is established in the European Union, and no further purchase is accepted; unless a valid number is given by the end of the period you have paid for, the subscription ends then, and nothing is refunded. A purchase made more than 35 days after the last check with the register waits for a new one, which you start in the portal.

4. What we provide

Content is addressed by a hash of its own contents and you choose which version your deployment uses. We cannot change a version you have pinned. We withdraw a published version only where we consider it defective or unsafe, or where the law compels us to — a court order, a third party's intellectual property claim, a sanctions listing — and for no other reason: never because publishing it has become commercially inconvenient to us. When we withdraw one, your deployment is told that the version was withdrawn, why, and which version supersedes it where one exists, and you decide when to move.

Changes to the service. We may change the service where there is a valid reason for it — to keep it secure, to comply with the law, because a provider we rely on changes what it offers, or to improve the service — and a change never costs you anything extra. Where a change affects your access to the service or your use of it adversely, and more than in a minor way, we tell you by email in advance, at the address your account uses, saying what changes and when it changes. None of this changes a content version you have pinned. Withdrawing a version because it is defective or unsafe, as above, keeps the content in conformity and is not a change of this kind; a withdrawal the law compels is, where it affects you in that way, and we then tell you as far in advance as the order or claim allows.

5. What we do not provide

We do not host, operate, monitor or access your deployment, and nothing of ours connects inbound to it. We do not supply the graph database it requires, the infrastructure it runs on, or any assurance about your systems. The database is a third-party component that you obtain and run under its own terms — we neither supply it nor operate it, and your deployment reaches it over a standard graph protocol. Assessing your own or a client's systems, and any conclusion drawn from our output, remains yours.

6. Your responsibilities

7. Price and payment

The price is charged per team on a single subscription, at one monthly rate for each package the team holds or, for a team edition, at that edition's own monthly price; the current rates are shown at checkout and on our offerings page. Prices are in euro and exclude VAT.

VAT is applied at checkout according to where your business is established: Hungarian VAT for a business established in Hungary; reverse charge for a business established elsewhere in the EU, on the VAT identification number we checked; and outside the EU no Hungarian VAT, the business accounting for any tax due in its own country. Payment is monthly in advance, by card, through our payment provider Stripe; we do not receive or store your card details. The total payable, including any tax we are required to charge, is shown on the payment page before you confirm the purchase.

Our invoices are issued electronically and sent by email to the sign-in address of the team's owner; you accept invoices issued and delivered that way.

Nothing is charged by how much you use the service. The subscription has no trial period. Evaluation access is arranged separately, by invitation, under section 2.

8. Adding and removing packages

You may add or remove packages at any time. Both take effect immediately and are prorated: adding is charged for the remainder of the current period on your next invoice, and removing credits the unused part of that period against it.

Team editions. Moving a team to a larger team edition charges the difference at once — the rest of the current month at the new price, less the unused part of the old, VAT included — to the card on file, for the figure shown and confirmed in the portal. If the payment does not go through, nothing changes, and the open invoice can be paid within the time the portal shows, at most 23 hours, or the change is dropped. Every renewal is at the new edition's monthly price. A team whose members, counting pending invitations, fit a smaller team edition can move to it in the portal: the move takes effect immediately, the difference in price for the rest of the current period is credited against your next invoices and is not paid out, and every renewal is at the smaller edition's monthly price.

9. Term, renewal and termination

The subscription runs for one month and renews for successive monthly terms until terminated. You may terminate at any time, with effect from the end of the period you have already paid for, using the cancellation control in your account — you do not need to contact us. Cancelling does not refund the remainder of a period you have paid for, because the service remains available to you throughout it.

We may terminate for good cause, including material breach of these terms and non-payment after a reminder. Either party's right to terminate with immediate effect for cause is unaffected.

Suspension while a possible sanctions match is checked. If your business's name may match an entry on the European Union's consolidated financial-sanctions list, a person checks it, usually within one working day. Meanwhile, if your team is paying, its access is paused and nothing is charged for the time it is paused.

Termination for European Union sanctions. If the match is confirmed, or your business becomes subject to European Union sanctions, we end the contract with immediate effect. The service stops at once; where the law forbids a payment to your business, none is made, a refund included; we report the case to the authority responsible; and the number is refused for later purchases.

10. When the contract ends

Nothing is deleted from your deployment and nothing is clawed back — we have no means to do either. Classes you have used stay registered, elements you configured keep their values, and results you have already produced stay where they are.

What stops is new entitled content and new evaluations. An evaluation without a subscription returns an explicit not evaluated, never no findings. Re-subscribing resumes both, with the same classes and the same identifiers.

11. Licence and intellectual property

For as long as your subscription runs, we grant you a non-exclusive, non-transferable right to use the content supplied under it within your own deployments, for your own purposes and for those of your clients. Content already delivered to a deployment may continue to be used on the same terms after the subscription ends.

What the licence covers. It covers the ordinary uses a company makes of an assessment: your own internal risk assessment; material you keep as evidence for an audit; a presentation to your management; reporting within your group; and documents you hand to a regulator or to an auditor. It also covers reproducing our guidance and exposure text inside a report you prepare for a client and invoice them for.

What you send us stays yours. The attributes your deployment sends, and anything else you give us in the course of using the service, remain yours. We acquire no rights in them. We do not use them to train anything, to develop the product, or for analytics.

You may not redistribute the content as content, sublicense it, or make it available as part of a product that competes with ours. All rights not expressly granted remain with us, including our rights in the name Dethernety.

12. Availability

We do not promise a particular level of availability and give no service level agreement. Your deployment holds a cache and keeps running when our service is unreachable; what degrades is access to new content and to evaluation.

13. Defects

Your statutory rights in respect of defective performance apply in full.

Four things about the content do not move.

When content is defective. Content is defective if the output does not follow from the attributes as the class's published schema and guidance define them; if guidance cites a control or a framework mapping that does not exist in the corpus version it names; or if a published version is unsafe to act on. It is not a defect that a real exposure exists which no class covers, or that a finding is unhelpful in your particular environment. Because the content is knowledge about technologies that change, we do not warrant that it is complete, current, or that it identifies every exposure a system carries: output is a contribution to your own assessment and does not replace it.

What happens when you report one. Report it to support@dether.net. We acknowledge your report within five working days. Within twenty-five working days we either publish a correction, withdraw the defective version and name the version that supersedes it where one exists, or explain why we do not consider it a defect. The clock runs from your report to that address — not from a remark in a meeting or a message on a social network — and it pauses for as long as we are waiting on you for information we reasonably need in order to reproduce the problem. A version we confirm is unsafe to act on is withdrawn as soon as we confirm it, without waiting out the twenty-five days.

Our methodology page sets out how all of this works. It is versioned, and it carries the detail.

14. Confidentiality

This obligation is mutual. What your deployment sends us describes your own infrastructure element by element — whether a database requires transport encryption, how a queue is authenticated, what is left unpinned. It is the most sensitive thing that crosses between us, and it is protected expressly here rather than by implication.

What is confidential. The attributes your deployment sends us and the assessments we return; the fact that you hold a subscription, what it covers and what you pay for it; any terms we agree with you that we have not published; anything either of us marks as confidential when it is given; and anything else whose confidentiality is obvious from what it is or from how it was given. On our side it also includes the evaluation policies and the test cases behind them, and how the content we supply is built.

Neither of us discloses the other's confidential information to anyone else, and neither of us uses it for any purpose other than performing this contract. Each of us protects it with at least the care it takes over its own, and gives access to it only to those of its people, professional advisers and sub-contractors who need it in order to perform this contract and who are themselves bound to keep it confidential. Each of us stays responsible for anyone it gives access to.

What this does not cover. Information that is public without either of us having breached this section; that the party receiving it already held free of any duty of confidence; that it developed independently without using what it received; or that it lawfully received from someone else who was free to pass it on. Nor does this section prevent a disclosure that the law, a court or a regulator requires — and where we are the one compelled, we tell you before we disclose, unless we are forbidden to tell you, and we disclose only what is actually required of us.

This section binds each of us from the moment the information is given and continues for five years after the subscription ends; where the information is a trade secret of either of us — information that has commercial value because it is not generally known or easy to come by, and that the party whose secret it is takes reasonable steps to keep that way — this section continues for as long as the information remains one, if that is longer. It adds to what we owe you under section 16 and our data processing annex rather than narrowing either: where personal data is also confidential information, both apply and the more protective obligation governs.

15. Liability

We do not exclude or limit our liability for intentional breach, or for damage to life, bodily integrity or health, or where the law does not permit it.

Fraud and wilful misconduct. Our liability for fraud and for wilful misconduct is unlimited.

Confidentiality, data protection, information security and infringement. For claims arising from a breach of our confidentiality obligations, a breach of our obligations under data protection law, a failure of information security on our side, or an infringement by the content we supply of a third party's intellectual property rights, our total liability is limited to €500,000 in aggregate.

That figure allocates those claims between you and us. It covers what you claim from us directly and what you claim from us in recourse for amounts you have had to pay to someone else. It is not a limit on what either of us owes a data subject: under Article 82 of the General Data Protection Regulation a data subject may claim the whole of their damage from a controller involved in the processing, and nothing agreed between us reduces that or can be set up against them.

Every other claim. To the extent permitted by law, our total liability for all other claims is limited to the greater of the fees paid for the subscription in the twelve months preceding the event and twelve months' fees at the rate in force when the event occurred. That limit applies to negligence of every degree, gross negligence included. We are not liable for lost profit, lost data or indirect loss.

16. Data protection

How we handle personal data is described in our privacy notice. Everything we store in our own systems is stored in the European Union, in the Frankfurt region of our cloud provider. Our support mailbox is hosted for us by Proton AG in Switzerland, and our invoices are issued and kept for us by our invoicing service, Billingo, in Hungary; our privacy notice says more about both. Requests to our pages, to our sign-in service and to the content service reach it through that provider's content delivery network, whose European and North American edge locations handle them: the address you connect from, your browser, the address you asked for, your token and, for an evaluation, the request body all pass through an edge in transit. The transfer mechanism for that, the North American edges included, is the standard contractual clauses in our agreement with the provider.

Which of us is the controller. For our own processing — your account, your team and its roster, your subscription, the contract records we keep, your team's business details and our checks of them, your deployment configuration, our metering, our application and security logging, and the correspondence you send our support address — we are the controller: we decided that each of those exists and how it works. For the attributes your deployment sends us to be evaluated we act as your processor: your deployment decides what to send, the attributes are your data about your systems, and we hold them to answer a single call and store none of them. The terms on which we process them are in our data processing annex, which forms part of this contract. That division is our own assessment of where the roles fall, taken on who decides the purpose and the means in each case, and we set it out so that you can check it rather than take it on trust.

What an evaluation carries. An evaluation carries the configured attributes of a single element. It carries no element names and no model names. Attribute values reach us as your deployment holds them: where an attribute is a string we accept whatever it contains and nothing inspects it, so treat those values as text you are sending us. The attributes are evaluated in memory, are never written to storage of any kind and are never logged; our data processing annex says what that leaves and what it does not.

What we record. We keep no record of which class was asked about: there is no access log at our edge or at our gateway that would show it. We do keep one metering line per request — at most two, where a request reaches us without naming your team — for thirty days, for rate limiting and to know that the service is working. That line is timestamped, and it carries the environment, the surface, the outcome, your team identifier and one count. Which count it carries depends on what was called: for an evaluation, how many undeclared attributes were dropped; for a query against our knowledge graph — the reference data your deployment searches and cross-references with — how many keys the query named. No line carries both. It never carries the class, the attributes, the keys themselves, the account identifier, the token or the address the request came from.

If there is a personal data breach. Our cloud service is ours to watch: we detect, investigate and notify, and where we act as your processor we tell you without undue delay after we become aware. Your own deployment is yours — we have no access to it and no channel into it — so for a breach that happens there you are the controller and we assist. Write to support@dether.net, marked for the attention of the managing director, and we will give you the facts we hold on our side: the records that relate to your team, our metering lines and application logs for as long as we still hold them, our authentication records — the sign-in events our sign-in service records for an account, which our privacy notice describes in full — our cloud provider's audit trail of administrative actions, account actions and sign-in requests, and what we know of the state of our own service at the time. Our privacy notice says how long each of them is kept.

17. Changes to these terms

We may change these terms where there is a valid reason, such as a change in the service or in the law. When we do, we publish the new version on this website at an address of its own, give it a new version number, and print on it the date it takes effect — at least thirty days after we publish it. Until that date the current version stays at /terms and continues to apply.

When we publish the new version we tell you so by email, at the address your account uses. The email says what changes and why, when the new version takes effect, where to read it, and that you may end your subscription instead and how. It also carries the new text itself, so that you have a copy of your own.

You are asked to accept the new version the next time you open your account in the portal on or after that date. Until you accept it, the version you last accepted continues to govern the subscription you hold. Every version of these terms we have published stays readable on this website, permanently, at an address of its own, so the version that governs you can always be read. Nothing is deemed accepted by your silence — we record the version you actually accepted and when, and if you never accept a version, you never agreed to it.

Until you accept, the only parts of your account the portal opens to you are the page that asks you to accept and the billing page, where you can cancel your subscription or remove a package; the rest opens once you have accepted. Buying a package, adding one to what you hold, buying or moving to a team edition, and joining somebody else's team are refused until you have accepted the version in force.

If you do not want to accept a new version, you may end your subscription instead, with effect from the end of the period you have already paid for. You can cancel it yourself on the billing page, without accepting, or write to support@dether.net and we will cancel it for you. Your existing deployment is unaffected by a change to these terms — it runs on your own infrastructure and we cannot reach it.

If a change to these terms also changes the service in a way that affects your access to it or your use of it adversely, and more than in a minor way, section 4 applies to it as well. Our email about the change then tells you so.

What we do not change this way. We do not use this section to change section 15, our liability to you; section 14, the confidentiality obligations either of us owes the other; or the licence we have already granted you for content already delivered to your deployment; and we do not use it to reduce the protection that section 16 or our privacy notice gives you. Changing any of those needs your agreement. The single exception is a change that a change in the law compels, and then only so far as it compels it.

18. Complaints

Please contact us — most things are resolved that way. If you are a business customer, section 19 governs any dispute between us.

19. Final provisions

Hungarian law applies, excluding the UN Convention on Contracts for the International Sale of Goods.

Where a dispute is decided. If you are a business customer, the courts of Budapest, Hungary have exclusive jurisdiction over any dispute arising out of or in connection with this contract, including one about its existence, validity or termination.

If any provision is or becomes invalid, the validity of the remaining provisions is unaffected.