Terms of Service

Last updated: 24 September 2026

These terms govern your use of:

• the NOUSEC platform at login.nousec.com;
• the NOUSEC Phishing Reporter add-on for Google Workspace;
• the nousec.com website (together, the "Service").

The Service is provided by NOUSEC, İzmir, Türkiye ("NOUSEC", "we", "us").

If your organisation has signed a separate agreement with NOUSEC (an order form, master services agreement or data processing agreement), that agreement takes precedence over these terms where the two conflict.

---

1. Who may use the Service

The Service is for businesses and other organisations. By using it on behalf of an organisation ("Customer"), you confirm that you are authorised to accept these terms for that organisation. Individual employees use the Service because their organisation has given them access.

2. Accounts

The Customer is responsible for:

• the accounts it creates;
• keeping credentials confidential;
• all activity under its accounts.

Tell us promptly at applications@nousec.com if you suspect unauthorised access.

3. Customer responsibilities

Security-awareness simulations imitate real attacks. The Customer agrees to:

• run simulations only against its own employees, domains and systems, or those it is authorised to test;
• tell its employees about the security-awareness programme and meet its own legal obligations towards them, including under employment and data protection law and any works-council or consultation rules;
• have a lawful basis for the personal data it puts into the Service (for example employee lists), as the data controller;
• never use the Service to attack, defraud or deceive anyone outside the Customer's own organisation;
• never use the Service to collect real credentials, payment details or other sensitive data.

4. Acceptable use

You must not:

• break the law using the Service;
• try to access another customer's data;
• probe or disrupt the Service, except through our vulnerability disclosure process at nousec.com/security;
• reverse-engineer the Service except where the law allows it;
• resell the Service without our written agreement.

5. The Phishing Reporter (Google Workspace add-on)

The Phishing Reporter is installed by the Customer's Google Workspace administrator from the Google Workspace Marketplace. It sends details of a message to NOUSEC only when an employee chooses to report that message. What is sent, and how we handle it, is described in our Privacy Policy.

The Customer's use of Google Workspace remains subject to Google's own terms. Installation and administration are documented in the Phishing Reporter for Gmail guide.

6. Fees

Paid plans are billed as agreed in the Customer's order. Unless the order says otherwise:

• fees are due within 30 days of invoice;
• fees are exclusive of taxes;
• fees paid are non-refundable, except where the law requires a refund or we end the Service without cause.

7. Customer data

The Customer keeps all rights to the data it and its users put into the Service ("Customer Data"). We use Customer Data only to provide and support the Service, to keep it secure, and as the Customer instructs, as described in the Privacy Policy and any DPA. We do not sell Customer Data.

8. Our intellectual property

NOUSEC owns the Service, including its software, simulation templates, training content and branding. We give the Customer a non-exclusive, non-transferable right to use the Service during its subscription, for its internal security-awareness purposes.

9. Availability and changes

We work to keep the Service available and secure, but it is provided on an "as is" and "as available" basis unless a separate agreement sets a service level. We may improve or change the Service. If we remove a feature the Customer relies on, we will give reasonable notice.

10. Suspension and termination

• By the Customer: you may stop using the Service at any time, subject to any minimum term in your order.
• By NOUSEC:
  • we may suspend access immediately if the Service is being used unlawfully, against these terms, or in a way that threatens its security or other customers;
  • we may terminate for material breach that is not fixed within 30 days of notice.
• Data after termination: the Customer can export its data before the end of the subscription. After termination, we delete Customer Data as described in the Privacy Policy.

11. Limitation of liability

To the extent the law allows:

• neither party is liable for indirect or consequential loss, or for lost profits, revenue or data;
• each party's total liability under these terms is limited to the fees the Customer paid for the Service in the 12 months before the event giving rise to the claim.

Nothing in these terms limits liability that cannot be limited by law.

12. Changes to these terms

We may update these terms. We will change the date above and, for material changes, notify Customers in advance. Continued use after the change means the updated terms apply.

13. Governing law

These terms are governed by the laws of the Republic of Türkiye. The courts and enforcement offices of İzmir have jurisdiction, unless the Customer's order states otherwise.

14. Contact

NOUSEC, İzmir, Türkiye
Email: applications@nousec.com