Legal
SecQon sends real attack traffic at real systems, so the agreement between us is unusually load-bearing. Three documents are what you accept when you create an account — and again if we amend one. The rest we publish rather than ask you to sign.
The agreements you accept
Terms of Service
The master agreement between you and Infiqon Pvt Ltd for the use of SecQon, including fees, warranties, liability and your indemnity.
Version 2026-09-v7 · effective 2026-09-26
Acceptable Use Policy
What you may and may not point SecQon at, which techniques are permanently disabled, and how we enforce it.
Version 2026-09-v4 · effective 2026-09-22
Rules of Engagement and Testing Authorisation
Your written authorisation for us to test your verified assets — the scope, the methods (including the penetration-test tier), the standing authorisation that lets scheduled intrusive and authenticated testing run, the risks you accept, and your indemnity.
Version 2026-09-v9 · effective 2026-09-22
Policies we publish
Privacy Policy
What personal data SecQon collects, why, where it is processed, exactly what reaches a language model, how long we keep it, what we store in your browser, and how to exercise your rights under India's DPDP Act and, where they apply, the EU and UK GDPR.
Version 2026-09-v11 · effective 2026-09-28
Data Processing Agreement
How Infiqon processes personal data on your behalf when you use SecQon — the instructions we act on, the measures we take, who else is involved, and what happens when you ask for it back or ask us to delete it.
Version 2026-09-v4 · effective 2026-09-28
Sub-processors
Every third party that processes personal data for SecQon — what each one does, what it receives, where it processes, and a dated record of every change.
Version 2026-09-v4 · effective 2026-09-28
GDPR and UK Data Protection Addendum
The terms the EU and UK GDPR add when they apply to you — our lawful bases and your rights where we are the controller, and the Article 28 terms and Standard Contractual Clauses where we process on your behalf and the data reaches India.
Version 2026-09-v2 · effective 2026-09-28
Refund and Cancellation Policy
How to cancel a SecQon subscription, when a refund is due and when it is not, how a one-off penetration-test report purchase is treated, how to ask for a refund, and how GST is handled on one.
Version 2026-09-v6 · effective 2026-09-26
How acceptance is recorded
Each document carries its own version and a SHA-256 hash of its exact text. When you accept, we record which document, which version, that hash, your user and organisation, the timestamp, your IP address and your browser — in an append-only, hash-chained audit log. Adding an asset and launching a scan each write a further attestation, pinned to the Rules of Engagement in force at that moment.
- Terms of Service
- 2026-09-v7 · sha256 541076374aa6c5a26e464a4e31d409067ff7e76ae3f353e59f3a6cfbc1e3b477
- Acceptable Use Policy
- 2026-09-v4 · sha256 e8e60dfecc6cda677dae62fb8dc35451b086342e6f02bf7808bdbcd53b0b0d64
- Rules of Engagement and Testing Authorisation
- 2026-09-v9 · sha256 1a691f6a00c037b4d18c52fdb709c976c015a75397632752d0c992a17a0a9636
The policies are versioned and hashed the same way, so you can pin the exact text you read — but nothing records an acceptance of them, because they inform you rather than bind you.
- Privacy Policy
- 2026-09-v11 · sha256 7bc6137de5a210b77a2e09c1563e5505bd4f10bf02640ff30fada2b85d0029f2
- Data Processing Agreement
- 2026-09-v4 · sha256 9b98b6b0bc992ae9052fcbf354c69f021b5ddf7134370427fbb22cf38c288446
- Sub-processors
- 2026-09-v4 · sha256 aac2b4fbb03e86ef960aeacf1bbc251208df01d92ffb806fdc09c793f2b76fec
- GDPR and UK Data Protection Addendum
- 2026-09-v2 · sha256 b74c0132e7f7f66bfefd5334190d8ce923cfbac451c8d90cfa1e58f920111d73
- Refund and Cancellation Policy
- 2026-09-v6 · sha256 bb4e99e39f3490c90457813ef35b3122b377f7fce5bc614793d01c7de14c74f0