Blacklock Security Limited
These Terms of Use ("Terms") govern access to and use of the websites, software platform, applications, portals and related online services operated by Blacklock Security Limited ("Blacklock", "we", "us" or "our").
Please read these Terms carefully before using our Services.
By accessing or using the Services, creating an account, accepting an Order, or otherwise using Blacklock's platform, you agree to these Terms.
If you use the Services on behalf of an organisation, you represent that you have authority to bind that organisation to these Terms. In that case, "Customer", "you" and "your" refer to that organisation.
If you do not agree to these Terms, you must not use the Services.
For these Terms:
Customer Data means information, files, targets, source code, configurations, scan data, security findings, reports or other information submitted to, generated through, or processed using the Services on behalf of the Customer.
Documentation means documentation, instructions, technical materials and user guidance Blacklock makes available for the Services.
Order means an order form, proposal, quotation, subscription, Statement of Work or other ordering document agreed between Blacklock and the Customer or an authorised Blacklock reseller.
Services means Blacklock's websites, SaaS platform, cybersecurity products, scanning services, software and associated functionality made available to the Customer.
User means an individual authorised by the Customer to access or use the Services.
These Terms apply to the use of Blacklock's online Services, including functionality relating to:
• penetration testing as a service (PTaaS);
• continuous vulnerability assessment;
• web application and API security testing;
• infrastructure security testing;
• cloud security testing;
• mobile application security testing;
• AI application security testing;
• Static Application Security Testing (SAST);
• Software Bill of Materials (SBOM);
• attack surface and vulnerability management;
• AI vulnerability validation and remediation functionality; and
• related cybersecurity services and integrations.
Specific Services may also be governed by an Order, Statement of Work, Software Licence and SLA, Data Processing Agreement or other written agreement.
If there is a conflict between these Terms and a separately executed written agreement with Blacklock, the separately executed agreement will prevail to the extent of the conflict.
You must be legally capable of entering into a binding agreement to use the Services.
If you access the Services on behalf of a company or other organisation, you confirm that you:
• are authorised to act on behalf of that organisation; and
• have authority to accept these Terms on its behalf.
The Services are intended for business and professional use.
Subject to these Terms, the applicable Order and payment of applicable fees, Blacklock grants the Customer a limited, non-exclusive, non-transferable and non-sublicensable right to access and use the Services during the applicable subscription or licence term.
The Services may be used only:
• for the Customer's internal business and security purposes;
• by authorised Users;
• for systems, applications, networks and other assets the Customer owns or is expressly authorised to test; and
• in accordance with these Terms, applicable Documentation and applicable laws.
No ownership rights in the Services are transferred to the Customer
Customers are responsible for:
• ensuring account information is accurate and current;
• maintaining the confidentiality of account credentials;
• implementing appropriate access controls;
• managing authorised Users and permissions;
• IP whitelisting, where applicable;
• protecting authentication credentials, API keys and integration tokens; and
• promptly notifying Blacklock of suspected unauthorised access.
The Customer is responsible for activities performed through its accounts by its Users.
Blacklock may suspend or disable credentials where we reasonably believe an account has been compromised, used unlawfully or used in breach of these Terms.
Cybersecurity testing may involve activities that could otherwise be considered intrusive or unauthorised.
The Customer represents and warrants that it has all necessary ownership rights, permissions and authorisations to submit each target to Blacklock for scanning, penetration testing or other security assessment.
This includes appropriate authorisation for:
• domains and subdomains;
• IP addresses and networks;
• websites and APIs;
• mobile and desktop applications;
• cloud environments;
• source-code repositories;
• internal infrastructure;
• third-party hosted systems; and
• any other target submitted to the Services.
The Customer must not instruct Blacklock to test a system or asset without appropriate authorisation from its owner.
Blacklock may request evidence of authorisation and may refuse, suspend or terminate testing where authorisation cannot reasonably be established.
You must not use the Services to:
• access, scan, exploit or test systems without authorisation;
• conduct unlawful hacking or other malicious activity;
• compromise accounts, systems or data belonging to another person;
• distribute malware, ransomware or other malicious code;
• conduct denial-of-service or destructive activity;
• bypass security controls protecting the Services;
• interfere with the availability or integrity of the Services;
• obtain unauthorised access to another Blacklock customer's information;
• use the Services in violation of applicable law;
• use the Services to facilitate fraud or other unlawful activity; or
• knowingly submit false, misleading or fraudulent information.
Customers must ensure that their Users comply with this section.
Except where expressly permitted by Blacklock or applicable law, you must not:
• copy, modify or create derivative works of the Services;
• reverse engineer, decompile, disassemble or attempt to derive the source code of the Services;
• circumvent technical restrictions or licence controls;
• sell, lease, sublicense or commercially provide the Services to another party;
• use the Services to develop or benchmark a competing product without Blacklock's written permission;
• scrape or systematically extract data from the Services except through authorised interfaces;
• remove or obscure Blacklock trademarks, copyright notices or other proprietary markings;
• introduce malware or harmful code into the Services;
• use automated mechanisms in a manner that places an unreasonable load on Blacklock infrastructure; or
• attempt to gain unauthorised access to Blacklock infrastructure, systems or accounts.
These restrictions do not prevent Customers from using reports, findings and deliverables produced for them in the ordinary course of their business.
The Customer retains ownership of Customer Data.
The Customer grants Blacklock the limited rights necessary to host, process, transmit, analyse and otherwise use Customer Data to:
• provide the Services;
• perform authorised security testing;
• validate vulnerabilities;
• generate reports and remediation guidance;
• provide technical support;
• maintain and secure the Services; and
• meet Blacklock's contractual and legal obligations.
The Customer is responsible for ensuring it has the necessary rights and lawful authority to provide Customer Data to Blacklock.
Blacklock will handle personal information contained within Customer Data in accordance with our Privacy Policy and applicable data protection requirements.
Blacklock may generate:
• vulnerability findings;
• penetration testing reports;
• validation results;
• remediation recommendations;
• proof-of-concept information;
• risk ratings;
• AI-generated remediation guidance and validation commands;
• SAST findings;
• SBOM information; and
• other security outputs.
Subject to payment of applicable fees, Customers may use deliverables created specifically for them for their internal business, stakeholders, auditors, security, compliance and customer assurance purposes.
Security assessments represent findings identified within the agreed scope and testing period.
No penetration test, vulnerability scan or security technology can identify every security vulnerability or guarantee that a system is secure.
A report indicating that no vulnerabilities were identified must not be interpreted as a guarantee that vulnerabilities do not exist or the system will never be compromised.
Blacklock may use artificial intelligence and automated technologies to support functionality such as:
• vulnerability validation;
• validation commands;
• security analysis;
• attack-path analysis;
• remediation guidance;
• vulnerability prioritisation;
• security testing workflows; and
• generation of technical recommendations.
AI-generated results may contain errors or incomplete information.
Customers are responsible for reviewing AI-generated recommendations before applying material changes to production systems.
AI functionality does not replace the Customer's responsibility for appropriate security engineering, risk assessment or change management.
Blacklock and its licensors retain all rights, title and interest in and to:
• the Blacklock platform;
• software and source code;
• algorithms and technology;
• methodologies;
• Documentation;
• interfaces and designs;
• trademarks and branding; and
• all improvements and developments relating to those materials.
Except for the limited rights expressly provided under these Terms, no intellectual property rights are transferred to the Customer.
The Customer retains ownership of its Customer Data.
Nothing in these Terms prevents Blacklock from using general skills, experience, techniques, methodologies or knowledge gained in providing its Services, provided that doing so does not disclose Customer Confidential Information.
Customers may provide suggestions, ideas or feedback relating to the Services and new product features.
Blacklock may use such feedback to develop and improve its products and services without restriction or obligation to the Customer, provided that Blacklock does not disclose Customer Confidential Information in doing so.
Each party may receive confidential or commercially sensitive information belonging to the other party.
The receiving party must:
• use Confidential Information only for purposes associated with the Services;
• protect it using at least reasonable care;
• restrict access to individuals who reasonably need the information and are subject to confidentiality obligations; and
• not disclose it to third parties except as permitted by these Terms or applicable law.
Confidential Information does not include information that:
• is publicly available through no breach by the receiving party;
• was lawfully known before disclosure;
• is lawfully received from another party without confidentiality restrictions;
• is independently developed without use of the Confidential Information; or
• is authorised for disclosure by the disclosing party.
A party may disclose Confidential Information where required by law, provided that, where legally permitted, it gives reasonable notice to the other party.
Blacklock processes personal information in accordance with its Privacy Policy and applicable privacy and data protection laws.
Customers are responsible for ensuring that they have an appropriate lawful basis for providing personal information to Blacklock.
Where Blacklock processes personal information on behalf of a Customer, additional data processing terms may apply.
Our Privacy Policy is available on the Blacklock website
The Services may integrate with or contain functionality provided by third parties.
Customers may be required to maintain their own accounts or licences with those third-party providers.
Blacklock is not responsible for:
• the availability of third-party services;
• changes made by third-party providers;
• third-party products outside Blacklock's reasonable control; or
• third-party processing governed by the third party's own terms.
Blacklock uses the below integrations, and no third-party or integration customer credentials are stored in our systems.
• Alerting: Slack, Microsoft Teams;
• Code Repository: Github, Gitlab, BitBucket, Azure DevOps;
• Ticketing: JIRA, Zapier, Vanta;
• Developer Learning: Secure Code Warrior;
• Dark Web Monitoring: nWebbed;
• Single Sign-On: Okta, Salesforce, JumpCloud, Microsoft Entra SAML SSO;
Blacklock may change or discontinue an integration where the relevant third-party service becomes unavailable, incompatible or materially changes its functionality.
Blacklock may offer free trials, proof-of-concept access or evaluation Services.
Unless Blacklock agrees otherwise in writing:
• trial access is temporary;
• functionality may be limited;
• Blacklock may modify or terminate trial access at any time; and
• trial Services are provided on an "as available" basis without service-level commitments.
Data contained in an expired trial environment may be deleted following expiry of the trial.
Fees and payment terms are specified in the applicable Order.
Unless stated otherwise in an Order:
• fees are exclusive of applicable taxes;
• customers are responsible for applicable GST, VAT or similar taxes; and
• payment obligations are non-cancellable and fees paid are non-refundable except where expressly stated otherwise.
Where Services are purchased through an authorised reseller or distributor, payment terms may be governed by the agreement between the Customer and that reseller or distributor.
Blacklock may suspend paid Services where amounts remain materially overdue after reasonable notice.
Blacklock will use commercially reasonable efforts to maintain the availability and security of the Services.
Specific availability commitments or service credits apply only where expressly stated in an applicable SLA or Order.
Blacklock may periodically:
• update the Services;
• add or remove functionality;
• apply security patches;
• perform maintenance;
• modify interfaces; or
• change supporting technologies.
Blacklock will use reasonable efforts to minimise material disruption to Customers.
Blacklock may suspend access to all or part of the Services where reasonably necessary because of:
• a security threat;
• suspected unauthorised activity;
• unlawful use;
• a material breach of these Terms;
• non-payment;
• risk to Blacklock's infrastructure or another customer; or
• a requirement imposed by law or a competent authority.
Where reasonably practicable, Blacklock will notify the Customer of the suspension and work with the Customer to restore access after the relevant issue is resolved.
These Terms apply while you access or use the Services.
Subscription terms are specified in the applicable Order.
Either party may terminate an applicable agreement where the other party materially breaches its obligations and fails to remedy the breach within 30 days after receiving written notice, where the breach is capable of remedy.
Blacklock may terminate or suspend access immediately where:
• the Services are being used unlawfully;
• security testing is being conducted without appropriate authorisation;
• continued use creates a material security risk;
• the Customer becomes insolvent; or
• termination is required by law.
Termination does not affect rights or liabilities accrued before termination.
Provisions that by their nature should continue after termination, including confidentiality, intellectual property, liability and payment obligations, will survive termination.
Blacklock warrants that paid Services will be provided:
• with reasonable care and skill; and
• materially in accordance with applicable
Documentation and agreed specifications.
If professional services materially fail to meet this standard, Blacklock may, at its option:
• re-perform the affected Services; or
• refund the fees paid for the materially non-conforming portion of the Services.
Except for warranties expressly stated in an applicable agreement and to the maximum extent permitted by law, the Services are provided "as is" and "as available".
Blacklock does not warrant that:
• the Services will operate without interruption or error;
• every vulnerability will be identified;
• every finding will be exploitable;
• remediation guidance will be appropriate in every environment; or
• use of the Services will make a Customer's systems completely secure.
Nothing in these Terms excludes warranties or rights that cannot lawfully be excluded.
To the maximum extent permitted by law, neither party will be liable to the other for any:
• indirect or consequential loss;
• loss of profit;
• loss of revenue;
• loss of anticipated savings;
• loss of business opportunity;
• loss of goodwill; or
• indirect loss of data, arising from or relating to the Services.
Except for liability that cannot legally be limited or excluded, each party's aggregate liability arising from the applicable Services will not exceed the total fees paid or payable by the Customer to Blacklock for the affected Services during the 12 months immediately preceding the event giving rise to the claim.
The limitations in this section apply regardless of whether liability arises in contract, tort, negligence or otherwise.
Nothing in these Terms limits liability to the extent such limitation is prohibited by applicable law.
The Customer will indemnify Blacklock against third-party claims, losses and reasonable costs arising from:
• Customer Data supplied in violation of another person's intellectual property, privacy or other rights;
• the Customer knowingly submitting an unauthorised target for security testing;
• unlawful use of the Services by the Customer; or
• a material breach of the Acceptable Use requirements in these Terms.
Blacklock will reasonably cooperate in the defence of any applicable claim.
Any broader or additional indemnification obligations agreed between the parties will be governed by the applicable Order or written agreement.
Information published on Blacklock's public website is provided for general informational purposes.
Website content, blog posts, vulnerability information and educational material do not constitute legal, financial or professional risk advice.
Blacklock may modify, update or remove website content without notice.
Blacklock's websites or Services may contain links to websites operated by third parties.
Blacklock does not control those websites and is not responsible for their:
• content;
• security;
• availability;
• accuracy; or
• privacy practices.
Access to third-party websites is at the user's discretion.
Blacklock may update these Terms from time to time to reflect:
• changes to our Services;
• changes to applicable law;
• security requirements; or
• operational changes.
The latest version will be published on our website with its effective date.
Where an update materially affects an existing Customer's rights or obligations, Blacklock will provide reasonable notice where appropriate.
Material changes will not override separately negotiated contractual terms unless agreed by the parties.
These Terms are governed by the laws of New Zealand.
The parties submit to the non-exclusive jurisdiction of the courts of New Zealand.
The United Nations Convention on Contracts for the International Sale of Goods does not apply.
Assignment
Neither party may assign its rights or obligations under these Terms without the other party's written consent, except in connection with a merger, corporate restructuring, acquisition or sale of substantially all of its relevant business or assets.
Independent parties
Blacklock and the Customer are independent contractors. Nothing in these Terms creates a partnership, joint venture, employment, agency or franchise relationship.
Waiver
Failure to enforce any provision of these Terms does not constitute a waiver of that provision or any other right.
Severability
If any provision is held to be invalid or unenforceable, it will be modified to the minimum extent necessary or severed, and the remaining provisions will continue in effect.
Entire agreement
These Terms, together with the applicable Order and any incorporated written agreements, constitute the agreement relating to use of the relevant Services.
They do not replace any separately executed confidentiality agreement, Statement of Work, Software Licence, SLA, Data Processing Agreement or other agreement except where that document expressly states otherwise.
Questions regarding these Terms may be sent to:
Blacklock Security Limited
Taiawa Tech Hub
Level 5, 33 Bunny Street
Wellington Central
Wellington 6011
New Zealand
Email: hello@blacklock.io
Phone: 0800 114 505
Website: blacklock.io
Last updated: 17 October 2026