These Terms of Service govern the enterprise relationship between SURF Security and its customers. By using SURF's platform, you agree to comply with these terms. For questions, contact legal@surf.security.
1. Acceptance of Terms
These Terms of Service ("Terms") constitute a legally binding agreement between your organisation ("Customer", "you", or "your") and SURF Security Ltd., a company incorporated in England and Wales ("SURF", "we", "us", or "our"), governing your access to and use of the SURF Enterprise AI Platform, SURF Browser, SURF Browser Extension, and all associated services, software, APIs, and documentation (collectively, the "Services").
By accessing or using the Services, or by executing an Order Form that references these Terms, you agree to be bound by these Terms and our Privacy Policy. If you are entering into these Terms on behalf of an organisation, you represent and warrant that you have the authority to bind that organisation to these Terms.
If you do not agree to these Terms, you may not access or use the Services.
2. Enterprise License Grant
2.1 License Grant
Subject to your payment of applicable fees and compliance with these Terms, SURF grants you a limited, non-exclusive, non-transferable, non-sublicensable license to access and use the Services during the Subscription Term solely for your internal business purposes and for the number of authorised users specified in your Order Form.
2.2 Deployment Options
Depending on your enterprise agreement, the Services may be deployed as: (a) a cloud-hosted SaaS offering operated by SURF; (b) a private cloud deployment within your cloud environment; or (c) an on-premise deployment within your infrastructure. Specific terms applicable to each deployment model are set out in your Order Form and applicable deployment addendum.
2.3 Restrictions
The license granted herein does not permit you to: (a) sublicense, sell, resell, transfer, or assign the Services or this license; (b) use the Services to build a competitive product or service; (c) access the Services for benchmarking purposes for public disclosure without SURF's prior written consent; or (d) exceed the usage limits specified in your Order Form.
3. Acceptable Use Policy
You agree to use the Services only in accordance with these Terms, applicable laws, and SURF's published Acceptable Use Policy. Without limitation, the following activities are expressly prohibited:
Reverse Engineering
You may not decompile, disassemble, reverse engineer, or attempt to derive the source code, underlying ideas, algorithms, or structure of the Services or any component thereof. This prohibition extends to the SURF Browser, SURF Browser Extension, Agent Runtime, policy enforcement engine, and all associated software.
Tampering with Sandbox Environments
You may not attempt to escape, bypass, compromise, or otherwise tamper with SURF's browser sandbox, process isolation mechanisms, session containment controls, or any other security boundary maintained by the Services. Any identified vulnerability must be reported through SURF's responsible disclosure programme.
Bypassing Runtime Guardrails
You may not attempt to circumvent, disable, or interfere with SURF's runtime guardrails, policy enforcement mechanisms, DLP controls, audit logging systems, or any other security or governance control implemented by the Services. This includes using AI models, scripts, or other automated tools to probe or defeat SURF's control plane.
Unauthorised Access
You may not attempt to gain unauthorised access to SURF's systems, other customers' data, or any component of the SURF platform beyond what is expressly authorised under your license.
Malicious Use
You may not use the Services to develop, test, deploy, or distribute malware, exploits, or other malicious code; to conduct phishing or social engineering attacks; or to facilitate any illegal activity.
Violation of this Acceptable Use Policy may result in immediate suspension or termination of your access to the Services and may give rise to civil or criminal liability.
4. Intellectual Property
4.1 SURF IP
SURF and its licensors retain all intellectual property rights in and to the Services, including all software, documentation, trademarks, patents, trade secrets, and all improvements, modifications, and derivative works thereof. Nothing in these Terms grants you any ownership interest in the Services or any SURF intellectual property.
4.2 Customer Data
You retain all intellectual property rights in and to data you submit to or generate through the Services ("Customer Data"). You grant SURF a limited license to process Customer Data solely to the extent necessary to provide the Services in accordance with these Terms and our Privacy Policy.
4.3 Feedback
If you provide SURF with feedback, suggestions, or ideas regarding the Services ("Feedback"), you grant SURF a perpetual, irrevocable, worldwide, royalty-free license to use, incorporate, and commercialise such Feedback without restriction or compensation to you.
5. Limitation of Liability
This section limits SURF's liability. Please read it carefully. It forms a material part of the agreement between SURF and Customer.
5.1 Exclusion of Consequential Damages
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING LOSS OF PROFITS, GOODWILL, DATA, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
5.2 Cap on Liability
SURF's total aggregate liability to you arising out of or related to these Terms will not exceed the greater of: (a) the total fees paid by you to SURF in the twelve (12) months preceding the event giving rise to the claim; or (b) one hundred US dollars (USD $100).
5.3 Exceptions
The limitations in this section do not apply to: (a) a party's obligation to pay amounts properly due under these Terms; (b) either party's indemnification obligations; (c) liability arising from fraud or wilful misconduct; or (d) liability that cannot be excluded under applicable law.
6. Governing Law
6.1 UK Customers
For customers contracting with SURF Security Ltd. (England and Wales company registration number to be confirmed), these Terms are governed by and construed in accordance with the laws of England and Wales, without regard to its conflict of law provisions. Both parties submit to the exclusive jurisdiction of the courts of England and Wales for the resolution of any dispute arising under or relating to these Terms.
6.2 US Customers
For customers contracting with SURF Security Inc. (a Delaware corporation), these Terms are governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of law provisions. Both parties submit to the exclusive jurisdiction of the state and federal courts located in the State of Delaware.
6.3 Dispute Resolution
Prior to initiating formal proceedings, the parties agree to attempt in good faith to resolve any dispute through escalated executive negotiations for a period of 30 days following written notice of the dispute.
6.4 Entire Agreement
These Terms, together with any applicable Order Form, Data Processing Agreement, and any addenda incorporated by reference, constitute the entire agreement between the parties with respect to the subject matter hereof and supersede all prior and contemporaneous agreements, representations, and understandings.
SURF reserves the right to update these Terms at any time. Enterprise customers will receive at least 30 days' written notice of material changes. Your continued use of the Services after the effective date of any update constitutes your acceptance of the revised Terms.