Legal

Terms of Service

Last updated 26 October 2026 · applies to michaelsec.com and the Michael agent

These terms are an agreement between you and the operator of Michael (“we”, “us”). By creating an account, installing the agent, or using the console you accept them. If you are accepting on behalf of a company, you confirm you may bind that company.

1. What Michael is

Michael is a security service. A small agent runs inside an application you deploy and reports its dependency inventory. Michael matches those versions against public vulnerability data, ranks what is exposed, and can publish rules that the agent enforces inside your application until you are able to deploy a fixed version (“virtual patching”).

Michael is not a penetration test, an audit, a guarantee that your application is secure, or a substitute for patching. It reduces exposure; it does not remove it.

2. Accounts

• You must give accurate information and keep your credentials to yourself.
• You are responsible for everything done through your account and for the agents you install.
• One person or organisation per workspace. Sharing a login is not permitted; invite people as members instead.
• You must be at least 18, or the age of majority where you live.

3. Acceptable use

You may use Michael only on systems you own or are authorised to protect. You must not:

• use it to scan, test or attack infrastructure you do not control;
• attempt to access another tenant’s data, or probe the service’s security except through our coordinated disclosure process;
• resell, sublicense or white-label the service without a written agreement;
• reverse engineer the hosted control plane, or bypass usage limits or authentication;
• upload malware, or use the agent to execute arbitrary code on our infrastructure.

We may suspend an account that endangers other customers, our providers, or the public, and will tell you why unless we are legally prevented from doing so.

4. Plans, fees and taxes

Paid plans are billed in advance, monthly or annually, through our payment provider (currently Bachs). Prices are shown in the console before you pay and exclude taxes, which are added where required. Fees are non-refundable except where the law requires it or where we terminate for our own convenience.

Failed payments may lead to suspension after a grace period. Upgrade and downgrade take effect at the point described on the plan page; downgrades that exceed the lower plan’s limits may disable applications rather than delete data.

5. Free tier

The free tier is offered as-is, with limits shown in the console. We may change those limits on reasonable notice. Free accounts may be suspended after 90 days of inactivity, with data deletion following the schedule in the Privacy Policy.

6. Your data and your applications

You keep all rights to your applications and to the data the agent reports. You grant us the licence needed to process it to provide the service. We never ask for, and the agent never sends, your source code, secrets, environment variables or host credentials.

You are responsible for having a lawful basis to send us any personal data contained in your inventory, and for complying with your own regulators.

7. Availability and support

We aim for high availability but do not promise a service level unless a separate written agreement says so. Planned maintenance is announced on the status page. Support is by email at [email protected]; paid plans receive a response target shown on the plan page.

8. Security and incidents

We apply the measures described on our security page: TLS in transit, scrypt password hashing, tenant isolation enforced in the database, hashed agent tokens and least-privilege roles. If we become aware of a breach affecting your data we will notify you without undue delay and, where required, the competent authority.

9. Third-party services

Michael depends on providers listed in our sub-processor list. If one of them fails, the service may be degraded; we will communicate it on the status page.

10. Intellectual property

The hosted service, the console and the brand are ours. The agent and the local console are distributed under the licence stated in their repository. Feedback you send may be used to improve the product without obligation.

11. Liability

To the extent permitted by law, neither party is liable for indirect or consequential loss, lost profits, or lost data. Our total liability arising out of this agreement is limited to the fees you paid in the twelve months before the event. Nothing limits liability for fraud, death or personal injury, or anything else that cannot be limited by law.

Michael detects and reduces risk; it does not warrant that any application is free of vulnerabilities, and you remain responsible for your own security posture.

12. Termination

You may stop using Michael at any time and delete your workspace in Settings. We may terminate for material breach, for non-payment after notice, or if we discontinue the service with 30 days’ notice. On termination we delete your data on the schedule described in the Privacy Policy.

13. Changes

We may update these terms. Material changes are announced by email or in the console at least 14 days before they take effect. Continuing to use the service after that means you accept the new terms.

14. Governing law

These terms are governed by the laws of the Federal Republic of Nigeria, and the courts of Lagos State have exclusive jurisdiction, without prejudice to any mandatory consumer protection rights you have where you live.

15. Contact

Operator: Michael · [email protected]
Registered address supplied on request and in your invoice.