Terms of Service

1. The service

Nisura provides an "outside-in" cyber risk quantification (CRQ) engine that estimates financial exposure and regulatory liability from user-supplied inputs. The free simulator produces an illustrative estimate; the full platform provides detailed modelling for registered customers.

2. Nature of the estimates — no warranty of outcome

Nisura outputs are algorithmic risk estimations using open-source likelihood frameworks. They do not constitute legal counsel, compliance guarantees, insurance underwriting, or a guarantee of any financial outcome. You remain responsible for your own security and compliance decisions.

3. Acceptable use

• Do not use the service unlawfully or to infringe third-party rights.
• Do not attempt to disrupt, reverse-engineer, scrape at scale, or gain unauthorised access to the service or its data feeds.
• Do not submit data you are not authorised to process, or that contains special-category personal data beyond what the service requests.

4. External exposure assessment — your authorisation

Parts of the service assess a domain's external attack surface (the "assessment"). By submitting a domain or other identifier for assessment, you represent and warrant that you own it or are otherwise authorised to have it assessed on the owner's behalf. You are solely responsible for having that authorisation, and you agree to indemnify OnDuty AI Solutions GmbH against third-party claims arising from a domain or asset you submitted without authorisation.

The assessment is passive. Nisura derives its findings from publicly available internet-exposure sources and third-party scan indexes (for example crt.sh, DNS, Shodan and Censys). In its default mode it does not send network traffic to, log in to, exploit, or otherwise access your systems or any third-party system — it reads data those systems have already made publicly observable. Any tier that actively interacts with your own infrastructure runs only after you expressly authorise it (for example by verifying domain ownership), and never against systems you do not control.

Operational technology (OT) / industrial control systems. Where the assessment reports that an industrial controller (PLC) or similar OT/ICS device is reachable from the internet, that finding is derived passively from public indexes. Nisura does not probe, query, or send any traffic to OT/ICS devices — active scanning of such devices can disrupt physical processes and is deliberately excluded from every tier of the service. OT findings are an exposure and architecture observation ("this is reachable from the internet"), not an attempt to access or exploit the device.

5. Accounts

Where registration is required, you must provide accurate information and keep your credentials secure. You are responsible for activity under your account.

6. Intellectual property

The Nisura service, models, and content are owned by OnDuty AI Solutions GmbH and its licensors. Third-party data sources and standards referenced by the service remain the property of their respective owners. You retain ownership of the inputs you submit.

7. Third-party data

The service references external threat-intelligence sources (e.g. EPSS by FIRST.org and VulnCheck) and public frameworks. We do not warrant the accuracy, completeness, or availability of third-party data.

8. Availability

The free simulator is provided "as is" and "as available", without an uptime commitment. For paid plans, we target 99.5% monthly uptime, excluding scheduled maintenance (announced in advance where practicable) and events outside our reasonable control. Any binding service levels are set out in the applicable order form or service agreement.

9. Limitation of liability

To the maximum extent permitted by applicable law, OnDuty AI Solutions GmbH is not liable for indirect, incidental, or consequential damages, or for decisions taken in reliance on the estimates. For paid services, our aggregate liability arising out of or in connection with the service is limited to the fees you paid in the twelve (12) months preceding the event giving rise to the claim. These limitations do not apply to liability that cannot be excluded or limited under mandatory law — including liability for intent or gross negligence, for personal injury, or under the Product Liability Act.

10. Governing law & jurisdiction

These terms are governed by the laws of Austria, excluding its conflict- of-law rules and the UN CISG. For disputes with businesses, the exclusive place of jurisdiction is the court with subject-matter competence for Wien (Innere Stadt), Austria. Mandatory consumer- protection venue rules remain unaffected for consumers.

11. Contact

Questions about these terms? Contact sales or see our Imprint. Data handling is described in our Privacy Policy.