Terms and Conditions

These Terms and Conditions ("Terms") govern the supply of cyber auditing, security monitoring and reporting services by Saario ("Saario", "we", "us", "our") through the website saario.app and associated applications, to the customer ("Customer", "you", "your"). Please read these Terms carefully before subscribing. By placing an order, creating an account or using the Services, you agree to be bound by these Terms.

1. Definitions and interpretation

1. 1.1In these Terms, the following definitions apply:

• "Contract" means the agreement between Saario and the Customer for the supply of the Services, incorporating these Terms and the applicable Order.
• "Customer Data" means all data, information and material read from or relating to the Customer's Microsoft 365 tenant, or otherwise provided by the Customer, in connection with the Services.
• "Deliverables" means the reports, scores, dashboards, action plans and other output generated by the Services, including the Saario Score and the Saario Report.
• "Fees" means the subscription charges for the Services, as published on the Website or otherwise agreed in writing.
• "Order" means the Customer's subscription to a plan via the Website, or any written order accepted by Saario.
• "Services" means the cyber auditing, monitoring, analysis and reporting services described on the Website, connecting to the Customer's Microsoft 365 tenant via the Microsoft Graph API.
• "Website" means saario.app and any subdomain of it.

1. 1.2Headings are for convenience only and do not affect interpretation. Words in the singular include the plural and vice versa. "Including" means including without limitation.

2. Formation of the contract

1. 2.1The Website constitutes an invitation to treat and not a contractual offer. An Order constitutes an offer by the Customer to purchase the Services subject to these Terms.
2. 2.2A Contract is formed when Saario accepts the Order by confirming the subscription and activating access to the Services, whichever occurs first.
3. 2.3These Terms apply to the exclusion of any other terms the Customer seeks to impose or incorporate, or which are implied by trade, custom, practice or course of dealing.
4. 2.4The individual accepting these Terms warrants that they are at least 18 years of age and duly authorised to bind the Customer.

3. The Services

1. 3.1Saario shall supply the Services to the Customer with reasonable skill and care, substantially in accordance with the description on the Website.
2. 3.2The Services operate by reading security-relevant signals from the Customer's Microsoft 365 tenant through the Microsoft Graph API, using read-only permissions granted by the Customer through Microsoft's admin-consent process. The Services do not modify the Customer's tenant and Saario does not receive or store the Customer's Microsoft credentials.
3. 3.3Saario may make changes to the Services which are necessary to comply with applicable law or security requirements, or which do not materially reduce the nature or quality of the Services.
4. 3.4Saario shall use reasonable endeavours to make the Services available at all times, but does not guarantee uninterrupted availability. The Services may be suspended temporarily for scheduled or emergency maintenance, or where required by a third-party provider (including Microsoft).
5. 3.5The Services depend on data made available by Microsoft through the Graph API. Saario is not responsible for the accuracy, completeness or timeliness of data supplied by Microsoft, nor for changes Microsoft makes to its APIs, permissions or licensing.
6. 3.6The Services and Deliverables are provided for information and internal governance purposes only. They do not constitute legal, regulatory, insurance or professional advice, and are not a certification, accreditation or guarantee of security or compliance.

4. Customer obligations

1. 4.1The Customer shall: (a) ensure it is authorised to connect each Microsoft 365 tenant it connects to the Services; (b) provide accurate account and billing information and keep it up to date; (c) keep account credentials secure and notify Saario promptly of any suspected unauthorised access; (d) use the Services only for its own lawful internal business purposes; and (e) comply with all applicable laws in its use of the Services.
2. 4.2The Customer shall not: (a) use the Services to audit or monitor any tenant or system without proper authorisation; (b) resell, sublicense or make the Services available to any third party except as expressly permitted; (c) copy, modify, decompile or reverse engineer any part of the Services except as permitted by law; (d) interfere with, disrupt or attempt to gain unauthorised access to the Services or their related systems; or (e) use the Services to develop a competing product or service.
3. 4.3The Customer is responsible for acting (or choosing not to act) on the findings and recommendations in the Deliverables, and for the security, configuration and administration of its own Microsoft 365 environment at all times.

5. Fees and payment

1. 5.1The Fees for each plan are stated on the Website in pounds sterling, exclusive of VAT, and are payable monthly in advance by the payment method selected at checkout. Payments are processed by our payment provider, Stripe.
2. 5.2The applicable plan is determined by the number of licensed users in the Customer's tenant. If the tenant exceeds the user band for the current plan, Saario may require the Customer to upgrade to the correct tier with effect from the next billing period.
3. 5.3Subscriptions renew automatically each month until cancelled. The Customer may cancel at any time; cancellation takes effect at the end of the then-current billing period and no pro-rata refund is due for the remainder of that period, except where required by law.
4. 5.4Saario may vary the Fees by giving not less than 30 days' written notice; any variation takes effect from the Customer's next billing period after expiry of the notice.
5. 5.5If any sum payable is not paid when due, Saario may, on written notice, suspend the Services until payment is received, and may charge interest on overdue sums at 4% per annum above the Bank of England base rate.
6. 5.6All Fees are non-refundable except as expressly stated in these Terms or required by law. Where the Customer deals as a consumer, statutory cancellation rights are unaffected.

6. Term and termination

1. 6.1The Contract commences on the date it is formed under clause 2.2 and continues on a rolling monthly basis until terminated in accordance with this clause.
2. 6.2Either party may terminate the Contract at any time with effect from the end of the current billing period, by the Customer cancelling the subscription or by Saario giving written notice.
3. 6.3Either party may terminate the Contract immediately on written notice if the other: (a) commits a material breach which is irremediable or, if remediable, is not remedied within 14 days of written notice; or (b) becomes insolvent, enters administration or liquidation, or ceases to trade.
4. 6.4Saario may suspend or terminate access immediately if the Customer's use of the Services presents a security risk, is unlawful, or breaches clause 4.2.
5. 6.5On termination: (a) the Customer's right to use the Services ends; (b) all sums due to Saario become immediately payable; (c) Saario will delete Customer Data in accordance with clause 9 and the Privacy Statement; and (d) clauses which by their nature should survive (including clauses 7–12 and 15) shall survive.

7. Intellectual property rights

1. 7.1All intellectual property rights in the Services, the Website, the Saario name, logo and branding, and the underlying software, methodologies, scoring models and documentation are and shall remain the property of Saario or its licensors.
2. 7.2Saario grants the Customer a limited, non-exclusive, non-transferable licence, for the duration of the Contract, to access and use the Services and Deliverables for its internal business purposes, including sharing Deliverables with its professional advisers, auditors and insurers.
3. 7.3All intellectual property rights in Customer Data remain with the Customer or its licensors. The Customer grants Saario a licence to process Customer Data solely to the extent necessary to provide the Services and perform the Contract.
4. 7.4Saario may use anonymised and aggregated data derived from use of the Services, which does not identify the Customer or any individual, for the purposes of benchmarking, statistics and improving the Services.

8. Confidentiality

1. 8.1Each party shall keep confidential all confidential information of the other party obtained in connection with the Contract, and shall not use or disclose it except as necessary to perform the Contract, to its professional advisers, or as required by law or a regulator.
2. 8.2This clause does not apply to information which is or becomes publicly available otherwise than through breach, was already lawfully known to the receiving party, or is independently developed without use of the other party's confidential information.
3. 8.3This clause survives termination of the Contract for a period of 5 years.

9. Data protection

1. 9.1Each party shall comply with applicable data protection legislation, including the UK GDPR and the Data Protection Act 2018, in connection with the Contract.
2. 9.2In respect of personal data contained in Customer Data, the Customer is the controller and Saario is the processor. Saario shall: (a) process such personal data only on the Customer's documented instructions, which include the instruction to provide the Services in accordance with the Contract; (b) implement appropriate technical and organisational security measures; (c) ensure persons authorised to process the data are bound by confidentiality; (d) engage sub-processors only under written terms offering equivalent protection, and remain responsible for their performance; (e) assist the Customer, at the Customer's reasonable cost, with data subject requests and its obligations regarding security, breach notification and impact assessments; (f) notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data; and (g) on termination, delete or return personal data in Customer Data, save to the extent retention is required by law.
3. 9.3Details of the personal data processed, the purposes of processing, current sub-processors and retention periods are set out in the Privacy Statement, which forms part of these Terms.

10. Warranties and disclaimers

1. 10.1Each party warrants that it has full power and authority to enter into the Contract.
2. 10.2Saario warrants that the Services will be performed with reasonable skill and care. As the sole remedy for breach of this warranty, Saario will re-perform the affected Services or, at its option, refund the Fees attributable to the affected period.
3. 10.3The Customer acknowledges that: (a) no security assessment can identify every vulnerability, misconfiguration or threat; (b) the Deliverables reflect the state of data available at the time of assessment and may become out of date; and (c) a favourable score or report does not mean the Customer's environment is secure, compliant or free from compromise.
4. 10.4Except as expressly set out in these Terms, all warranties, conditions and other terms implied by statute or common law are excluded to the fullest extent permitted by law.

11. Limitation of liability

1. 11.1Nothing in these Terms limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability which cannot lawfully be limited or excluded.
2. 11.2Subject to clause 11.1, Saario shall not be liable, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for: (a) loss of profits, revenue, business, goodwill or anticipated savings; (b) loss or corruption of data (other than caused by Saario's breach of clause 9); (c) any security incident, breach or compromise of the Customer's systems, whether or not identified by the Services; or (d) any indirect or consequential loss.
3. 11.3Subject to clauses 11.1 and 11.2, Saario's total aggregate liability arising out of or in connection with the Contract in any period of 12 months shall not exceed the total Fees paid by the Customer in that period or, where no Fees have been paid, £100.
4. 11.4If the Customer deals as a consumer, nothing in these Terms affects statutory rights which cannot be excluded or limited.

12. Indemnity

1. 12.1The Customer shall indemnify Saario against all losses, damages, costs and expenses (including reasonable legal fees) arising out of or in connection with: (a) the Customer connecting a tenant, or authorising monitoring of a system, without proper authority; or (b) the Customer's breach of clause 4.2 or of applicable law in its use of the Services.

13. Force majeure

1. 13.1Neither party shall be in breach of the Contract nor liable for delay or failure to perform its obligations (other than payment obligations) resulting from events beyond its reasonable control, including failure of telecommunications networks or third-party services, acts of government, epidemics, and denial-of-service or similar attacks. If such an event continues for more than 60 days, either party may terminate the Contract on written notice.

14. General

1. 14.1Entire agreement. The Contract constitutes the entire agreement between the parties and supersedes all previous agreements and understandings relating to its subject matter. Neither party relies on any statement or representation not set out in the Contract.
2. 14.2Variation. Saario may update these Terms from time to time. Material changes will be notified to the Customer with reasonable notice, and continued use of the Services after the effective date constitutes acceptance. No other variation is effective unless in writing and agreed by both parties.
3. 14.3Assignment. The Customer may not assign or transfer the Contract without Saario's prior written consent. Saario may assign the Contract to a successor in connection with a merger, acquisition or sale of its business.
4. 14.4Waiver. No failure or delay in exercising any right constitutes a waiver of it.
5. 14.5Severance. If any provision of these Terms is held invalid or unenforceable, it shall be deemed modified to the minimum extent necessary, and the remaining provisions continue in full force.
6. 14.6Third-party rights. The Contract does not confer any rights on any third party, whether under the Contracts (Rights of Third Parties) Act 1999 or otherwise.
7. 14.7Notices. Notices shall be in writing and sent by email — to the Customer at the address on its account, and to Saario at info@saario.app — and are deemed received on the next business day after sending.
8. 14.8Relationship. Nothing in the Contract creates a partnership, agency or employment relationship between the parties. Saario is an independent supplier and is not affiliated with, sponsored by or endorsed by Microsoft Corporation.

15. Governing law and jurisdiction

1. 15.1The Contract, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, shall be governed by the laws of England and Wales.
2. 15.2The courts of England and Wales shall have exclusive jurisdiction, except that where the Customer deals as a consumer, mandatory local law and jurisdiction rights are unaffected.

Questions about these Terms and Conditions can be sent to info@saario.app.