This is the licence for NuajProtect. It is one of two agreements you accept: this one, which covers everything specific to NuajProtect, and the Nuaj Master Terms, which carry everything that is the same for every Nuaj product — the commercial terms, the liability limit, the indemnity, the obligations that attach to providing a service to third parties, and the general legal provisions.
Words defined in the Master Terms have the same meaning here.
By installing, accessing, or using NuajProtect, you agree to this Agreement and to the Master Terms.
NuajProtect is licensed by:
Nuaj Company Inc.
8250 Lawson Rd., Suite 201
Milton, Ontario L9T 5C6
Canada
General and legal enquiries: legal@nuaj.com
Support: support@nuaj.com
Security reports: security@nuaj.com
This is Nuaj's place of business and its address for notices, as stated in the Master Terms.
"NuajProtect", the Product under this Agreement, consists of:
References to NuajProtect include all four unless the context requires otherwise. Where this Agreement addresses hardware specifically, it says "Appliance".
"Endpoint" means each device or instance enrolled to your account that NuajProtect protects or monitors — including a NuajBridge appliance, a host running the NuajProtect agent, a managed router, and an aggregator — counted once per enrolled device or instance, whatever its type. The unit is the enrolled device, not the network behind it, not the traffic through it, and not the number of people who use it. Your plan's Endpoint limit and the number currently enrolled are shown in the dashboard.
Subject to your compliance with this Agreement and the Master Terms and, where a paid plan applies, to payment of the applicable fees, Nuaj grants you a non-exclusive, non-transferable, non-assignable, revocable licence, for the term of your subscription or of your use, to:
The licence covers use for others. It permits both your own internal use and your use of NuajProtect to deliver a service to End Customers, whether or not you charge for it. The obligations that come with doing so — flow-down, indemnity, no onward service level commitments, and the rest — are set out in Providing Services to Third Parties in the Master Terms and apply in full. The licence itself remains yours and may not be transferred, assigned, or resold as a licence.
Where an Appliance is supplied, the licence to the Software and Firmware on it runs for as long as you own and operate that unit in accordance with this Agreement.
Metering. NuajProtect is metered in Endpoints. The meter counts every Endpoint you enrol, on your own networks and on those of your End Customers alike.
Exceeding your Endpoint limit does not disconnect you, and it does not stop traffic. Endpoints beyond the limit are placed in passthru mode: they remain enrolled and continue to forward traffic, but NuajProtect does not filter or enforce policy on them. Where the limit is exceeded, the Endpoints enrolled longest keep protection and the most recently enrolled lose it. Traffic through an Endpoint in passthru mode is unprotected while the deployment continues to look connected, and it is your responsibility to monitor your Endpoint count against your plan. We show the count and the passthru state in the dashboard; we do not undertake to notify you before an Endpoint enters passthru.
Except to the extent a restriction is prohibited by applicable law, or expressly permitted by the licence of an open-source component, you may not:
How NuajProtect may be used, on whose networks, and for what purposes is governed by the Acceptable Use Policy, which applies to this Product as it does to every Nuaj product.
A breach of this section or of the Acceptable Use Policy is a material breach. Nuaj may act on it under Suspension and Termination in the Master Terms, and it terminates the licence granted above.
These restrictions survive the licence. The prohibitions on reverse engineering, on copying, and on transferring the Software and Firmware continue to apply to any copy that remains in your possession after the licence ends, and ending the licence does not release you from them.
NuajProtect inspects, filters, and blocks network traffic, and is normally deployed in the path of it. You represent and warrant, for every network where you deploy it:
Nuaj has no relationship with the party whose network you protect, cannot obtain those authorisations for you, and does not verify them. You are responsible for determining that your deployment is lawful in your jurisdiction.
You are also responsible for the accuracy of your configuration and for reviewing the effect of policy changes before applying them to production traffic; for safeguarding credentials and controlling which of your personnel hold administrative access; and for maintaining security controls, backups, monitoring, business continuity plans, and disaster recovery procedures independent of NuajProtect.
NuajProtect includes a community threat-intelligence capability (the Nuaj Threat Exchange). When enabled, it transmits to Nuaj-operated services limited technical indicators derived from attacks observed by your deployment: attacking IP addresses, targeted ports and protocols, threat categories, timestamps, and anonymous reporter counts. No log content, no packet payloads, and no identifiers of your users or endpoints are transmitted.
Indicators are aggregated with submissions from other deployments and redistributed as community threat lists, provided "AS IS" and without warranty of any kind. Community lists are derived from attacks observed in the field: they can be incomplete, can be stale, and can name an address that has since changed hands. Acting on them may block a destination you consider legitimate, and their use does not warrant that any listed address is in fact hostile or that any unlisted address is safe.
This capability is enabled by default and may be disabled at any time in the server settings, without affecting any other functionality and without penalty. Nuaj processes these indicators on the basis of the legitimate interest of Nuaj, of the Customer, and of every other participant in defending against the attacks the indicators describe — not on the basis of consent, so accepting this Agreement is not consent to it and turning it off costs you nothing. The Privacy Policy describes this processing in full.
Where you deploy NuajProtect on a network that is not your own — for a client, a member organization, or anyone else you provide a service to — the indicators submitted describe attacks observed on that network. Because the capability is on by default, you warrant that you have the authority to submit them, and you are responsible for telling that party where your arrangement with them requires it, and for turning the capability off where you do not have that authority. Nuaj has no relationship with that party and cannot obtain that authority for you.
No security product is perfect. NuajProtect is not, and will never be. This is not a shortcoming peculiar to this product — it is a property of the field. Every network security product, from every vendor, acts on incomplete information against an adversary who is actively working to defeat it, and none can be made complete. Residual risk always remains, and it remains with you.
Specifically, and without limiting No Warranty in the Master Terms, you acknowledge that:
NuajProtect is one layer, not a security programme. It does not replace patching, backups, endpoint protection, network segmentation, access control, staff training, log retention, an incident response plan, cyber insurance, or independent professional advice, and it does not by itself make you compliant with any law, regulation, or standard. You must not deploy NuajProtect as your only safeguard against a risk whose realization you could not absorb.
No statement in any marketing material, benchmark, demonstration, roadmap, or documentation is a warranty, a representation, or a guarantee of a security outcome, and nothing in them promises that any particular incident will be prevented.
Where you deploy NuajProtect for an End Customer, this section describes what you are delivering to them, and you must not represent otherwise.
Support. Support for NuajProtect is provided at the level described for your plan, as set out in Support in the Master Terms. Only you may raise support requests; your End Customers go to you.
Automatic updates. NuajProtect installs software updates and threat data automatically, and verifies the signature on every update before installing it. You consent to that installation, and you acknowledge that an update may change behaviour and may briefly interrupt filtering or connectivity while it applies.
Automatic updates are on by default and are how NuajProtect stays effective: security updates are what stop the defects described in Nature and Limits of Protection from remaining exploitable, and threat data goes stale in days. Where the product allows you to turn updates off, doing so is not a breach of this Agreement — but a deployment running with updates disabled is unsupported, protects less, and may protect very little, and the resulting risk is yours. Nuaj may decline to provide support for, and gives no warranty in respect of, a deployment that is not current.
Support period. Nuaj produces and publishes security updates, corrective updates, and threat intelligence for NuajProtect, including for each Appliance model, for at least sixty (60) months from the date Nuaj announces that the model or version is no longer sold. This is the support period for the purposes of applicable product-security law. Delivery of updates and threat intelligence to a deployment requires an active subscription, as it does for any deployment; this commitment is that Nuaj keeps producing them, not that they are supplied without a subscription.
End of sale and end of life. Nuaj may stop selling any model or plan at any time, and may change or withdraw a planned model before it ships. Notice of end-of-sale is given through the service or by email to the address on the account. Where a model you own is discontinued, the hardware warranty continues to run for its full term, any subscription included with the unit continues for the term it was sold with, and the support period above runs from the announcement. Discontinuing a model is not a defect and does not, by itself, entitle you to a refund or a replacement.
This section applies only where you purchase a NuajBridge Appliance, and only to that hardware.
Liability relating to the Appliance. Limitation of Liability and Limitation Period in the Master Terms apply to the Appliance in the same way, and to the same extent, as they apply to the Software, the Firmware, and the Hosted Service — whether a claim is made under the limited warranty above, under this Agreement, or otherwise. The cap on Nuaj's liability under the limited warranty, being the price paid for the unit, operates within that overall limit and does not raise it. Nothing in this section excludes or limits liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence and liability under the European Union product liability regime described in the Master Terms.
This Agreement incorporates, and is to be read with:
Each of them is published, is linked from the screen on which you accept this Agreement, and may be read before you accept. Together with this Agreement they are the Documents.
Where they conflict, the order of precedence in The Agreement and Order of Precedence of the Master Terms governs: mandatory law first, then a signed agreement, then the Privacy Policy and the Data Processing Agreement on questions of personal data, then this Agreement, then the Acceptable Use Policy, then the Master Terms, then any other referenced policy.
Acceptance. This Agreement is accepted and recorded as described in Acceptance, Authority, and Records in the Master Terms: the accepting user account, the date and time, the source IP address, the version, the language version displayed, and a cryptographic hash of the exact text accepted. When the version changes materially you are asked to accept the updated Agreement before continuing to use NuajProtect, and a new record is created.
Term and termination. This Agreement applies from your first acceptance or use of NuajProtect and continues until terminated. You may terminate it at any time by ceasing all use and removing the Software and Firmware from your systems. Nuaj may terminate or suspend the licence as set out in Suspension and Termination in the Master Terms. On termination the licence ends and you must cease using and remove the Software and Firmware; termination of this Agreement does not by itself terminate a subscription.
Survival. Parties and the Product, Restrictions, Your Representations, Nature and Limits of Protection, Appliance — Warranty, Title, and Returns, and this section survive termination of this Agreement, together with the surviving provisions of the Master Terms.
Language. This Agreement was drafted in the English language, and the English version is the sole authoritative and legally binding version. Any translation is provided for convenience only and has no legal effect. A complete French-language version is published and available to you before you accept, from the language selector on this page. Where you accept after having been able to read the French version, the parties have expressly requested and agreed that this Agreement, together with all related documents and notices, be drafted in the English language, and that the English version govern. Les parties ont expressément demandé et convenu que la présente convention, ainsi que tous les documents et avis qui s'y rapportent, soient rédigés en langue anglaise. Nuaj records which language version was displayed to you at the time you accepted.
If you do not agree to these terms, do not install or use NuajProtect.