VCIY Terms of Service

VCIY is a product of Voxell, Inc., a Delaware corporation ("Voxell", "we"). These terms are the agreement between Voxell and the customer ("you") for use of VCIY at vciy.com and app.vciy.com. By creating an account or using the service, you agree to them.

VCIY provides vulnerability decision records and the evidence machinery behind them: dated, source-attributed facts about public vulnerability records; snapshots that freeze the fact set behind a decision; watches and notifications on material changes; proof links that re-derive served values; and, on applicable plans, team features, attestation, continuous subject discovery from OpenTelemetry resource metadata, and the evidence scorecard.

Plan entitlements are as stated on the pricing page at the time of purchase. Founding-rate subscriptions keep their founding price for as long as the subscription remains continuously active. Monthly subscriptions cancel anytime, effective at the end of the billing period. Annual subscriptions carry a 30-day money-back guarantee from first purchase, no questions asked; refunds are processed to the original payment method. Custody plans include up to five seats on your verified domain. You are responsible for your users' compliance with these terms.

Cloud plans run on shared infrastructure and are engineered for a stated envelope. Current service limits are published at vciy.com/limits and form part of these terms; as of the effective date they include: subjects up to 5,000 active service identities per organization (a distinct service and version counts once, replicas collapse to one, and identities retire after 30 days unseen; higher volumes available upon request), the rate and payload limits stated there, and one running forensic investigation per account. We may throttle traffic beyond these limits (requests receive HTTP 429 with Retry-After) and cap identity cardinality. If your sustained usage exceeds the envelope, we will tell you, and the path forward is the On-Prem plan, where the full system runs on your hardware inside your network and capacity is engineered to your scale. We will not silently degrade your service, and we will not bill you for overage without an agreement to do so.

VCIY records, dates, and reconstructs what public sources (including NVD, CISA KEV, EPSS, and exploit-code indicators) published, as of stated times. A snapshot or proof link attests the state of those sources at a moment; it does not warrant that any source was accurate, complete, or timely. VCIY does not assess your systems, does not determine whether you are exploitable, and does not tell you what to do. Vulnerability decision records are records of your decisions, made by you; VCIY is not security advice, legal advice, or a substitute for your judgment. You are responsible for your decisions and their outcomes.

Watches, alerts, and pushed notifications depend on upstream feed publication, our processing, and third-party delivery networks. We publish our measured latencies and our uptime, and we engineer in good faith for promptness, but we do not guarantee that any notification will be delivered, or delivered within any particular time. You agree not to rely on VCIY notifications as your sole means of learning about any vulnerability, and Section 11 applies fully to alleged losses from missed, delayed, or inaccurate notifications.

OpenTelemetry ingest reads resource attributes only. Span, metric, and log payload data is dropped at ingress and is not stored or logged, and our published collector configuration strips it before it leaves your network. Your decision records, subjects, and notes are yours. We may use aggregated, de-identified usage data to operate and improve the service. On termination, you may export your decision records and bound records; your records leave with you.

Voxell owns the service, its software, its index, and its marks. The VDR format specification is published openly and may be used by anyone without a license from us. Your decision records and their contents are yours. You grant us the license needed to host, process, snapshot, and display your content back to you and your team.

No unlawful use; no attempts to breach, overload, or probe the service outside any published disclosure policy; no reselling or offering the service to third parties as your own without an agreement; no scraping at scale beyond published limits; no use of the service to make representations that VCIY endorsed your decisions.

For the avoidance of doubt, ordinary professional use of the output is permitted and always was: quoting answers, receipts and proof links in your own tickets, incident reports, board papers, audit responses and client deliverables. Section 7 makes your records yours; this says plainly what that means on a Tuesday. What needs an agreement is packaging the service itself as your own product to third parties.

The service is provided as is and as available, without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement, to the maximum extent permitted by law.

To the maximum extent permitted by law: neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, lost data, business interruption, or costs of security incidents, breaches, or regulatory actions, even if advised of the possibility. Voxell's total aggregate liability under these terms is capped at the amounts you paid to Voxell in the twelve months before the event giving rise to the claim. For clarity, this section applies to claims arising from missed, delayed, or inaccurate notifications, from reliance on snapshots or proof links, and from source errors, and nothing in the service's marketing modifies it.

You will defend and indemnify Voxell against third-party claims arising from your content, your decisions, or your breach of these terms. Voxell will defend and indemnify you against third-party claims that the service, as provided, infringes their intellectual property.

Either party may terminate for material breach uncured within 30 days of notice. You may cancel per Section 3. On termination we make your export available for 30 days. Sections 5, 7 (export), 8, 10, 11, 12, and 15 survive.

We may update these terms and the published limits page; material changes get 30 days' notice by email or in-product. Continued use after the effective date is acceptance. Founding-price commitments in Section 3 are not reduced by changes to these terms.

These terms are governed by the laws of the State of Delaware, without regard to conflicts rules. Disputes will be resolved in the state or federal courts located in Yuba County, California, and both parties consent to that venue. Small-claims matters may be brought in either party's local small-claims court.

Voxell, Inc., 525 Washington Square, Marysville, CA 95901. Questions about these terms: [email protected].