Skip to content
Hackiwi
Get started

Legal - Terms

Terms of Service

Last updated: September 2026

These Terms govern your use of the Hackiwi platform. They set out what the Service is, what you may and may not do with it, who owns what, and how liability is allocated between us. Governed by the laws of the Netherlands.

Definitions

In these Terms, the following capitalised words have the meanings given below. Other capitalised terms are defined where they first appear.

Clause 1.1. "Hackiwi", "we", "us" or "our" means Hackiwi B.V., a company established in the Netherlands.
Clause 1.2. "Customer" or "you" means the organisation or individual that creates an account for the Service or on whose behalf an account is created.
Clause 1.3. "User" means an individual authorised by the Customer to access the Service, including employees, contractors and administrators of the Customer.
Clause 1.4. "Service" means the Hackiwi security awareness platform made available at hackiwi.com and app.hackiwi.com, including the training library, phishing simulation, reporting and triage, exposure and OSINT tooling, and any associated documentation and support.
Clause 1.5. "Customer Data" means all data, content and materials submitted to or generated in the Service by or for the Customer or its Users, including personal data relating to Users.
Clause 1.6. "Agreement" means these Terms together with the Acceptable Use Policy, the Privacy Policy, the Data Processing Agreement, and any order form or written subscription terms agreed between the parties.
Clause 1.7. Order of precedence. If there is a conflict, the following order applies: (a) a signed order form or subscription terms; (b) the Data Processing Agreement, in respect of the processing of personal data; (c) the Acceptable Use Policy, in respect of permitted use; (d) these Terms.

Acceptance

Clause 2.1. By creating an account or using the Service, you agree to these Terms. If you do not agree, do not use the Service.
Clause 2.2. You represent and warrant that you have the authority to bind your organisation to this Agreement, and that the information you provide when creating an account is accurate and complete.
Clause 2.3. Where an individual accepts these Terms on behalf of an organisation, "you" refers to that organisation, and that organisation is responsible for the acts and omissions of its Users as if they were its own.
Clause 2.4. The Service is intended for use by adults in a professional context. You must not create an account for anyone under the age of 16.

The Service

Clause 3.1. Hackiwi is a security awareness training platform. Depending on the Customer's plan and configuration, it includes training modules, phishing simulations, reporting and triage, domain and dependency monitoring, website scanning and OSINT exposure tooling.
Clause 3.2. The Service is provided "as is" and "as available". We do not guarantee any specific security outcome. Security awareness training reduces risk; it does not eliminate it, and no simulation result, score or report should be read as an assurance that you will not be successfully attacked.
Clause 3.3. We may modify, add to or discontinue features of the Service. Where a change materially reduces the functionality of a paid plan, we will give at least 30 days' notice to the administrative contact on the account.
Clause 3.4. We aim to keep the Service available at all times but do not warrant uninterrupted or error-free operation. Maintenance, third-party infrastructure failures and events beyond our reasonable control may interrupt availability. Unless a separate service level agreement has been signed, no availability commitment applies.
Clause 3.5. Certain features depend on third-party services that the Customer connects using its own credentials. Those services are governed by the relevant provider's own terms, and we are not responsible for their availability, accuracy or acts. See section 6 of the Privacy Policy.
Clause 3.6. The Hackiwi source code is published under the GNU Affero General Public License v3.0 and may be self-hosted. This Agreement governs the hosted Service we operate; it does not govern your own deployment of the source code, which is governed by that licence. View the source.

Acceptable use

Clause 4.1. Your use of the Service is subject to the Acceptable Use Policy, which forms part of this Agreement. You are responsible for ensuring that your Users comply with it.
Clause 4.2. Phishing simulations are for internal security awareness only. You may send simulated phishing messages only to your own Users, and only from domains you have verified you own within the Service. You must not send simulations to anyone outside your organisation.
Clause 4.3. You must not use simulation templates, tooling or infrastructure to conduct an actual phishing attack, to obtain credentials for any purpose other than a bona fide internal exercise, or to target anyone who has not been placed within your organisation's scope.
Clause 4.4. Exposure, OSINT and scanning features may be directed only at domains you own and have verified, and at addresses at those domains.
notice
Breach of clauses 4.2 to 4.4 is a material breach of this Agreement. We may suspend the Service immediately under section 10 where we reasonably believe such a breach is occurring.

Account responsibilities

Clause 5.1. You are responsible for all activity that occurs under your account, including the acts and omissions of your Users.
Clause 5.2. You must keep authentication credentials confidential, must not share accounts between individuals, and must maintain accurate administrative contact information so that we can reach you with service, security and legal notices.
Clause 5.3. You must notify us without undue delay at [email protected] if you become aware of any unauthorised access to or use of your account.
Clause 5.4. You are responsible for assigning roles appropriately. Administrative roles can read and export data about your Users, change security settings and initiate simulations; grant them deliberately.
Clause 5.5. You must ensure that you have a lawful basis for enrolling your Users and for the processing the Service performs on your instructions, including any notification or consultation obligations you owe them under employment law.

Data and privacy

Clause 6.1. Personal data is processed in accordance with the Privacy Policy and the Data Processing Agreement.
Clause 6.2. For personal data contained in Customer Data, the Customer is the data controller and Hackiwi is the data processor. The Data Processing Agreement applies automatically and requires no separate signature; a countersigned copy is available on request to [email protected].
Clause 6.3. You retain all right, title and interest in Customer Data. You grant us a limited, non-exclusive licence to host, process, transmit and display Customer Data solely to provide and support the Service, and to comply with your documented instructions.
Clause 6.4. We do not use Customer Data to train machine learning models, and we do not sell it or disclose it for any third party's own purposes.
Clause 6.5. You may export Customer Data at any time through the Service. See section 10 for what happens to it on termination.

Intellectual property

Clause 7.1. The Service, and all intellectual property rights in the platform, its software, design and branding, are owned by Hackiwi B.V. or its licensors. Except for the licences expressly granted here and under the open-source licences below, no rights are transferred to you.
Clause 7.2. Training content is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0), and you may use, adapt, translate and redistribute it on those terms, including for commercial purposes, provided you give appropriate credit. Read the licence.
Clause 7.3. The platform source code is licensed under the AGPL-3.0. Your rights in the source code are those the AGPL-3.0 grants you, and nothing in this Agreement limits them.
Clause 7.4. The name "Hackiwi", the Hackiwi wordmark and logo are our trade marks. The open-source licences above do not grant trade mark rights, and you may not use our marks in a way that suggests endorsement or affiliation without our written permission.
Clause 7.5. Feedback. If you send us suggestions or feedback about the Service, we may use them without restriction or obligation to you. Do not send us anything you consider confidential.

Fees

Clause 8.1. Free tier. The training library is free for everyone. The premium tooling is free for individuals, families and organisations below 20 seats. No payment is required and feature availability is limited to the free tier's entitlements.
Clause 8.2. Paid plans. Fees, billing frequency, currency and seat counts are those agreed at the point of subscription. Unless agreed otherwise, fees are stated exclusive of VAT and other applicable taxes, which you are responsible for paying.
Clause 8.3. Invoices are payable within 30 days of the invoice date unless the order form says otherwise. We may charge statutory interest on overdue amounts under Dutch law.
Clause 8.4. We will give at least 30 days' notice of any change to pricing. A price change takes effect at the start of your next renewal term. If you do not accept it, you may decline to renew.
Clause 8.5. If your seat count rises above the threshold for your plan during a term, we will contact you to agree the appropriate plan rather than interrupting the Service.
Clause 8.6. Except where required by law, fees already paid are non-refundable.

Warranties and disclaimers

Clause 9.1. Each party warrants that it has the legal power and authority to enter into this Agreement.
Clause 9.2. You warrant that you have obtained all rights, consents and authorisations necessary for us to process Customer Data as contemplated by this Agreement, and that your use of the Service - including any simulation you run - complies with applicable law.
Clause 9.3. To the fullest extent permitted by law, and except as expressly stated in this Agreement, we disclaim all warranties, whether express, implied or statutory, including any implied warranty of merchantability, fitness for a particular purpose, non-infringement, or that the Service will be uninterrupted, error-free or secure against every attack.
Clause 9.4. Findings produced by exposure, OSINT, dependency and website scanning features are informational and derived from third-party and public sources. We do not warrant that they are complete or accurate, and they are not a substitute for your own security assessment.
Clause 9.5. Nothing in this Agreement excludes or limits either party's obligations under applicable mandatory law.

Suspension and termination

Clause 10.1. By you. You may cancel your subscription at any time. Cancellation takes effect at the end of the then-current billing period unless agreed otherwise.
Clause 10.2. For breach. Either party may terminate this Agreement if the other commits a material breach and fails to remedy it within 30 days of written notice. A breach of the Acceptable Use Policy is a material breach.
Clause 10.3. Immediate suspension. We may suspend the Service or a specific feature, in whole or in part and without prior notice, where we reasonably believe that continued operation would breach the law, expose Users or third parties to harm, or where clauses 4.2 to 4.4 are being breached. We will tell you what happened and what is required to restore service as soon as we reasonably can.
Clause 10.4. Effect of termination. Access ends on termination. You should export any Customer Data you need before that date; export remains available up to it.
Clause 10.5. Data after termination. Customer Data is retained for 30 days after termination and is then permanently deleted, with copies ageing out of encrypted backups within a further 30 days. Retention of audit records is described in section 8 of the Privacy Policy. On written request made within that 30-day window we will delete it sooner.
Clause 10.6. Sections 6, 7, 9, 11, 12, 13 and 16 survive termination, together with any provision that by its nature is intended to survive.

Limitation of liability

Clause 11.1. To the fullest extent permitted by law, neither party is liable for any indirect, incidental, special or consequential damages, nor for loss of profits, revenue, goodwill, business opportunity, or loss or corruption of data, however caused and under any theory of liability, even if advised of the possibility.
Clause 11.2. Each party's total aggregate liability arising out of or in connection with this Agreement is limited to the fees paid by the Customer in the twelve (12) months preceding the event giving rise to the claim.
Clause 11.3. Where the Customer is on a free plan and has paid no fees, our total aggregate liability is limited to one hundred euros (EUR 100).
Clause 11.4. These limits do not apply to liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for wilful misconduct or gross negligence ("opzet of bewuste roekeloosheid").
Clause 11.5. Each party must take reasonable steps to mitigate its losses.

Indemnity

Clause 12.1. You will indemnify and hold us harmless against third-party claims, and reasonable legal costs, arising from: (a) your breach of the Acceptable Use Policy; (b) a phishing simulation you sent to a recipient outside your organisation, or from a domain you did not own; (c) your breach of applicable employment or data protection law in relation to your Users; or (d) Customer Data infringing a third party's rights.
Clause 12.2. We will notify you promptly of any claim to which this section applies, allow you to control the defence and settlement of it (provided no settlement imposes an obligation on us without our consent), and give you reasonable cooperation at your expense.

Confidentiality

Clause 13.1. Each party may receive non-public information from the other that is marked confidential or that a reasonable person would understand to be confidential ("Confidential Information"). Customer Data is the Customer's Confidential Information.
Clause 13.2. The receiving party will use Confidential Information only to perform this Agreement, will protect it with at least reasonable care, and will disclose it only to personnel and advisers who need it and who are bound by confidentiality obligations.
Clause 13.3. These obligations do not apply to information that is or becomes public through no fault of the receiving party, was lawfully known to it without restriction, or is independently developed. Disclosure required by law is permitted, provided the other party is notified where lawful.

Force majeure

Neither party is liable for a failure or delay in performance, other than a payment obligation, caused by an event beyond its reasonable control, including infrastructure or network failure at a sub-processor, denial-of-service attack, act of government, or natural disaster. The affected party will notify the other and use reasonable efforts to resume performance. If such an event continues for more than 30 consecutive days, either party may terminate the affected subscription on written notice.

General

Clause 15.1. Assignment. Neither party may assign this Agreement without the other's written consent, except that either may assign it in its entirety to a successor in connection with a merger, acquisition or sale of substantially all its assets, on notice.
Clause 15.2. Subcontracting. We may engage sub-processors as described in the Data Processing Agreement and remain responsible for their performance.
Clause 15.3. Notices. Notices to us go to [email protected]. Notices to you go to the administrative contact on your account and, where relevant, to a notice in the Service. It is your responsibility to keep that contact current.
Clause 15.4. Severability. If any provision is held invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remainder of the Agreement stays in force.
Clause 15.5. No waiver. A failure to enforce a provision is not a waiver of the right to enforce it later.
Clause 15.6. Independent parties. The parties are independent contractors. Nothing here creates a partnership, agency or employment relationship.
Clause 15.7. Entire agreement. This Agreement is the entire agreement between the parties on its subject matter and supersedes all prior discussions. Any purchase order terms you issue are of no effect.
Clause 15.8. Publicity. We will not use your name or logo as a reference customer without your prior written consent.

Governing law and jurisdiction

Clause 16.1. This Agreement, and any non-contractual obligation arising out of or in connection with it, is governed by the laws of the Netherlands, excluding its conflict of law rules and the United Nations Convention on Contracts for the International Sale of Goods.
Clause 16.2. The courts of Amsterdam, the Netherlands, have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement.
Clause 16.3. Nothing in this section deprives a consumer of the protection of mandatory provisions of the law of their country of habitual residence, nor of the right to bring proceedings before the courts of that country where applicable law so provides.

Changes to these Terms

Clause 17.1. We may amend these Terms. The date at the top of this page shows when they were last revised.
Clause 17.2. We will give at least 30 days' notice of any material change, by email to the administrative contact on the account and by notice in the Service.
Clause 17.3. Continuing to use the Service after a change takes effect constitutes acceptance of the amended Terms. If you do not accept a material change, you may terminate under section 10.1 before it takes effect.

Contact

Hackiwi B.V.

Hackiwi B.V. is established in the Netherlands. The contracting entity's registration details are:

Legal entity
Hackiwi B.V.

This document was prepared in good faith. Hackiwi recommends that customers seek independent legal advice regarding their own compliance obligations.