Platform Terms of Use for the Alpha Strike Platform

Version 2.0 · Effective: May 2026

Language

This English version is provided as a convenience translation of the German original "Terms of Service - Plattform-Nutzungsbedingungen für die Alpha Strike Platform, Version 2.0". In the event of any discrepancy between the German and the English version, the German version shall prevail.

Scope of these Terms

These Terms of Service ("ToS") govern the use of the Alpha Strike Platform on the account level only — that is, the creation, administration, and use of an individual platform account. The commercial relationship between Alpha Strike Labs GmbH and a customer regarding subscription, fees, service levels, and data delivery is governed by the General Terms and Conditions for the Alpha Strike Platform v1.0 ("GTC"), individual master agreements, whitelabel agreements, or comparable contractual instruments. These ToS do not replace such agreements but supplement them on the account level.

Preamble

Alpha Strike Labs GmbH ("Provider" or "Alpha Strike") operates the Alpha Strike Platform ("Platform"), a cloud-based SaaS solution for the analysis and visualization of an organization's externally visible cyber attack surface. Access to the Platform requires account registration and activation by Alpha Strike.

These ToS apply to any person who creates or uses a Platform account — regardless of whether the underlying commercial relationship arises from a Trial Access, a paid master agreement, a whitelabel agreement, or an invitation by an existing customer.

§ 1 Scope and Conclusion of Agreement

These ToS apply to the use of every Platform account created on alphastrike.io or on a subdomain operated by Alpha Strike. They become part of the agreement between Alpha Strike and the natural person using the account ("User") upon acceptance in the registration form and subsequent activation of the account by Alpha Strike. Where the User creates the account on behalf of an enterprise, these ToS shall apply concurrently vis-à-vis the named enterprise.
The Platform and any account are made available exclusively to entrepreneurs within the meaning of section 14 of the German Civil Code ("BGB"), legal persons under public law, and special funds under public law, and to their employees. Use for private purposes is excluded.
General terms and conditions or purchasing terms of the User or the User's enterprise shall not become part of these ToS, even if Alpha Strike does not expressly object thereto.

§ 2 Relationship to Existing Agreements

These ToS govern the account level only. The commercial relationship between Alpha Strike and the User's enterprise concerning the provision of the Platform — including scope of services, remuneration, service levels, data protection roles, data delivery, warranty, and limitation of liability with respect to the service provision and conversion — is governed by the applicable master agreement framework, in particular the GTC v1.0 with its annexes, a whitelabel agreement, a sales partner side letter, an individual agreement, or, in the case of a Trial Access, by § 5 of these ToS.
Where a master agreement framework within the meaning of paragraph (1) exists between Alpha Strike and the User's enterprise, such framework shall prevail over these ToS in case of any conflicts concerning the service relationship. These ToS shall apply on a supplementary basis for the account level and for any matters not regulated by such master agreement framework.
Where no such master agreement framework exists, these ToS shall apply together with the trial-specific provisions set forth in § 5 below, and the GTC v1.0 shall apply on a supplementary basis.

§ 3 Account Registration and Activation

Account creation is effected by truthful completion of the requested mandatory fields. The User represents and warrants that the User is authorized to act in the name and on behalf of the enterprise named in the registration form.
Activation of an account is effected exclusively after internal review by Alpha Strike. Such review covers in particular the identity of the User and the User's enterprise, the legitimate interest, the plausibility of the stated use case, and the existence of any pre-existing contractual relationship. Alpha Strike may request additional evidence and may make activation conditional upon the provision thereof.
The User is obliged to disclose, at the time of registration, any pre-existing contractual relationship between Alpha Strike and the User's own enterprise or any affiliated enterprise, to the extent known to the User or which should be reasonably known after internal inquiry.
Alpha Strike decides, in its sole discretion, on activation and on the scope and conditions thereof. There is no entitlement to activation, to a particular scope of functionality, to a particular processing time, or to reasons for any refusal. Alpha Strike may revoke, restrict, or condition any activation that has already been effected at any time.

§ 4 Account, Credentials, and Multi-User Administration

An account is personal and non-transferable. The disclosure of credentials to third parties is prohibited. Multiple logins under a single account by different individuals are not permitted; additional users require their own accounts that have been individually activated.
The User is obliged to keep the credentials confidential, to use a sufficiently strong password, and to enable the security features offered by the Platform (in particular Multi-Factor Authentication) where required by Alpha Strike. The User shall notify Alpha Strike without undue delay of any suspected compromise of the credentials.
Actions performed via the User's account shall be deemed actions of the User or, as applicable, of the enterprise behind the account, unless the User proves that Alpha Strike is responsible for the misuse.
Alpha Strike may, in its sole discretion and without prior notice, adjust at any time the functional scope, performance limits, rate limits, and other technical parameters of an account, in particular to secure the Platform, to prevent misuse, or to manage load.
Where the User's enterprise has a master agreement that provides for multi-user administration, additional accounts may be created and authorized by the administrator designated by the enterprise. Activation of each individual account by Alpha Strike pursuant to § 3 (2) remains required. Alpha Strike may suspend or terminate individual accounts independently of the continued effectiveness of the master agreement vis-à-vis the enterprise.

§ 5 Trial Access

Where Alpha Strike grants a Trial Access to the User as part of the activation, the provisions of this § 5 shall apply on a supplementary basis. The Trial Access is granted free of charge and serves the sole purpose of internal evaluation of the Platform by the User's enterprise for its own security, risk, and compliance purposes.
The trial duration shall as a rule be up to thirty (30) calendar days from activation. Alpha Strike may, in its sole discretion, shorten or extend the trial duration at any time and may adjust or restrict the trial functionality during the term. Neither automatic extension nor automatic conversion to a paid agreement shall occur.
Upon the end of the trial duration, Alpha Strike may, in its sole discretion, either deactivate the account immediately or transfer it for a period of up to thirty (30) calendar days into a read-only mode. In read-only mode, only inspection of existing findings and their export are available; all other functions are excluded. After the end of the read-only period, Alpha Strike may delete the account including the associated data at any time, unless statutory retention obligations or applicable provisions of the master agreement framework require otherwise.
Conversion to a paid agreement is effected exclusively manually — by execution of an order form, acceptance of an individual offer, or incorporation into an existing master agreement of the User's enterprise. Upon the effective date of the conversion, the GTC v1.0 with its annexes or the applicable master agreement framework shall replace this § 5; the remaining provisions of these ToS shall continue to apply on the account level.
Since the Trial Access is granted free of charge, Alpha Strike's liability under the Trial Access shall be limited, in line with § 9 (8) GTC, to intent and gross negligence; any liability that exists as a matter of mandatory law shall in any event be capped at EUR 1,000.
The User shall have no entitlement to a minimum trial duration, a particular functionality, a conversion, the migration of trial data into a successor environment, or to maintenance of the read-only mode.

§ 6 Code of Conduct — Permitted and Prohibited Use

Purpose and self-conception of the Platform. The Alpha Strike Platform is a defensive cybersecurity tool. It supports enterprises in identifying their own digital attack surface, in assessing their suppliers and acquisition targets for cyber risk, and in responding to security incidents. The User commits to this self-conception and uses the Platform exclusively in this sense and in accordance with the rights of third parties.
Red lines. Without prejudice to the prohibitions set out in § 3 (3) GTC, the use of the Platform and of its content is excluded at all times for the following purposes:
- identification, monitoring, assessment, or profiling of natural persons outside a concrete cybersecurity context;
- employee monitoring, background screening in the labor- or criminal-law sense, credit assessment, and political, ideological, or religious profiling;
- preparation or execution of cyber attacks, or authentication using credentials made available through the Platform against systems in respect of which the User has no legitimate interest in investigation;
- development, expansion, or improvement of a competing service or competing data set;
- law enforcement without official authorization, and any other activities which under applicable law require regulatory approval, in the absence of such approval.
Security obligations of the User. The User shall implement at least the following minimum measures: (i) use of the Platform exclusively from devices managed by the enterprise or from devices with up-to-date security configuration; (ii) activation of the MFA function offered by the Platform; (iii) non-disclosure of credentials; (iv) secure storage of exported data in accordance with the User's own security policies.
Trial-specific restrictions. Under a Trial Access, the following additional restrictions apply: (i) no publication of feature descriptions, screenshots, or comparison results; (ii) no disclosure of trial results to third parties beyond the circle of persons necessary for the evaluation; (iii) no commercial use of trial results; (iv) no parallel or successive trial accesses by the same enterprise in order to circumvent the trial duration.
Cooperation in cases of suspicion. The User shall report indications of a violation of this § 6 — whether by itself, by other employees of its enterprise, or by third parties — without undue delay to support@alphastrike.io or datenschutz@alphastrike.io and shall cooperate within reasonable bounds in the investigation.
Consequences of violations. In the event of a violation of this § 6 or of § 3 (3) GTC, Alpha Strike shall be entitled, without prior warning, to temporarily suspend access to the Platform or to permanently block individual accounts, to terminate the Trial Access or the master agreement relationship for good cause, to assert claims for damages, and to notify competent authorities where required by law. Alpha Strike shall determine the severity of the measure at its reasonable discretion.

§ 7 Data Protection

The data protection roles, responsibilities, and duties in connection with the use of the Platform result from the Privacy Terms for the External Attack Surface Intelligence Platform ("Platform Privacy Terms") and from the Privacy Notice for Platform Users (Art. 13 GDPR), each in the version linked at the time of registration. Alpha Strike and the User's enterprise shall, unless expressly provided otherwise therein, each act as separate controllers within the meaning of the GDPR.
The Platform uses exclusively technically necessary cookies that are required for login, session management, and the operation of the web application. No tracking, analytics, marketing, or third-party cookies are used on the Platform.

§ 8 Availability and Support

On the account level, no specific availability, response time, or restoration time is owed. Specific service levels apply only where the User's enterprise has a master agreement framework that expressly includes a Service Level Agreement (SLA). The SLA v1.0 does not apply to the Trial Access.
Support is provided on a best-effort basis via the support function integrated in the Platform or by email to support@alphastrike.io and otherwise in accordance with the applicable master agreement framework.

§ 9 Suspension, Termination, and Account Deletion

Alpha Strike may at any time temporarily suspend, restrict, or permanently terminate the User's account, in particular in the event of violations of these ToS, of the applicable master agreement framework, or of applicable law, in case of suspected misuse, in case of false or incomplete information provided at registration, where the legitimate interest no longer exists, and for operational, security-related, or legal reasons. Alpha Strike shall determine the severity of the measure at its reasonable discretion; no prior consultation or warning is required.
The User may terminate the account at any time via the function provided in the Platform or by email to support@alphastrike.io. Termination of the account does not affect the master agreement framework between Alpha Strike and the User's enterprise.
Upon termination of the account, Alpha Strike may at any time delete or block the personal data associated with the User and any content processed in the account in accordance with the Platform Privacy Terms and the Privacy Notice, unless statutory retention obligations or contractual obligations under the applicable master agreement framework require otherwise. There is no obligation to retain data beyond the requirements set out in this provision.

§ 10 Liability and Indemnification

Alpha Strike's liability in connection with the account level shall be governed by § 9 GTC and the limitations of liability set out therein, applied accordingly. For unpaid account uses including the Trial Access, § 9 (8) GTC shall apply; any liability that exists as a matter of mandatory law shall be capped at EUR 1,000.
Liability concerning the service relationship — that is, for the analysis, data, and reporting services provided through the Platform — shall be governed exclusively by the applicable master agreement framework. These ToS do not establish independent liability of Alpha Strike for the accuracy, completeness, or timeliness of any content provided through the Platform.
Indemnification. The User shall indemnify Alpha Strike and its legal representatives, employees, officers, agents, and subcontractors against any third-party claims arising from a breach of these ToS — in particular of § 6 —, from the unlawful inclusion of analysis targets, from the unlawful use of Platform results, or from misuse of the User's account, including reasonable defense costs. § 4 (3) GTC shall apply accordingly.

§ 11 Amendments to these ToS

Alpha Strike may amend these ToS at any time, in particular to implement legal, security, technical, or product-related requirements and to reflect changes in the functionality of the Platform. Amended ToS shall be communicated to the User in text form or via the Platform with a notice period of seven (7) calendar days. For amendments required to address concrete security or legal risks, the notice period may be waived.
If the User does not object to the amended ToS within the notice period, they shall be deemed accepted. In the event of a timely objection, Alpha Strike may terminate the account effective on the effective date of the amendment; the applicable master agreement framework shall remain unaffected.

§ 12 Final Provisions

The relationship between Alpha Strike and the User shall be governed by the laws of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction for any disputes arising out of or in connection with these ToS shall be Berlin.
Should any provision of these ToS be or become invalid or unenforceable, the validity of the remaining provisions shall remain unaffected. The invalid or unenforceable provision shall be replaced by a valid and enforceable provision that comes closest to the economic purpose of the invalid provision.
Amendments and additions to these ToS shall be made in text form; § 11 shall remain unaffected.

Reset your password