SOC Platform Terms of Use

Last Updated: September 2026

1. Introduction and Scope

These SOC Platform Terms of Use ("Platform Terms") govern your access to and use of the DolutechAI software service platforms, including the SOC AI Agent autonomous security operations platform, SOC AI WebApps, the Dolutech SOC Model, XDR endpoint agents, SOAR automation, dashboards, APIs, and all related software services (collectively, the "Platform") provided by Dolutech OÜ ("DolutechAI", "we", "us", or "our"), a company registered in Estonia, European Union, with Registry Code 17414318.

These Platform Terms apply to the use of our software service platforms and are separate from the Website Terms of Use that govern browsing of the dolutech.ai website. By creating an account, deploying an agent, integrating an API, or otherwise accessing the Platform, you agree to be bound by these Platform Terms.

2. Definitions

• "Platform" means the DolutechAI software service platforms listed in Section 1, including all dashboards, APIs, agents, models, and documentation.
• "Customer" or "you" means the individual or organization that registers for or uses the Platform.
• "Customer Data" means the data, content, and configurations that you or your users submit to or store in the Platform.
• "Security Telemetry Data" means cybersecurity data generated by the security requests processed by the Platform, including detection events, alerts, indicators of compromise (IOCs), security request and response metadata, signatures, model verdicts, and confidence scores. Security Telemetry Data does not include Personal Data, special-category (sensitive) data, or your business data or content.
• "Personal Data" has the meaning given in the General Data Protection Regulation (EU) 2016/679 ("GDPR").

3. The Service

The Platform provides autonomous, AI-assisted cybersecurity operations, including 24/7 monitoring, detection, investigation, and response (MDR), web application protection (WAF), endpoint telemetry (XDR), and security orchestration and automated response (SOAR), with optional human-in-the-loop analyst validation.

We may update, improve, or modify features of the Platform as part of our continuous improvement program, provided that such changes do not materially reduce the security or functionality of the service you purchased.

4. Accounts, Eligibility, and Security

4.1 Eligibility

To use the Platform you must be at least 18 years old, have the legal capacity to enter into a binding contract, and — when acting on behalf of an organization — have the authority to bind that organization to these Platform Terms.

4.2 Account Security

You agree to:

• Provide accurate, current, and complete registration information and keep it up to date
• Maintain the confidentiality of your credentials, API tokens, and agent enrollment keys
• Enable two-factor authentication where offered and promptly notify us of any unauthorized use of your account
• Accept responsibility for all activities that occur under your account

5. Data Hosting and GDPR Compliance

All hosting, storage, and processing of data within the Platform is performed in compliance with the GDPR. In particular:

• For Customer Data, you act as the data controller and DolutechAI acts as the data processor, processing data only on your documented instructions and under appropriate technical and organizational measures.
• For account, billing, and contact data, DolutechAI acts as the data controller and processes Personal Data in accordance with our Privacy Policy.
• Data is hosted on infrastructure subject to European data protection standards. Where international transfers occur, they are protected by appropriate safeguards such as Standard Contractual Clauses.
• A Data Processing Agreement (DPA) is available for customers who require one.

6. Your Rights under the GDPR

Every user of the Platform holds all rights granted by the GDPR. You may exercise them free of charge and at any time:

• Right of access — obtain confirmation and a copy of your Personal Data.
• Right to rectification — correct inaccurate or incomplete Personal Data.
• Right to erasure ("right to be forgotten") — request the deletion of your Personal Data.
• Right to restriction of processing — limit how we process your Personal Data.
• Right to data portability — receive your Personal Data in a structured, commonly used, and machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — withdraw any consent you have given, at any time, without affecting the lawfulness of prior processing.
• Rights related to automated decision-making — not be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you.
• Right to lodge a complaint — with your local supervisory authority or the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

6.1 Right to Revoke and Close Your Account

You may revoke your authorization and close your account or terminate the service at any time, for any reason, directly from your account settings or by contacting us. Closure takes effect without penalty. After closure, your Personal Data is deleted or anonymized within a reasonable period, except where retention is required by law or necessary for the establishment, exercise, or defense of legal claims.

7. Security Telemetry Data and AI Model Training

To operate, improve, and train the Platform, Security Telemetry Data generated by security requests is flagged for use in training and the continuous improvement of the Platform and our large language models (LLMs), including the Dolutech SOC Model.

• This covers only the cybersecurity data described in Section 2 — not Personal Data, not sensitive (special-category) data, and not your business data or content.
• Security Telemetry Data is processed for training in aggregated and anonymized form wherever possible and is never sold or used for advertising.
• You can disable the use of your Security Telemetry Data for AI training and model improvement at any time in your account Settings. Disabling does not affect the operation of the security services you receive.

8. Security Assurance and Compliance

The Platform is operated under a compliance-first security program:

• GDPR — the Platform complies in full with the General Data Protection Regulation.
• ISO/IEC 27001 — our information security management system (ISMS) is fully compliant with ISO/IEC 27001.
• Regular penetration testing — the Platform undergoes regular independent penetration tests (pentests).
• Security audits — our platforms undergo periodic security audits covering infrastructure, application, and process controls.
• Continuous improvement — security findings feed a continuous improvement program within our compliance framework.

9. Acceptable Use

You agree not to:

• Use the Platform to violate laws or third-party rights, or to attack systems you are not authorized to test
• Probe, scan, or exploit the Platform itself, except under an authorized security assessment agreement
• Interfere with the Platform's operation or attempt to extract model weights, training data, or other customers' data
• Resell or provide the service to third parties except as permitted by your subscription or a written agreement

10. Service Availability and Changes

We aim for continuous 24/7 availability of the Platform's security services. Scheduled maintenance is announced in advance where practicable. We may suspend the service immediately where necessary to protect the Platform or other customers (for example, an active attack or abuse).

11. Term, Termination, and Data Deletion

These Platform Terms apply for as long as you use the Platform. You may close your account at any time as described in Section 6.1. We may suspend or terminate access for material breach of these Platform Terms, unlawful use, or non-payment, with notice where reasonably practicable.

After termination, we make Customer Data available for export for a limited period where technically feasible, after which it is deleted in accordance with our data retention practices and the GDPR.

12. Warranties and Limitation of Liability

The Platform is provided with the security assurances described in Section 8, but no security product can guarantee the prevention of all incidents. To the maximum extent permitted by law, our aggregate liability is limited to the amounts you paid for the service in the twelve (12) months preceding the event giving rise to the claim, and we are not liable for indirect or consequential damages.

13. Changes to These Terms

We may update these Platform Terms from time to time. For material changes we provide at least 30 days' notice through the Platform or by email. Continued use of the Platform after the effective date constitutes acceptance of the updated Platform Terms.

14. Governing Law and Jurisdiction

These Platform Terms are governed by the laws of the Republic of Estonia and applicable European Union law, without regard to conflict of law rules. Disputes are subject to the exclusive jurisdiction of the courts of Tallinn, Estonia, unless mandatory consumer protection law provides otherwise.

15. Contact Information

For questions about these Platform Terms, or to exercise any of your GDPR rights, please contact us: