These terms govern your use of the MakSisu website and the managed security awareness training services we provide. By booking a walkthrough or entering a service agreement with us, you agree to them.
DECISION NEEDED — Insert the registered legal entity name, company number and registered address.
The service
MakSisu provides managed security awareness training: we configure a training portal, select and schedule interactive exercises, run simulated phishing campaigns with your authorisation, chase completion, and deliver a quarterly report suitable for auditors and insurers.
We provide a service, not a software licence. You are not buying a platform, and access to any portal we operate on your behalf ends when the engagement ends.
Plans, fees and billing
- Launch is a one-time fee, payable in advance, covering setup for 10–50 staff.
- Managed and Compliance+ are billed monthly in advance and carry a three-month minimum term.
- All prices are in US dollars (USD) and exclude any applicable sales tax, VAT or GST, which is added where required.
- Fees may change with 60 days' written notice, effective from your next renewal.
Prices are quoted and charged in US dollars regardless of your location. Your bank or card issuer may apply its own conversion rate and fees, which are outside our control.
Term and cancellation
After the three-month minimum, monthly plans continue until either party gives 30 days' written notice. On termination we provide your final training records and evidence package within 30 days, then delete or return personal data per the privacy notice. Fees already paid for a completed period are not refundable.
Your responsibilities
- Nominate one contact with authority to approve campaigns and receive reports.
- Provide accurate staff details and keep them current.
- Authorise phishing simulations in writing before we run them, and confirm you have the authority to do so for the people involved.
- Allow our sending domains through your mail filtering where a simulation requires it.
- Comply with any works-council, union or local-law consultation obligations that apply to monitoring your staff. We will help you understand the mechanics; determining what your jurisdiction requires is your responsibility.
Acceptable use
You may not use our exercises, reports or materials to train people outside your organisation, resell our services, or reverse-engineer the training content. You may not use anything we provide to conduct real attacks against anyone.
Intellectual property
Reports, records and configurations we produce for you are yours to use for your compliance, audit and insurance purposes.
The interactive training exercises are provided courtesy of the RansomLeak open library (ransomleak.com) under CC BY-NC 4.0 with attribution. That content remains the property of its creators. MakSisu provides managed deployment, administration and reporting services around it. You receive no ownership of the exercise content and may not redistribute it.
DECISION NEEDED — The RansomLeak library is CC BY-NC 4.0 — non-commercial. Confirm you hold separate written permission for commercial use, and reference it here. If you do not, this needs resolving before launch.What we don't promise
Security awareness training reduces risk. It does not eliminate it. We do not warrant that your organisation will not suffer a breach, that staff will not fall for a real attack, that any insurer will grant or renew coverage, or that any auditor or regulator will accept our documentation. We provide records of training actually delivered; how a third party assesses those records is outside our control.
Compliance mappings we provide are informational and are not legal advice. You remain responsible for your own regulatory obligations.
Liability
To the extent permitted by law, our total liability arising out of the services is limited to the fees you paid us in the 12 months before the claim. Neither party is liable for indirect or consequential loss, including lost profits or lost data. Nothing here limits liability for death or personal injury caused by negligence, fraud, or anything else that cannot lawfully be limited.
Confidentiality
Each party keeps the other's confidential information confidential and uses it only to perform the agreement. Our obligations continue for three years after the engagement ends. We will not name you as a client publicly without your written permission.
Governing law
DECISION NEEDED — Insert governing law and jurisdiction, e.g. 'These terms are governed by the laws of the Province of Ontario and the federal laws of Canada, and both parties submit to the exclusive jurisdiction of its courts.' This must match where the entity is actually registered.Changes
We may update these terms; the date above shows when. Material changes affecting active clients are notified to your named contact at least 30 days before they take effect.