Terms of Service

ThreatLoops is a security awareness and intelligence service. It collects publicly available advisories, vulnerability data, end-of-support dates and vendor status information, summarises it, and matches it against the technology stack you tell us you run.

ThreatLoops is advisory. It is not a monitoring agent, a scanner, a managed detection service, or an incident response provider. It does not connect to your network, watch your endpoints, or detect attacks against you. Decisions about patching, configuration and response remain yours.

You need a valid email address to sign in. You are responsible for keeping access to that mailbox secure, for everything done under your account, and for the accuracy of the stack and preferences you enter.

You must be at least 18 and able to enter a contract. If you sign up for an organisation, you confirm you are authorised to accept these terms for it.

Every new account starts with a 30-day trial with full access to its plan features. No card is required to start.

When the trial ends, access to the application stops until you choose a plan. There is no free tier. Current plans are Solo at $19/month or $190/year, Team at $49/month or $490/year, MSP at $149/month or $1490/year. Annual billing is charged up front and is priced at ten months.

Seat and client-workspace allowances are shown on the pricing page and enforced in the product. Exceeding an allowance requires an upgrade.

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.

Paddle handles the transaction, applicable sales tax or VAT, invoicing and your receipts. We never see or store your card details. Your purchase is also subject to Paddle's Buyer Terms at https://www.paddle.com/legal/checkout-buyer-terms, which govern payment, billing, tax, cancellation and refund mechanics.

Subscriptions renew automatically at the end of each period until cancelled. You can cancel at any time from Settings; access continues to the end of the period you have already paid for.

We offer a 30-day money-back guarantee on new subscription purchases and renewals — see our Refund Policy at /refunds for how to request one. Refunds are processed by Paddle; you can request one at paddle.net or by emailing support@threatloops.com. If a payment fails, Paddle retries for several days before the subscription lapses.

We may change prices with at least 30 days' notice by email. Changes never apply to a period you have already paid for.

Card checkout is temporarily paused while we complete payment setup. During this period you can create an account and use the full trial, and no payment is taken. When checkout opens, the terms in this section apply to every purchase.

You agree not to:

• resell, sublicense or white-label the service beyond the client reporting features included in your plan
• scrape, bulk-export or redistribute the aggregated intelligence as a competing dataset or feed
• share one seat between multiple people, or use client workspaces to serve organisations not covered by your plan
• attempt to access other accounts, probe the service for vulnerabilities without contacting us first, or interfere with its operation
• use the service to plan or support unlawful activity

We may suspend an account that materially breaches this section, normally after warning you by email.

Much of what ThreatLoops shows originates with third parties: government advisories, vendor status pages, security publications, podcasts and video channels. We do not control that content, we may summarise it, and we link to the original so you can verify it. Their terms apply to their material.

If you own rights in material shown in ThreatLoops and believe it is used improperly, email support@threatloops.com with "Rights notice" in the subject line, including: identification of the work, the URL in ThreatLoops where it appears, your contact details, a statement that you believe the use is unauthorised, and a statement made in good faith that the information is accurate. We remove or amend material that should not be there, and we terminate the accounts of repeat infringers.

Some explanations, severity framing and recommended next steps are produced by AI models from the underlying public data. They can be incomplete or wrong. Every item links to its source, and you should verify anything you act on.

We work to keep ThreatLoops available and its data current, but we do not offer an uptime guarantee at these price points. Upstream sources go down, rate-limit us, or change format; when that happens the affected data may be stale or absent, and the health page in the app shows what is current.

You keep ownership of what you enter: your stack, client names, preferences and saved items. You grant us permission to process it to run the service. The Privacy Policy explains what we hold and for how long.

The aggregated catalogue, matching logic, scoring, summaries and interface remain ours.

The service is provided "as is" and "as available", without warranties of any kind to the fullest extent the law allows. We do not warrant that the intelligence is complete, accurate, or that acting on it will prevent a security incident.

To the maximum extent permitted by law, neither party is liable for indirect, incidental or consequential losses, including lost profits or the cost of responding to a security incident. Our total liability for any claim is limited to the fees you paid in the twelve months before the claim arose.

You can close your account at any time. We may terminate for material breach, non-payment, or if we discontinue the service — in the last case we will give notice and refund any unused prepaid period.

On termination we delete your account data within 30 days, except records we must keep for tax or legal reasons.

We may update these terms. Material changes are announced by email or in-app at least 30 days before they take effect. Continuing to use the service after that means you accept the new terms.

Neither party is liable for failing to perform where the cause is beyond its reasonable control — including upstream source outages, hosting or network failures, denial-of-service attacks, changes in law, or acts of government. We will keep you informed and resume as soon as we reasonably can; if such an event lasts more than 30 days, either party may terminate and we will refund any unused prepaid period.

These terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-law rules.

Questions about these terms: support@threatloops.com. Our legal entity and postal address are published at /contact.