Terms of Service

These Terms of Service ("Terms") govern the use of the Traceira website at traceira.com (the "Site") and the ordering and delivery of Traceira structured weakness analysis services (the "Services"). Traceira is a service of Plto Oy, a company registered in Finland with its principal place of business in Helsinki ("Traceira", "we", "us", "our").

By using the Site or submitting an analysis request, you accept these Terms. If you accept on behalf of a company, you confirm that you are authorized to bind that company. Our Services are provided to businesses and organizations only, not to consumers.

If a separate written agreement is signed between Traceira and a client, that agreement prevails over these Terms to the extent of any conflict.

Traceira provides structured weakness analyses of security, operations, and strategy. Analyses combine automated methods supervised by our team with review, validation, and structuring by senior analysts. Deliverables typically include a written report categorized by severity and an expert led walkthrough of the findings.

The available analysis levels, their scope, and their focus are described on the Site. The exact scope, schedule, and price of each engagement are agreed in writing before work begins.

Submitting a request through the Site is an invitation to discuss an engagement. It does not create a contract, and it does not obligate either party. A binding contract for Services is formed only when both parties sign a written agreement or when we confirm an order in writing.

No active scanning or testing of any system begins before a formal contract is signed. Any preliminary scoping review is limited to the information you provide and publicly available information, and is carried out only with the consent you give in the request form.

Our work depends on clear and lawful authorization. As a client, you represent and warrant that:

You own the systems, domains, and assets included in the agreed scope, or you have obtained all permissions needed to authorize their analysis, including any consent required from hosting providers or other third parties.

The scope you authorize is accurate and complete, and you will inform us without delay of any changes that affect it.

You will provide the access, documentation, and cooperation reasonably needed for the engagement.

You will maintain adequate backups of your systems and data before any testing begins.

You will not ask us to analyze systems or data in violation of any law or of the rights of any third party. We may suspend or terminate work immediately if we reasonably believe the authorization is defective, and you will indemnify us against claims arising from analysis of assets you were not entitled to authorize.

We perform the Services with professional skill and care, strictly within the agreed scope and any agreed testing windows. We take reasonable precautions to avoid disruption, but you acknowledge that security testing carries an inherent risk of unexpected effects on systems, and that some level of operational impact cannot be fully excluded. If we detect an issue we reasonably consider an immediate and serious threat, we may notify you outside the agreed reporting schedule.

Reports and findings reflect the state of the analyzed systems and processes at the time of the analysis and the information available to us. A weakness analysis is a professional assessment, not a certification or guarantee. We do not warrant that every weakness, vulnerability, or risk will be identified, or that remediation of reported findings will prevent all incidents. Decisions on whether and how to act on findings remain yours.

Fees are set out in the engagement agreement or order confirmation. Unless agreed otherwise, prices exclude value added tax, invoices are payable within 14 days of the invoice date, and late payments accrue interest under the Finnish Interest Act. We may suspend work if undisputed invoices remain unpaid after a written reminder.

Each party will keep confidential all nonpublic information received from the other party in connection with an engagement, use it only for the purposes of the engagement, and protect it with at least the same care it applies to its own confidential information. Reports and findings are confidential to the client. These obligations survive the end of the engagement and do not apply to information that is or becomes public without breach, that was lawfully known before disclosure, or that must be disclosed under law or a binding order, in which case the disclosing party will be notified where legally permitted.

Personal data processed through the Site and in our own operations is handled as described in our Privacy Policy. Where we process personal data contained in client systems during an engagement, we act as a data processor under the client's instructions, and the parties will enter into a data processing agreement where required by applicable law.

You retain all rights to your systems, data, and materials. Upon full payment, you receive ownership of the report delivered to you and the right to use it for your internal business purposes. We retain all rights to our methods, tools, software, templates, and know how, including improvements developed during engagements, provided that they contain no confidential information of yours. The Site and its content are protected by intellectual property rights and may not be copied or reused without our permission.

To the maximum extent permitted by law, neither party is liable for indirect or consequential damages, including loss of profit, loss of business, or loss of data, and the total aggregate liability of Traceira arising out of or related to an engagement is limited to the fees paid for that engagement during the 12 months preceding the event giving rise to the claim.

These limitations do not apply to damage caused by willful misconduct or gross negligence, to breaches of confidentiality, or to liability that cannot be limited under mandatory law.

Engagements run for the period agreed in the engagement agreement. Either party may terminate an engagement for material breach if the breach is not cured within 14 days of written notice. We may suspend or restrict use of the Site at any time for security, maintenance, or legal reasons. Sections concerning confidentiality, intellectual property, liability, and governing law survive termination.

You agree to use the Site lawfully and not to interfere with its operation, attempt unauthorized access, or submit false or misleading information in the analysis request form. The Site is provided as is, without warranties of uninterrupted availability or freedom from errors.

We may update these Terms from time to time. The current version is always available on the Site, and the effective date above shows when the Terms were last revised. Changes do not apply retroactively to engagements already agreed in writing.

These Terms and all engagements are governed by the laws of Finland, excluding its conflict of law rules. The parties will first attempt to settle any dispute through good faith negotiations. If no settlement is reached, disputes will be resolved by the District Court of Helsinki as the court of first instance, unless the parties agree in writing to arbitration.

Plto Oy (Traceira)

Helsinki, Finland

Business ID: 3181608-8

Email: pak@traceira.com