Terms of Service

These Terms are entered into between SecureByte Consulting (Pty) Ltd, a private company incorporated under the laws of the Republic of South Africa (“SecureByte”, “we”, “us”) and the legal entity that has registered for the Service (“Customer”, “you”). By creating an account or using the Service you agree to be bound by these Terms.

If you are accepting these Terms on behalf of an organisation, you represent that you have authority to bind that organisation. Where you do not, you accept these Terms in your personal capacity.

The SecureByte service (“Service”) is a compliance and GRC automation platform that connects (with your authorisation) to your cloud accounts and tools, runs configured controls, collects and evaluates evidence, manages risk, vendor, and privacy programmes, and produces audit-ready reporting and a Trust Center. It includes a POPIA/GDPR privacy module (data-subject requests, consent, breach management, ROPA, DPIA, and data-flow mapping) and a tamper-evident audit trail.

The specific features available to you depend on your subscription tier — currently Free, Starter, Foundation, Scale, Enterprise, and Enterprise+ (Regulated & MSP). We may update, add, or retire features over time; we will not materially reduce the core functionality of a paid tier during a paid period without notice.

We will use reasonable efforts to keep the Service available with the uptime target appropriate to your tier. Service-level commitments at Enterprise and Enterprise+ (which include enhanced support response targets) are recorded in the Master Services Agreement applicable to those tiers.

You are responsible for all activity that occurs under your account, for keeping your credentials secure, and for promptly notifying us of any suspected unauthorised access. You will configure access controls (single sign-on, role assignments, two-factor authentication, IP allowlisting) appropriate to your organisation’s policies. Each individual accessing the Service must use their own account.

Access to administrative actions (billing, member management, cloud connection configuration) is restricted to users you designate. SecureByte staff do not access your tenant’s Customer Data except as necessary to provide support, and only with your prior consent unless we are responding to a security incident affecting your tenant. All such access is recorded in the audit trail.

Subscription fees are payable monthly or annually in advance, depending on the billing cycle you select. All prices on our website are quoted in South African Rand (ZAR) and are inclusive of 15% VAT unless explicitly stated otherwise. The price shown is the total amount charged — no VAT is added at checkout — and a compliant tax invoice breaking out the VAT portion is issued to South African customers in line with the Value-Added Tax Act, No. 89 of 1991. Annual self-service plans are offered at a discount to the equivalent monthly price.

Self-service payments are processed by PayFast, a South African payment gateway, via a secure hosted checkout. SecureByte does not receive or store payment card data; we retain only an encrypted recurring-billing token and a PayFast reference for your subscription. Enterprise and Enterprise+ tiers are billed annually under a Master Services Agreement (Contact Sales) rather than through self-service checkout.

Monthly plans are non-refundable for partial periods. Annual plans may be cancelled at any time; access continues until the end of the paid period and pro-rata refunds are not issued except where required by South African consumer law. Downgrades within a paid period are credited against your next invoice. When you cancel, you can export your data (see “Your data” below).

We may offer a free trial (currently 30 days) on self-service tiers so you can evaluate the Service. Trials are provided “as is”; unless you start a paid subscription before the trial ends, access to paid features will be suspended.

From time to time we offer a founder or design-partner programme with discounted, price-locked subscriptions in exchange for feedback and reference rights. Where you redeem such an offer, the specific pricing, lock period, and any reference commitments are those stated in the offer at the time of redemption and form part of these Terms.

You may not use the Service in any way that violates applicable law, infringes the rights of others, or interferes with the Service’s operation. The full list of prohibited uses is published in our Acceptable Use Policy and is binding under these Terms.

You retain all rights, title, and interest in the data you submit to the Service (“Customer Data”). You grant SecureByte a limited licence to host, process, and display Customer Data only as necessary to provide the Service to you.

Where Customer Data includes personal information as defined by the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”), SecureByte acts as an operator processing such personal information on your behalf, under the terms of our Data Processing Agreement.

Customer Data is hosted in AWS Cape Town (af-south-1) by default. Alternative residency (EU or US) is available at Enterprise and Enterprise+ on request and recorded in the Master Services Agreement. On termination you may export your Customer Data using the built-in export tools for a limited window, after which it is deleted in accordance with the DPA (subject to any legal hold).

The Service can connect to third-party systems you choose to integrate — for example your cloud accounts (AWS, Azure, GCP), identity provider, code repositories, collaboration and ticketing tools, security tooling, and HR systems. You are responsible for having the authority to connect those systems, for the credentials and scopes you grant, and for complying with the third party’s own terms. Cloud-posture connections are requested on a read-only basis.

SecureByte is not responsible for third-party services, their availability, or their acts and omissions. Your use of a third-party integration is governed by your agreement with that provider.

Certain features can use artificial intelligence to draft narratives, suggest evidence, or recommend remediation. AI features are optional and operate only on the content you submit to them. AI output is advisory and may contain errors; you remain responsible for reviewing and validating it before relying on it, and you must not present AI-generated content as audited fact without verification.

When AI features are enabled, content is processed by the AI sub-processors listed on our sub-processors page. Enterprise customers may route AI processing through their own provider key (BYOK). We do not use your Customer Data to train third-party foundation models.

The Service, including all software, documentation, and any content we provide, is and remains the property of SecureByte and its licensors. You receive a non-exclusive, non-transferable, revocable licence to use the Service in accordance with these Terms for the duration of your subscription.

You may not copy, modify, reverse-engineer, or create derivative works of the Service except to the extent expressly permitted by applicable law.

Each party will treat as confidential any information disclosed by the other that is marked as confidential or that would reasonably be regarded as confidential given its nature. Confidential information may be disclosed only to personnel and contractors who need to know it for the purposes of performing under these Terms and who are bound by similar confidentiality obligations.

We warrant that the Service will perform substantially as documented in our public materials. We do not warrant that the Service will be uninterrupted, error-free, or that it will satisfy a specific regulatory outcome for your organisation; compliance is a programme that depends on your operational practices.

Except as expressly set out in these Terms, the Service is provided “as is” and we disclaim all other warranties to the maximum extent permitted by law. Nothing in these Terms limits any right you have under the Consumer Protection Act or other South African law that cannot lawfully be excluded.

To the maximum extent permitted by law, neither party will be liable to the other for indirect, special, consequential, or punitive damages, or for loss of profits, revenue, or data, arising out of these Terms or the Service.

Our total aggregate liability under these Terms in any twelve-month period will not exceed the fees paid by you to SecureByte during that period. The Enterprise and Enterprise+ Master Services Agreements may set a different liability cap.

These Terms apply for as long as you have an active subscription. Either party may terminate at any time in writing — your subscription remains active until the end of the paid period at the time of termination.

We may suspend or terminate your access immediately, with notice, if you materially breach these Terms, fail to pay fees when due, or use the Service in a way that poses a security risk to other customers or to SecureByte. On termination you may export your Customer Data for a limited window, after which it is deleted in accordance with the Data Processing Agreement.

These Terms are governed by the laws of the Republic of South Africa. The parties submit to the exclusive jurisdiction of the High Court of South Africa, Gauteng Local Division, Johannesburg, for any dispute arising out of these Terms.

We may update these Terms from time to time. Material changes will be notified to you by email and surfaced on the dashboard at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance.

Questions about these Terms can be sent to legal@securebyte.co.za. The Information Officer for POPIA purposes is contactable at privacy@securebyte.co.za.