Subscription Agreement
This document is a draft. It has not yet been reviewed by a Singapore-qualified lawyer, and it may change. We publish it in draft rather than leave you with nothing to read, because you should be able to see the terms before you commit to them, not after. If a term matters to your decision, email legal@sabikisecurity.com and we will answer it plainly. The version and date at the top of this page will change when it is finalised.
This is the contract that governs your use of AIRM. It applies when you create an account, whether you pay us or use a free assessment.
The Data Processing Addendum, the Acceptable Use Policy and the Service Level Agreement form part of this agreement. If any of them conflicts with this document, the DPA wins on data protection and this document wins on everything else.
1. Parties
This agreement is between SABIKI PTE. LTD. (UEN 202135394K), a company incorporated in Singapore and trading as Sabiki Security, whose registered office is at 36 Robinson Road, #20-01 City House, Singapore 068877 ("Sabiki", "we", "us"), and the organisation that creates an AIRM account ("you").
If you are creating an account on behalf of an organisation, you are confirming that you have authority to bind it.
2. What we provide
We provide AIRM as a service: a Non-Human Identity Control Plane that connects to a Microsoft 365 tenant using read-only Microsoft Graph permissions, discovers the non-human identities in it, scores them, and helps you govern them.
AIRM is read-only and it does not act on its own. It recommends. It never changes anything in your tenant. Every action is taken by a person, in your organisation, who clicks a button. We designed it that way and we are not going to change it quietly.
3. Your licence
For as long as you are paying and not in breach, we grant you a non-exclusive, non-transferable right to use AIRM for your own business, and for the tenants you are entitled to connect under the Acceptable Use Policy.
Partners. If you are on a partner tier, your agreement additionally permits you to use AIRM to deliver services to your clients, and to resell it on the terms of the partner programme.
4. Your responsibilities
- Connect only tenants you are entitled to. This is the important one. See section 1 of the Acceptable Use Policy.
- Keep your credentials secure, and tell us promptly if they are compromised.
- Be responsible for what your people do with the access you give them.
- Comply with the law, including data protection law, in how you use AIRM and what you do with its output.
5. Fees, and how they work
Pricing is per tenant, per month. Current prices are published at sabikisecurity.com/airm-pricing. Prices are exclusive of any tax we are required to charge.
The assessment is free. Running a Sabiki NHI Risk Score™ on a tenant costs nothing and requires no card. We mean that. Fees begin when you subscribe a tenant.
Invoicing. Annual subscriptions are invoiced in advance. Payment is due within 30 days.
Who takes your money. Payments are processed by Paddle, our merchant of record. That means Paddle, not Sabiki, is the seller of record for the transaction, and Paddle handles payment, invoicing and sales tax or VAT where it applies. Your card details are given to Paddle and never to us; we do not see them and we do not store them. Paddle is a controller in its own right for the billing data it collects, under its own terms and privacy policy. It is listed on our sub-processors page.
Price changes. We may change prices, but not during a term you have already paid for. We will give you at least 60 days' notice before a renewal at a new price, and you may decline by not renewing.
Late payment. If an invoice is more than 30 days overdue we may suspend the service after giving you 14 days' written notice and a chance to pay.
6. Term, renewal and termination
Term. Your subscription runs for the term you selected, and renews automatically for the same period unless either of us gives notice at least 30 days before the end of the current term.
Termination for convenience. You may stop renewing at any time. We do not refund fees already paid for a term in progress, but we will not stop you leaving and we will not make it hard.
Termination for breach. Either of us may terminate if the other is in material breach and does not fix it within 30 days of being told. We may suspend or terminate immediately for a breach of section 1 of the Acceptable Use Policy, or for anything that endangers other customers or the service.
What happens on termination. Your access ends. We delete your data as set out in the DPA. You may revoke AIRM's Entra consent yourself, at any time, and you do not need our permission or our cooperation to do it.
7. Intellectual property
Ours stays ours. AIRM, its code, its models, the Sabiki NHI Risk Score and its methodology, our marks and our documentation belong to us.
Yours stays yours. Your tenant data, and the reports generated from it, belong to you. We claim no ownership of them.
Aggregated insight. We may use anonymised, aggregated data derived from scans to improve the product and to build peer benchmarks. This is stripped of anything that identifies you, your tenant or your people, and we will never publish or share anything from which you could be identified. If you would rather we did not do this at all, tell us and we will exclude you.
Feedback. If you tell us how to make the product better, we may act on it, and we will not owe you anything for it.
8. Confidentiality
Each of us will keep the other's confidential information confidential, use it only for this agreement, and protect it at least as carefully as our own. This does not apply to information that is public through no fault of ours, or that we are compelled by law to disclose, in which case we will tell you first if we lawfully can.
9. Warranties
We warrant that we will provide AIRM with reasonable skill and care, in accordance with the SLA, and that it will perform materially as our documentation describes.
We do not warrant that AIRM will find every non-human identity in every configuration, or that it will be error-free. It is a discovery and scoring tool, not an oracle. It is one control among several, and it does not relieve you of responsibility for your own security.
Except as stated here, and to the extent the law allows, all other warranties are excluded.
10. Liability
Neither of us is liable to the other for indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated savings, or loss of business opportunity, however it arises.
Our total liability under this agreement, in any 12-month period, is limited to the fees you paid us in the 12 months before the claim arose.
Nothing in this agreement limits either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.
11. Indemnity
We will defend you against a third-party claim that AIRM infringes their intellectual property, and we will pay the damages finally awarded, provided you tell us promptly and let us run the defence.
You will defend us against a third-party claim arising from your breach of section 1 of the Acceptable Use Policy, which is to say: from you connecting a tenant you were not entitled to connect.
12. Changes to this agreement
We may update this agreement. We will give you at least 30 days' notice of a material change, and it will not take effect during a term you have already paid for. If you do not accept it, do not renew.
13. General
Assignment. Neither of us may assign this agreement without the other's consent, except that either may assign it to a successor in a merger or a sale of substantially all its business.
Publicity. We will not name you as a customer, or use your logo, without your written consent.
Entire agreement. This agreement, with the DPA, the AUP and the SLA, is the whole of what is agreed between us on this subject.
Governing law. Singapore law governs this agreement, and the courts of Singapore have exclusive jurisdiction.