The Web sites’ access, navigation and use involve, on its behalf, the express acceptance and binding by you (User) of all terms of the present General Terms of Use (hereinafter the Terms of Use or the Terms).
Their observance and compliance will be needed for any person to gain access, navigate or use the Web sites and the Service. If you disagree with these Terms, do not access, navigate, or use these Web sites or Services.
Xygeni Security, S.L., a company registered in Calle Pasion 4 2 planta, 47001, Valladolid, Spain, is the author and owner of the Service and the Web sites.
To contact Xygeni directly and effectively, you can use the email address info@xygeni.io.
The present Terms regulate the access and use of the Software and Services offered by Xygeni through the Web sites and the Service and its use by its Users.
Xygeni reserves the right to modify the presentation, configuration and contents of the Service, as well as the required conditions for access and use. The access and use of the Service, after the coming in force of its modifications and changes in the Terms, assume the acceptance of those by the Users.
Notwithstanding the above, the access to particular contents and the use of particular parts of the Service can be subjected to particular conditions that, according to the cases, will substitute, complete and/or modify the current Terms. In the case of contradiction, the terms of the particular conditions over this General Terms of Use will prevail.
Before using and/or contracting these parts of the Service offered by Xygeni, you must carefully read the particular terms created in its case, to such effect by Xygeni. The use and/or the contract of these parts of the Service involve the acceptance of the particular terms that regulate, in the published version by Xygeni, at the moment that this use and/or contract is caused.
These Terms of Service refer to the following additional terms, which also apply to your use of the Services:
The services provided by Xygeni are intended solely for the purpose of assessing and analyzing the customer’s own software or third-party software used within it. The customer agrees to utilize the services exclusively for internal security analysis and improvement of their own Software Supply Chain.
The customer is expressly prohibited from using Xygeni’s services for the purpose of assessing, analyzing, or otherwise providing information on the security posture, vulnerabilities, or potential security flaws in the Software Supply Chain of any software to external parties not directly affiliated with the customer’s own software development or maintenance. It includes but is not limited to, providing security assessment services, vulnerability reports, or security consultancy to third parties using data obtained from Xygeni’s services.
In the event of a breach of this clause:
a. Service Termination: Xygeni reserves the right to immediately terminate the provision of services to the customer without prior notice.
b. Legal Action: Xygeni retains the right to take any legal actions deemed necessary to address the breach. This includes seeking remedies for any damages incurred and enforcement of compliance through legal proceedings.
c. Acknowledgment and Agreement
The customer acknowledges that this restriction is necessary to protect the proprietary and confidential nature of Xygeni’s services and methodologies. By using Xygeni’s services, the customer agrees to comply with the terms outlined in this clause.
For access and navigation through the Service’s functionalities, a previous registration is required through the selection by the User of identification, password and other identification details that will be saved in Xygeni’S Users Registration.
The password will be personal, non-transferable, and will be created by the User at the moment it is contracted and will have a temporary unlimited validity. The Service provides the needed functionality so that the User can change the password when is considered appropriate.
The User agrees to make diligent use of the password and to maintain it in secret, not to transmit it to any third party or Xygeni. Consequently, the User is responsible for the adequate custody and confidentiality of any identifiers and/or passwords that have been selected as a registered User of Xygeni and undertake not to hand over its use to others, either temporarily or permanently, and to not allow access to others. It will be the User’s exclusive responsibility if the Service is used illegally by a third party that uses a password caused by careless use or the loss by the User.
In virtue of the above, the User has an obligation to notify the administrator of the Service immediately about any fact that allows the inappropriate use of the identifiers and/or passwords, such as theft, loss or unauthorized access, to proceed to the immediate cancellation. Meanwhile, if such a fact is not disclosed, Xygeni will not assume and is exempted from any liability whatsoever that results from the inappropriate use of the identifiers or passwords used by unauthorized third parties.
5. Intellectual and industrial property rights
The Web sites and the Service are regulated by Spanish law.
In no case can be understood that the access and navigation of the User in the Web sites or the use, purchase and/or contracting of the offered Service through the Web site involves, either totally or partially, a resignation, waiver, transmission, license or assignment of rights by Xygeni. The User is granted exclusively a right to use privately, exclusively to enjoy the benefits of the Service according to these Terms.
The references to names and trademarks or registered brands, logos or other distinctive symbols, either being Xygeni’s ownership or third companies, have the ban over the use without Xygeni’s consent or its legitimate owner. In no case, unless expressly stated, the access or use of the Web sites and/or their contents and/or the Service confer rights to the User over the trademarks, logos and/or distinctive symbols in this, including the ones protected by law.
All rights are reserved to the intellectual and industrial property over the contents and/or the Service, and, in particular, it’s forbidden to modify, copy, reproduce, communicate publicly, transform or distribute in any way the total or part of the contents and/ or services included in the Web sites for public or commercial purposes without the prior express and written authorization by Xygeni or in the case, the titleholder of the corresponding rights.
Xygeni does not claim any intellectual property rights related to your software artefact, code, projects, or any materials you share with us through the Service.
However, to facilitate to the User the usage of our Services, it is necessary for the scanner to examine segments of the configurations and projects. They never are transmitted to our servers. Xygeni only transmits the result and findings regarding security. The information that we handle includes, but is not restricted to, data about the project, such as its name and metadata, data about the project’s dependencies, including open-source and closed-source tools readily accessible, how they are referenced within the project, and environmental data (“Inventory Information”). For these reasons, we require, and you grant us a global, non-exclusive, royalty-free license to store, utilize, reproduce, display, and transmit the Inventory Information and any other materials sent through the Service, to the extent required for your utilization of the Services, including monitoring services. This license will continue to be in effect until you or we decide to terminate these Terms of Service.
Beyond the rights you have accorded to us above, we also need you to grant us a license to store, use, reproduce, display, and transmit the Inventory Information and any other materials sent through the Service for analytical reasons (like understanding the project’s state at the time of its deletion) and for enhancing our Services. This license will remain active unless and until you send an email to support@xygeni.io specifically requesting us to remove such data from our database. For clarity, this license will not terminate upon the cessation of these Terms of Service or if you remove the associated project from the project page on our Platform.
The User agrees to use the Service in accordance with the law and the current Terms. The User forces itself to abstain from using the Service with unlawful effects or opposite from the established in this Terms of Use.
Using the Service, the User declares the approval of these Terms, agreeing not to transmit, issue, o put in the disposition of third parties any type of material that by any way violates the legislation currently in force.
Any free account used for the Xygeni Platform expressly waives any right to use the service for any commercial purpose.
We commit that the Services will function largely as outlined in the Documentation. However, this commitment does not cover any non-compliance resulting from your usage of the Services in violation of our instructions or these Terms of Service or any changes made to the Services or the software used to provide the Services by an unauthorized third party. You acknowledge and agree that we are not obligated to adjust the software to accommodate your usage of the Services.
We reserve the right to enforce quotas and usage limits (to any resources, including the API and scans) at our sole discretion, with or without notice, which may result in the disabling or throttling of the user’s account for any amount of time.
In particular, we have implemented rate-limiting measures to enhance system stability in the face of rising request volumes. This system is under continuous observation to guarantee it minimally affects users while maintaining system robustness. Each user is limited to a maximum of requests per minute according to the licensing and volume contracted, though this may be adjusted in the future. As a reference, the default rate limit is calculated by dividing the maximum API calls in the contract by 480. We advise that API calls should be moderated, irrespective of the existing limit. Requests exceeding the customer threshold will receive a 429 status code, indicating ‘Too many requests’ for the duration of the rate-limit interval.
In particular and by indicative and not exhaustive merely title, the User agrees not to capture details with advertising purposes, not to send any type of advertisement online, nor chain messages, and not transmit, not spread or give to third parties through the Service provided by the Web site, information, messages, graphics, sound or image files, photographs, recordings, software and generally any class of material, data or contents that without exhaustive encouragement:
Occasionally, we might add new services, features, or functions to our existing Services. These Terms of Service will govern these additions unless distinct or supplementary terms accompany them. In such a case, you must accept these separate or additional terms to gain access and utilize these new services, features, or functionality.
For those authorized Xygeni Partners that want to use Xygeni to provide services for their customers, it is allowed following these guidelines:
Intentionally misuse of these guidelines may result in an account deactivation.
For a correct display and navigation through the Web site, it requires: a) A monitor with a minimum resolution of at least 1440 x 900 pixels, and b) The use of some of the next navigators: Microsoft Edge, Firefox, Chrome or Safari in its latest version
Analyzing the software assets, pipelines and tools provided by the user, it is possible and normal that by different technical reasons, it cannot all be analyzed. Users also have to notice that metrics and indicators obtained by the Service can oscillate depending on the configuration of the policies applied, the version and configuration of the scanner and detectors, or other circumstances.
If the number of issues found when scanning customer software assets, pipelines and tools exceed an important amount (i.e. 10.000), that could impact the overall Service quality, that specific scan can be cancelled, notifying Users. These limits also apply to the exportation of data from the platform in any form: CSV, Sarif, or future formats.
The Services may encounter restrictions, delays, and other issues typically associated with using communication networks and facilities.
The Support and Maintenance Services provided by Xygeni include all those evolutive & corrective maintenance operations necessary for the appropriate execution of the Service.
In the case that the User detects any abnormality, problem, technical defaults, defects or failure concerning the functionality of the Service (Incidence), Xygeni commits disposure to the User of all necessary materials to proceed to the correction in the established periods in accordance to the incidence level.
The Support Service does not include the incidences or abnormalities resolution caused by incorrect use of the Service.
The procedure to report from the User to Xygeni and the service provision by this to the User will be provided through the Customer Support tool provided by the Service and by e-mail.
Technical support for attention and troubleshooting is provided Monday through Friday during working hours.
By correct maintenance reasons, the Service could be non-operative during the time necessary to update to a version that can resolve incidents. The unavailability time of the Service owing to maintenance processes will be conveniently notified to the Users with at least three hours advance notice, preferably through email. However, you understand that such notice may not be feasible in urgent situations. Maintenance windows will be excluded from the platform availability calculation. It will carry out during the timetable with less impact on the User operations.
In case the User sends any type of information to Xygeni through the Web sites or the Service using the channels established to that end at the Web sites or the Service, the User declares, guarantees and accepts that has the right to do it freely, that such information doesn’t infringe any intellectual property rights, brands, patents, commercial secrets or any other third party rights, such information doesn’t have confidential character and that such information isn’t harmful to third parties.
The User assumes the responsibility and will keep Xygeni harmless of any communication made personally or on his/her behalf. This responsibility includes, without limitation, the accuracy, legality, originality and title of such information.
Xygeni cannot guarantee the reliability, utility or veracity of the Service or the information given through the Web site.
In consequence, Xygeni is not responsible for (i) the continuity of the contents of the Service; (ii) the error absence in such contents or products; (iii) the absence of viruses and/or the rest of harmful components in the Service or the Server that supplies it; (iv) the invulnerability of the Service and/or the impregnability of the security measures that are adopted from the same; (v) the lack of utility or performance of the contents and products of the Service; (vi) the damages that are caused, to itself or to a third person, any person that infringes the conditions, rules or instructions that Xygeni establishes on the Service or through the violation of the security Systems of the Service.
This nevertheless, Xygeni declares that has adopted all the necessary precautions, in the possibilities and the technology state, to (i) ensure the proper functioning of the Service and (ii) avoid the existence and transmission of viruses and other harmful components to the users.
If the User knew of the existence of any illicit content that is illegal, opposite to the laws or that could suppose a violation of the intellectual and/or industrial property rights will have to notify immediately to Xygeni so they can proceed to adopt the necessary matters.
The User agrees to the following limitations on Xygeni:
Furthermore, given the nature of the Services, we are not responsible for any harm resulting from errors or omissions in any content or in any information, instructions, or scripts that you provide to us in relation to the Services or any action (or inaction) on our part at your direction.
Any warranties, conditions, representations, or other terms that are implied by statutory or common law concerning the Services, Documentation, Service Data, and the Platform we provide are wholly excluded, as far as the law allows.
The User agrees to protect, compensate, and absolve Xygeni of any responsibility against any claims, legal actions, proceedings, losses, damages, expenses, and costs (including but not limited to court costs and reasonable attorney fees) that arise from or are associated with your use of the Services, Documentation, or Platform in violation of these Terms of Use or any other agreements mentioned in them.
In the case of in the Web sites, the User could find links to other web pages through different buttons, links, banners, etc.; third parties would manage these. Xygeni doesn’t have faculty, human or technical resources to know, control, or approve all the information, contents, products or services given by other websites to those that can establish links from the Web site.
In consequence, Xygeni does not assume any type of responsibility by any aspect relative to the web page that could establish a link from the Web site, concretely, by way of example and not limitation over the functionality, access, details, information, files, quality and reliability on the products and services, their own links and/or any of their contents in general.
In this way, if the Users had effective knowledge of the illicit developed activities through these web pages of third parties, they would have to communicate immediately to Xygeni for the effects to proceed to disable the access link to the same.
Establishing any link from the Web sites to another unknown Web site will not involve any relation, collaboration or dependency between Xygeni and the responsible of the unknown Web site.
If any User, entity or website wishes to establish any type of link with destination to the Web sites will have to abide by the below stipulations:
Scans and WebUI usage tools report back details such as the tool version, other tools versions such as node or npm version, arguments and inputs to the Scanner and specifics about the actions’ duration, success or failure. We use this information for analysis and to enhance our Services. It provides Xygeni with insights into how the platform is utilised, guiding our product development choices.
Should you wish to opt out of this data collection, you may do so by contacting us.
You are at liberty to end these Terms of Use with us whenever you wish, for any reason. This can be done by requesting us to delete your account via an email to support@xygeni.io and discontinuing all usage of the Services, Documentation, and Service Data.
We reserve the right to terminate these Terms of Use with you instantly and without prior notice if you violate these Terms of Use in a significant or repeated manner, if the Services are discontinued, if we lose the privilege to provide you with the Services, or if the provision of the Services becomes illegal.
Upon termination:
We hold the right to modify these Terms of Use at any point, as per our judgement. Any such alterations will come into effect 10 days after the updated Terms are published on the Site. Your ongoing site usage following this period signifies your acceptance of these changes.
We strive to maintain the utmost accuracy. However, we cannot guarantee that the content presented on the Web site is accurate, complete, dependable, up-to-date, or free of errors. We retain the right to modify the Content, or any portion of it, based on our sole discretion, without any obligation to provide prior or subsequent notice of such changes. Any usage of the content, or any part of it, is entirely at your own risk and responsibility.
The customer and Xygeni operate as independent entities. None of these Terms of Use provisions establishes a partnership, joint venture, agency, or employment relationship between you and Xygeni. It is imperative that you refrain from making or assuming any guarantees, representations, commitments, or obligations on behalf of Xygeni under any circumstances.
This Data Protection Policy is an integral part of the Terms of Use of the Service “Xygeni” (the “Service”) of Xygeni Security, S.L. (Xygeni), placed in the URL https://xygeni.io (the “Web site”) and any subdomains such as http://in.xygeni.io (the “Web UI”) and others, all of them owned by Xygeni Security, S.L. (Xygeni). Include cookies policy in accordance with the EU directive.
Pursuant to Organic Spanish Law 15/1999 of 13th of December, of Personal Character Data Protection, Xygeni communicates that:
Xygeni could treat information about the visitors on the Web sites. Such as, this Web sites can use cookies and other usual invisible systems through those that can obtain information about the visit frequency of the most selected contents and geographic location, as with other details to optimize and improve the navigation on the Web site.
TYPES OF COOKIES
| ACCORDING TO THE ENTITY THAT MANAGES THEM | Own cookies | These cookies are gathered by the website publisher themselves to provide the service requested by the user. |
| Third-party cookies | These cookies are gathered and managed by a third party and cannot be considered our own cookies. | |
| ACCORDING TO THE AMOUNT OF TIME THEY REMAIN ACTIVE | Session cookies | These collect information for as long as the user browses the webpage to provide the requested service. |
| Persistent cookies | These are stored in the terminal, and the information obtained will be used by the entity in charge of the cookie to provide the requested service. | |
| ACCORDING TO THEIR PURPOSE | Technical cookies | These are needed for correct web browsing. |
| Customization cookies | These allow the user to choose certain features (e.g. language) while browsing the website. | |
| Analytical cookies | These allow the provider of a service to associate browsing behaviour with a user to understand their use of the webpage and to analyse statistics on the most-visited content, number of visitors, etc. | |
| Advertising cookies | These allow the website publisher to include advertisements on their webpage that are adapted to its content. | |
| Behavioural advertising cookies | These allow the website publisher to include advertisements on their webpage that are adapted to the information obtained on the user’s browsing habits. |
The Xygeni websites provide a detailed list and associated information of the specific cookies used and specifically ask for acceptance according to the RGPD requirements.
Other third-party cookies are installed on all visitors on other sites, even if they are not registered users in the correspondent platforms:
Xygeni understands that the navigation through the Web sites declares the acceptance for the pickup and treatment of such information. In any case, the navigators of common use contain security functions that permit the User to avoid using cookies and/or other pickup detail navigation systems at any point.
Customers agree during the term of their Xygeni account to list their company name and brand on the Xygeni Web Sites.
Holder: Xygeni Security, S.L. CIF: B09620287.
Registered address: CALLE PASION 4 2 PLANTA,47001 VALLADOLID.
Email Address: info@xygeni.com
Registered details: Register office in Valladolid, Volume: 68 Folio: 86 Section: 2 Entry: 22000020
Xygeni uses some of the most advanced technology for Internet security available today. Secure Socket Layer (SSL) technology protects your information using encryption and authentication servers for both your equipment and data between the data centres, ensuring that data in transit is safe, secure and available only to registered users in your organization.
In addition to SSL encryption, your account/data are protected by a mandatory User ID and Password. Any password-protected Service areas can be accessed only with a valid password and additional (optional) MFA authentication mechanisms. Each password owner is responsible for keeping the password secret and confidential and for notifying Xygeni if the password may have been stolen or otherwise might be misused. For more information, please see our Terms of Use.
Our servers are securely located in a state-of-the-art facility that Amazon, a premier hosting provider and advanced connectivity solutions, manages. Xygeni has chosen Amazon because of its reputation for quality service and support and its unparalleled reputation for reliably posting many of the internet’s most trafficked Web Systems.
Users can decide to delete their account anytime. When a customer account is deleted, all associated data is also deleted from the platform.
Deleting a customer account in the platform does not mean unsubscribing from periodical email marketing communications. Users can always unsubscribe from these communications directly by clicking the appropriate link in the received emails.
Xygeni adheres to a strict policy for ensuring the privacy of your personally identifiable information (such as full name, address, e-mail address, and/or other identifiable information). We will never share your information with third parties outside Xygeni unless you give express permission for us to do so or unless we are required to do so under applicable law. For more information, please see our Privacy Policy Statement.
Xygeni does not store code or other private information of the software artefacts, pipelines, or any other code or configuration. The only information transmitted to Xygeni is related to the security issue and meta information that enable its explanation and potential mitigation actions.
Xygeni Service follows these procedures:
Xygeni implements the following scanner analyses and sensor persistence policy:
A few special considerations (exceptions) to the code privacy behaviour are the following:
All perimeter doors require key card access and a matching biometric palm or fingerprint scan. Visitors are only allowed escorted access to the data centre and NOC as needed. All internal doors leading to the data centre also require an additional card scan for access. All customer equipment is located in locked cabinets or cages within the data centre.
Amazon Support maintains an account on all hosted systems and applications for the purposes of maintenance and support. In some cases, selected Xygeni support engineers may also have access to hosted applications and data. Only employees with the highest clearance have access to application data and code. Authentication is done via individual passphrase-protected public keys rather than passwords, and the servers only accept incoming SSH connections from securitized gateways and the Xygeni virtual network (VPC) hosted in Amazon. Application data is only accessible with appropriate credentials, ensuring that there is no possibility of one customer having access to another customer’s data without explicit knowledge of their login information.
In Addition to regular audits, including 3rd party application penetration testing, the Amazon facilities have undergone a successful SAS70 Type II audit. SAS70 certifies that a service organization has had an in-depth audit of its controls (including control objectives and control activities), which in the case of Amazon, relates to operational performance and security to safeguard customer data.
Database backups are performed daily for the Xygeni Service and maintained for at least seven days.
