Terms of Service | KaribuKloud

Provider Entity: KaribuKloud Limited
Official Email: [email protected]
Website: https://karibukloud.com
Governing Jurisdiction: Republic of Kenya (Nairobi Courts / Arbitration)

1. Acceptance of Terms & Service Scope

These Terms of Service (“Terms”, “Agreement”) govern the access to and use of all websites, diagnostic tools, client portals, and Managed Security Services provided by KaribuKloud Limited (“KaribuKloud”, “Provider”, “we”, “us”, or “our”).

By visiting our website (https://karibukloud.com), using our interactive tools (including the DPA-K Compliance Estimator), or executing a Master Services Agreement (MSA), Statement of Work (SOW), or Service Order for our 24/7 Managed Fusion Security Operations Center (SOC) and Seceon-powered Open Threat Management (OTM) platform, you (“Client”, “Customer”, “User”, or “You”) agree to be bound by these Terms.

If you are entering into this Agreement on behalf of a corporation, SACCO, financial institution, healthcare provider, or other legal entity, you represent and warrant that you have full legal authority to bind that entity to these Terms.

2. Description of Managed Security & GRC Services

KaribuKloud provides AI-driven, software-defined Managed Security Services and continuous Governance, Risk, and Compliance (GRC) automation. Our core service portfolio includes:

24/7 Managed Fusion SOC: Tier-1 through Tier-3 security monitoring, threat triaging, escalation, and incident response provided through our Nairobi Fusion SOC.
AI-Driven Threat Detection & SOAR (Seceon OTM Platform): Unified aiSIEM, aiXDR, aiSecurity Score360/BI360, and aiSecOT360 telemetry ingestion, machine learning behavioral analytics, and sub-1.5 second automated SOAR threat containment across 300+ playbooks.
Edge Collector Architecture (CCE): Deployment of an agentless Collection and Control Engine (CCE) within Client networks to inspect, parse, and correlate logs locally, streaming only 256-bit encrypted SSH metadata to our Analytics and Processing Engine (APE).
Autonomous GRC & Compliance Auditing (CMX360): Continuous control validation and automated evidence archiving mapped to Kenya’s Data Protection Act (DPA-K 2019), SASRA, CBK, ISO 27001, PCI-DSS, and HIPAA.
Offensive Security & Vulnerability Assessments: Automated vulnerability scanning, penetration testing scoping, and breach attack simulation (aiBAS360).

3. Account Registration & Acceptable Use

3.1. Account Credentials & Security

Clients and registered channel partners must maintain the confidentiality of all portal credentials, API keys, and administrative access tokens. You are fully responsible for all activities occurring under your authenticated account. You must notify KaribuKloud immediately at [email protected] upon discovering any unauthorized access or credential compromise.

3.2. Acceptable Use Policy

You agree not to use KaribuKloud services, networks, software, or portals to:

Conduct unauthorized vulnerability scanning, brute-forcing, or penetration testing against third-party networks without prior written authorization.
Interfere with, disable, or tamper with the operation of our CCE edge collectors, APE processing engines, or security telemetry streams.
Reverse-engineer, decompile, deobfuscate, or duplicate any software algorithms, threat modeling engines, or proprietary code provided by KaribuKloud or Seceon.
Host, transmit, or distribute malicious code, ransomware, command-and-control (C2) signals, or unauthorized bulk communications.
Violate any applicable laws of Kenya, including the Computer Misuse and Cybercrimes Act (CMCA 2018) and the Data Protection Act (DPA-K 2019).

Violation of this section constitutes a material breach entitling KaribuKloud to immediately suspend services without refund or prior notice.

4. Proprietary Rights & Intellectual Property

4.1. Platform Ownership

All right, title, and interest in and to the KaribuKloud portals, website content, diagnostic calculators, custom GRC code, software architectures, logos, and trademarks—including all underlying intellectual property rights in Seceon’s OTM platform (aiSIEM, aiXDR, CCE, APE, CMX360)—remain the sole and exclusive property of KaribuKloud Limited and its licensors.

4.2. Subscription License Grant

Subject to timely payment of subscription fees, KaribuKloud grants Client a non-exclusive, non-transferable, non-sublicensable, limited license during the active term to access and use the security dashboard, view compliance reports, and deploy CCE edge collectors solely for Client’s internal cybersecurity and compliance operations.

4.3. Developer Attribution

All formal assessment briefs, compliance matrices, and presentation collateral generated by or for KaribuKloud carry standardized developer attribution (LetsDoITBetter by Ken Kagota). Removal, alteration, or obfuscation of required statutory or developer copyright notices is strictly prohibited.

5. Client Responsibilities & Edge Infrastructure Requirements

To enable KaribuKloud to deliver effective 24/7 threat detection and meet SLA targets, Client agrees to:

Provide Infrastructure Access: Grant necessary network read access, administrative syslog/NetFlow forwarding permissions, and virtual machine resources for CCE edge collector deployment (minimum recommended specifications: 4 CPU Cores, 4 GB RAM, 256 GB HDD).
Maintain Administrative Contacts: Keep primary IT, CISO, and emergency incident escalation contacts updated at all times in the client portal.
Data Accuracy & Licensing: Ensure that all endpoints, firewalls, and database servers monitored under the subscription are legally owned or authorized for monitoring by Client.
Local Network Protection: Maintain physical and network access security around the CCE edge collector to prevent local tampering or unauthorized data modification.

6. Service Level Agreements (SLAs) & Incident Response

6.1. System Availability Target

KaribuKloud strives to maintain a 99.9% uptime for our central cloud Analytics and Processing Engine (APE) and client dashboard portals, excluding scheduled maintenance windows notified at least 48 hours in advance.

6.2. Critical Incident Response SLA

For Managed SOC clients with an active Master Services Agreement:

Sub-1.5 Second Automated Containment: Automated SOAR playbooks execute local host isolation, credential revocation, or firewall block rules automatically upon high-confidence ML detection.
15-Minute Critical (P1) Escalation SLA: P1 security alerts (active ransomware, severe lateral movement, verified data exfiltration) are acknowledged within 15 minutes and triaged with an actionable containment response provided within 30 minutes by our 24/7 Nairobi Fusion SOC team.

7. Data Protection, Data Sovereignty & Confidentiality

7.1. Compliance with Data Protection Act (DPA-K 2019)

Both parties agree to comply strictly with the Data Protection Act (DPA-K 2019), subsidiary regulations, and ODPC guidelines. Where KaribuKloud processes personal data on behalf of Client, the executed Data Processing Agreement (DPA) governs all processing operations.

7.2. Edge Metadata Sovereignty

Client acknowledges and agrees that KaribuKloud’s edge collector (CCE) architecture parses and correlates raw logs locally within Client’s network perimeter. Raw logs and unencrypted PII remain internal to Client’s environment. Only compressed, 256-bit encrypted behavioral metadata is transmitted to the processing engine, guaranteeing local data localization compliance under Section 50 of the Data Protection Act.

7.3. Confidentiality

Each party agrees to hold all non-public technical, financial, architecture, and network configuration information disclosed by the other party in strict confidence, using at least the same degree of care as it uses for its own confidential information (and no less than reasonable care). Confidential information shall not be disclosed to third parties except to authorized employees, sub-processors, and legal counsel bound by non-disclosure duties.

8. Fees, Quotations, Invoicing & Partner Referrals

8.1. Quotations & Subscription Pricing

All quotations provided by KaribuKloud or authorized channel partners are valid for thirty (30) days from issue. Service fees are billed on a fixed, predictable subscription basis as set forth in the executed Service Order or SOW.

8.2. Payment Terms & No Ingestion Hidden Costs

Invoices are payable within thirty (30) days from the date of invoice unless specified otherwise in the SOW. Because KaribuKloud utilizes edge metadata correlation rather than raw log ingestion volume pricing, Client’s subscription fee remains fixed and predictable without raw gigabyte surcharge spikes.

8.3. Late Payment & Suspension

Late payments attract interest at the rate of 1.5% per month (or the maximum allowed by Kenyan law). KaribuKloud reserves the right to suspend 24/7 SOC monitoring or portal access after providing ten (10) days written notice of overdue accounts.

8.4. Channel Partner & Commission-Only Reseller Terms

Resellers participating in KaribuKloud’s Channel Partner Program earn commission based on verified client referrals tracked via dedicated tracking links or referral codes (e.g., /cases). KaribuKloud and Seceon handle 100% of technical onboarding, CCE deployment, and SOC operations. Commissions are disbursed upon receipt of client subscription payments.

9. Warranties, Disclaimers & Limitation of Liability

9.1. Express Service Warranty

KaribuKloud warrants that it will perform all Managed Security Services with professional diligence, skill, and care consistent with prevailing cybersecurity industry standards and Level-1 certified technical competencies.

9.2. Cyber Risk Disclaimer

Client explicitly acknowledges that no cybersecurity platform, AI threat model, or 24/7 SOC can guarantee 100% protection against all zero-day vulnerabilities, nation-state attacks, or insider threat threats. KaribuKloud does not warrant that its services will prevent all security breaches or unauthorized network intrusions. Services are provided "AS IS" and "AS AVAILABLE" except as expressly stated in an executed SOW.

9.3. Limitation of Liability

To the maximum extent permitted by Kenyan law:

Consequential Damages Waiver: Neither party shall be liable to the other for any indirect, incidental, special, consequential, or punitive damages, including loss of profits, business disruption, loss of data, or reputational damage, arising out of or in connection with these Terms.
Liability Cap: KaribuKloud’s aggregate liability for all claims arising under or related to this Agreement shall be strictly limited to the total fees actually paid by Client to KaribuKloud in the twelve (12) months preceding the event giving rise to liability.

10. Indemnification

Client agrees to defend, indemnify, and hold harmless KaribuKloud Limited, its officers, directors, employees, and technology partners (including Seceon Inc.) from and against any third-party claims, liabilities, damages, losses, or expenses (including reasonable legal fees) arising out of or related to:

Client’s unauthorized modification or tampering with CCE edge collectors.
Client’s breach of Acceptable Use policies or applicable data protection laws.
Unauthorized network monitoring initiated by Client on assets not legally owned or controlled by Client.

11. Term, Termination & Offboarding

11.1. Term

This Agreement remains in effect for the duration specified in the SOW or Master Services Agreement (typically 12, 24, or 36 months) and automatically renews for successive 12-month periods unless either party provides written notice of non-renewal at least sixty (60) days prior to term expiration.

11.2. Termination for Cause

Either party may terminate this Agreement immediately by written notice if the other party materially breaches any provision of these Terms and fails to cure such breach within thirty (30) days of receiving written notice specifying the breach.

11.3. Offboarding & Data Purge

Upon agreement termination:

Client license to access the portal and Seceon OTM dashboard expires.
Client must uninstall all CCE edge collector virtual appliances.
KaribuKloud will securely delete all Client tenant configurations and metadata within thirty (30) days, except for compliance archives retained under statutory retention obligations.

12. Governing Law & Dispute Resolution

12.1. Governing Law

These Terms and all Master Services Agreements shall be governed by, construed, and enforced in accordance with the Laws of the Republic of Kenya.

12.2. Amicable Negotiation & Mediation

In the event of any dispute, controversy, or claim arising out of or relating to these Terms, the parties shall first attempt in good faith to resolve the dispute through executive negotiation between senior representatives within fourteen (14) business days.

12.3. Binding Arbitration in Nairobi

If negotiation fails, the dispute shall be referred to and finally resolved by binding arbitration under the Rules of the Chartered Institute of Arbitrators (Kenya Branch). The tribunal shall consist of a single arbitrator appointed by agreement or by the Chairman of CIArb Kenya. The seat of arbitration shall be Nairobi, Kenya, and proceedings shall be conducted in the English language.

13. Miscellaneous Provisions

Entire Agreement: These Terms, together with any executed SOW, MSA, Data Processing Agreement (DPA), and Privacy Policy, constitute the complete agreement between the parties.
Severability: If any provision of these Terms is found to be invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall remain in full force and effect.
Force Majeure: Neither party shall be liable for failure or delay in performing obligations (except payment) due to events beyond reasonable control, including natural disasters, acts of government, telecommunications blackouts, or major cyber-warfare events.
Modifications: KaribuKloud reserves the right to update these Terms periodically. Continued use of services following published updates constitutes acceptance of revised Terms.

14. Official Contact Information

For any legal inquiries, service contract questions, or compliance notices, please contact:

KaribuKloud Limited – Legal & Contracts Office
Email: [email protected]
Website: https://karibukloud.com
Cases Portal: https://karibukloud.com/cases
Compliance Portal: https://karibukloud.com/compliance
Address: Nairobi, Kenya