These Terms of Use (the "Terms") set forth the conditions for using "FirstLook" (the "Service") provided by Securious Lab G.K. ("we," "us," or "our"). The Japanese version of these Terms is the governing version. This English version is provided for reference only.
1. Nature of the Service
The Service is a tool intended to support digital forensics, incident response, log analysis, IOC matching, threat intelligence lookups, report preparation, and related analytical work. The Service assists investigations, judgments, reporting, and decisions by the user and the organization that permits or procures such use (collectively, "User"); it does not replace them.
2. Individual Conditions
Service term, fees, payment terms, available features, support scope, PoC, trial, evaluation use, and other individual conditions are governed by the relevant order form, quotation, agreement, or other written or electronic agreement between the User and us ("Individual Agreement"). If an Individual Agreement conflicts with these Terms, the Individual Agreement prevails to the extent of the conflict.
3. Nature of Analysis Results
Automated analysis, rule-based determinations, IOC matching, threat intelligence lookups, scoring, reports, comments, summaries, and other outputs generated by the Service ("Analysis Results") may include false positives, missed detections, misclassification, incomplete explanations, outdated information, errors from external sources, analysis failures, or processing failures. Users must treat Analysis Results as reference information and are responsible for their final decisions and use.
4. No Professional Advice or Operational Substitute
The Service and Analysis Results do not constitute incident response services, forensic investigation services, legal advice, audit services, warranties, deliverable preparation, operational outsourcing, professional advice, or any service that guarantees a particular result. Separate professional services, if any, are governed by an Individual Agreement.
5. Support
We provide support to registered users of the Service for how to use the Service, confirmation of specifications, reports of defects or unintended behavior, and reports of behavior that appears to differ from the user guide or other explanatory materials separately provided by us.
Support is intended to help users use the Service appropriately and to confirm defects in the Service itself. Support does not include interpretation, evaluation, or validation of Analysis Results; advice on response plans or recommended actions; risk assessment; explanations to third parties or responses to questions from third parties; investigation of individual incidents; analysis of the user environment or any third-party environment; continuing advice; preparation of deliverables; or any other professional advice or operational outsourcing.
If a User requests review by our analyst, interpretation assistance, supplemental findings, or review of Analysis Results for a specific report created within the Service, the User must request the paid analysis result review through the designated analysis menu in the Service or by another method specified by us. Such requests are not accepted as ordinary support inquiries.
For inquiries not covered by the preceding paragraph, if the content concerns investigation beyond the scope of a report, organizational response policy, explanations to third parties, recurrence prevention, continuing assistance, advisory services, or other consulting services, we may guide the User to a separate Individual Agreement, paid support, or another service provided by us. We determine whether an inquiry falls within the scope of support or whether it should be handled as an analysis result review or other paid engagement, based on the inquiry content and use of the Service.
Users must submit inquiries through the in-service inquiry form or other method specified by us, using a user account registered to the tenant. Categories shown in the inquiry form are for intake and guidance. Regardless of the category selected, we may guide the inquiry to an appropriate category, route, or handling method according to its content. If an incorrect category is selected, inquiries that fall within the scope of support will still be handled as ordinary support inquiries.
We do not set a fixed limit on the number of support inquiries. However, Users must use support within a reasonable scope. If we determine that the content, frequency, volume, urgency, or repetition of inquiries significantly exceeds the scope of support associated with ordinary use of the Service, we may adjust the order, method, scope, intake route, or contact point for responses and, where necessary, guide the User to a separate Individual Agreement, paid support, another service provided by us, or discussions regarding the manner of use.
Support hours are 10:00 to 17:00 Japan time on weekdays, excluding Saturdays, Sundays, public holidays in Japan, and our company holidays. The inquiry form may be submitted 24 hours a day, but inquiries received outside support hours or on company holidays are treated as received on the next business day.
We aim to provide an initial response by the end of the next business day after the receipt date of the inquiry. This does not guarantee response time, resolution time, recovery time, or any other service level. We will endeavor to prioritize inquiries regarding situations where the Service cannot be used, but even in such cases we do not guarantee response time, resolution time, or recovery time.
6. Authority and Responsibility for Uploaded Data
Users represent and warrant that they have all necessary rights and authority to upload, input, transmit, or connect logs, files, artifacts, IOCs, notes, reports, customer information, personal data, confidential information, and other data to the Service ("Uploaded Data"), and that doing so does not violate laws, contracts, internal policies, customer agreements, or third-party rights. Users are responsible for selecting, minimizing, lawfully submitting, and safeguarding Uploaded Data.
7. Confidential, Personal, and Dangerous Data
Users must submit Uploaded Data only to the minimum extent necessary for the purpose of using the Service, and must not upload unnecessary personal data, credentials, decryption keys, or other highly confidential data. Malware, suspicious files, malicious scripts, exploit code, executable files, or other potentially dangerous data may be uploaded only in formats, methods, or analysis targets expressly supported or permitted by us. Details are governed by our Data Handling Policy and related documents.
8. External Services and APIs
The Service may use external APIs, threat intelligence services, cloud services, and other external services for analysis, lookups, report generation, quality improvement, feature improvement, operations, monitoring, or support. We may transmit or process Uploaded Data, metadata, IOCs, hashes, domains, IP addresses, URLs, log fragments, Analysis Results, and other information through such external services to the extent necessary and appropriate. For external threat intelligence lookups, we generally send IOCs such as hash values, IP addresses, domains, and URLs. File names, file paths, log bodies, and file bodies are not sent for external threat intelligence lookup purposes except where an expressly described feature, or the User's explicit operation or consent, provides otherwise. The categories of external services, categories of data that may be sent, and data that is not sent are described in our Data Handling Policy and related documents.
9. AI and Data Use
As of this draft, the standard analysis functions of the Service do not send Uploaded Data to generative AI or LLM services for analysis. If we later use AI, LLMs, or similar external services as standard Service functionality, we will describe the handling in our Data Handling Policy or related documents and, where necessary, notify Users or obtain consent. We will not use Uploaded Data to train or improve general-purpose AI models or other third-party AI models.
10. Use, Retention, and Deletion of Data and Analysis Results
We may use Uploaded Data, Analysis Results, usage history, operation logs, error information, feedback, and related information for providing the Service, analysis, report generation, support, security, quality improvement, product improvement, feature improvement, operational improvement, statistical analysis, and related purposes. We will obtain separate consent before using information in a manner that identifies an individual, organization, customer, or matter in public materials, sales materials, training materials, case studies, or other third-party-facing materials.
Standard retention periods for the cloud-provided version are governed by the Data Handling Policy separately established by us. Unless an Individual Agreement provides otherwise, uploaded data bodies, parsed intermediate data, and detailed analysis data become subject to deletion after more than 30 days have elapsed from analysis completion. Findings, scores, summaries, reports, and other display data presented to Users become subject to deletion after more than 360 days have elapsed from analysis completion. After that period, final report deliverables (docx, xlsx, and pdf) that we have generated and stored before deletion may remain downloadable by the method we designate.
Upon contract termination or data deletion, information assets that can be returned or provided to the User are limited to those that remain in the Service at that time and are stored in a format we can provide. Uploaded data bodies may have already been deleted after the retention period above and are not guaranteed to be returnable at contract termination. Operation logs, audit logs, billing or usage records, support history, contract records, security response records, and other data necessary for laws, accounting, audit, misuse investigation, dispute handling, contract management, or security may be retained to the extent necessary even after uploaded data or reports are deleted.
Data subject to deletion is deleted or made unavailable from ordinary production databases and storage. However, deletion is reflected in backups, redundancy copies, disaster recovery data, and other operationally necessary replicated data with a time lag, in accordance with our backup rotation, retention periods, and recovery procedures. The maximum period until deleted data disappears from backups, and details of backup scope, schedule, encryption, storage location, integrity checks, and recovery procedures, are governed by the Data Handling Policy, the Individual Agreement, or related documents separately established by us.
11. Use of Reports
Users are responsible for their use of reports, notes, Analysis Results, and other deliverables generated by the Service. If Users provide them to customers, internal stakeholders, auditors, insurers, law enforcement, regulators, or other third parties, Users must review the contents and, as necessary, make corrections, additions, expert confirmations, or other appropriate measures.
12. Prohibited Conduct
Users must not use the Service for unlawful conduct, unauthorized access, attacks, infringement, excessive load, unauthorized account sharing, or any act that disrupts the Service. Without our prior written consent, Users must not reverse engineer, decompile, disassemble, analyze, copy, modify, adapt, extract, scrape, automatically acquire, reproduce, plagiarize, create derivatives from, resell, redistribute, lend as SaaS or other third-party services, provide to unauthorized third parties, build competing services from, or commercially exploit beyond the permitted scope, the Service, Analysis Results, screens, specifications, analysis logic, templates, report formats, or other Service-related information.
13. Permitted Sharing and Representative Use
Users may use and share Analysis Results and reports for internal use, customer reporting, and legitimate reporting to auditors, insurers, law enforcement, regulators, and similar recipients. If an MSSP, DFIR vendor, consultant, or other third party uses the Service on behalf of a customer, the User is responsible for obtaining necessary authority from the customer and ensuring compliance with these Terms and the Individual Agreement. Such representative use is subject to the Individual Agreement or our separate approval.
14. Personal Data
We handle Users' personal data in accordance with our Privacy Policy. Please refer to the Privacy Policy on this website. With respect to personal data included in Uploaded Data, Users are responsible for ensuring they have the necessary authority, notices, consents, contractual grounds, or other lawful basis for processing.
15. Use Restrictions and Account Suspension
If a User violates these Terms or an Individual Agreement, engages in unauthorized use, attack activity, reverse engineering, excessive resource consumption, payment delay or non-payment, registration of false information, creates security risks, is suspected of violating laws, is subject to a reasonable third-party complaint, or if we otherwise determine that action is necessary for operation of the Service, we may restrict or suspend use of the Service, or suspend or delete the account, without prior notice.
16. Fees, Term, and Refunds
Service fees are payable in accordance with the Individual Agreement. For annual or other prepaid contracts, unless otherwise provided in the Individual Agreement, we will not refund fees already paid if termination is requested by the User, if use is suspended due to the User's breach of these Terms or the Individual Agreement, or if suspension is attributable to the User.
17. Changes, Suspension, and Termination
We may change, add, or remove Service content, specifications, service conditions, analysis logic, external integrations, credit consumption, data retention periods, support scope, and other aspects of the Service as necessary. We may suspend or stop all or part of the Service for maintenance, failures, external service suspension, legal compliance, security reasons, or other reasons we deem necessary. Unless otherwise provided in an Individual Agreement, we do not guarantee any particular uptime, response time, recovery time, support hours, or other service level.
18. Disclaimer of Warranties
We will endeavor to implement reasonable safeguards in providing the Service. However, we do not warrant the accuracy, completeness, usefulness, timeliness, fitness for a particular purpose, achievement of results, continuous availability, uninterrupted operation, absence of failures, errors, or defects, or detection of all threats, compromises, vulnerabilities, or unauthorized acts.
19. Limitation of Liability
Except in cases of our willful misconduct or gross negligence, we are not liable for damages incurred by Users in connection with the Service. Even where we are liable, our liability is limited to ordinary and direct damages actually incurred, and we are not liable for lost profits, indirect damages, special damages, consequential damages, data loss, loss of business opportunities, customer handling damages, claims from third parties, or similar damages. For paid contracts, our aggregate liability is capped at the total Service fees actually paid to us by the User for the contract year in which the damage occurred. For free use, PoC, trial, or evaluation use, our aggregate liability is capped at JPY 10,000, except in cases of our willful misconduct or gross negligence.
20. Changes to these Terms
We may change these Terms as necessary. If we change these Terms, we will notify Users of the revised terms and effective date by posting in the Service, email, or other appropriate means. For material changes, we may request renewed consent by a method we deem appropriate. If a User uses the Service on or after the effective date of the revised Terms, the User is deemed to have agreed to the revised Terms.
21. Governing Language
The Japanese version of these Terms is the governing version. Any English or other translation is for reference only. If there is any conflict or inconsistency between the Japanese version and a translation, the Japanese version prevails.
22. Governing Law and Jurisdiction
These Terms are governed by and construed in accordance with the laws of Japan. If any dispute arises between us and the User in connection with the Service or these Terms, the Tokyo District Court has exclusive jurisdiction as the court of first instance.