Terms of Service

These Terms are a contract between Sysera Inc. ("SYS3RA", "we", "us") and the organization or household that registers for the Service ("you", the "Customer"). By creating an account, or by installing or using the Service, you agree to them. If you accept for an organization, you confirm that you have the authority to bind it.

Read this together with our Privacy Notice and, for household accounts, our Children's Privacy Notice. If you run into anything unclear, write to contact@sysera.ca.

1. The Service

The "Service" is the SYS3RA platform: the hosted web console and Portal at https://app.sysera.ca, the application programming interface, the endpoint agent and installers, the SYS3RA4kids mobile app, and the documentation, in each case as we make them available to you.

1. 1.1Order of documents. If an order form we both sign conflicts with these Terms, the order form wins. Schedule A (the Data Protection Addendum) wins over the rest of these Terms for personal information in Customer Data. These Terms win over any other policy we publish.
2. 1.2Self-hosted use. If you run SYS3RA software on your own infrastructure instead of using our hosted Service, section 10 applies to you.
3. 1.3Some features are not available on every plan or every device. The plan you hold, your operating systems and your device manufacturers decide what works. Where a feature cannot work on a device, the Service says so instead of pretending.

2. Accounts

1. 2.1Who may register. You must be at least 18 years old, or the age of majority where you live if that is higher, and able to form a binding contract. A child may not register an account.
2. 2.2Review. We review new accounts. We may approve, decline or suspend any account, and some household accounts are opened by a verification step described in section 8. Until an account is approved it grants no access.
3. 2.3Accurate information. What you give us when you register, including the country and region you tell us you are in, must be true and kept current. We use it to decide which privacy notices and rules apply to you.
4. 2.4Credentials. You are responsible for what happens under your account, including administrator roles, access tokens and the people you give them to. Use the sign-in and multi-factor protections the Service offers. If you think a credential has been exposed, revoke it in the console and write to contact@sysera.ca.
5. 2.5Your administrators. The people you give administrator roles can act for you. We may rely on their instructions as yours.

3. Household accounts and children

1. 3.1Parents and legal guardians only. Child features (SYS3RA4kids: screen time, website blocking, chores, location and the related alerts) are available only on household accounts, and only to a parent or legal guardian who has authority over each child they add. A business account cannot add a child unless we have agreed otherwise in writing.
2. 3.2Your promises. When you add a child you promise that you are that child's parent or legal guardian; that you will tell the child, in words suited to their age, what the app shows you; that you will use the features only for the safety and wellbeing of your own child; and that you will remove a child and their devices when you no longer have that authority.
3. 3.3Never covert surveillance of an adult. You must not use the Service to monitor another adult without that adult's knowledge and consent, to track a partner or former partner, or to hide that a device is managed. The Service includes a tool that helps customers find covert monitoring software, and is designed so that a managed device is not hidden from the person who uses it. We may suspend any account used this way, immediately and without refund, and may report it where the law allows or requires.
4. 3.4Not a safety guarantee. The features are aids, not supervision. A child, an operating system, a manufacturer or a network can limit or defeat them. Location can be late, approximate or missing. The Service is not an emergency service and does not contact the police or any emergency service. In an emergency call your local emergency number.
5. 3.5Children's information. How we handle information about children is in the Children's Privacy Notice, which forms part of these Terms for household accounts.

4. Managing devices and people

The Service can inventory devices, apply policy, collect security events, locate a lost device, block software, run scripts, open a live session, lock, isolate or wipe a device, and record privileged sessions. These are powerful. You must use them lawfully.

1. 4.1Authority and notice. Before you enroll a device or monitor a person you must have the legal right to do so and must give every notice and obtain every consent the law requires where that person lives and works. This includes workplace electronic-monitoring notices, and notice to people who use their own device for work. We do not do this for you and cannot check it.
2. 4.2Your instructions are yours. A remote action you or your administrators start, or approve, is your action. Wiping, isolating, killing a process or running a script can cause loss of data and loss of service. The approval features (maker-checker) reduce the chance of a mistake and do not remove it.
3. 4.3Do not point it at others. You may use these capabilities only on devices that you own or control.

5. Acceptable use

You will not, and will not help anyone else to:

• break the law, or use the Service to harm, harass, stalk or defraud anyone, or to endanger a minor;
• use the Service for the covert monitoring described in section 3.3;
• attack, probe or scan the Service or anyone else's systems, except as our security policy allows;
• try to read another customer's data, or defeat the isolation between customers, or exceed your own permissions;
• upload or send malware, except samples you handle as part of lawful security work on your own systems;
• circumvent or tamper with a licence, plan limit, entitlement, device limit or usage metering, or share an enrollment token or API token to avoid them;
• overload the Service, or interfere with its operation or with other customers' use of it;
• resell, sublicense or provide the Service to a third party as a managed service, unless you hold an MSP plan or an agreement with us that allows it;
• use the Service in breach of export-control or sanctions law, or from a place that law prohibits.

We may suspend access when a breach threatens people, security or the Service, at once and with as much notice as is practical; otherwise we will first ask you to fix it.

6. Your data

1. 6.1Customer Data. "Customer Data" is everything you or your users put into the Service or that your devices send to it: device and software inventory, events and logs, user and administrator identities, policy, tickets and cases, locations, and information about children. You keep all rights in it.
2. 6.2What we may do with it. You give us a limited licence to host, copy, transmit and process Customer Data only to provide the Service to you, to keep it secure, to give you support, and as the law requires. We do not sell Customer Data. We do not use it for advertising. We do not use it to train or improve artificial-intelligence models.
3. 6.3Artificial intelligence features. Assistive summaries are off unless your organization turns them on. When they are on, the text of the item being summarised is sent to the AI provider configured for the Service (see Schedule B). Information about children is never sent to an AI provider. Summaries are suggestions: never the basis of an automatic decision about a person.
4. 6.4Operational information. We may collect and use information about how the Service performs (for example capacity, error rates and timing) that does not identify you or any individual, to run and improve the Service.
5. 6.5Access and export. You can export and delete much of your Customer Data with the tools in the console, including data-subject request tools and child export and erasure. Our staff access Customer Data only to give you support you asked for, to keep the Service secure and working, or as the law requires.
6. 6.6Privacy law roles. For personal information in Customer Data, you decide why and how it is used and we act on your instructions as your service provider (processor). Schedule A sets out how.

7. Security

1. 7.1What we do. We keep administrative, technical and physical safeguards that fit the sensitivity of Customer Data. Schedule A, Annex 1 lists the main ones.
2. 7.2What we cannot promise. No system is perfectly secure. You are responsible for your own devices, networks, credentials and the safeguards the Service asks you to turn on.
3. 7.3If something goes wrong. If we confirm a breach of security safeguards that affects your Customer Data we will tell you without undue delay, as Schedule A explains.
4. 7.4Researchers. If you find a vulnerability in the Service, follow our security policy.

8. Plans, fees and payments

1. 8.1Plans. The Service is offered in plans (Starter, Standard, Enterprise and, for households, Family). A plan sets which features are included and a price per device; a plan does not limit how many devices you may enrol. Every plan is paid. Trials and features in preview are provided as they are, with no commitment to support or availability.
2. 8.2Fees. Paid plans are described on our pricing page or in an order form. Unless the order form says otherwise, the fee for a period is the price per device multiplied by the number of devices you manage, counted as the checkout page or the order form describes (an enrolled device that has not been removed, and at least one), and a different price per device may have been agreed for your account. If the number of devices changes during a period, the charge changes for the rest of that period in proportion; a change in the price per device applies from the next period. Fees are charged in advance for the period, are non-refundable except where these Terms or the law say they are not, and exclude taxes, which you pay. We may change prices for a later period on 30 days' notice.
3. 8.3Trials. A new business account starts with a 30-day trial of the Standard plan and a household account with a 14-day trial of the Family plan, with no card. Each organization has one trial. A trial ends on its own and does not renew.
4. 8.4Subscriptions and renewal. A paid plan is a subscription bought by the account's owner through our payment processor, monthly or yearly. It renews automatically at the end of each period for the same period at the then-current price until it is cancelled. You can cancel at any time in the billing portal; a cancellation takes effect at the end of the period already paid, and a subscription cannot be cancelled for part of a period. Prices and the tax we add are shown before you pay.
5. 8.5When a plan ends. An account with no plan keeps everything it already enforces, and can still sign in, read, export its data, remove, revoke and delete, and answer data requests. It cannot create or change anything, issue enrollment tokens or enrol a device until it has a plan. We tell you before a trial or plan ends and again if the account stays without a plan. We may suspend an account that has had no plan for 90 days, and this ends the agreement for that account under section 17.
6. 8.6Hybrid. If you run the Software on your own servers, your plan is licensed to the installation online. A license lasts for the paid period plus 14 days, so a lost connection does not stop the installation at once. When the plan ends, the installation has no plan as described above.
7. 8.7Late payment. If a fee is overdue by 30 days after we have written to you, we may suspend paid features until it is paid.
8. 8.8Verification payments for households. To open a household account we may ask the adult to complete a small card payment on our payment processor's page, to confirm that an adult is setting up the account. That is a verification charge, not a subscription fee. Your card details go to the payment processor and not to us. We refund the charge only if we say, on the payment page, that we will.

9. Our software and our rights

1. 9.1Licence. The endpoint agent, installers, mobile app and other software we provide ("Software") are licensed, not sold. For as long as these Terms apply and you have a paid or free plan that includes it, we give you a limited, non-exclusive, non-transferable, revocable licence to install and run the Software on devices that you own or control, up to the limits of your plan, and only to use the Service.
2. 9.2Limits. You may not copy, modify, translate, sublicense, sell or distribute the Software or the Service, reverse engineer or decompile it, or try to extract its source code, except to the extent the law gives you that right despite this limit or a component's own open-source licence gives it to you. You may not remove notices, install an agent that we did not sign and release, or use the Software to build a competing product.
3. 9.3Ownership. We and our licensors own the Service and the Software, and everything in them. These Terms give you no ownership of them. Source code of the Service is not licensed to you, even if you are able to see it; all rights not expressly granted are reserved.
4. 9.4Open-source components. The Software includes third-party components under their own licences, which apply to those components. Their notices are provided with the Software and in the console's licence notice.
5. 9.5Feedback. If you give us ideas or suggestions we may use them without obligation to you.

10. Self-hosted deployments

If we license SYS3RA software to you to run on your own infrastructure:

1. 10.1section 9 applies to that software, and any limits in your order form, such as the number of devices, apply;
2. 10.2you are the operator: you are responsible for the servers, network, backups, updates, security and the privacy notices and terms you present to your own users, and for any law that applies to what you do with the data;
3. 10.3we do not receive your data unless you send it to us, and Schedule A does not apply to a deployment you run;
4. 10.4we support self-hosted software as the order form says, and not otherwise.

11. Other companies' services

The Service can connect to services that other companies run, such as sign-in providers, mapping, messaging, ticketing and payment services (Schedule B names them). Their terms and privacy notices apply to your use of them, and you are responsible for the credentials you give the Service for them. We are not responsible for a third-party service.

12. Confidentiality

Each of us will protect the other's non-public information that is marked or would be understood to be confidential, use it only for the purposes of these Terms, and share it only with people who need it and are bound to keep it confidential. This does not apply to information that is public through no fault of the receiver, that the receiver already knew or independently developed, or that the receiver lawfully received from someone else. A party may disclose information as required by law after giving the other notice where the law allows. This lasts for five years after these Terms end, and for as long as a trade secret remains a trade secret.

13. Availability and support

We aim to keep the Service available and will make reasonable efforts to announce planned maintenance. Unless your order form promises a service level, we give none. Support is by email, and free and trial plans get best-effort support only.

14. Warranties and disclaimers

1. 14.1We will provide the Service with reasonable skill and care.
2. 14.2Otherwise the Service is provided "as is" and "as available". We do not promise that it will be uninterrupted or error-free, or that it will find every threat, block every harmful site or application, find every device, or prevent every incident. Security and parental-control software reduces risk and cannot remove it.
3. 14.3To the extent the law allows we disclaim all other warranties, express and implied, including merchantability, fitness for a particular purpose and non-infringement.
4. 14.4Nothing in these Terms removes a right or warranty that the law does not allow to be excluded, including rights of consumers.

15. Limitation of liability

1. 15.1No indirect loss. To the extent the law allows, neither of us is liable for lost profits, lost revenue, lost data (except as 15.4 says), loss of goodwill, or for indirect, special, incidental, consequential or punitive losses, even if told they might happen.
2. 15.2Cap. To the extent the law allows, each party's total liability for all claims arising out of the Service or these Terms in any twelve-month period is limited to the fees you paid us for the Service in the twelve months before the event that gave rise to the claim, or CAD 100 if you paid us nothing.
3. 15.3What the limits do not cover. Nothing in these Terms limits or excludes liability for death or bodily injury, for fraud, for intentional or gross fault, for your obligations to pay fees, for a breach of section 12 (confidentiality), or for anything the law does not allow to be limited. In Quebec, nothing excludes or limits liability for material injury caused by intentional or gross fault.
4. 15.4Data. Our liability for loss or corruption of Customer Data is limited to using commercially reasonable efforts to restore it from our latest backup.
5. 15.5Some places do not allow some of these limits. Where that is so, the limits apply only as far as the law allows.

16. Your responsibility for claims

You will defend us against, and pay the damages and costs finally awarded or agreed in settlement of, a third-party claim that arises from: Customer Data you provided without the right to do so; your monitoring of a person without the authority, notice or consent required by law; or your use of the Service in breach of section 5. We will tell you promptly, let you control the defence (we may take part at our own cost), and you will not settle in a way that admits fault for us without our consent. This section does not apply to a consumer who is a member of a household to the extent the law does not allow it.

17. Term and ending

1. 17.1Term. These Terms start when you register and continue until ended.
2. 17.2You may end them at any time, by closing the account in the console or by writing to contact@sysera.ca. Fees already paid are not refunded unless the law or your order form says so.
3. 17.3We may end them if you breach them and do not fix it within 30 days of our notice; at once for a breach of section 3.3 or 5 that endangers people or the Service, or for abuse; if you become insolvent; or for a free plan, on 30 days' notice.
4. 17.4What happens next. Access ends. For 30 days afterwards you can ask us for an export of your Customer Data. Then, within 90 days of the end of these Terms, we delete or irreversibly de-identify Customer Data, except what the law requires us to keep and records we must keep as evidence (such as the record of the terms you accepted, and a tenant's audit-log entries where the law requires). Copies in encrypted backups are removed as the backups expire, in the ordinary course. Enrolled devices are no longer managed and the agent must be uninstalled by you.
5. 17.5Surviving. Sections 5, 6.1, 9, 12, 14, 15, 16, 17 and 19 and Schedule A (while we hold Customer Data) continue after these Terms end.

18. Changes

We may change the Service and these Terms. For a change to these Terms that matters to you we will give at least 30 days' notice, by email to the account's contact address or in the console, before it applies to you. If you do not agree, you may end these Terms before the change applies. Using the Service after it applies means you accept it. Each version of these Terms has a date; we record which version an account accepted and when.

19. Governing law and disputes

1. 19.1These Terms, and any dispute about them or the Service, are governed by the laws of the province or territory of Canada in which Sysera Inc.'s registered office is located and the federal laws of Canada that apply there, without regard to rules about conflicts of laws.
2. 19.2If you are an organization, the courts of that province or territory have exclusive jurisdiction, and each of us submits to them.
3. 19.3If you are an individual or a household using the Service for personal purposes, you keep the protection of the mandatory consumer laws of the place where you live, and may bring a claim in the courts of that place.
4. 19.4Before either of us starts a claim, we will each try in good faith to settle it by writing to the other and talking for 30 days. Either may ask a court for urgent relief at any time.

20. General

1. 20.1Whole agreement. These Terms, the documents they refer to, and any order form are the whole agreement about the Service and replace earlier ones about it.
2. 20.2If part is invalid. If a part is unenforceable, the rest continues, and the part is applied as far as the law allows.
3. 20.3No waiver. Not enforcing a right is not giving it up.
4. 20.4Assignment. You may not transfer these Terms without our written consent. We may transfer them to a company that takes over the business of the Service, and will tell you.
5. 20.5Events beyond control. Neither of us is liable for delay or failure caused by events beyond reasonable control, other than a duty to pay.
6. 20.6Notices. We give notice by email to the account's contact address, in the console or by post to the address you gave. You give notice by email to contact@sysera.ca; privacy matters go to privacy@sysera.ca and security reports to contact@sysera.ca.
7. 20.7Relationship. We are independent contractors. No joint venture, partnership or agency exists between us.

---

Schedule A: Data Protection Addendum

This addendum applies when you are an organization and we process personal information for you through the hosted Service. It forms part of the Terms. For a household account, the Children's Privacy Notice describes how we handle information instead. "Applicable privacy law" means the privacy laws that apply to the Customer Data, including the Personal Information Protection and Electronic Documents Act (Canada), the provincial privacy laws of Canada, the Quebec Act respecting the protection of personal information in the private sector, and the privacy laws of the United States and its states, including the California Consumer Privacy Act as amended.

A1. Roles and scope

1. A1.1You are the organization responsible for the personal information in Customer Data (the controller, or the "business" under California law). We are your service provider (processor).
2. A1.2Subject matter and duration. Providing the Service to you for as long as you use it and for the deletion period in section 17.
3. A1.3Nature and purpose. Hosting, storing, transmitting and analysing Customer Data to provide the Service: device management, security monitoring and response, privileged access, remote management, ticketing, reporting, and support you ask for. These are the only business purposes for which we process it.
4. A1.4Kinds of personal information. Names, email addresses and phone numbers of your administrators and users; the identifiers of their devices; software inventory; security events and logs, including network addresses; the content of tickets and cases; the location of devices you choose to locate; sign-in and audit records; and anything else you or your devices put into the Service.
5. A1.5People it is about. Your employees, contractors, administrators and other users, and the people who use the devices you manage.

A2. Our promises about how we use it

We will:

1. A2.1process personal information in Customer Data only on your documented instructions, which are these Terms, your use of the Service's features and your written requests, and tell you if we think an instruction breaks applicable privacy law;
2. A2.2not sell it or share it (including for cross-context behavioural advertising);
3. A2.3not retain, use or disclose it for any purpose other than the business purposes in A1.3, or outside our direct business relationship with you, or for any commercial purpose of our own;
4. A2.4not combine it with personal information we receive from anyone else or collect from our own interactions with individuals, except as the law allows a service provider to;
5. A2.5give the same level of privacy protection as applicable privacy law requires, and tell you promptly if we decide we can no longer do so;
6. A2.6let you take reasonable and appropriate steps to make sure we use it consistently with your obligations, and to stop and remedy unauthorized use (see A9);
7. A2.7make sure the people who handle it are bound by confidentiality;
8. A2.8help you respond to requests and meet your obligations (A6) and carry out assessments you must do about our processing, given the nature of the Service and the information we have.

A3. Security

We keep the measures in Annex 1, and review them at least once a year.

A4. Sub-processors

1. A4.1You authorise us to use the sub-processors in Schedule B.
2. A4.2We will give you at least 30 days' notice, by email to your account's contact address or in the console, before adding or replacing a sub-processor that handles personal information in Customer Data. You may object on reasonable grounds in that time; if we cannot resolve it you may end the affected Service and we will refund the unused prepaid fees for it.
3. A4.3We bind every sub-processor to obligations no less protective than these, and are responsible to you for their performance of them.

A5. Where data is processed

Customer Data is stored and processed in the United States. If you are in Canada, you understand and agree that personal information about people in Canada will be transferred to, stored in and accessible from the United States, where it is subject to the laws of that country and may be accessed by its courts, law-enforcement and national-security authorities. Where the law of a Canadian province requires you to assess a transfer outside the province, we will give you the information about our processing you reasonably need to do that. We do not currently offer the Service for customers in the European Economic Area or the United Kingdom.

A6. Requests from individuals

If an individual asks us for access to, correction of, or deletion of personal information in Customer Data, we will tell them to contact you, and will tell you about the request. The Service includes tools for you to answer requests yourself, including data-subject request tools and, for households, child export and erasure. We will give reasonable help beyond them on request.

A7. Breach of security safeguards

We will tell you without undue delay, and aim to tell you within 72 hours of confirming it, when we confirm a breach of security safeguards affecting personal information in your Customer Data. We will tell you what we know: what happened, what information and how many people are involved, what we have done, and what we recommend. We keep a record of every breach of security safeguards for at least 24 months and give you the part that concerns you. You decide whether to notify regulators and individuals, and we help you do so.

A8. Law-enforcement and government requests

If a government body asks us for Customer Data we will, unless the law forbids it, send the request to you, give only what we are legally required to give, and challenge a request we reasonably believe is unlawful or overbroad.

A9. Audit

Once each year, and after a confirmed breach of security safeguards, we will answer your reasonable security questionnaire and give you our current documentation about the measures in Annex 1. An on-site inspection is available only where the law requires it, with 30 days' notice, in business hours, under confidentiality and at your cost.

A10. Return and deletion

On the end of the Terms we return and delete Customer Data as section 17.4 says.

A11. Liability

Section 15 applies to this addendum.

Annex 1: Security measures

• Separation of customers. Every customer's data is held under row-level security enforced by the database, so a statement running for one customer cannot see another's. The tenant is taken from the credential, never from the request.
• Encrypted transport. Browsers and agents reach the Service over TLS. Agents authenticate with a certificate issued to that device and sign each check-in.
• Protected secrets. Passwords, tokens, keys and similar secrets that customers store with the Service are encrypted with a platform key before being written to the database. Tokens are stored only as one-way hashes.
• Access control. Role-based permissions with deny by default, multi-factor sign-in through your identity provider, expiring tokens, and maker-checker approval for high-risk actions.
• Tamper-evident logging. Each customer has an append-only audit log in which every entry carries a hash of the one before it, and the chain can be verified.
• Signed instructions. Commands sent to devices are signed, and software updates to the agent are verified against pinned release keys before they are installed.
• Development and testing. Dependency and container vulnerability scanning, static analysis, secret scanning, fuzzing of parsers that take untrusted input, and automated tests, on every change.
• Our people. Access to production systems is limited to staff who need it, with individual accounts.
• Backups and recovery. Encrypted backups on a schedule, and a written recovery procedure that is tested.
• Incident response. A procedure to detect, contain and investigate incidents, and to notify customers as A7 says.

---

Schedule B: Sub-processors and other recipients

We use the following companies to provide the Service. "When" says whether they are used for everyone or only when a feature is on.

We give the names of the hosting and email providers to any customer who asks at privacy@sysera.ca.

Recipients you direct. When you connect an integration, such as Slack, Microsoft Teams, Jira, ServiceNow, a signed webhook, a syslog destination, or an email address, the Service sends it what you configure it to send, and the company that runs it is your service provider, not ours. A guardian who turns on the street map in the parent app has their own phone ask the OpenStreetMap Foundation's servers for map pictures of the area on the screen, and a guardian who also turns on "Follow roads" has their own phone send a child's route to the OpenStreetMap community's routing service. Both are off until chosen.