Terms of Service

Nemesis is operated by Gonçalo Veríssimo Unipessoal LDA, a single-member private limited company (sociedade unipessoal por quotas) trading as Verixian, with registered office at Rua dos Camponeses, nº 23, 2925-108 Azeitão, Portugal, registered with the Portuguese Commercial Registry under the single registration and tax number (NIPC) 518949729, with a share capital of €1,000. You can reach us at geral@verixian.com.

By accessing or using the Nemesis website, the client portal or any related service (together, the 'Service'), you agree to be bound by these Terms. If you do not agree, do not use the Service.

If you use the Service on behalf of an organization, you represent that you are authorized to bind that organization, and references to you include that organization.

Our services are offered only to businesses and other organizations, and to people acting for them in a professional capacity. They are not offered to consumers.

Verixian delivers one continuous security program across three areas: security engagements that assess the running systems you authorize, code monitoring for the repositories you connect, and dark-web exposure monitoring. Results are made available in the client portal and in a written report every week.

Our services are governed by a separate written agreement between Verixian and your organization, such as an order form or subscription agreement, together with the written scope and authorization to test and a data processing agreement. If that agreement conflicts with these Terms, the agreement prevails.

We test only the systems, networks, applications and accounts that your organization has listed in a written scope and authorized us to test. Testing is active: within that scope, and following the rules agreed for the engagement, we may attempt to use the weaknesses we find to demonstrate their real impact.

Your organization confirms that it owns the systems in scope or is entitled to authorize testing of them, including any permission required from hosting or other service providers, and that the authorization stays valid for the duration of the engagement. Your organization is responsible for the accuracy of the scope and the authorization it gives us.

Code monitoring covers only the repositories your organization connects by installing our app on its code host. Your organization confirms that it is entitled to connect those repositories and to have the code in them analyzed. The app can read code, post checks and comments on pull requests, and open pull requests with suggested fixes. It never merges anything.

Your organization sets the policy that decides whether a finding warns, holds or blocks a pull request, and who can sign off a hold. Whether a pull request can be merged also depends on the settings of your organization’s own code host, which remain its responsibility.

Suggested fixes are proposals. Your developers remain responsible for reviewing, testing and merging any change to their code.

You agree not to: (a) attempt to gain unauthorized access to the website or the client portal, or to test, probe or disrupt their security or availability, unless we have authorized it in writing; (b) submit through our forms false information, or personal data of others that you have no right to share; (c) send form submissions by automated means; (d) copy, resell or reverse engineer the client portal, except where the law does not allow that restriction; or (e) use the Service in breach of any applicable law.

The Service, including its software, design, and content, is owned by Verixian and its licensors and is protected by intellectual-property law. These Terms grant you a limited, non-exclusive, non-transferable right to use the Service; they do not transfer ownership.

The findings and reports we deliver to your organization may be used by it to secure its own systems, as set out in its agreement with us.

Our services are provided under an annual subscription. Our current plans and prices are published on the Plans page of the website. The fees that apply to your organization are those set out in its order form or subscription agreement.

Findings, reports and the evidence behind them can reveal sensitive security weaknesses in the tested systems. Both parties will keep them confidential and use them only to fix and improve the security of those systems.

Information on the website is provided for general information and may change without notice. To the maximum extent permitted by law, the website and the Service are provided 'as is' and 'as available', without warranties of any kind beyond those in your organization’s agreement with us.

Security testing and code monitoring reduce risk but cannot remove it. We make reasonable efforts to keep the Service reliable, but we do not warrant that it will identify every security weakness, in your running systems or in your code, that results will be error-free, or that the Service will be uninterrupted.

To the maximum extent permitted by law, Verixian is not liable for indirect or consequential damages, such as loss of profit, revenue, data or business opportunity, arising out of or relating to the website or the Service. Any limit on Verixian’s liability for our services is set out in your organization’s agreement with us.

Nothing in these Terms excludes or limits liability that cannot be excluded or limited by law, including liability for death or personal injury, or for intent or gross negligence.

The Service relies on third-party providers, including Vercel for hosting and content delivery, Formspree for delivering the contact, brochure request and job application forms to us, Cloudflare Turnstile for verifying form submissions, Clerk for client portal sign-in, and Supabase for storing client portal data. To deliver engagements and code monitoring we also use providers of AI model inference and of breach-exposure intelligence, listed by category on our Trust page. Code monitoring also connects to the code host your organization uses. How these providers handle personal data is described in the Privacy Policy.

The Service may link to third-party websites. Verixian is not responsible for the content or policies of those sites.

We may update these Terms from time to time. The version in force is the one shown at the top of this page. Your continued use of the Service after changes take effect constitutes acceptance of the updated Terms. Changes do not alter services already agreed, which follow their own agreement.

These Terms are governed by Portuguese law. Any dispute arising from them will be submitted to the competent courts of Lisbon, Portugal.

Questions about these Terms can be sent to geral@verixian.com.