These terms apply when a company registers for and uses weakestlink — a service for security-awareness training and authorised internal phishing simulation, operated by WEAKESTLINK ApS (Danish CVR no. 46614011), info@weakestlink.io. The service is offered exclusively to businesses; consumer protection legislation, including the right of withdrawal, does not apply. By creating an account, you accept these terms on behalf of your company.

1. Account and registration

The account is created on a self-service basis using a work email address. You warrant that you are authorised to act on behalf of your company and that the information provided is accurate. You are responsible for keeping your login details confidential and for all activity on the account.

2. Trial period

New organisations get a free one-month trial from the date of creation, with unlimited users and full access. The trial does not require a payment card and does not automatically convert into a paid subscription — you will only be charged once you have registered a card yourselves.

3. Prices and payment

After the trial period, the applicable price per active user per month applies, as set out in the price list at weakestlink.io — currently 1 € in Denmark. Prices are exclusive of VAT; sales to businesses in other EU countries are invoiced under the reverse-charge rules. Prices are shown in local currency for information purposes only but are charged in Danish kroner (DKK) — the amount on your statement may differ due to your card issuer's exchange rate and any fees.

Payment is made monthly in advance and is charged automatically to the payment card you have registered. The number of active users is calculated on the 1st of each month; a user is active when they have been created on the account and have not been deactivated (offboarded) at the time of calculation. Users created during a month are only counted from the next calculation onwards, and no refund is given for users deactivated within a month that has already been paid for. If the amount cannot be charged, we will remind you by email, and the account will be placed in restricted mode (section 4) until payment has been completed.

Prices may vary by market. We may change the price — including for a single market at a time — with at least 30 days' notice by email; the new price applies at the earliest from the first payment period after the notice period expires, and never for a period already paid. If you do not wish to continue at the new price, you may cancel before it takes effect and will pay the previous price until termination. There is no minimum commitment.

4. Expiry of the trial period and restricted mode

If the trial period expires without a payment card having been registered — or if a payment cannot be completed — the account is placed in restricted mode: no new simulations can be sent and no new users can be created, but your data and reports are retained and remain accessible. The account is unlocked again as soon as payment has been registered. If the account remains in restricted mode for more than 90 consecutive days, we consider the customer relationship terminated; we will notify you by email at least 30 days in advance and will then delete personal data in accordance with the data processing agreement.

5. Permitted use

Phishing simulations may only be sent to the organisation's own employees (or people who hold an account with you) on the basis of written authorisation from the organisation's management and a completed and approved balancing-of-interests assessment (legitimate interest, GDPR Article 6(1)(f)) — and only once a sender domain has been verified. It is not permitted to use the service to send simulations to third parties or to carry out real attacks. In the event of misuse, we may suspend the account immediately and terminate without notice.

6. Your responsibility for simulations

Simulations are only sent out on your express authorisation and on the basis of the balancing-of-interests assessment you approve in the product. You warrant that the authorisation has been given by a person with management responsibility, and that you will inform and involve employee representatives, works councils, etc., where the law or agreements in your country require it. You bear responsibility for internal consequences of approved simulations — for example, reactions from employees, alerts in your IT security systems, or erroneous escalations — unless the damage results from us having deviated from the approved content or the approved recipient group.

Delivery of simulations into your mail environment requires you to set up the recommended exceptions (allowlisting) in your mail filter. We are not responsible for simulations that are blocked or altered by your own systems, and we recommend that your IT operations team be informed before the first simulation is sent.

7. Roles and personal data

When you use the service for employee training, your company is the controller of the employee data, and weakestlink is the processor. The processing takes place under the data processing agreement, which is accepted upon sign-up. See also the privacy policy for the information for which weakestlink is itself the controller.

8. Availability and support

We aim for high uptime, but the service is provided as is and as available — without a guaranteed uptime (SLA) and without guaranteed support response times. Support is provided by email at info@weakestlink.io, and we respond within a reasonable time on business days. We may carry out planned maintenance and updates.

9. Liability

The service is a training and measurement tool. It does not constitute security advice and is no guarantee against real attacks or of specific behavioural changes among employees.

Neither party is liable for indirect losses, including loss of operation, loss of data or consequential damages. Our total liability under the agreement is limited to the amount you have paid for the service in the preceding 12 months. These limitations do not apply in cases of intent or gross negligence, or where applicable law does not permit such limitation.

10. Customer content and our rights

You retain the rights to the data you input (e.g. employee lists). You grant us only the access necessary to deliver the service. Our course content and simulation library belong to weakestlink and may not be resold or published outside your organisation. We may compile and use statistics in anonymised and aggregated form, which cannot be traced back to your organisation or individuals, to improve the service and for threat insight across the service.

Simulation templates may mimic known senders and reproduce the names and logos of third parties. These belong to their respective owners, are used solely for authorised, internal training within a closed group of recipients, and imply no affiliation with or endorsement from the owners. If a rights holder objects to a template, we will remove it.

11. Confidentiality

The parties shall treat each other's non-public information as confidential — including reports on your organisation's training and simulation results — and shall use it only for the purposes of the agreement. This obligation also applies after termination. We will not use your name or logo in marketing without your consent.

12. Termination and cessation

You can cancel at any time in the admin panel or by writing to us; cancellation takes effect at the end of the paid period. We may terminate with 30 days' notice to the end of a month; any prepayment for the period after termination will be refunded. In the event of material breach — including misuse (section 5) or non-payment despite a reminder — we may suspend the account immediately and terminate without notice. Upon termination, we will delete or return personal data as you choose, pursuant to the data processing agreement (no later than 90 days after termination).

13. Force majeure

Neither party is liable for circumstances beyond that party's reasonable control, including failures at subcontractors, power outages, cyberattacks, war or government orders, for as long as the circumstance persists.

14. Assignment

We may assign the agreement as part of a full or partial business transfer or restructuring. You may not assign the agreement without our written consent, which will not be unreasonably withheld.

15. Changes to the terms

We may change these terms. Material changes will be notified by email with at least 30 days' notice. If you do not wish to continue under the amended terms, you may cancel before they take effect; continued use thereafter constitutes acceptance.

16. Governing law and venue

These terms are governed by Danish law. Disputes shall be resolved exclusively before the Danish courts, with the district court (byret) in the jurisdiction where WEAKESTLINK ApS has its registered office as the court of first instance.

Questions? Write to info@weakestlink.io.