Terms of Service

By using Seclum, you agree to these terms. They are an agreement between you and Angstroma, Inc.(a Delaware corporation operating the Seclum brand, referred to here as “Seclum,” “we,” or “us”). If you do not agree, do not use Seclum.

1. What Seclum does

Seclum is a tool that takes a URL or message you submit, asks an AI model whether it looks like a scam, and returns a verdict with reasoning. We do not block, redirect, or take any action based on that verdict — the decision is yours.

2. Account

You need an account to use Seclum. Every signed-in account gets a free tier of 5 reasoned checks per 24 hours. You agree to provide accurate information (an email address that you control), to keep your credentials secure, and not to share or transfer your account.

You must be at least 13 years old (16 in the EU) to create an account. Seclum is not directed to children.

3. Free tier

Every account gets 5 checks per 24 hours, free, with the full AI verdict and reasoning. The free tier is not a trial. We will not silently downgrade your verdicts, nor convert you to a paid tier without explicit action on your part.

4. Credit packs (paid)

Beyond the free 5-checks-per-day floor, you can buy credit packs:

• Starter — $5 for 500 credits
• Plus — $20 for 2,500 credits
• Power — $50 for 8,000 credits

Each fresh check beyond the daily free quota debits one credit. Cache hits do not debit credits. Failed checks (bad input, model error, abuse block) do not debit credits. Credits do not expire.

All payments are processed by Stripe. Your card data never touches our servers.

4b. Seclum Pro (optional subscription)

Seclum Pro is an optional plan at $4 per month, billed on a recurring basis through Stripe. It includes always-on email breach monitoring — we check your verified email addresses daily and email you when one appears in a new data breach — plus 300 AI checks per month across scam, password, and breach checks. It renews automatically each month until you cancel. You can cancel at any time from Settings → Manage subscription (the Stripe Customer Portal); cancellation stops future charges, and your Pro features remain until the end of the current billing period. The free 5-checks-per-day floor stays whether or not you subscribe. Subscription charges are not prorated or refunded for partial months (the 14-day policy below covers credit-pack purchases).

4c. Seclum Team (subscription)

Seclum Team is a per-seat plan at $4 per user, per month, billed on a recurring basis through Stripe by the team owner. A team on the free plan is the owner alone — adding a second member requires the paid Team subscription. Team includes phishing-awareness training for every seat, up to three AWS cloud connectors, and a pooled 300 AI checks per month shared across the whole team (not per seat).

You buy a fixed number of seats and cannot invite more members than you have paid seats. Cancel at any time from the Stripe Customer Portal. On cancellation or payment lapse the team returns to the free plan: existing members keep their access, but new invitations are blocked until you subscribe again.

6b. Phishing-awareness simulations and employee data (Team plan)

Seclum Team can send simulated phishing emails to your own employees as security-awareness training. The email is written by an AI model, it is sent from your own mailbox through a Google Workspace connector that your administrator authorizes, and anyone who clicks the link lands on a Seclum disclosure page that explains it was a simulation. That page has no login form, no password field, and captures nothing. The simulation teaches; it never harvests.

This feature processes the personal data of people who are not our users — your employees. The terms in this section are the conditions on which we will do that.

You are the controller. We are the processor.

For the employee personal data you enroll (their email addresses and whether they opened, clicked, or reported a simulation), you are the data controller and Seclum is your processor within the meaning of GDPR Article 28 and equivalent laws. We process that data only on your documented instruction, only to run the simulation you configured, and for no other purpose. We do not use it to train models and we do not sell it. Our Data Processing Agreement is available on request and governs this processing.

What you promise us

By running a simulation you represent and warrant that:

• You are the employer or authorized administrator of the mail domain you connect, and you are authorized to run security-awareness simulations on the people you enroll.
• You will only enroll addresses inside your own verified mail domain. (We also enforce this technically — a target outside the connected domain is rejected. You cannot use Seclum to phish another company.)
• You have a lawful basis for the processing and have completed any disclosure, notice, or consultation your jurisdiction requires. In several European countries this includes consulting a works council or employee representatives before monitoring-adjacent tooling is deployed. Meeting those obligations is your responsibility, not ours.
• You are responsible for your own employee-facing transparency notice — telling your people, in whatever form your law requires, that simulations happen.

Prohibited use — results are for coaching, never for judging people

You must not use simulation results to make or support decisions about hiring, firing, promotion, demotion, discipline, compensation, or performance evaluation. This is not a guideline; it is a condition of use, and we will terminate Team access for a violation.

The reason is legal as well as ethical. Seclum classifies this feature as a limited-risk AI system because it produces training content and makes no decision about any person. Using its output to evaluate employees would turn it into an employment-related AI system under Annex III of the EU AI Act, with a different and much heavier set of obligations that neither of us has undertaken. A click is a teachable moment. It is not evidence about an employee.

What we store, and what we do not

• We store:the target's email address, encrypted at rest, plus a one-way hash of it used as the internal handle; the outcome of the simulation (sent, opened, clicked, reported); and the coaching notes.
• We do not store the simulated email itself. The subject and body are generated, sent, and discarded — they are never written to our records.
• We do not collect anything else about the person — no name, no job title, no department, no manager. The AI model that writes the email never sees an employee address at all.
• Anthropic generates the training content and is our sub-processor for this feature. Google is your system, not our sub-processor — the mail leaves your tenant under your own mail policy.

Your kill switch

The connector we ask for is scoped to send only. Seclum cannot read your mail, cannot modify it, and cannot browse your directory. Revoke the grant in your Google Admin console at any time and we are cut off instantly. Removing a target deletes it outright; disconnecting the mailbox deletes the campaigns and targets that depended on it.

Subject rights: because you are the controller, requests from your employees come to you — and we will help you answer them. Tell us what to export or erase and we will act on it.

5. Refunds

We will refund unused credits within 14 days of purchase, no questions asked. Email hello@seclum.com with the order ID and we will process the Stripe refund and adjust your balance.

6. Acceptable use

You agree NOT to:

• Submit content you do not have the right to submit (e.g., personal data of others without their consent)
• Use Seclum to harass, defame, or harm others
• Reverse-engineer or attempt to extract our model weights or prompt content
• Automate Seclum to circumvent the rate limit or credit-pack debits (use the API when we offer it)
• Resell access to Seclum without a written agreement
• Probe, scan, or attempt to compromise our infrastructure (responsible disclosure: security@seclum.com)

We may suspend or terminate accounts that violate these terms. Unused credits in a terminated account are forfeit only if termination is for cause; otherwise they are refunded.

7. The verdict is advisory

The Seclum verdict is an opinion generated by an AI model. It can be wrong. It can be outdated (a domain that was safe yesterday can be compromised today). It can miss novel scams.

Do not treat a “safe” verdict as a guarantee. Use Seclum as a second opinion, not the only one. We are not liable for losses, damages, or harm arising from your reliance on a verdict.

8. Privacy

Our handling of your data is governed by our Privacy Policy. Short version: we hash your input at the edge, we never store the raw content, and you can export or delete everything from settings.

9. Intellectual property

Seclum, the Seclum™ name and logo, the AI agent prompts, and the source code are owned by Angstroma, Inc. At v1.5 launch the browser extension will be published under an open-source license. You retain all rights in the content you submit; we only need a limited license to process it for the purpose of generating your verdict.

10. Service availability

We aim for high availability but do not promise specific uptime. We may take Seclum offline for maintenance, security, or model updates. We will not give you advance notice for emergency maintenance.

11. Changes to these terms

If we make material changes, we will email you at the address on your account and post a notice on the home page for at least 30 days. Continued use after the change takes effect is acceptance of the new terms. If you disagree, delete your account.

12. Termination

You can delete your account from settings at any time. We may terminate your access for material violations of these terms or applicable law, with notice when feasible.

13. Disclaimers and limitation of liability

Seclum is provided “as is” and “as available.” We disclaim all warranties to the maximum extent permitted by law, including merchantability, fitness for a particular purpose, and non-infringement.

To the maximum extent permitted by law, our aggregate liability arising out of or related to Seclum is limited to the greater of (a) $100 USD or (b) the amount you paid us in the 12 months preceding the claim.

Some jurisdictions do not allow the exclusion of certain warranties or limitation of liability — in those jurisdictions, the above applies to the maximum extent permitted by law.

14. Governing law and disputes

These terms are governed by the laws of the State of Delaware, USA, without regard to conflict-of-laws rules. Disputes will be resolved in the state or federal courts located in Delaware, USA, except where applicable consumer-protection law gives you the right to bring a claim in your home jurisdiction.

15. Contact

Questions: hello@seclum.com. Legal notices: same address, marked “Legal” in the subject line.