Terms of Service

These terms govern your use of BadgerQuest, a security-awareness training service operated by CyberBadger, a company registered in Ontario, Canada. By creating an account, accepting an invitation, or using the service, you agree to them.

1. Definitions

• Services means the BadgerQuest application at badgerquest.ca and the infrastructure we run behind it.
• Organisation means a company, agency or other entity with its own BadgerQuest workspace.
• Account means one person's sign-in, whether personal or provided by an Organisation.
• Seat means a person who is a member of an Organisation, counted by membership rather than by how often they sign in. Every member is one seat whether or not they have used the Services recently.
• Plan means Wanderer, Realm or Stronghold, as described in section 4.
• Platform Content means our training content, the generator that produces simulated scams, and the archetypes, brand banks and other ingredient libraries behind it.
• Organisation Content means content an Organisation writes or edits in its own workspace.
• MSP means a managed service provider that contracts for a pool of seats on behalf of client Organisations (section 11).
• Quote means a signed enterprise order form for a Stronghold Plan.

2. Who can accept these terms for an organisation

If you accept these terms for an Organisation, by creating its workspace, accepting an invitation as its first administrator, or otherwise, you confirm you have authority to bind it. In that case "you" means the Organisation as well as you.

3. Accounts

You are responsible for your account and for keeping your password, passkey or single sign-on access secure. If an Organisation provided your account, your use is also subject to that Organisation's own policies. CyberBadger staff accounts are internal and are kept separate from customer Organisations.

4. Plans

• Wanderer: free, for individuals, with quest sessions capped at 5 per week.
• Realm: $4.00 CAD per seat per month, billed monthly, no seat minimum (one seat is a valid subscription), no commitment, cancel any time.
• Stronghold: enterprise, quoted individually. There is no published price and your terms are set by your Quote.

All prices are Canadian dollars, before tax (section 8).

5. Free trial

A 30-day free trial of the Realm Plan is available, with no card required and a limit of 50 seats during the trial. Each subject, whether an Organisation or an individual account, gets one trial ever. If you do nothing by the end of it, the account returns to the Wanderer Plan. Progress, history and content are kept; only the Plan changes.

6. Billing for Realm

Realm is billed monthly. Seats added during a period are prorated and charged then. Seats removed during a period are not refunded to your card; we bank the prorated amount as a credit against your next renewal. A daily reconciliation keeps the quantity we bill in line with your actual membership, so the bill follows your roster without you managing it.

7. Enterprise billing

Stronghold Plans run on the dates in your Quote rather than a monthly cycle. Where your Quote sets payment terms of 15, 30 or 60 days, access begins when we invoice you, not when payment arrives. We flag invoices at 30 days overdue, and suspending access for non-payment is always a decision a person makes, never an automatic one.

Stronghold Plans do not renew automatically, because repricing an enterprise agreement should be a decision rather than a default. A new Quote is required for each term. We send renewal reminders 60, 30 and 7 days before a term ends, and a term that lapses without a new Quote has a 14-day grace period before access changes.

8. Taxes and where we can sell

We charge GST or HST on Canadian sales at the rate for your province or territory. Four provinces (British Columbia, Manitoba, Quebec and Saskatchewan) levy their own separate sales tax on top, and we collect that only where we are registered to. We are registered in Ontario, and we do not currently sell into provinces whose separate sales tax we are not registered to collect.

Outside Canada, the only country we currently bill is the United States, where we charge no sales tax while our sales stay below each state's economic nexus threshold. That is a point-in-time position we monitor rather than a permanent exemption. Every charge, everywhere, is in Canadian dollars.

9. Failed payments and cancellation

If a card payment fails, the subscription enters a 14-day grace period and keeps working. If payment has still not succeeded at the end of it, the subscription is cancelled and the account returns to the Wanderer Plan.

If you cancel a Realm subscription yourself, access continues to the end of the period you have paid for, which runs 32 days from your last successful charge.

Lapsing to the free Plan removes access to paid features. It does not delete anything: progress, history and records are kept, and deletion is a separate act you choose (see the Privacy Policy).

10. Refunds

Refunds and voided charges sync from our payment provider and reverse the related credit on your account. Partial refunds are reviewed by a person before being issued. A refund does not by itself change your Plan or entitlement. Credit notes are available against enterprise invoices.

11. Managed service providers and pooled seats

An MSP can contract for a pool of seats and spread it across client Organisations on a single invoice rather than contracting per client.

Using more seats than the contracted pool is allowed and billed at the MSP's contracted rate. We do not block it. Two ceilings sit above the pool:

• Grace ceiling, the pool plus the greater of 10 seats or 10 percent. Above this, additions started by an administrator stop, so the refusal reaches somebody who can act on it. People arriving another way, such as signing in through single sign-on for the first time, are still admitted.
• Breach ceiling, the pool plus the greater of 100 seats or 25 percent. Above this everything stops. This is an incident backstop, for a client onboarded far outside the contracted pool without telling us, and not a limit anybody should meet in normal use.

An MSP sees each client Organisation's aggregate figures only, never that client's staff names or roster. Anything wider is arranged with us by agreement between the MSP and that client, not by a setting either can flip alone. The MSP is our contracting party for billing; each client Organisation remains responsible for its own people's data, as described in the Privacy Policy.

12. Content and intellectual property

Platform Content is ours. Organisation Content belongs to the Organisation that wrote it, and by creating it that Organisation grants us only the licence we need to host it and serve it to that Organisation's own members.

The generator and its ingredient libraries remain ours even when an Organisation uses them to draft something. An Organisation owns the output it edits and saves, not the generator or the banks it drew on. Organisation Content is isolated: it cannot reach or modify Platform Content, and it cannot reach or modify another Organisation's content.

If you send us feedback or suggestions, we may use them without obligation to you.

13. Simulated content and trademarks

To teach people to recognise phishing, BadgerQuest's training includes simulated messages that reference real company, brand and government agency names, in the way an attacker would when impersonating them. Those names and marks belong to their owners and are used nominatively, to identify what is being impersonated, for educational purposes only. BadgerQuest and CyberBadger are not affiliated with, endorsed by, or sponsored by any of them, and no message in the product actually originates from the party it names.

Every simulated message is fictional and stays inside the training app. We do not send simulated phishing to real inboxes, phone numbers or messaging accounts. That is a deliberate product stance, not a limitation: every simulation happens inside the app, where it is clearly practice rather than a test somebody can be blamed for failing.

14. Certificates

A certificate records completion of training. It carries the holder's name, the training name, the Organisation's name, a score and a unique serial, and anyone can verify it by opening the certificate address and matching the serial.

An Organisation can rebrand its own workspace (name, colour, emblem), and a rebranded workspace carries a "Powered by BadgerQuest" mark. A certificate cannot be rebranded and always states that it is verified by BadgerQuest. A certificate is evidence because a third party issued it; reissued under the holder's own brand it would be a claim they made about themselves.

A certificate evidences that the named person completed the named BadgerQuest training, and nothing more. It is not an accreditation, it is not issued by a standards body, and it does not certify that anyone complies with any law, standard or insurance requirement. Whether an auditor, insurer, regulator or customer accepts it as evidence of anything is entirely their decision, which we neither control nor promise.

15. Acceptable use

You may not:

• Attempt to breach the security of the Services, or the isolation between Organisations.
• Access data that is not yours.
• Abuse the Services automatically, for example by scraping or credential stuffing.
• Use the Services to create or send genuinely malicious content to anyone.

Keep any API keys we issue confidential, and use them only within the scopes they were granted. We apply rate limits and usage caps, published in our documentation rather than restated here so they stay current. We may suspend an account that breaches this section.

16. API access, and what you may do with what you export

Organisation customers on a qualifying Plan can use a read-only API, authenticated with organisation-scoped keys, each limited to its granted scopes and to 240 reads per minute. Entitlement is re-checked on every request, so API access stops as soon as a Plan lapses. Signed outbound webhooks are available for a fixed list of events, documented in our docs.

Data you export, including individual Human Risk Scores, is personal information about your own people, and you remain responsible for it once it leaves us. In particular, you agree not to use a BadgerQuest score as the sole basis for an automated decision that produces a legal or similarly significant effect on a person, such as automated disciplinary action, termination, or withdrawal of access, without human review. We tell your people that no algorithm acts on their score. This clause is what keeps that true once the data reaches your systems.

17. Availability

We do not offer a service level agreement, an uptime commitment or a public status page, and the Services are provided as is. We work to keep BadgerQuest available and to fix problems quickly, but we do not promise a level of availability and you should not plan around one.

18. Support

We aim to answer support requests promptly. We do not commit to specific response times.

19. Liability

To the maximum extent the law allows, our total liability arising out of or relating to the Services is limited to the fees you paid us in the three months before the event giving rise to the claim. Neither of us is liable to the other for indirect, incidental, special or consequential damages, including lost profits or lost data, even if warned they were possible.

BadgerQuest is training and risk-reduction software. It does not guarantee prevention of any security incident, and nothing in these terms should be read as such a guarantee.

Nothing here limits liability that cannot be limited under applicable Canadian law, including for gross negligence, wilful misconduct, or death or personal injury caused by our negligence.

20. Termination

You may stop using the Services and delete your account at any time. We may suspend or terminate an account for a breach of section 15, or for non-payment as described in section 9. For Stronghold Plans, your Quote governs termination where it addresses it.

21. Survival

Sections that by their nature should outlast the agreement do: definitions, content and intellectual property, simulated content and trademarks, certificates, liability, and governing law.

22. Changes to these terms

We may update these terms as the product, our business or the law changes, and will post the new version with a new effective date. Where a change is material we will take reasonable steps to tell you, by email or in the product, with reasonable notice before it takes effect.

23. Assignment

We may assign these terms in connection with a merger, acquisition or sale of substantially all of our assets. You may not assign them without our written consent.

24. Force majeure

Neither of us is liable for a failure or delay caused by events beyond reasonable control, including natural disasters, war, government action, and widespread infrastructure or internet outages.

25. Governing law

These terms are governed by the laws of Ontario, Canada, and the courts of Ontario have exclusive jurisdiction over disputes arising from them. Nothing in this section limits a consumer protection right you have where you live that cannot be waived.

26. Entire agreement, and how a Quote fits

These terms, the Privacy Policy, and where applicable your signed Quote and any Data Processing Agreement, are the whole agreement between us about the Services and replace anything agreed earlier on the same subject. Where a signed Quote conflicts with these terms, the Quote controls, but only on the specific point of conflict.

27. Severability

If any provision is unenforceable, the rest stands, and that provision is read as narrowly as needed to make it enforceable, or removed if it cannot be.

28. Contact

Questions about these terms: legal@cyberbadger.ca.

See also our Privacy Policy.