Usta Digital (Pty) Ltd: Cyber Risk Snapshot Terms of Sale

Please read these points first

These are the terms most likely to matter to you. Each is explained in full in the clause shown.

1. The Snapshot is an indicative estimate for internal discussion, not advice. Do not rely on it for a board resolution, a lending, investment or insurance decision, or a regulatory filing (clause 6).
2. Our liability is limited to the amount you paid for the Snapshot, and we are not liable for indirect or consequential loss (clause 12).
3. Refunds. You can cancel for a full refund at any time before your run starts. Once your run has started at your request, it cannot be cancelled for a refund, unless the law gives you that right. If the scan of your domain cannot be completed, we refund you in full without you needing to ask (clauses 8 to 10).
4. You confirm that you are authorised to buy the Snapshot for your organisation and to ask us to check its domain, and that your answers are accurate to the best of your knowledge. Your organisation indemnifies us if those confirmations are untrue (clauses 3, 5 and 13).

1. About these terms

1.1 These terms govern the purchase and use of the Üsta Cyber Risk Snapshot (the Snapshot). The seller is Usta Digital (Pty) Ltd, registration number 2025/284709/07, a private company registered in South Africa (Üsta, we, us). The buyer is the organisation named in your order (your organisation), acting through the person who signs up (you). Where these terms say "you", they mean your organisation, and you as the person acting for it, as the context requires.

1.2 You accept these terms by ticking the acceptance box when you create your account, and again by paying. We record which version you accepted and when.

1.3 The contract for a Snapshot is concluded when your payment is confirmed.

1.4 The version of these terms in force when you pay applies to that order. Each version stays available at its own address, which is linked in your payment confirmation email. You can save or print it.

1.5 If your organisation has a signed agreement with Üsta that covers the Snapshot, that agreement prevails over these terms.

1.6 Nothing in these terms limits any right you have under the Consumer Protection Act 68 of 2008 or Chapter VII of the Electronic Communications and Transactions Act 25 of 2002 (ECTA), where either applies to you. If a provision of these terms would limit such a right, it applies only to the extent the law allows.

2. What you are buying

2.1 One Snapshot is one run. You answer a short questionnaire about your organisation and its controls (about 20 questions), and we carry out an outside-in check of your organisation's domain using publicly available information. From these we produce an indicative range of your organisation's expected annual cyber loss in South African rand, with a short report explaining what drives the range and what the outside-in check found.

2.2 The kinds of loss covered. The range covers the kinds of cyber loss named on the result. At the date of these terms they are: ransomware; data breaches; payment and invoice fraud; and major outages of cloud services or systems that are not caused by an attack. The range does not cover other kinds of cyber loss.

2.3 One run, one domain, one buyer. A purchase gives exactly one run, to the person who bought it, on the domain of their verified work email address or a subdomain of it. Another run is another purchase. We allow one run per domain in any seven-day period.

2.4 Delivery. Your result appears in your Snapshot account, and we email you a link to it that works for seven days. Results are usually ready within a few minutes of your run starting. If the scan of your domain cannot be completed, clause 10 applies.

2.5 Your result is kept as issued. We store your result with the version of our model that produced it. Later changes to our model do not change a result already issued. Your result stays available in your account for the period set out in our Privacy Notice.

2.6 The Reviewed Snapshot is a different product. It has your inputs reviewed and the output signed off, and it is prepared to be shared with a board, a lender or an insurer. It is contracted separately and is not part of a Snapshot purchase.

3. Who may buy

3.1 The Snapshot is for organisations assessing their own cyber exposure. It is not for personal or household use.

3.2 To buy a Snapshot you must:

(a) be at least 18 years old;

(b) sign up with your own work email address at your organisation's domain, and verify it;

(c) be authorised by your organisation to buy the Snapshot and to accept these terms on its behalf; and

(d) be authorised by your organisation to ask for an outside-in check of its domain.

3.3 Personal and disposable email addresses cannot be used. If you want a domain checked that is different from your email domain (for example, a holding company or a client), contact us; this cannot be done through the self-serve Snapshot.

3.4 The Snapshot is priced and reported in rand and is designed for organisations operating in South Africa. We may decline any order. If we decline an order after you have paid, we refund you in full.

4. Price and payment

4.1 The price is the price shown on the checkout page before you pay. The launch price is R3,000 for the first five paid orders we receive. After that the price is R7,500. It is a once-off payment for one run. There is no subscription and nothing renews.

4.2 No VAT is charged: Usta Digital (Pty) Ltd is not a registered VAT vendor. The price shown is the full amount payable. We add no other fees. If you pay with a card issued outside South Africa, your bank may charge its own fees.

4.3 Payment is by card through Manza (Manza Finance). Card payments are processed by Paystack South Africa (Pty) Ltd, a registered third-party payment provider. We never see or store your card details. Manza's and Paystack's own terms apply to the payment itself.

4.4 We email you a payment confirmation, which serves as your receipt. We can provide an invoice on request. Because we are not a registered VAT vendor, we cannot issue a tax invoice.

4.5 Launch-price feedback. An order at the launch price is made on one further condition, which you agree to at checkout. Your organisation will take part in a feedback call of about 20 minutes within 30 days of your result, and allows us to publish a short quote or case study about its Snapshot. We name your organisation where its policy allows, and otherwise describe it by sector and size. We send you the text first and publish nothing until you approve it in writing. We do not publish your result, figures, findings or answers unless you separately agree in writing. You may ask us to remove a published quote or case study at any time, and we will take it down from the places we control within ten business days.

5. How the outside-in check works, and its limits

5.1 The check is passive and uses publicly available information only, such as your domain's registration and email security records, your website's security settings as any browser sees them, lookalike domains registered on the internet, and information held by third-party services such as domain registries and lists of malicious websites.

5.2 We do not log in to, test, attack or try to get past any access control on your organisation's systems, and we do no intrusive testing of any kind. To run the check, we send your domain, hostnames and IP addresses to some third-party lookup services, as our Privacy Notice explains.

5.3 The check has limits:

(a) it shows your organisation's position on the day it ran;

(b) public sources can be incomplete, out of date or wrong;

(c) controls that cannot be seen from outside rely on your answers and on sector benchmarks, which widens the range;

(d) if a supporting check cannot be completed, the result is produced without it and the run remains valid; and

(e) if a core check that a valid result depends on cannot be completed, clause 10 applies.

5.4 Your answers are your responsibility. Before your run starts, you confirm that your answers are accurate to the best of your knowledge and that they are yours to provide. We do not verify them. Inaccurate answers produce an inaccurate result. Clause 11 explains how to correct a company fact.

5.5 The Snapshot measures exposure. It does not certify or guarantee that your organisation is secure or compliant, and a finding that nothing was detected does not mean nothing is there.

6. What the result is, and what it is not

6.1 An expected value, not a prediction. The range is an estimate of your organisation's expected annual cyber loss: an average over many possible years. It is not a prediction of any particular event or year. Actual losses will differ, and in a bad year they can be far higher than the range.

6.2 Indicative and unreviewed. The Snapshot has not been reviewed or signed off by Üsta's Actuarial Lead.

6.3 Permitted use, and no reliance. The Snapshot is for your organisation's preliminary internal understanding and discussion of its cyber exposure. It is not a verified assessment. Neither your organisation nor anyone else may rely on it as establishing your organisation's actual exposure, or use it as the basis for a board resolution, a lending or investment decision, a regulatory filing, or an insurance purchase or placement. If you need a figure to share for those purposes, ask us about the Reviewed Snapshot, which has its own terms.

6.4 Not advice. The Snapshot is not financial, insurance, legal, tax, accounting or security advice. It is not an actuarial opinion issued under a professional standard, a valuation, or an audit or assurance opinion.

6.5 Not insurance. The Snapshot is not a quote, a premium or a rate, and it is not a recommendation about whether to buy insurance cover, how much cover to buy or on what terms. We do not sell, arrange or advise on insurance.

6.6 Decisions you make using the Snapshot are your own.

7. Your account

7.1 Your account is for you alone. Keep your sign-in details secure and tell us promptly at hello@usta.co.za if you think someone else has used your account.

7.2 We may suspend an account to protect it, or our services, if we see signs of misuse or compromise.

8. Cancelling before your run starts

8.1 After you pay, and at any time before your run starts, you may cancel your order and we will refund the full amount. Email hello@usta.co.za from the email address on your account. A paid run that has not been started does not expire.

8.2 Your run starts when you confirm that you want it to start, on the final confirmation step, after you have answered the questions.

8.3 Cooling-off. If ECTA's cooling-off right applies to you (it applies to natural persons who buy as the end user), you may cancel within seven days of the agreement without reason. Under section 42(2) of ECTA, that right does not apply to services that began with your consent before the seven days ended. We ask for that consent on the final confirmation step. Until then, clause 8.1 gives you a full refund on request whether or not ECTA applies to you.

8.4 We process a refund under this clause within five business days of your request. It reaches your card account on your bank's timeline, and in any case within 30 days.

9. After your result is delivered

Once your result has been delivered, the Snapshot has been provided and we do not refund it. This does not affect clause 11 (corrections), clause 12.5, or any right you have under the Consumer Protection Act or Chapter VII of ECTA, where either applies.

10. If the scan of your domain cannot be completed

10.1 If a core check that a valid result depends on cannot be completed, we retry the run once, automatically.

10.2 If the retry also cannot be completed, we do not issue a result. We tell you by email and refund the full price to the card you paid with. You do not need to ask. We process the refund within five business days of the failed retry, and it reaches your card account within 30 days.

10.3 You are welcome to buy a new Snapshot later.

11. Corrections

11.1 Our errors. If your result is wrong because of an error on our side, such as a calculation error or a finding we got wrong, we correct it and reissue the result free of charge. The reissued result is marked "corrected", and we keep the original in our records.

11.2 Company facts. If a company fact you gave was wrong (for example your organisation's revenue, sector or number of employees), you may ask us once, within 30 days of delivery, to correct it and reissue the result at no charge. The correction uses facts as they stood on the date of the run. Your domain and your control answers cannot be changed this way; a run on different control answers is a new Snapshot.

12. Our liability (important)

12.1 We will provide the Snapshot with reasonable care and skill, using the method described in clauses 2 and 5.

12.2 To the extent the law allows, we give no other warranty, express or implied, including about the accuracy or availability of third-party data sources or uninterrupted availability of our services.

12.3 Cap. Our total liability arising out of or in connection with a Snapshot, or these terms as they apply to it, is limited to the amount you paid for that Snapshot.

12.4 Excluded losses. We are not liable for: indirect, consequential or special loss; loss of profit, revenue, business, opportunity, goodwill or data; loss arising from reliance on the Snapshot contrary to clause 6; or loss arising from inaccurate answers given by you or your organisation.

12.5 What we do not limit. Nothing in these terms limits or excludes liability for fraud, wilful misconduct or gross negligence by us or anyone acting for us, or any liability that cannot lawfully be limited or excluded.

12.6 No duty to anyone else. The Snapshot is prepared for your organisation only. We accept no duty or liability to any other person who sees or uses it.

13. Your confirmations and indemnity (important)

13.1 You confirm that: you are authorised by your organisation as clause 3.2 requires; the domain checked belongs to your organisation; and your answers are accurate to the best of your knowledge and yours to provide.

13.2 Your organisation indemnifies Üsta against any claim by a third party, and any resulting loss, fine and reasonable legal cost, arising from:

(a) any of the confirmations in clause 13.1 being untrue; or

(b) a breach of clause 15.

13.3 If you were not authorised to act for your organisation, you are personally responsible for the confirmations you gave.

13.4 If we reasonably believe a confirmation was untrue or clause 15 has been breached, we may cancel the order without refund, withhold or delete the result, and close the account. We may report serious misuse to the relevant authorities.

14. Intellectual property and use of the report

14.1 Üsta owns the Snapshot, the report, and the method, model, parameters, software and content behind them.

14.2 We grant your organisation a non-exclusive, non-transferable, perpetual licence to use the report for its own internal purposes, including sharing it in confidence with its directors, employees and professional advisers for discussion.

14.3 If you share the report, share all of it, including the basis statement. Do not edit it or remove Üsta's name or the basis statement.

14.4 You may not: publish the report; give it to a third party, such as a lender, insurer, investor, customer or regulator, as a basis for a decision; sell it; present it as reviewed or as your own work; or use the report or the service to build, train, calibrate or benchmark a competing product or model, or to try to work out our model, parameters or calibration.

14.5 Your answers remain your organisation's. You allow us to use them to provide the Snapshot and as clause 16 describes.

15. Acceptable use

You must not:

(a) ask for a check of any domain other than your organisation's own;

(b) get around our email verification, rate limits or the one-run rule, including by using a disposable or misleading email address;

(c) access our services by automated means, or scrape them;

(d) interfere with our services, or test their security, without our written consent. Good-faith security reports to hello@usta.co.za are welcome and are not a breach where you did not exploit, extract data or disrupt;

(e) give false information; or

(f) use the Snapshot in breach of any law, including the Protection of Personal Information Act 4 of 2013 and the Cybercrimes Act 19 of 2020.

16. Data, confidentiality and benchmarks

16.1 Our Privacy Notice at usta.co.za/privacy explains how we handle personal information. Under South African law, information about your organisation can also be personal information, and we treat it that way.

16.2 We keep your answers and your result confidential. We disclose them only to the service providers we need to deliver the Snapshot, where the law requires it, or with your consent.

16.3 We will not name or identify your organisation in any publication, benchmark, case study or marketing without your organisation's written consent.

16.4 We may combine de-identified information from your run with information from other runs, to improve our model and to publish aggregate benchmarks. We do this only in groups large enough that no organisation can be identified (at least 10 organisations), and never with your answers or findings as such. Your organisation can opt out at any time by emailing privacy@usta.co.za.

17. Changes

17.1 We may stop offering the Snapshot, or change it, for new orders. If we cannot deliver a run you have paid for, we refund you in full.

17.2 Changes to these terms apply only to orders placed after the change.

18. Events outside our control

We are not liable for delay or failure caused by events outside our reasonable control, including the failure of third-party services, networks or power supply. If such an event means we cannot deliver your result, clause 10 applies and you are refunded.

19. Complaints, disputes and general terms

19.1 Talk to us first. Contact hello@usta.co.za with any complaint. We aim to reply within five business days. Privacy complaints go to privacy@usta.co.za.

19.2 Law and courts. These terms are governed by the law of the Republic of South Africa, and the South African courts with jurisdiction may hear any dispute. Nothing in these terms limits your right to approach the National Consumer Commission, a consumer court or any other body under the Consumer Protection Act, where it applies.

19.3 General. If any provision is invalid, the rest remains in force. A delay in enforcing a right is not a waiver of it. These terms and the order are the whole agreement for a Snapshot, subject to clause 1.5. We may transfer our rights and obligations to a successor business; you may not transfer yours without our written consent. We send notices to the email address on your account; send yours to hello@usta.co.za.

20. Company information