SecurityMetrics

Privacy Policy and Terms

Add Comment

Contact Us Store Log In Data Security Penetration Testing Vulnerability Scan (ASV) Threat Intelligence Managed Firewall Ecommerce Security NIST 800-30 Risk Assessment Card Data Discovery PII Data Discovery Internal Scan Security Training Mobile Security EI3PA Compliance Consulting Reseller Incident Response PCI PCI Compliance PCI Policies PCI Training PCI DSS Audit PA-DSS Audit P2PE Audit Acquirer PCI Program PCI Compliance for Small Businesses PIN Security Assessment HIPAA HIPAA Compliance HIPAA for Small Practices HIPAA Audits for Covered Entities HIPAA Audits for Business Associates HIPAA for Health Networks HIPAA Policies HIPAA Training HITRUST GDPR eDiscovery Learn Blog Learning Center Data Security Academy SecurityMetrics Summit Contact No Worries, We Keep Your Information Safe No Worries, We Keep Your Information Safe Ask a question SecurityMetrics Privacy Policy&nbsp. Introduction SecurityMetrics, Inc. is aware of the privacy concerns of its customers. Our policy for collecting and using personal information is detailed below. EU-US Privacy Shield &amp. Swiss-US Privacy Shield This Privacy Policy describes how SecurityMetrics collects, uses, and discloses certain personally identifiable information that we receive in the US from the European Economic Area (“EEA Personal Data”). SecurityMetrics recognizes that the EEA has established strict protections regarding the handling of EEA Personal Data, including requirements to provide adequate protection for EEA Personal Data transferred outside of the EEA. To provide adequate protection for certain EEA Personal Data about Customers received in the US, SecurityMetrics has elected to self-certify to the EU-US Privacy Shield Framework administered by the US Department of Commerce (“Privacy Shield”). SecurityMetrics adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and Liability. SecurityMetrics also complies with the Swiss-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information from Switzerland. For purposes of enforcing compliance with the Privacy Shield, SecurityMetrics is subject to the investigatory and enforcement authority of the US Federal Trade Commission. For more information about the Privacy Shield, see the US Department of Commerce’s Privacy Shield website located at: https://www.privacyshield.gov. To review SecurityMetrics’ representation on the Privacy Shield list, see the US Department of Commerce’s Privacy Shield self-certification list located at: https://www.privacyshield.gov/list Information Collected SecurityMetrics collects information about its Customers from third parties such as acquiring banks, merchant service providers, and independent sales organizations (collectively “MSPs”), with whom the Customer has a contractual relationship and through its website and related eCommerce services at several points. SecurityMetrics’ website is maintained in the United States of America. By using SecurityMetrics’ website, you freely and specifically give us your consent to export your personally identifiable information to the USA and store and use it in the USA as specified by this Privacy Policy. All information collected by SecurityMetrics is provided by the user, which in this case is the Customer. <ul> <li>SecurityMetrics may collect information related to user information of Customer contacts as part of the services performed for a Customer including name, email address, phone number, address, fax numbers, and other contact information related to the user.</li> <li>Credit card data of the Customer may be collected and stored by SecurityMetrics. This data is stored in accordance with the PCI DSS.</li> <li>SecurityMetrics also collects data related to a Customer’s data security as requested by the Customer when purchasing the services. This data includes answers to self-assessment questionnaires, vulnerability scan data, and which security services the Customer purchases.</li> <li>SecurityMetrics allows Customers to add additional users to a Customer’s account. Customer agrees that SecurityMetrics may allow an MSP from whom it received Customer’s information to be added as an additional user on a user’s account with rights to make changes to the account.</li> <li>SecurityMetrics collects information that is not personally identifiable to the user, such as referring URL addresses, time spent in certain areas of SecurityMetrics’ website, actions taken while on SecurityMetrics’ website, and origination of the user.</li> <li>Certain information such as your IP address, browser type, domain names, and access times may also be collected.</li> <li>To receive products and services sold or provided by SecurityMetrics, contact information is required for billing, communicating about the services, and to perform the services.</li> </ul> Information Usage <ul> <li>Part of SecurityMetrics services is to report certain Customer compliance with data security standards, and this reporting requires contact information of the Customer.</li> <li>SecurityMetrics must be certified as an Approved Scanning Vendor in order to provide certain scanning services. Part of the agreement with the Payment Card Industry Security Standards Council (“PCI SSC”), the body that certifies Approved Scanning Vendors, requires SecurityMetrics to provide information requested by the PCI SSC.</li> <li>SecurityMetrics may use the information collected to provide notifications regarding the Customer’s services, accounts, fulfillment of transactions, information about SecurityMetrics’ websites, service changes, special offers, legal notices, and newsletters.</li> <li>Customers who provide information may receive email announcements regarding SecurityMetrics’ services from time to time.</li> <li>SecurityMetrics may use the information and data submitted by users and customers for any other purposes related to SecurityMetrics’ business that are compatible with the purposes for which your information was collected by SecurityMetrics, including, but not limited to, conducting market research, improving its products and services, sending surveys, and notifying customers of product upgrades and updates, new products, special offers, seminars and conventions and any other changes within SecurityMetrics that may affect customers and users.</li> </ul> We process EEA Personal Data for the purposes stated above. SecurityMetrics will only process EEA Personal Data in ways that are compatible with the purpose that SecurityMetrics collected it for, or for purposes the individual later authorizes. Before we use your EEA Personal Data for a purpose that is materially different than the purpose we collected it for or that you later authorized, we will notify you and provide you with the opportunity to opt out. Third parties with whom SecurityMetrics Shares Information SecurityMetrics’ policy in relation to information collected through registration, testing, and/or any other means is to respect and protect the privacy and confidentiality of our users. SecurityMetrics does not disclose, rent, or sell email addresses, security test results, or any other information that we may receive to any third party, unless: <ul> <li>specifically requested by the customer;</li> <li>requested or required by applicable credit card associations, acquiring banks, credit card processors, or merchant service providers with which SecurityMetrics has a contractual agreement;</li> <li>in response to duly authorized information requests of governmental authorities or where required by law;</li> <li>in connection with any legal proceedings where disclosure of such data has been requested or required;</li> <li>to service providers to conduct customer surveys, research and analytics, marketing, and data enrichment. or</li> <li>to an agent of SecurityMetrics acting on behalf of SecurityMetrics (e.g., for database hosting, data processing or mailing services). In this case, SecurityMetrics will make certain that the agent complies with the GDPR and Privacy Shield principles (as defined above) and our commitments in this policy.</li> </ul> Under certain circumstances, we may remain liable for the acts of our third-party agents or service providers who perform services on our behalf for their handling of EEA Personal Data that we transfer to them. Access to Information SecurityMetrics understands the importance of maintaining accurate information and thus SecurityMetrics allows Customers to update their information on SecurityMetrics websites through those websites. Customers may choose to remove information collected by SecurityMetrics by contacting us in writing at: SecurityMetrics, Inc., 1275 West 1600 North, Orem, UT 84057. SecurityMetrics will respond to the request within thirty (30) days. SecurityMetrics retains information for as long as an account is active or as needed to provide the services requested by the Customer. SecurityMetrics will also retain information as needed to comply with legal or tax obligations, comply with industry regulations, resolve disputes, and enforce agreements. Privacy Shield Questions or Complaints You can direct any questions or complaints about the use or disclosure of your EEA Personal Data to us at privacy@securitymetrics.com. We will investigate and attempt to resolve any complaints or disputes regarding the use or disclosure of your EEA Personal Data within 45 days of receiving your complaint. For any unresolved complaints, we have agreed to cooperate with our Independent Dispute Resolution Body, the EU Data Protection Authorities, who will resolve the issue within a reasonable timeframe. These EU Data Protection Authorities can be reached at: https://edps.europa.eu. SecurityMetrics has further committed to cooperate with the panel established by the EU data protection authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved Privacy Shield complaints concerning data transferred from the EU and Switzerland. Data Security SecurityMetrics maintains reasonable and appropriate security measures to protect EEA Personal Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction in accordance with the Privacy Shield. Use of Cookies SecurityMetrics uses cookies to track how you interact with our website. SecurityMetrics does not sell cookies information to third parties or track you outside of SecurityMetrics website. Opt Out Customers who do not wish to receive commercial information from SecurityMetrics may opt out of that email by following the instructions at the bottom of the email. Customers are not usually able to opt out of emails containing information regarding a Customer’s account, services, or transactions. Binding Arbitration Customer may have the option to select binding arbitration for the resolution of Customer’s complaint under certain circumstances, provided you have taken the following steps: (1) raised your compliant directly with SecurityMetrics and provided us the opportunity to resolve the issue. (2) made use of the independent dispute resolution mechanism identified above. and (3) raised the issue through the relevant data protection authority and allowed the US Department of Commerce an opportunity to resolve the complaint at no cost to you. For more information on binding arbitration, see (https://www.privacyshield.gov/article?id=ANNEX-I-introduction). Amendments This privacy policy may be amended from time to time consistent with the requirements of the Privacy Shield Principles. We will post any revised policy on this website. Contact To access your information, ask questions about our privacy practices, request to limit the disclosure of your personal information, or issue a complaint, contact us at: SecurityMetrics 1275 W 1600 N Orem, UT 84057 privacy@securitymetrics.com 801-724-9600 Effective Date: May 25, 2018 SECURITYMETRICS TERMS OF USE AGREEMENT The following terms and conditions (collectively "Terms of Use Agreement"), are entered into by and between You, the customer ("Customer" or "you"), and SecurityMetrics, Inc., a Utah corporation ("SecurityMetrics"). The Terms of Use Agreement relates to SecurityMetrics' compliance and data security programs and services, which may include but are not limited to Payment Card Industry Data Security Standard ("PCI DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), Managed Firewall, and other data security and compliance services (collectively "Services"). The Terms of Use Agreement also apply to all content functionality, and services offered or purchased on or through www.securitymetrics.com (the "Website"). By use of any Services or the Website, you accept and agree to all conditions imposed in this Terms of Use Agreement. Note: THIS TERMS OF USE AGREEMENT CONTAINS ARBITRATION, WARRANTIES, AND LIMITATION OF LIABLITY CLAUSES THAT AFFECTS YOUR RIGHTS UNDER THIS TERMS OF USE AGREEMENT WITH RESPECT TO ALL SERVICES. Services You may select some or all of the following Services: PCI Compliance. If you have selected service packages that contain PCI Compliance Services, then that package may include, but is not limited to, all or some of the Services listed below. <ul> <li>Help you determine the scope of the applicable PCI Compliance requirements. You alone are responsible for determining the scope of your PCI Compliance requirements. SecurityMetrics will not be liable for any mistake or error in determining the scope;</li> <li>Provide you with a copy of the self-assessment questionnaire determined by the scope determined above and help understanding the questions, if needed;</li> <li>Provide vulnerability scanning on IP addresses or domains specified and provided by the Customer. all vulnerability scanning is done in accordance with Warranties and Limitation of Liabilities Sections of this Terms of Use;</li> <li>Provide Customer with access to scan results and copies of the self-assessment questionnaire</li> <li>Report the status of the self-assessment questionnaire and vulnerability scans via SecurityMetrics website;</li> <li>Service Warranty (described below);</li> <li>One or more, depending on the invoice, non-exclusive, non-transferable license(s) of PANscan® during the term of this Terms of Use. PANscan® is SecurityMetrics' software that finds unencrypted credit card numbers on computer systems;</li> <li>One or more, depending on the invoice, non-exclusive, non-transferable license(s) of PIIscan® during the term of this Terms of Use. PIIscan® is SecurityMetrics' software that finds unencrypted personally identifiable information on computer systems;</li> <li>SecurityMetrics Mobile, a software application that scans mobile devices for vulnerabilities;</li> <li>Seats to PCI Compliance trainings. and</li> <li>Technical support.</li>   </ul> HIPAA If you have selected service packages that contain HIPAA Compliance Services, then that package may include, but is not limited to, all or some of the Services listed below: <ul> <li>Help you determine a map of the Protected Health Information ("PHI") – as defined by 45 C.F.R. part 164 and subparts A and B of part 160 – contained on your systems. You alone are responsible for determining what, how much, and where PHI is located on your systems. SecurityMetrics will not be liable for any mistake or error in determining your PHI map.</li> <li>Provide a template of a general risk analysis document that inventories the hardware, software, policies, and procedures put in place by you.</li> <li>Provide a template of a risk management plan document.</li> <li>Vulnerability scanning on IP address or domains specified and provided by the Customer.</li> <li>Business Associate Agreement;</li> <li>Service Warranty (described below);</li> <li>One or more, depending on the invoice, non-exclusive, non-transferable license(s) of PANscan® during the term of this Terms of Use Agreement. PANscan® is SecurityMetrics' software that finds unencrypted credit card numbers on computer systems;</li> <li>SecurityMetrics Mobile, a software application that scans mobile devices for vulnerabilities;</li> <li>Seats to SecurityMetrics trainings. and</li> <li>Technical support.</li>   </ul> Managed Firewall Services Managed Firewall Services is part of a PCI Compliance service package. If you have selected service packages that contain Managed Firewall Services, then that package may include, but is not limited to, some or all of the following: <ul> <li>SecurityMetrics will provide you with some equipment that contains a firewall, managed by SecurityMetrics ("Managed Equipment"). The firewall may be managed by SecurityMetrics:<ul> <li>Monitoring the hardware and the firewall,</li> <li>Updating and patching the firewall,</li> <li>Maintaining logs at SecurityMetrics discretion, and</li> <li>Providing Customer support.</li> </ul> </li> <li>The Managed Equipment also has internal vulnerability scanning capability to scan your internal network. All vulnerability scanning is performed in accordance with Warranties and Limitation of Liabilities Sections of this Terms of Use Agreement.</li> <li>SecurityMetrics may also provide another piece of equipment ("Failover Equipment") that supports 3G or 4G failover in case the internet connection of the Managed Equipment is not working or down. You are responsible for purchasing any secure digital ("SD") cards required for the 3G or 4G wireless access to function.</li> <li>SecurityMetrics or other third parties own and retain all rights to the hardware, software, and firmware of the Managed Services, Managed Equipment, and Failover Equipment. The hardware will not be deemed fixtures or in any way part of your premises. SecurityMetrics may remove or change the hardware at SecurityMetrics' sole discretion at any time. You may not sell, lease, abandon, or give away the hardware. The hardware may only be used on the premises that you and SecurityMetrics configured the hardware for during the initial set-up call. YOU UNDERSTAND AND ACKNOWLEDGE THAT IF YOU MOVE, INSTALL, OR USE THE HARDWARE OR MANAGED FIREWALL SERVICES AT A LOCATION OTHER THAN THE PREMISES FOR WHICH IT WAS SET UP, THEN THE SERVICES AND HARDWARE MAY NOT FUNCTION PROPERLY.</li> <li>SecurityMetrics has no obligation to provide support, maintenance, or repair of any hardware or software not owned by SecurityMetrics.</li>   </ul> Changes to Services or Rates SecurityMetrics reserves the right to change the Services, prices, or charges at any time without notice. If you do not accept these changes, you have the right to cancel the Services, but cancellation fees may apply. If you continue to use the Services after these changes have been applied, then you be deemed to have accepted these changes. Changes to the Terms of Use Agreement We may revise and update this Terms of Use Agreement from time to time in our sole discretion. All changes are effective immediately when SecurityMetrics posts them, and apply to all access to and use of the Website thereafter. Your continued use of the Website and the Services following the posting of a revised Terms of Use Agreement means that you accept and agree to the changes. You are expected to check this page so you are aware of any changes, as they are binding on you. Prohibited Uses: Users are strictly forbidden to use the Services or the Website to perform security tests on computers, servers, or devices that they do not have permission or authorization to test. If Customer uses a third party hosting service, Customer must notify the service and receive permission for SecurityMetrics to perform security testing. Customer agrees to hold SecurityMetrics harmless for any failure to obtain any necessary permission. Customer may not use the Services or the Website: <ol> <li> In any way that violates any applicable federal, state, local, or international law or regulation (including, without limitation, any laws regarding the export of data or software to and from the US or other countries). </li> <li> For the purpose of exploiting, harming, or attempting to exploit or harm minors in any way by exposing them to inappropriate content, asking for personally identifiable information or otherwise. </li> <li> To impersonate or attempt to personate SecurityMetrics, a SecurityMetrics employee, another user, or any other person or entity (including, without limitation, by using email addresses associated with any of the foregoing). </li> <li> To transmit, or procure the sending of, any advertising or promotional material including any junk mail, chain letter, or spam or any other similar solicitation. </li> <li> To engage in any other conduct that restricts or inhibits anyone's use or enjoyment of SecurityMetrics Websites, or may harm SecurityMetrics or any of its users </li> </ol> Additionally, you agree not to: <ol> <li> Use any robot, spider, or other automatic device, process, or means to access this Website for any purpose, including monitoring or copying any of the material on the Website. </li> <li> Introduce any viruses, Trojan horses, worms, logic bombs or other material which is malicious or technologically harmful. </li> <li> Attack the Website via a denial-of-service attack or a distributed denial-of-service attack. </li> <li> Attempt to gain unauthorized access to, interfere with, damage or disrupt any parts of the Website or any user's use of the Website. </li> <li> Otherwise attempt to interfere with the proper working of the Website. </li>   </ol> Enrollment By creating a user name or accessing and using the SecurityMetrics Website, Customer agree to be bound by this Terms of Use Agreement. Customer hereby requests SecurityMetrics to perform security testing Services as outlined in the SecurityMetrics invoice previously generated by Customer ("Invoice"), as well as any additional services Customer subsequently requests, pursuant to this Terms of Use Agreement. Customer assumes sole responsibility and liability for any problems or liabilities arising out of any failure to provide SecurityMetrics with all of Customer's IP addresses and/or domain names that should be tested. SecurityMetrics has the right to change the Services and its prices at any time. SecurityMetrics will use good faith efforts to notify Customer of such changes via e-mail or other written notice. Term By using this Website, you agree to this Terms of Use Agreement. This Terms of Use Agreement are effective upon your access to the Website or agreement to abide by them and will continue in effect for one (1) year, unless Customer has purchased packages including Managed Firewall services. If you have selected service packages that contain Managed Firewall Services, then this Terms of Use Agreement will remain in effect for three (3) years. If Customer is purchasing online Compliance services, this Terms of Use Agreement shall automatically renew for successive one-year terms. Only Customer or SecurityMetrics may terminate this Terms of Use Agreement at any time upon written notice, with or without cause. Customer agrees that SecurityMetrics may contact Customer in furtherance of the automatic renewal of the Services. Intellectual Property SecurityMetrics will provide Customer with written or online reports, data, policies, templates, checklists, and other materials (collectively, "Materials") in connection with the Services. Customer agrees that all intellectual property rights in the Materials, including trade secrets, copyrights, patents and trademarks, are exclusively owned by SecurityMetrics and its licensors. Customer shall hold in confidence all Materials marked as "confidential" and shall use the Materials solely for the purposes for which they are disclosed. All Materials are licensed to Customer only for its own use and Customer does not have any rights to copy, distribute or make derivative works of the Materials without the prior written authorization of SecurityMetrics. Dissemination, distribution, copying or use of the Materials in whole or in part by a SecurityMetrics competitor or their agents is strictly prohibited. Payment Customer agrees to pay all charges for the Services provided to Customer, unless Customer's acquirer, payment processor, or other entity has entered into an agreement with SecurityMetrics to pay for those services. If Customer's acquirer, processor or other entity has an agreement with SecurityMetrics to pay for the Services, then Customer authorizes its acquiring bank or other merchant service provider to bill Customer for the Services. If Customer has provided SecurityMetrics with credit card information ("Card Information"), Customer authorizes SecurityMetrics to charge Customer the price of the Services, as provided in the invoice or order confirmation sent by SecurityMetrics, using the Card Information. Customer also authorizes SecurityMetrics to charge any cancellation fee associated with the cancellation of the Services. If Customer is purchasing online Compliance services, Customer also authorizes SecurityMetrics to automatically charge the price of Services for each renewal term of this Agreement using the Card Information. Customer agrees to give SecurityMetrics prompt notice of any changes to the Card Information. Cancellation Fee. For Customers that have purchased packages of services that contain Managed Firewall Services, a cancellation fee will apply if Customer cancels the Managed Firewall Services before the end of the three-year term. The cancellation fee will cover the costs of hardware and the setup fees and may vary depending on the circumstances of the cancellation. Collection Costs. If SecurityMetrics uses a collection agency or attorney to collect money owed by you, you agree to pay the reasonable costs of collection, including, but not limited to, any collection agency's fees, reasonable attorneys' fees, and arbitration or court costs. Refund Policy. If an acquirer or merchant service provider pays for the Services, refunds may not apply. Refunds for the unused portion of services may be obtained by contacting the Account Renewals team at SecurityMetrics. Refunds will be processed within 5 business days. SecurityMetrics owns and operates the servers that host this web site. Contact information for SecurityMetrics may be obtained by clicking the "Contact Us" link at the top of any page. Accuracy of Information Customer's compliance depends entirely upon the accuracy of information provided to SecurityMetrics by Customer. Customer agrees that if Customer provides incomplete or inaccurate information this may affect the Services, Customer's compliance status, and SecurityMetrics will not be held liable for any damages incurred as a result of incomplete or inaccurate information provided by customer. A scan result from SecurityMetrics only indicates the compliance status of the systems that SecurityMetrics has scanned and does not represent Customer's overall compliance status with the PCI Data Security Standards. Customer also agrees to give SecurityMetrics prompt notice if any information affecting data security previously provided to SecurityMetrics has changed, is changing or will change. Customer understands and agrees that any threat designated as a false positive by Customer is done at Customer's own risk. In no event shall SecurityMetrics be liable for any damages incurred by Customer as a result of Customer's designation of a threat as a false positive. Communications Customer authorizes SecurityMetrics to contact Customer through email, phone or fax to notify Customer of changes in Customer's compliance status or Services. Customer also authorizes SecurityMetrics to contact Customer in regards to payment, renewal, cancellation, or the Services. Reliance on Information Posted The information presented on or through the Website is made available solely for general information purposes. SecurityMetrics does not warrant the accuracy, completeness or usefulness of this information. Any reliance you place on such information is strictly at your own risk. SecurityMetrics disclaims all liability arising from any reliance placed on such materials by you or any other visitor to the Website or by anyone who may be informed of any of its contents. Information About You and Your Visits to the Website All information we collect on this Website is subject to our Privacy Policy, which can be found at: https://www.securitymetrics.com/terms-of-service#privacy. By using the Website, you consent to all actions taken by us with respect to your information in compliance with the Privacy Policy. Limited Warranty DUE TO THE NATURE OF THE COMPUTER SECURITY BUSINESS, NO SECURITY COMPANY CAN GUARANTEE THAT IT WILL DETECT EVERY VULNERABILITY OR SECURITY PROBLEM. SECURITYMETRICS PROVIDES ITS SERVICES ON AN "AS IS" BASIS AND WITHOUT ANY WARRANTIES WHATSOEVER. SECURITYMETRICS DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO ITS SERVICES, MATERIALS AND PRODUCTS. SECURITYMETRICS DOES NOT WARRANT THAT THE SERVICES WILL DETECT EVERY VULNERABILITY ON CUSTOMER'S SYSTEM, OR THAT SECURITYMETRICS' VULNERABILITY ASSESSMENTS, SUGGESTED SOLUTIONS OR ADVICE WILL BE ERROR-FREE OR COMPLETE. CUSTOMER AGREES THAT SECURITYMETRICS SHALL NOT BE RESPONSIBLE OR LIABLE FOR THE ACCURACY OR USEFULNESS OF ANY INFORMATION PROVIDED BY IT, OR FOR ANY USE OF SUCH INFORMATION. Limitation of Liability Customer acknowledges that use of the Services does not guarantee compliance with the PCI DSS, the HIPAA Standard, or any other security or privacy standards, or that its Systems are secure from unauthorized access. This is due to, and Customer acknowledges that, the Services being dependent upon multiple variables, which include the information provided by Customer, and Customer's level of cooperation with policies regarding compliance with the PCI DSS or the validation thereof. CUSTOMER ACKNOWLEDGES THAT THE RATE OF BRINGING CUSTOMER AND ITS SYSTEM IN COMPLIANCE WITH PCI DSS OR HIPAA IS DEPENDENT UPON MULTIPLE VARIABLES, WHICH INCLUDE CUSTOMER'S LEVEL OF COOPERATION WITH POLICIES REGARDING COMPLIANCE. UNDER NO CIRCUMSTANCES SHALL SECURITYMETRICS, ITS AFFILIATES OR THEIR LICENSORS, SERVICE PROVIDERS, EMPLOYEES, AGENTS, OFFICERS, OR DIRECTORS BE LIABLE FOR DAMAGES OF ANY KIND, UNDER ANY LEGAL THEORY, ARISING OUT OF IN CONNECTION WITH CUSTOMER'S USE, OR INABILITY TO USE, THE WEBSITE, ANY WEBSITES LINKED TO IT, ANY CONTENT ON THE WEBSITE OR SUCH OTHER WEBSITES OR ANY SERVICES ON OR OBTAINED THROUGH THE WEBSITE, DELAY IN BECOMING OR CUSTOMER'S FAILURE TO BECOME COMPLIANT. IN NO EVENT SHALL SECURITYMETRICS OR ITS AGENTS BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO, PERSONAL INJURY, PAIN AND SUFFERING, EMOTIONAL DISTRESS, LOSS OF REVENUE, LOSS OF PROFITS, LOSS OF BUSINESS OR ANTICIPATED SAVINGS, LOSS OF USE, LOSS OF GOODWILL, LOSS OF DATA, AND WHETHER CAUSED BY TORT (INCLUDING NEGLIGENCE), BREACH OF CONTRACT OR OTHERWISE, EVEN IF FORESEEABLE. THE FOREGOING DOES NOT AFFECT ANY LIABILITY WHICH CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW. Limitation of Action. No action arising out of this Terms of Use Agreement, regardless of the form of action, may be brought by Client more than one year after the action accrued. Indemnification You agree to defend, indemnify and hold harmless SecurityMetrics, its affiliates, licensors and service providers, and its and their respective officers, directors, employees, contractors, agents, licensors, suppliers, successors and assigns from and against any claims, liabilities, damages, judgments, awards, losses, costs, expenses or fees (including reasonable attorneys' fees) arising out of or relating to your violation of this Terms of Use Agreement or your use of the Website, including, but not limited to any use of the Website's content, services and products other than as expressly authorized in this Terms of Use Agreement or your use of any information obtained from the Website. Arbitration Excluding Customer Complaints regarding SecurityMetrics' Privacy Policy and the Terms and Conditions therein, SecurityMetrics may require you, at SecurityMetrics' sole discretion, to submit any disputes arising from the use of this Terms of Use Agreement or the Website, including disputes arising from or concerning their interpretation, violation, invalidity, non-performance, or termination, to final and binding arbitration under the Rules of Arbitration of the American Arbitration Association applying Utah law. General Provisions SecurityMetrics reserves the right to modify this Terms of Use Agreement at any time without notice. This Terms of Use Agreement will be construed in accordance with and governed by the laws of the State of Utah and applicable U.S. federal laws, without regard to conflicts of laws provisions. Jurisdiction and venue for any actions arising under or relating in any way to this Terms of Use Agreement will vest exclusively in the courts of general jurisdiction of the State of Utah. This is the sole agreement between the parties concerning its subject matter. If any term of this Terms of Use Agreement is found void or unenforceable, all other terms shall remain in full force and effect. Customer may not assign this Terms of Use Agreement without SecurityMetrics' written consent. SecurityMetrics and Customer agree to the terms of the Privacy Policy posted on the SecurityMetrics.com Website with respect to the use and protection of Customer's data. The headings of this Terms of Use Agreement are for convenience and ease of reference only, and shall not be used to construe, interpret, expand, or limit the terms and conditions of this Terms of Use Agreement. No waiver of any Terms of Use Agreement right will be effective unless in writing signed by an authorized representative of the waiving party. No waiver of a right arising from any breach or failure to perform will be deemed a waiver of any future right. No person or entity, whether or not mentioned or referred to in this Terms of Use Agreement, other than Customer and SecurityMetrics and their permitted successors and assigns, will be considered to be a third-party beneficiary of or entitled to assert any rights under this Terms of Use Agreement. None of the information contained within our Services, or within the content SecurityMetrics makes available through our Services, should be regarded as Legal Advice. The distribution and publication of our Services, and the content made available with our Services, does not create an attorney-client relationship between Customer and SecurityMetrics. SecurityMetrics reserves the right to modify or terminate the Services and SecurityMetrics' Websites or to terminate Customer's access to the Services and SecurityMetrics' Website, in whole or in part, at any time. PREMIUM SERVICE WARRANTY("BREACH PROTECTION"). The following Premium Service Warranty ("PSW") applies to Customers who have purchased Services that also contains a premium service warranty. <ol> <li>The Warranty. <ol> <li>SecurityMetrics will provide a PSW to merchants or entities in the health industry (collectively "Merchants") that have purchased service packages that include a premium service warranty. This PSW provision modifies the Limited Warranty provision set forth above for those Merchants that are enrolled in and have purchased a service package that includes a PSW. SecurityMetrics represents and warrants that SecurityMetrics PCI DSS and HIPAA compliance Services will be performed in accordance and comply with the PCI DSS as amended or HIPAA as amended from time to time. SecurityMetrics provides a PSW to a Merchant only for Services actually purchased by the Merchants.</li> <li>Exclusions. This PSW excludes incorrect data, information, or policies provided by the Merchant, zero-day vulnerabilities, customer labeled false positives identified by SecurityMetrics' scanning engine. The PSW does not apply to SecurityMetrics Managed Firewall Services, any security and privacy trainings sold by SecurityMetrics, and any services performed by a Qualified Security Assessor, Payment Application Qualified Security Assessor, Point-to-Point Encryption Qualified Security Assessor, Payment Card Industry Forensic Investigator, penetration tester, or an employee supervised by one of the above-mentioned specialists.</li> <li>A Merchant that is enrolled in SecurityMetrics' PCI or HIPAA compliance services that includes a PSW, and suffers a data breach as a result of a failure of such SecurityMetrics' Services, will be reimbursed by SecurityMetrics for certain expenses described in Section 2 below and subject to all other terms and conditions in this Terms of Use Agreement. The foregoing sets forth SecurityMetrics' sole liability and a Merchant's sole remedy for any data breach while enrolled with a PSW Service.</li> <li>A Merchant's credit card processor, acquiring bank, independent sales organization, or merchant services provider (collectively "Acquirer") may contract and/or pay SecurityMetrics for the PCI compliance Services, for which SecurityMetrics provides the PSW.</li> </ol> </li> <li>Reimbursement Limitations. The PSW is not available to level 1 Merchants, as level 1 Merchants are defined by the card brands. The PSW is only available to Merchants located in the United States and Canada and that have enrolled in and paid (or whose Acquirer has paid) SecurityMetrics for the Services described in this Terms of Use Agreement or an applicable Statement of Work. The PSW reimburses a Merchant up to $100,000 (the "PSW Limit") per Merchant identification number (or other mutually agreed upon form of identification,) subject to the terms and limitations described more fully below. SecurityMetrics will reimburse Merchants only for the following costs and expenses actually incurred as a result of a failure of SecurityMetrics' Services to comply with PCI DSS and HIPAA, and that are timely reported according to Section 5 below by Merchants in connection with a properly reported data breach: <ol> <li>Penalties or fines charged to Merchant by Visa, MasterCard, Discover, American Express, or JCB directly or through an Acquirer. A fine or penalty by a card brand must not exceed the maximum monetary assessment, fine, fee, or penalty permitted by applicable rules or agreements in effect as of the inception date of this Terms of Use Agreement.</li> <li>Costs of a forensic investigation conducted by a PCI Forensic Investigator approved by the PCI Security Standards Council.</li> <li>The costs associated with replacing credit cards that were compromised in a breach.</li> <li>Any GLBA or HIPAA regulatory penalty or fine charged to a Merchant by a governmental regulatory agency or body.</li> <li>The cost of an audit to determine the cause or extent of a GLBA or HIPAA violation.</li> <li>If approved in writing by SecurityMetrics, notification costs, victim cost reimbursement, or identity theft monitoring and services.</li> </ol> </li> <li>The Program is Not Insurance. The PSW is not insurance. Neither Merchants nor any other entity with which the Merchant has a relationship receives insurance as a result of the PSW or this Terms of Use Agreement. Neither the Merchant nor any other entity with which the Merchant has a relationship is an "insured" or beneficiary under any insurance policy. Nothing in PSW or this Terms of Use Agreement creates an insurance relationship between Acquirer or the merchant and AIG (or any other AIG affiliate). SecurityMetrics is not providing Merchants or any entity with which Merchants have a relationship with insurance pursuant to a contractual agreement. </li> <li>The Program Limit. The PSW Limit is the most any Merchant can recover for each merchant identification number (or other mutually agreed upon form of identification) during a twelve (12) month period for any or all such costs or expenses, combined, and regardless of the number of data security events discovered or regulatory actions taken. </li> <li>Notification. Merchants are required to provide SecurityMetrics notice within thirty (30) days of discovery or suspicious of a breach or compromise. A Merchant is required to provide SecurityMetrics with any documentation, invoice, or other evidence required by SecurityMetrics within thirty (30) days after receipt of this documentation, invoice, or other evidence. </li> <li>Reporting. The PSW reimburses Merchants only if a Merchant provides a timely (within 30 days) notification and complete report of a data security event or regulatory action as soon as the Merchant becomes aware of such event or action. Merchants will need to provide details on the data security event or regulatory action including, but not limited to: a complete description of the data security event or regulatory action, all documents relating to the data security event or regulatory action, and any other pertinent information requested by or on behalf of SecurityMetrics. To report a data security event or regulatory action under the Program, contact SecurityMetrics at: Breach_Reporting@securitymetrics.com. </li> <li>Reimbursement Process. <ol> <li>Merchants must provide invoices of costs described in Section 1 above to SecurityMetrics in a timely manner–within 30 days. Merchants may email SecurityMetrics at the email address above, or by certified mail to 1275 West 1600 North, Orem, Utah 84057.</li> <li>Once an invoice is received by SecurityMetrics, SecurityMetrics will determine whether the PSW applies to the Merchant's breach or compromise. If SecurityMetrics determines that the PSW applies and SecurityMetrics will reimburse the Merchant in accordance with the PSW terms, then SecurityMetrics will provide the Merchant with the reimbursement in a reasonable time. If SecurityMetrics determines that the PSW doesn't apply, then SecurityMetrics will notify the Merchant that no reimbursement is available.</li> </ol> </li> <li>Limitation of Liability for the Program. Merchants assume sole responsibility and liability for making timely and complete claims under the PSW, providing necessary or requested data and information, and otherwise complying with the terms and conditions set forth in the PSW. </li> </ol> Scanning Abuse SecurityMetrics, Inc., is a PCI Approved Scanning Vendor under certificate number 3707-01-08 and performs security assessment scans within the guidelines of the PCI data security initiative. Scanners It is important to allow SecurityMetrics security scanners to have the same level of network access to your Internet-connected devices that you provide to the rest of the world under normal circumstances. Users of SecurityMetrics scanning services are encouraged to add rules to their firewalls and inform their ISPs or hosting providers that security assessment scans may originate from the scanning locations listed in the table below. Ensuring that traffic from SecurityMetrics scanners does not get blocked ensures maximum accuracy of the security assessments, which leads to better security. If you have any questions, please contact SecurityMetrics Technical Support.   SecurityMetrics Scanners IP Ranges Subnet Mask (Short) Subnet Mask (Long) 162.211.152.1-255 162.211.152.0/24 162.211.152.0/255.255.255.0 Note: This table may be updated from time to time without notice.   Abuse Users of SecurityMetrics scanning services are required to consent to abiding by the Terms of Use before purchasing scanning services from SecurityMetrics. SecurityMetrics takes reports of abuse very seriously and works with ISPs, hosting providers, and other organizations to ensure that any abuse is dealt with in a timely and appropriate manner. CTA Do you believe some form of SecurityMetrics scanning service abuse is occurring? Please email us (scanabuse@securitymetrics.com) COMPLIANCE <ul> <li> GDPR Compliance </li> <li> PCI Compliance </li> <li> PCI DSS Audit </li> <li> PCI Level 4 Program </li> <li> PA DSS Audit </li> <li> P2PE Audit </li> <li> PIN Security Assessment </li> <li> PCI Policies </li> <li> HIPAA Compliance </li> <li> HIPAA Policies </li> <li> HIPAA Training </li> <li> HIPAA BA Program </li> <li> HITRUST </li> </ul> DATA SECURITY <ul> <li> Vulnerability Scan </li> <li> Penetration Testing </li> <li> Security Training </li> <li> PANscan® </li> <li> SecurityMetrics Vision </li> <li> SecurityMetrics Mobile </li> <li> GSA Schedule HACS </li> <li> Consulting </li> <li> Reseller </li> <li> Forensic/Incident Response </li> <li> eDiscovery </li> <li> Data and Network Security </li> <li> Data Security Academy </li> <li> Webpage Integrity Monitoring (WIM) </li> <li> Shopping Cart Inspect </li> <li> Shopping Cart Monitor </li> </ul> COMPANY <ul> <li> Our Story </li> <li> Blog </li> <li> Media Relations </li> <li> Careers </li> <li> Terms of Use </li> <li> Privacy </li> <li> Privacy Rights Requests </li> <li> Abuse </li> </ul> Contact <ul> <li> Contact Us </li> </ul> STAY UP TO DATE STAY UP TO DATE SUBSCRIBE TO OUR BLOG Subscribe Your IP Address is: 188.68.49.4 © 2021 SecurityMetrics Inc., All Rights Reserved. CloseAddThisMay we use cookies to track your activities? Please see our privacy policy for details and any questions.Yes No