Authorization agreement and terms of use

You confirm you are authorised to bind the organisation named at signup. If you are not, do not accept. Authority to run security testing against staff normally sits with a director, or with the head of IT, security or human resources.

You instruct Vlumetech to send simulated phishing messages to email addresses on domains your organisation has verified through the platform, to record how recipients respond, and to present training to those who interact with a simulation.

Simulations are sent only to addresses on a verified domain. The platform refuses to send to any address outside one, so you cannot use it to target people outside your organisation.

For each employee on your roster the platform holds a name, an email address and an optional department, together with what they did with each simulation: whether it was delivered, opened, clicked, reported, or a credential submission occurred.

Passwords are never captured. Where a simulation presents a sign-in page, the platform records only that a submission event happened. The characters entered are discarded and are never written to storage or logs, in plain text or any other form.

You are the data controller for your employee data; Vlumetech processes it on your instruction. You are responsible for having a lawful basis for that processing under the data protection law that applies to you, and for telling your staff that security awareness testing forms part of your normal practice.

You are responsible for keeping your roster accurate, for removing people who leave, and for arranging any mail gateway changes needed for simulations to be delivered.

Results measure an organisation, not an individual. Vlumetech provides them so you can direct training, and asks that you do not use an individual’s result as grounds for disciplinary action. Programmes run that way suppress reporting, which is the behaviour the product exists to build.

A self-serve trial runs for seven days and is limited to twenty employees. You may configure your workspace during a trial, but live campaigns are not enabled until Vlumetech has reviewed and approved the account. Every phishing scenario is reviewed by Vlumetech before it can be sent.

You may withdraw this authorization at any time by notifying Vlumetech, which stops further simulations. Vlumetech may suspend an account where it reasonably believes the platform is being used against people outside your organisation, or otherwise unlawfully.

When you accept, Vlumetech records the version of this agreement, the email address of the person accepting, the date and time, and the originating IP address. That record is visible to you in your account and is retained for the life of the account.

Material changes are published as a new version. Continued use after a new version is published does not, by itself, constitute acceptance of it; Vlumetech will ask you to accept a new version where one materially changes your obligations.