EVOKE SECURITY TERMS OF SERVICE
Effective Date: May 17, 2026
These Terms of Services, together with any terms incorporated by reference (collectively, the “Terms”), govern access to and use of the internet-based platform, software, browser extensions, and associated services (collectively, the “Services”) offered by Evoke Security, Inc. (“Evoke”, “we”, “us”, or “our”), including as made available at and through the website evokesecurity.com or any other website Evoke may create (the “Site”). These Terms govern use of the Services by both individual users (each, a “User”, “you”, “your”) and, to the extent the Services is used by a User on behalf of an organization or other entity (each, an “Organization”), by such Organization. Any User accepting these Terms on behalf of an Organization represents and warrants they have the authority to bind such Organization to these Terms. As used in these Terms, “Customer” means the applicable User and, if applicable, the Organization on whose behalf such User is using the Services.
PLEASE READ THESE TERMS CAREFULLY. BY INDICATING ACCEPTANCE OF THESE TERMS VIA CLICK-THROUGH OR OTHER ELECTRONIC MEANS OFFERED BY EVOKE, BY INSTALLING OR DEPLOYING ANY ENDPOINT SENSOR, BROWSER EXTENSION, PROXY, SDK, OR OTHER EVOKE SOFTWARE, OR BY OTHERWISE ACCESSING OR USING THE SERVICE, CUSTOMER IS ENTERING INTO A LEGAL AGREEMENT WITH EVOKE AND AGREES TO BE BOUND BY THESE TERMS AS OF SUCH APPLICABLE DATE (THE “EFFECTIVE DATE”). IF CUSTOMER DOES NOT AGREE WITH THESE TERMS, CUSTOMER IS NOT PERMITTED TO USE THE SERVICE.
Notwithstanding the foregoing, if an Organization has entered into a separate, written master services agreement with Evoke governing access to and use of the Services (“MSA”), such MSA will control with respect to such Organization’s use of the Services to the extent of any conflict with these Terms.
We may make changes to these Terms or to the Services from time to time. When such changes are made, we will make the updated Terms available on the Site. Unless otherwise notified by Evoke, Customer understands and agrees that the updated Terms will be effective upon posting and that Customer’s continued use of the Services after such date constitutes acceptance of the updated Terms. If Customer does not agree to the updated Terms, Customer must discontinue use of the Services.
Eligibility and User Accounts. In order to access and use the Services, each User must have an account with Evoke (each, a “User Account”). A User may create a User Account directly or, where applicable, a User Account may be created on behalf of such User by the applicable Organization. Each User represents and warrants that: (i) the User is at least 18 years old and has the legal authority to enter into these Terms; (ii) all information provided to Evoke is current, accurate, and complete; (iii) the User will not allow another person to access the Services using their User Account; and (iv) the User will not access the Services using another individual’s User Account.
If a User is using the Services on behalf of an Organization, such Organization may be able to access and view such User’s use of the Services as well as restrict or terminate such User’s access. Organizations are liable for the acts and omissions of all Users who access and use the Services on behalf of such Organization, including their compliance with these Terms.
Security and credentials. Customer is responsible for (i) using the Services in a private and secure manner, and (ii) maintaining the confidentiality of each applicable User Account and any API keys, tokens, or similar credentials we provide to Customer that enable Customer to send data to, or interact with, the Services (“API Tokens”, and collectively with login and password information for all applicable User Accounts, “Credentials”). Evoke is not liable for any damage or loss due to unauthorized User Account or Organization access resulting from Customer’s acts or omissions, or, in the case of an Organization, any acts or omissions of any Users using the Services on behalf of such Organization.
If Customer becomes aware of (a) any unauthorized use of an applicable User Account or Organization workspace, (b) any loss, theft, or disclosure to an unauthorized third party of any Credentials, or (c) any other compromise of an applicable User Account or Organization workspace, Customer will notify Evoke immediately at support@evokesecurity.com.
Use of the service. Customer will use the Services solely in accordance with these Terms, the documentation for the Services published by Evoke (the “Documentation”), and the applicable subscription plan, if any, including any subscription period, number of monitored agents, events, endpoints, or other usage parameters (collectively, “Approved Use”), as well as applicable laws and regulations.
Without limiting the foregoing, Customer will not, and will not permit any User or third party to:
use the Services in a way that negatively affects others or our ability to provide the Services;
use the Services for any illegal or unauthorized purpose, or in violation of any applicable export-control, sanctions, privacy, or data-protection laws;
use any technology or other means not authorized by us to access the Services or to extract data;
attempt to gain unauthorized access to the Services or any portion thereof, including by trying to circumvent any restrictions, rate limits, or authentication mechanisms;
attempt to decipher, decompile, reverse engineer, disassemble, reproduce, modify, copy, distribute, publicly perform, publicly display, or create derivative works of the Services or the source code of the software used to provide the Services (including any endpoint sensor, browser extension, or proxy API client), except as and only to the extent permitted by applicable law;
use the Services, or any data or output derived from the Services, to build, train, or improve any competing product, service, or machine learning model, or to benchmark the Services for competitive purposes without Evoke’s prior written consent;
deploy or install any Evoke endpoint sensor, browser extension, SDK, proxy, or other Evoke software on any device, account, environment, or data source for which Customer does not have the authority to do so;
use the Services to process sensitive categories of personal information (including, without limitation, protected health information subject to HIPAA, or any similar categories) except as expressly permitted in a separate written agreement with Evoke; or
Make improper use of our support services or submit false reports of abuse or misconduct.
Upload or transmit (or attempt to upload or to transmit) any material that acts as a passive or active information collection or transmission mechanism, including without limitation, clear graphics interchange formats (“gifs”), 1×1 pixels, web bugs, cookies, or other similar devices (sometimes referred to as “spyware” or “passive collection mechanisms” or “pcms”).
Use a buying agent or purchasing agent to make purchases on the Site. Make any unauthorized use of the Site, including collecting usernames and/or email addresses of users by electronic or other means for the purpose of sending unsolicited email, or creating user accounts by automated means or under false pretenses.
Deployment, Sensors, And Scope Of Monitoring. The Services are designed to discover, inventory, monitor, and help secure artificial intelligence agents, agent skills, model context protocol servers, tools, models, and data sources within Customer’s environment. Depending on the components Customer elects to deploy, the Services may include, without limitation: (a) a lightweight endpoint sensor installed on User or Organization endpoints; (b) a browser extension that monitors interactions with web-based AI platforms; (c) production integrations (including with cloud providers and source-code hosts); (d) a Python SDK and proxy API; and (e) SaaS integrations and connectors.
Customer is solely responsible for: (i) determining where, when, and in what scope to deploy each component of the Services; (ii) obtaining and maintaining all authorizations, legal bases, and notices required to install such components and to monitor the relevant endpoints, browsers, accounts, integrations, users, agents, and data flows; (iii) providing all notices to and, where required, obtaining all consents from its employees, contractors, and other Users whose activity may be observed by the Services; and (iv) ensuring that Customer’s deployment and use of the Services complies with all applicable laws, including, without limitation, employment, labor, and electronic-communications-monitoring laws in each jurisdiction where the Services is deployed.
Customer acknowledges that the Services observes, logs, and processes agent prompts, tool calls, API calls, MCP calls, browser interactions, configuration data, and other activity in order to perform inventory, posture management, threat modeling, detection, prevention, and response functions. Customer is responsible for the lawful collection, configuration, and use of all such data.
Complimentary Services And Pre-Release Features. Evoke may elect to offer Customer certain complimentary proof-of-concept, onboarding, trial, or other similar services (“Complimentary Services”), and/or access to certain “pre-release,” “experimental,” “beta,” or other Services features prior to their full commercial release (“Pre-Release Features”), at Evoke’s sole option. Receipt and use of any Complimentary Services and/or Pre-Release Features may be conditioned on acceptance of additional terms and may be subject to confidentiality obligations.
CUSTOMER HEREBY ACKNOWLEDGES AND AGREES THAT COMPLIMENTARY SERVICES AND PRE-RELEASE FEATURES MAY EXPERIENCE DELAYS OR FAILURES OF FUNCTIONALITY, MAY BE INCOMPLETE, AND MAY CONTAIN ERRORS, DEFECTS, BUGS, OR OTHER INACCURACIES THAT COULD CAUSE FAILURES, CORRUPTION, OR LOSS OF DATA. FEATURES AND FUNCTIONALITY MAY CHANGE AT ANY TIME. CUSTOMER SHOULD NOT RELY ON ANY FUNCTIONALITY REFLECTED IN ANY COMPLIMENTARY SERVICES OR PRE-RELEASE FEATURES BEING INCLUDED IN A COMMERCIAL VERSION OF THE SERVICE. EVOKE SHALL HAVE NO LIABILITY FOR ANY COMPLIMENTARY SERVICES OR PRE-RELEASE FEATURES, INCLUDING, WITHOUT LIMITATION, FOR ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING OUT OF OR IN CONNECTION WITH ANY SUCH COMPLIMENTARY SERVICES OR PRE-RELEASE FEATURES, REGARDLESS OF THE FORM OF ACTION. THIS SECTION SUPERSEDES ANY CONFLICTING PROVISION OF THESE TERMS.
Fees And Payment. Access to the Services may be available under a subscription fee with specific features, functionality, and usage limits. By signing up for any paid plan (a “Paid Plan”), Customer expressly agrees that we are authorized to charge Customer for: (i) the fees for the applicable Paid Plan billed annually in advance on the frequency stated at the time of purchase; (ii) any other fees owed for the Services, including overages for usage above the purchased tier; and (iii) any applicable taxes, duties, or similar charges (other than taxes based on Evoke’s net income) in connection with Customer’s use of the Services, to the payment method Customer provides, and to reimburse us for all collection costs and interest for any overdue amounts.
When Customer purchases a Paid Plan (each such purchase, a “Transaction”), Customer will supply additional information relevant to such Transaction (collectively, “Payment Information”). Customer must provide current, complete, and accurate Payment Information, and must promptly update Customer’s Payment Information if it changes.
We may change our prices at any time, provided that we will give Customer fifteen (15) days’ notice for changes to the pricing of any existing Paid Plan. All fees in connection with the Services are non-refundable and non-cancelable, unless otherwise indicated in the purchase order for the Services (“Purchase Order”).
Payment processing is handled by third-party payment processors (each, a “Payment Processor”). Customer may be required to register with, and agree to the terms of service of, the applicable Payment Processor. Evoke is not a party to, and has no obligations or liability under, any such agreement between Customer and a Payment Processor.
If Customer’s use of the Services substantially exceeds the resource requirements of typical customers on a similar plan (for example, in endpoints monitored, events ingested, storage, or computing resources), we may limit or suspend Customer’s Services until such usage is within a more typical operating range, or we may invoice Customer for overage on a pro-rata basis.
Privacy and processing of personal information. Evoke’s privacy notice, available at https://www.evokesecurity.com/privacy (the “Privacy Notice”), describes how Evoke processes personal information it collects in connection with the Site and the Services. The Privacy Notice is incorporated into these Terms by reference.
To the extent Customer submits personal data or personal information (each as defined under applicable law) to the Services for processing on Customer’s behalf, Customer further agrees that: (i) Customer is responsible for providing all legally required privacy notices and obtaining all necessary consents and legal bases for the processing of such personal data via the Services; and (ii) the Evoke Data Processing Addendum, available at evokesecurity.com/dpa (the “Evoke DPA”), is incorporated herein by reference and applies to such processing. Customer represents and warrants that Customer has provided all necessary privacy notices and obtained all necessary consents, authorizations, and legal bases prior to submitting any personal data to the Services. Customer is responsible for processing such personal data in accordance with all applicable laws and regulations.
Given the nature of the Services, Customer further acknowledges that the Services will observe activity of individuals (including employees, contractors, and other authorized users) who interact with the agents, tools, endpoints, browsers, and integrations Customer has chosen to monitor. Customer is solely responsible for determining whether, and in what manner, such monitoring is lawful in each jurisdiction in which it is performed, and for providing any notices to, and obtaining any consents from, such individuals as may be required.
Proprietary rights. Customer acknowledges and agrees that Evoke owns all legal right, title, and interest in and to the Services and the Site (whether those rights are registered or not, and wherever in the world those rights may exist), including all software, sensors, extensions, APIs, detection engines, detection signatures, heuristic and machine-learning models, policy frameworks, documentation, and other technology comprising or associated with the Services, and all improvements, enhancements, and modifications thereto. These Terms do not convey to Customer any rights of ownership in or related to the Services, the Site, or any intellectual property rights that belong to Evoke whether registered or unregistered.
Provided that Customer is eligible to use the Site or Services, Customer is granted a limited license to access and use the Site or Services. We reserve all rights not expressly granted to you in and to the Site or the Services.
Customer hereby grants to Evoke a worldwide, fully paid-up, royalty-free, and non-exclusive license to use, reproduce, adapt, modify, host, maintain, process, compile, translate, share, display, distribute, and perform the Customer Data (and data derived therefrom) for the purpose of providing, operating, securing, and supporting the Services (and related systems and technologies) for Customer.
Evoke will have the right (during and after the Term hereof) to: (i) use Customer Data and data derived therefrom to operate, secure, maintain, improve, and enhance the Services and for other development, diagnostic, and corrective purposes in connection with the Services and other Evoke offerings; (ii) collect and use aggregated, de-identified, or anonymized usage, configuration, threat, and performance data to measure the performance of, and to develop new features and threat intelligence for, the Services (“Services Analyses”); and (iii) disclose any of the foregoing solely in aggregate or other de-identified form in connection with its business, including for security research, industry benchmarking, and publication of threat intelligence. Evoke will own all legal right, title, and interest in and to the Services Analyses.
Customer may choose, or we may invite Customer, to submit comments or ideas about the Services, including suggestions for improvement (“Feedback”). By submitting any Feedback, Customer agrees that such submission is gratuitous, unsolicited, and without restriction, will not place us under any fiduciary or other obligation, and that we are free to use the Feedback without any additional compensation to Customer and to disclose the Idea on a non-confidential basis or otherwise to anyone.
Customer hereby agrees that Evoke shall have the right to identify Customer as a customer of the Services, and display Customer’s name and logo (if any) in connection with such identification, on the Evoke websites and in our other published marketing materials. We will use good-faith efforts to comply with any reasonable trademark usage guidelines Customer provides to Evoke.
Term and Termination. These Terms will take effect upon the Effective Date and will continue until terminated by either Customer or Evoke.
Customer may stop using the Services at any time and may terminate these Terms upon thirty (30) days prior notice to Evoke. If Customer terminates these Terms and cancels the Services, Customer’s cancellation will take effect immediately upon our receipt of Customer’s cancellation notice. However, if Customer has a Paid Plan with a monthly or annual subscription term, Customer’s cancellation will take effect at the end of such then-current subscription term.
Customer agrees that we, in our sole discretion and for any or no reason, may terminate Customer’s User Account and access to the Services. Customer agrees that any termination of access to the Services may be without prior notice, and that we will not be liable to Customer or any third party for such termination. Unless otherwise stated at the time of purchase, all fees are non-refundable and non-cancellable.
After any termination hereof, Customer will no longer have access to Customer Data through the Services, and we may delete all such Customer Data. We accept no liability for such deleted Customer Data. We have no obligation to provide Customer a copy of any Customer Data, except to the extent required by applicable law. Customer may request an export of Customer Data prior to termination of these Terms for any reason, provided that if we terminate these Terms (other than for Customer’s breach), we will provide Customer a reasonable opportunity to retrieve Customer Data.
In addition to the foregoing termination rights, Evoke shall have the right to temporarily suspend or limit Customer’s access to the Services (including Customer’s User Account, Organization workspace, and any Customer Data), in its sole discretion, if Customer violates a material restriction or obligation in these Terms, or if in Evoke’s reasonable judgment the Services or any component thereof is about to suffer a threat to security or functionality, or to prevent harm to Evoke, its customers, or third parties. Evoke will use reasonable efforts to re-establish access to the Services promptly after Evoke determines, in its reasonable discretion, that the situation giving rise to the suspension has been cured.
The provisions of these Terms relating to limitation of liability, warranty disclaimer, indemnification, intellectual property rights, confidentiality, and any other provisions that by their nature should survive termination shall continue in effect after termination of these Terms.
Warranty Disclaimer
CUSTOMER EXPRESSLY UNDERSTANDS AND AGREES THAT THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE,” AND THAT CUSTOMER’S USE OF THE SERVICE IS AT CUSTOMER’S OWN RISK. EVOKE, ITS SUBSIDIARIES AND AFFILIATES, AND ITS LICENSORS MAKE NO EXPRESS WARRANTIES AND DISCLAIM ALL IMPLIED WARRANTIES REGARDING THE SERVICE, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, EVOKE, ITS SUBSIDIARIES AND AFFILIATES, AND ITS LICENSORS DO NOT REPRESENT OR WARRANT TO CUSTOMER THAT: (A) CUSTOMER’S USE OF THE SERVICE WILL MEET CUSTOMER’S REQUIREMENTS; (B) CUSTOMER’S USE OF THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE, OR FREE FROM ERROR; (C) ANALYSIS DATA, DETECTION RESULTS, OR OTHER OUTPUTS PROVIDED THROUGH THE SERVICE WILL BE ACCURATE, COMPLETE, OR FREE FROM FALSE POSITIVES OR FALSE NEGATIVES; OR (D) THE SERVICE WILL DETECT, PREVENT, BLOCK, OR RESPOND TO ALL MALICIOUS, UNAUTHORIZED, OR OTHERWISE HARMFUL ACTIVITY. CUSTOMER ACKNOWLEDGES THAT NO SECURITY PRODUCT IS INFALLIBLE AND THAT CUSTOMER REMAINS SOLELY RESPONSIBLE FOR THE SECURITY OF ITS ENVIRONMENT.
Limitation of Liability
CUSTOMER EXPRESSLY UNDERSTANDS AND AGREES THAT EVOKE, ITS SUBSIDIARIES AND AFFILIATES, AND ITS LICENSORS SHALL NOT BE LIABLE TO CUSTOMER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES WHICH MAY BE INCURRED BY CUSTOMER, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY. THIS SHALL INCLUDE, WITHOUT LIMITATION, ANY LOSS OF PROFIT, LOSS OF GOODWILL OR BUSINESS REPUTATION, LOSS OF DATA, LOSS ARISING FROM UNDETECTED OR UNPREVENTED SECURITY INCIDENTS, OR OTHER INTANGIBLE LOSS. EVOKE’S TOTAL CUMULATIVE LIABILITY FOR DIRECT DAMAGES INCURRED BY CUSTOMER IN CONNECTION WITH THESE TERMS OR THE SERVICE (INCLUDING ANY THIRD-PARTY MATERIALS), WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, WILL NOT EXCEED THE GREATER OF: (I) THE FEES PAID BY CUSTOMER TO EVOKE IN THE TWELVE (12) MONTH PERIOD PRIOR TO THE EVENT GIVING RISE TO THE APPLICABLE CLAIM; AND (II) ONE HUNDRED U.S. DOLLARS (US$100). THE LIMITATIONS ON OUR LIABILITY TO CUSTOMER ABOVE SHALL APPLY WHETHER OR NOT EVOKE HAS BEEN ADVISED OF, OR SHOULD HAVE BEEN AWARE OF, THE POSSIBILITY OF ANY SUCH LOSSES. NOTWITHSTANDING THE FOREGOING, NOTHING IN THESE TERMS SHALL EXCLUDE OR LIMIT EVOKE’S LIABILITY FOR LOSSES WHICH MAY NOT BE LAWFULLY EXCLUDED OR LIMITED BY APPLICABLE LAW.
Indemnification. Customer agrees to defend, indemnify, and hold Evoke and our subsidiaries, affiliates, officers, agents, employees, advertisers, licensors, suppliers, and partners harmless from and against any third-party claim arising out of or in any way related to: (i) Customer’s breach of these Terms (and, in the case of an Organization, a breach by any User using the Services on Customer’s behalf); (ii) Customer’s violation of any applicable law or regulation, including any privacy, data-protection, or electronic-monitoring law; (iii) Customer’s deployment of any Evoke Services; or (iv) any Customer Data, including any claim that Customer Data infringes or misappropriates any third-party intellectual property or privacy right. Evoke will provide Customer with written notice of any such claim. We may also assume control of the defense or settlement of a claim subject to indemnification hereunder at any time upon notice to Customer.
Third-Party Materials. The Services may include or interoperate with software (such as open-source software), materials, models, agents, tools, platforms, and content developed by third parties (“Third-Party Materials”), including, without limitation, cloud providers, source-code hosts, productivity suites, foundation model providers, agent frameworks, MCP servers, and browser platforms. Customer’s use of Third-Party Materials may be subject to additional terms and conditions of the applicable third party. With respect to hyperlinks to, or integrations with, other websites or services, Evoke provides such links and integrations as a convenience, is not responsible for the availability of any such external sites, services, or resources, and does not endorse any advertising, products, or other materials on or available from such websites, services, or resources. Evoke has no responsibility or liability with respect to Customer’s access to or use of Third-Party Materials.
General
These Terms, including the Privacy Notice, the DPA (if applicable), and any other terms incorporated by reference, constitute the entire legal agreement between Customer and Evoke and completely replace any prior agreements between Customer and Evoke in relation to the Services. Notwithstanding the foregoing, if Customer is an Organization and has entered into an MSA with Evoke, such MSA shall continue to govern such Organization’s use of the Services in place of these Terms of Services to the extent of any conflict.
Should any provision of these Terms be found invalid or unenforceable, the remaining terms shall still apply. There are no third-party beneficiaries to these Terms. The parties are independent contractors, and nothing in these Terms creates an agency, partnership, or joint venture.
Customer agrees that we may provide Customer with notices, including those regarding changes to the Terms, by email, regular mail, or postings on the Services or our website at our sole discretion. By providing us an email address, Customer consents to our using the email address to send Customer any notices required by law in lieu of communication by postal mail.
Customer agrees that if we do not exercise or enforce any legal right or remedy contained in these Terms (or of which we have the benefit of under any applicable law), this will not be taken to be a waiver of our rights and that those rights or remedies will still be available to us. If for any reason a court of competent jurisdiction finds any provision of these Terms to be unenforceable, that provision will be enforced to the maximum extent permissible so as to effect the intent of the parties, and the remainder of these Terms will continue in full force and effect.
These Terms, and Customer’s relationship with us under these Terms, shall be governed by the laws of the State of California, without regard to its conflict-of-laws provisions. Customer agrees to submit to the exclusive jurisdiction of the state and federal courts located in Delaware to resolve any legal matter arising from these Terms, except that we may seek injunctive or other equitable relief in any court of competent jurisdiction to protect our intellectual property or confidential information.
Customer will comply with all applicable laws and regulations and will not, without prior government authorization, export, re-export, or transfer Evoke services (including the Services) or technology, either directly or indirectly, in violation of such laws and regulations. Customer represents and warrants that Customer: (a) is not located in, under the control of, or a national or resident of any country to which the United States has embargoed goods or services, or that has been designated by the U.S. Government as a “terrorist supporting” country; (b) has not been identified as a “Specially Designated National” by the Office of Foreign Assets Control; (c) has not been placed on the U.S. Commerce Department’s Denied Persons List; and (d) will not use the Services if any applicable laws in Customer’s country prohibit Customer from doing so in accordance with these Terms.
Customer may not assign any of Customer’s rights or obligations under these Terms, whether by operation of law or otherwise, without our prior written consent (not to be unreasonably withheld). Any attempted assignment or delegation in contravention of the foregoing shall be void.
Notice
In order to provide notice to Evoke, or to receive further information regarding use of the Services, please contact us at support@evokesecurity.com.