SecurityMetrics, Inc. is aware of the privacy concerns of its customers. Our policy for collecting and using personal information is detailed below.
SecurityMetrics recognizes that the EEA has established strict protections regarding the handling of EEA Personal Data, including requirements to provide adequate protection for EEA Personal Data transferred outside of the EEA. To provide adequate protection for certain EEA Personal Data about Customers received in the US, SecurityMetrics has elected to self-certify to the EU-US Privacy Shield Framework administered by the US Department of Commerce (“Privacy Shield”). SecurityMetrics adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and Liability.
SecurityMetrics also complies with the Swiss-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information from Switzerland.
For purposes of enforcing compliance with the Privacy Shield, SecurityMetrics is subject to the investigatory and enforcement authority of the US Federal Trade Commission. For more information about the Privacy Shield, see the US Department of Commerce’s Privacy Shield website located at: https://www.privacyshield.gov. To review SecurityMetrics’ representation on the Privacy Shield list, see the US Department of Commerce’s Privacy Shield self-certification list located at: https://www.privacyshield.gov/list
We process EEA Personal Data for the purposes stated above. SecurityMetrics will only process EEA Personal Data in ways that are compatible with the purpose that SecurityMetrics collected it for, or for purposes the individual later authorizes. Before we use your EEA Personal Data for a purpose that is materially different than the purpose we collected it for or that you later authorized, we will notify you and provide you with the opportunity to opt out.
SecurityMetrics’ policy in relation to information collected through registration, testing, and/or any other means is to respect and protect the privacy and confidentiality of our users. SecurityMetrics does not disclose, rent, or sell email addresses, security test results, or any other information that we may receive to any third party, unless:
Under certain circumstances, we may remain liable for the acts of our third-party agents or service providers who perform services on our behalf for their handling of EEA Personal Data that we transfer to them.
SecurityMetrics understands the importance of maintaining accurate information and thus SecurityMetrics allows Customers to update their information on SecurityMetrics websites through those websites. Customers may choose to remove information collected by SecurityMetrics by contacting us in writing at: SecurityMetrics, Inc., 1275 West 1600 North, Orem, UT 84057. SecurityMetrics will respond to the request within thirty (30) days.
SecurityMetrics retains information for as long as an account is active or as needed to provide the services requested by the Customer. SecurityMetrics will also retain information as needed to comply with legal or tax obligations, comply with industry regulations, resolve disputes, and enforce agreements.
You can direct any questions or complaints about the use or disclosure of your EEA Personal Data to us at email@example.com. We will investigate and attempt to resolve any complaints or disputes regarding the use or disclosure of your EEA Personal Data within 45 days of receiving your complaint. For any unresolved complaints, we have agreed to cooperate with our Independent Dispute Resolution Body, the EU Data Protection Authorities, who will resolve the issue within a reasonable timeframe. These EU Data Protection Authorities can be reached at: https://edps.europa.eu.
SecurityMetrics has further committed to cooperate with the panel established by the EU data protection authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved Privacy Shield complaints concerning data transferred from the EU and Switzerland.
SecurityMetrics maintains reasonable and appropriate security measures to protect EEA Personal Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction in accordance with the Privacy Shield.
Customers who do not wish to receive commercial information from SecurityMetrics may opt out of that email by following the instructions at the bottom of the email. Customers are not usually able to opt out of emails containing information regarding a Customer’s account, services, or transactions.
Customer may have the option to select binding arbitration for the resolution of Customer’s complaint under certain circumstances, provided you have taken the following steps: (1) raised your compliant directly with SecurityMetrics and provided us the opportunity to resolve the issue; (2) made use of the independent dispute resolution mechanism identified above; and (3) raised the issue through the relevant data protection authority and allowed the US Department of Commerce an opportunity to resolve the complaint at no cost to you. For more information on binding arbitration, see (https://www.privacyshield.gov/article?id=ANNEX-I-introduction).
To access your information, ask questions about our privacy practices, request to limit the disclosure of your personal information, or issue a complaint, contact us at:
1275 W 1600 N
Orem, UT 84057
Effective Date: May 25, 2018
You may select some or all of the following Services:
If you have selected service packages that contain PCI Compliance Services, then that package may include, but is not limited to, all or some of the Services listed below.
If you have selected service packages that contain HIPAA Compliance Services, then that package may include, but is not limited to, all or some of the Services listed below:
Managed Firewall Services
Managed Firewall Services is part of a PCI Compliance service package. If you have selected service packages that contain Managed Firewall Services, then that package may include, but is not limited to, some or all of the following:
SecurityMetrics reserves the right to change the Services, prices, or charges at any time without notice. If you do not accept these changes, you have the right to cancel the Services, but cancellation fees may apply. If you continue to use these services after receiving notice of a change in services, prices, or charges; it will be determined that you understand and accept the changes.
Users are strictly forbidden to use the Services or the Website to perform security tests on computers, servers, or devices that they do not have permission or authorization to test. If Customer uses a third party hosting service, Customer must notify the service and receive permission for SecurityMetrics to perform security testing. Customer agrees to hold SecurityMetrics harmless for any failure to obtain any necessary permission.
Customer may not use the Services or the Website:
In any way that violates any applicable federal, state, local, or international law or regulation (including, without limitation, any laws regarding the export of data or software to and from the US or other countries).
For the purpose of exploiting, harming, or attempting to exploit or harm minors in any way by exposing them to inappropriate content, asking for personally identifiable information or otherwise.
To impersonate or attempt to personate SecurityMetrics, a SecurityMetrics employee, another user, or any other person or entity (including, without limitation, by using email addresses associated with any of the foregoing).
To transmit, or procure the sending of, any advertising or promotional material including any junk mail, chain letter, or spam or any other similar solicitation.
To engage in any other conduct that restricts or inhibits anyone's use or enjoyment of SecurityMetrics Websites, or may harm SecurityMetrics or any of its users
Additionally, you agree not to:
Use any robot, spider, or other automatic device, process, or means to access this Website for any purpose, including monitoring or copying any of the material on the Website.
Introduce any viruses, Trojan horses, worms, logic bombs or other material which is malicious or technologically harmful.
Attack the Website via a denial-of-service attack or a distributed denial-of-service attack.
Attempt to gain unauthorized access to, interfere with, damage or disrupt any parts of the Website or any user's use of the Website.
Otherwise attempt to interfere with the proper working of the Website.
SecurityMetrics will provide Customer with written or online reports, data, policies, templates, checklists, and other materials (collectively, "Materials") in connection with the Services. Customer agrees that all intellectual property rights in the Materials, including trade secrets, copyrights, patents and trademarks, are exclusively owned by SecurityMetrics and its licensors. Customer shall hold in confidence all Materials marked as "confidential" and shall use the Materials solely for the purposes for which they are disclosed. All Materials are licensed to Customer only for its own use and Customer does not have any rights to copy, distribute or make derivative works of the Materials without the prior written authorization of SecurityMetrics. Dissemination, distribution, copying or use of the Materials in whole or in part by a SecurityMetrics competitor or their agents is strictly prohibited.
Customer agrees to pay all charges for the Services provided to Customer, unless Customer's acquirer, payment processor, or other entity has entered into an agreement with SecurityMetrics to pay for those services. If Customer's acquirer, processor or other entity has an agreement with SecurityMetrics to pay for the Services, then Customer authorizes its acquiring bank or other merchant service provider to bill Customer for the Services. If Customer has provided SecurityMetrics with credit card information ("Card Information"), Customer authorizes SecurityMetrics to charge Customer the price of the Services, as provided in the invoice or order confirmation sent by SecurityMetrics, using the Card Information. Customer also authorizes SecurityMetrics to charge any cancellation fee associated with the cancellation of the Services. If Customer is purchasing online Compliance services, Customer also authorizes SecurityMetrics to automatically charge the price of Services for each renewal term of this Agreement using the Card Information. Customer agrees to give SecurityMetrics prompt notice of any changes to the Card Information.
For Customers that have purchased packages of services that contain Managed Firewall Services, a cancellation fee will apply if Customer cancels the Managed Firewall Services before the end of the three-year term. The cancellation fee will cover the costs of hardware and the setup fees and may vary depending on the circumstances of the cancellation.
If SecurityMetrics uses a collection agency or attorney to collect money owed by you, you agree to pay the reasonable costs of collection, including, but not limited to, any collection agency's fees, reasonable attorneys' fees, and arbitration or court costs.
If an acquirer or merchant service provider pays for the Services, refunds may not apply. Refunds for the unused portion of services may be obtained by contacting the Account Renewals team at SecurityMetrics. Refunds will be processed within 5 business days.
SecurityMetrics owns and operates the servers that host this web site. Contact information for SecurityMetrics may be obtained by clicking the "Contact Us" link at the top of any page.
Customer's compliance depends entirely upon the accuracy of information provided to SecurityMetrics by Customer. Customer agrees that if Customer provides incomplete or inaccurate information this may affect the Services, Customer's compliance status, and SecurityMetrics will not be held liable for any damages incurred as a result of incomplete or inaccurate information provided by customer. A scan result from SecurityMetrics only indicates the compliance status of the systems that SecurityMetrics has scanned and does not represent Customer's overall compliance status with the PCI Data Security Standards. Customer also agrees to give SecurityMetrics prompt notice if any information affecting data security previously provided to SecurityMetrics has changed, is changing or will change. Customer understands and agrees that any threat designated as a false positive by Customer is done at Customer's own risk. In no event shall SecurityMetrics be liable for any damages incurred by Customer as a result of Customer's designation of a threat as a false positive.
Customer authorizes SecurityMetrics to contact Customer through email, phone or fax to notify Customer of changes in Customer's compliance status or Services. Customer also authorizes SecurityMetrics to contact Customer in regards to payment, renewal, cancellation, or the Services.
The information presented on or through the Website is made available solely for general information purposes. SecurityMetrics does not warrant the accuracy, completeness or usefulness of this information. Any reliance you place on such information is strictly at your own risk. SecurityMetrics disclaims all liability arising from any reliance placed on such materials by you or any other visitor to the Website or by anyone who may be informed of any of its contents.
DUE TO THE NATURE OF THE COMPUTER SECURITY BUSINESS, NO SECURITY COMPANY CAN GUARANTEE THAT IT WILL DETECT EVERY VULNERABILITY OR SECURITY PROBLEM. SECURITYMETRICS PROVIDES ITS SERVICES ON AN "AS IS" BASIS AND WITHOUT ANY WARRANTIES WHATSOEVER. SECURITYMETRICS DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO ITS SERVICES, MATERIALS AND PRODUCTS. SECURITYMETRICS DOES NOT WARRANT THAT THE SERVICES WILL DETECT EVERY VULNERABILITY ON CUSTOMER'S SYSTEM, OR THAT SECURITYMETRICS' VULNERABILITY ASSESSMENTS, SUGGESTED SOLUTIONS OR ADVICE WILL BE ERROR-FREE OR COMPLETE. CUSTOMER AGREES THAT SECURITYMETRICS SHALL NOT BE RESPONSIBLE OR LIABLE FOR THE ACCURACY OR USEFULNESS OF ANY INFORMATION PROVIDED BY IT, OR FOR ANY USE OF SUCH INFORMATION.
Customer acknowledges that use of the Services does not guarantee compliance with the PCI DSS, the HIPAA Standard, or any other security or privacy standards, or that its Systems are secure from unauthorized access. This is due to, and Customer acknowledges that, the Services being dependent upon multiple variables, which include the information provided by Customer, and Customer's level of cooperation with policies regarding compliance with the PCI DSS or the validation thereof.
CUSTOMER ACKNOWLEDGES THAT THE RATE OF BRINGING CUSTOMER AND ITS SYSTEM IN COMPLIANCE WITH PCI DSS OR HIPAA IS DEPENDENT UPON MULTIPLE VARIABLES, WHICH INCLUDE CUSTOMER'S LEVEL OF COOPERATION WITH POLICIES REGARDING COMPLIANCE. UNDER NO CIRCUMSTANCES SHALL SECURITYMETRICS, ITS AFFILIATES OR THEIR LICENSORS, SERVICE PROVIDERS, EMPLOYEES, AGENTS, OFFICERS, OR DIRECTORS BE LIABLE FOR DAMAGES OF ANY KIND, UNDER ANY LEGAL THEORY, ARISING OUT OF IN CONNECTION WITH CUSTOMER'S USE, OR INABILITY TO USE, THE WEBSITE, ANY WEBSITES LINKED TO IT, ANY CONTENT ON THE WEBSITE OR SUCH OTHER WEBSITES OR ANY SERVICES ON OR OBTAINED THROUGH THE WEBSITE, DELAY IN BECOMING OR CUSTOMER'S FAILURE TO BECOME COMPLIANT. IN NO EVENT SHALL SECURITYMETRICS OR ITS AGENTS BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO, PERSONAL INJURY, PAIN AND SUFFERING, EMOTIONAL DISTRESS, LOSS OF REVENUE, LOSS OF PROFITS, LOSS OF BUSINESS OR ANTICIPATED SAVINGS, LOSS OF USE, LOSS OF GOODWILL, LOSS OF DATA, AND WHETHER CAUSED BY TORT (INCLUDING NEGLIGENCE), BREACH OF CONTRACT OR OTHERWISE, EVEN IF FORESEEABLE.
THE FOREGOING DOES NOT AFFECT ANY LIABILITY WHICH CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW.
None of the information contained within our Services, or within the content SecurityMetrics makes available through our Services, should be regarded as Legal Advice. The distribution and publication of our Services, and the content made available with our Services, does not create an attorney-client relationship between Customer and SecurityMetrics.
SecurityMetrics reserves the right to modify or terminate the Services and SecurityMetrics' Websites or to terminate Customer's access to the Services and SecurityMetrics' Website, in whole or in part, at any time.
The following Premium Service Warranty ("PSW") applies to Customers who have purchased Services that also contains a premium service warranty.
The PSW Limit is the most any Merchant can recover for each merchant identification number (or other mutually agreed upon form of identification) during a twelve (12) month period for any or all such costs or expenses, combined, and regardless of the number of data security events discovered or regulatory actions taken.
Merchants are required to provide SecurityMetrics notice within thirty (30) days of discovery or suspicious of a breach or compromise. A Merchant is required to provide SecurityMetrics with any documentation, invoice, or other evidence required by SecurityMetrics within thirty (30) days after receipt of this documentation, invoice, or other evidence.
The PSW reimburses Merchants only if a Merchant provides a timely (within 30 days) notification and complete report of a data security event or regulatory action as soon as the Merchant becomes aware of such event or action. Merchants will need to provide details on the data security event or regulatory action including, but not limited to: a complete description of the data security event or regulatory action, all documents relating to the data security event or regulatory action, and any other pertinent information requested by or on behalf of SecurityMetrics. To report a data security event or regulatory action under the Program, contact SecurityMetrics at: Breach_Reporting@securitymetrics.com.
Merchants assume sole responsibility and liability for making timely and complete claims under the PSW, providing necessary or requested data and information, and otherwise complying with the terms and conditions set forth in the PSW.
SecurityMetrics, Inc., is a PCI Approved Scanning Vendor under certificate number 3707-01-08 and performs security assessment scans within the guidelines of the PCI data security initiative.
It is important to allow SecurityMetrics security scanners to have the same level of network access to your Internet-connected devices that you provide to the rest of the world under normal circumstances. Users of SecurityMetrics scanning services are encouraged to add rules to their firewalls and inform their ISPs or hosting providers that security assessment scans may originate from the scanning locations listed in the table below. Ensuring that traffic from SecurityMetrics scanners does not get blocked ensures maximum accuracy of the security assessments, which leads to better security. If you have any questions, please contact SecurityMetrics Technical Support.
|IP Ranges||Subnet Mask (Short)
||Subnet Mask (Long)|
Note: This table may be updated from time to time without notice.
Do you believe some form of SecurityMetrics scanning service abuse is occurring?
Please email us (firstname.lastname@example.org)