Terms of
Service.

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Customer") and Soreva AB ("Soreva," "we," "us," or "our"), a company registered in Sweden and Norway. By creating an account, activating a network, or otherwise accessing Soreva's services, you confirm that you have read, understood, and agree to be bound by these Terms in full.

If you are accepting these Terms on behalf of an organisation, you represent and warrant that you have the authority to bind that organisation, and that your acceptance constitutes the organisation's acceptance. If you do not agree to these Terms, you must not use Soreva's services.

Use of the service by minors is not permitted. By accepting these Terms you confirm that you are at least 18 years of age.

Soreva provides network-level DDoS mitigation and traffic filtering services ("Services") delivered via a globally distributed anycast infrastructure. The specific features, capacity limits, and support entitlements available to you depend on the plan you have subscribed to, as described on our pricing page and confirmed in your order.

Soreva reserves the right to modify, extend, or discontinue any feature of the Services at any time. Where a modification materially reduces the capabilities of your current plan, we will provide at least 30 days' written notice.

The Services are provided on an "as available" basis, subject to the uptime commitments set out in Section 5. Scheduled maintenance will be announced via the Network Status page with at least 48 hours' notice wherever possible.

You are responsible for maintaining the security of your account credentials, including your password and any API keys issued to your account. Soreva will not be liable for any loss or damage arising from your failure to protect these credentials.

You must notify us immediately at soreva.se/contact if you become aware of any unauthorised access to your account. We may suspend your account as a protective measure while an incident is investigated.

You may not share, sell, or transfer access to your account to any third party without our prior written consent. Sub-accounts created within your account remain your responsibility; all activity under your account is deemed to be your activity.

You may use the Services only to protect IP prefixes and infrastructure that you own or are authorised to protect. Announcing prefixes you do not have the right to announce ("prefix hijacking") is strictly prohibited and will result in immediate account suspension.

The following uses are expressly prohibited:

• Using the Services to launch, facilitate, or conceal attacks against third parties.
• Announcing BGP routes that fail RPKI or IRR validation without prior written approval.
• Attempting to circumvent or reverse-engineer any aspect of the mitigation infrastructure.
• Reselling or sublicensing the Services to third parties without a written reseller agreement.
• Using the Services to protect infrastructure involved in illegal activity under applicable law.
• Generating artificial or synthetic traffic to inflate usage metrics or test system limits without written authorisation from Soreva.
• Interfering with the operation of Soreva's network or the networks of other customers.

Soreva reserves the right to investigate suspected violations and to suspend or terminate accounts where violations are found. We will cooperate with law enforcement requests as required by applicable law.

Soreva commits to the following monthly uptime targets for the mitigation network, measured as the percentage of minutes in a calendar month during which the scrubbing infrastructure is operational and accepting traffic from your BGP session.

SLA credits are your sole remedy for uptime failures. Credits are issued as account balance and applied to a future invoice. To claim a credit, you must submit a request via soreva.se/contact within 14 days of the incident, including the approximate time window and any supporting logs.

The SLA does not apply to downtime caused by: (a) your own infrastructure or BGP configuration; (b) scheduled maintenance windows communicated in advance; (c) force majeure events; or (d) attacks that exceed the mitigation capacity of your subscribed plan.

Services are billed in advance on a monthly cycle. Your first invoice is generated at the time of account activation and covers the remainder of the current calendar month on a pro-rated basis. Subsequent invoices are issued on the first calendar day of each month.

All fees are stated in US Dollars (USD) unless otherwise agreed in writing. Prices shown on the pricing page are exclusive of any applicable taxes, levies, or duties, which are your responsibility.

Payment is due within 14 days of invoice issuance. Overdue invoices will incur a late fee of 1.5% per month (or the maximum permitted by law, whichever is lower). Accounts with invoices overdue by more than 30 days may be suspended until outstanding balances are settled.

Refund policy: Fees paid for the current billing cycle are non-refundable. If you cancel your subscription before the end of a billing cycle, your account will remain active until the end of that period and will not renew. No partial-month refunds are issued.

Soreva reserves the right to change plan pricing with 30 days' written notice. Continued use of the Services after the effective date of a price change constitutes acceptance of the new pricing.

To operate the Services, Soreva processes network traffic metadata — including source and destination IP addresses, port numbers, protocol fields, and packet rates — for the purpose of detecting and mitigating attacks. This metadata is not sold or shared with third parties except where required by law.

Account data, including your name, email address, and billing information, is processed in accordance with our Privacy Policy. By using the Services you consent to this processing.

Traffic event logs are retained for 90 days on Premium and Enterprise plans, and for 30 days on the Pro plan. Raw packet captures are never stored; only aggregated metadata is retained.

Soreva processes data in Sweden and Norway and, via its PoP infrastructure, in various jurisdictions globally. Where data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place consistent with the requirements of the GDPR.

All software, rule engine logic, dashboard interfaces, documentation, and other materials made available by Soreva as part of the Services remain the exclusive intellectual property of Soreva AB or its licensors. These Terms do not grant you any ownership interest in any Soreva intellectual property.

You are granted a limited, non-exclusive, non-transferable, revocable licence to use the Services and associated APIs solely for the purposes described in these Terms and within the scope of your subscribed plan.

Rule configurations, network definitions, and other content you create within the platform remain your property. You grant Soreva a limited licence to process this content solely as necessary to deliver the Services to you.

To the maximum extent permitted by applicable law, Soreva's total cumulative liability to you for any claims arising under or in connection with these Terms or the Services — whether in contract, tort, or otherwise — shall not exceed the total fees paid by you to Soreva in the three calendar months immediately preceding the event giving rise to the claim.

Soreva shall not be liable for any indirect, incidental, consequential, special, or punitive damages, including but not limited to loss of revenue, loss of profits, loss of data, or business interruption, even if we have been advised of the possibility of such damages.

Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be excluded or limited under applicable law.

You acknowledge that DDoS mitigation is inherently probabilistic and that no service can guarantee 100% protection against all attack types and volumes. Soreva's obligations are limited to providing the Services in accordance with the specifications of your subscribed plan.

You may terminate your subscription at any time by cancelling through the dashboard or by contacting support. Termination takes effect at the end of your current billing cycle. No refunds are issued for unused time within a billing cycle.

Soreva may terminate or suspend your account immediately, without prior notice, if:

• You materially breach these Terms and fail to remedy the breach within 7 days of written notice.
• You engage in any prohibited use described in Section 4.
• Your account has an overdue balance outstanding for more than 30 days.
• Soreva is required to do so by applicable law or a competent authority.

Upon termination, your BGP sessions will be withdrawn, all tunnels will be torn down, and your access to the dashboard and API will be revoked. Event log data will be deleted within 30 days of account closure. Any outstanding balances remain due and payable.

Soreva reserves the right to update these Terms at any time. When we make material changes, we will notify you by email and by posting an updated version on this page with a revised "Last revised" date. Non-material changes (such as clarifications or corrections) may be made without notice.

Your continued use of the Services after the effective date of any updated Terms constitutes your acceptance of the changes. If you do not agree to the revised Terms, you must stop using the Services and cancel your subscription before the effective date.

These Terms are governed by the laws of Sweden and Norway, without regard to its conflict of law provisions. Any dispute arising from or in connection with these Terms that cannot be resolved informally shall be submitted to the exclusive jurisdiction of the courts of Sweden and/or Norway.

For questions about these Terms, billing disputes, or legal notices, contact us at soreva.se/contact. Legal notices must be submitted in writing and will be acknowledged within 5 business days.

Soreva · SE/NO · LinkedIn