RegBear logoRegBear Contact Us

Terms of Use

Last updated: 1 October 2026

Terms of Use

1. Introduction and acceptance

These Terms of Use ("Terms") govern access to and use of the RegBear website and the RegBear compliance and security platform (the "Platform"). By accessing the website, creating an account or using the Platform, you agree to these Terms. If you accept these Terms on behalf of an organisation, you confirm that you are authorised to bind that organisation. If you do not agree, do not use the website or the Platform.

Where you have signed a separate subscription, service or data processing agreement with us (an "Agreement"), that Agreement takes precedence over these Terms in case of conflict.

2. Definitions

  • "RegBear", "we", "us", "our": the operator of the website and the Platform.
  • "Customer", "you", "your": the organisation (or individual acting for it) that uses the Platform.
  • "Tenant": the separate, isolated environment we provide to each Customer, with its own database and users.
  • "Authorised User": a person whose account in a Tenant was created by the Customer or by us at the Customer's request.
  • "Customer Data": all data entered, uploaded, collected or generated in your Tenant, including data sent by Agents.
  • "Modules": the optional features that can be enabled for a Tenant, such as DORA, MiCA, Vulnerability Scanner, Penetration Testing, Asset Management, CRM and AI Assistant.
  • "Agents": the software we supply that you install on your own systems to send scan, inventory or asset information to the Platform.

3. Who may use the Platform

The Platform is a business-to-business service for organisations, in particular financial entities and crypto-asset businesses in the European Union and the European Economic Area that are subject to Regulation (EU) 2022/2554 (DORA) and Regulation (EU) 2023/1114 (MiCA). It is not intended for consumers. You must be at least 18 years old and act in a professional capacity to use it.

4. Accounts and access security

  • The Customer manages its Authorised Users and their roles and is responsible for all activity under its accounts.
  • Two-factor authentication (TOTP) is mandatory for every user. Passwords must follow the Platform's password policy, including complexity, history and periodic expiry.
  • Credentials, recovery codes and authenticator devices must be kept confidential and must not be shared between people.
  • For security and audit purposes we record sign-in events, including IP address, browser, approximate location and time, and make them visible to your Tenant administrators.
  • Notify us without delay at business@regbear.com if you suspect unauthorised access. We may suspend accounts or block IP addresses that show signs of compromise, brute-force activity or abuse.

5. Tenant isolation and Customer Data

Each Tenant runs on its own database with its own database credentials. Customer Data is never shared with or made visible to other customers.

You keep all rights in your Customer Data. You give us a limited licence to host, store, process, back up and display Customer Data only as needed to provide, secure and support the Platform for you. The Platform is hosted in data centres located in the European Union.

You are responsible for the lawfulness, accuracy and quality of the Customer Data you submit, and for having the rights and legal bases needed to process it on the Platform.

6. Compliance modules: no legal advice

The DORA and MiCA modules provide checklists, registers (including the Register of Information), roadmaps, templates and exportable evidence to help you organise your compliance work. They are tools, not legal, regulatory, audit or financial advice.

You remain solely responsible for your compliance with DORA, MiCA and any other applicable law, for decisions you take, and for all reports and submissions to competent authorities. We do not guarantee that use of the Platform will result in compliance or that a regulator or auditor will accept any output.

7. Agents and vulnerability scanning

  • Install Agents only on devices and networks that you own or are expressly authorised to scan.
  • Agents collect technical information such as installed software and versions, configuration and hardening settings, open ports and network services, and asset inventory data. They send this information to your Tenant over an encrypted connection.
  • Agents are code-signed and may update themselves automatically to receive security fixes and new checks. Do not modify, decompile or redistribute Agents, except where the law expressly allows it.
  • Vulnerability findings are based on public and commercial vulnerability data (such as CVE feeds) and automated checks. They may include false positives or miss some issues.

8. Penetration testing

The Penetration Testing module, including the AI pentest assistant, sends active security tests to the targets you define. You may only test web applications, domains and IP addresses that you own or for which you hold prior written authorisation from the owner. Before a scan you must confirm scope and consent on the Platform.

Active testing can affect performance or availability of the tested systems. You are solely responsible for choosing targets and timing scans, and for any consequences of testing. We may refuse, limit or stop any scan, block targets, and keep scan logs to prevent misuse. Using the module against third parties without authorisation is strictly prohibited and may be reported to the competent authorities.

9. AI features

The AI Assistant, the Compliance Check (document gap analysis) and the AI pentest assistant use large language models supplied by a third-party AI provider. To produce a response, the content you submit (prompts, uploaded documents and scan context) is sent to that provider. This may involve processing outside the EEA under appropriate safeguards as required by the GDPR, such as Standard Contractual Clauses. We do not use your content to train AI models.

  • AI output may be incomplete, inaccurate or out of date. Have it reviewed by qualified people before relying on it.
  • Do not submit special categories of personal data, or information you are not permitted to share with a sub-processor.
  • AI features are limited to compliance and security topics. We filter off-topic or abusive use and keep usage logs for security, abuse prevention and service quality.

10. Acceptable use

You must not, and must not allow anyone to:

  • use the website or the Platform in breach of any law or regulation;
  • try to access another customer's Tenant, our administrative systems or any data you are not authorised to see;
  • test, probe, scan or attack the Platform itself, or bypass its security controls (including the web application firewall, rate limits, two-factor authentication and IP restrictions), unless we have agreed to it in writing in advance;
  • upload malware or unlawful content, or use the Platform to send spam;
  • use automated means to scrape or extract data from the website or the Platform, except through features we provide;
  • resell, sublicense or provide the Platform to third parties, or use it to build a competing service.

11. Our security commitments

We protect the Platform with appropriate technical and organisational measures. These include tenant isolation, encryption in transit, mandatory two-factor authentication, a web application firewall, brute-force protection, logging and continuous monitoring. No system is completely secure, however, and we cannot guarantee that unauthorised access will never occur. If a personal data breach affects Customer Data, we will notify you without undue delay as required by the GDPR.

12. Data protection

For Customer Data, you act as the controller and we act as a processor under the General Data Protection Regulation (EU) 2016/679 (GDPR). We process Customer Data only on your documented instructions as set out in our Data Processing Agreement, which forms part of the Agreement. We will provide a list of our sub-processors on request.

For our own website, the contact form, and the business contact and account data we need to run the relationship, we act as controller. We use that data to respond to enquiries, manage accounts, keep the Platform secure and meet our legal obligations.

13. Financial entities and DORA

If you are a financial entity under DORA, RegBear is your ICT third-party service provider. The contractual terms required by Article 30 DORA are set out in the Agreement. These include the service description, data location, access and audit rights, incident assistance, cooperation with competent authorities, termination rights and exit support. We will provide reasonable cooperation for your ICT risk management and for inspections or audits by you or your competent authority.

14. Fees, availability and support

Fees, subscription term, enabled Modules, service levels and support channels are set out in the Agreement. Unless the Agreement provides otherwise, we aim to respond to support requests within 24 hours on business days. We may perform maintenance that briefly affects availability and will try to schedule it outside normal business hours. We may suspend access where fees are seriously overdue, or where we need to in order to protect the Platform, other customers or third parties.

15. Intellectual property

The website, the Platform, the Agents, their software, templates, content, logos and trademarks belong to RegBear or its licensors. During your subscription we grant you a non-exclusive, non-transferable right to use the Platform for your internal business purposes. You may use the reports and documents you export from the Platform in your own compliance activities. If you send us feedback, we may use it to improve our services without any obligation to you.

16. Confidentiality

Each party will keep the other party's non-public information confidential and use it only to perform under these Terms and the Agreement. This obligation does not apply where disclosure is required by law, by a court, or by a competent supervisory or regulatory authority. The Agreement may contain additional confidentiality obligations.

17. Disclaimer of warranties

Except as expressly stated in the Agreement and to the extent permitted by law, the website and the Platform are provided "as is" and "as available", without warranties of any kind, whether express or implied. This includes warranties of merchantability, fitness for a particular purpose, uninterrupted operation, and the accuracy or completeness of scan results, compliance content or AI output.

18. Limitation of liability

To the maximum extent permitted by law, RegBear is not liable for any indirect, incidental, special or consequential damages, or for loss of profits, revenue, data or goodwill. This includes damage caused by scans or tests that you initiate, or by regulatory measures taken against you. Our total liability for all claims in any twelve (12) month period is limited to the fees you paid us in the twelve (12) months before the event giving rise to the claim. These limitations do not apply to liability that cannot be limited by law, including liability for intent or gross negligence.

19. Indemnification

You will indemnify RegBear against third-party claims, fines and costs resulting from your breach of these Terms. This includes in particular scanning or testing systems without authorisation, unlawful Customer Data, and misuse of the Platform by your Authorised Users.

20. Term, termination and your data

These Terms apply for as long as you use the website or the Platform. Either party may end the subscription as provided in the Agreement. We may suspend or terminate access immediately for a serious breach of these Terms, in particular unauthorised testing or an attempt to access other Tenants.

After termination you can request an export of your Customer Data within the period set out in the Agreement (30 days if the Agreement does not specify one). After that period we delete the Tenant, including its database and uploaded files, unless the law requires us to keep the data.

21. Third-party services and links

The Platform relies on third-party infrastructure, vulnerability-data and AI providers, and the website may link to external sites. We are not responsible for the content or practices of third-party websites.

22. Governing law and jurisdiction

These Terms and any non-contractual obligations arising from them are governed by the laws of the EU Member State in which RegBear is established. Mandatory provisions of EU law remain unaffected. Disputes fall under the exclusive jurisdiction of the competent courts of that Member State, unless the Agreement provides otherwise.

23. Severability

If any provision of these Terms is found invalid or unenforceable, the remaining provisions continue in full force. The invalid provision will be replaced by a valid one that comes as close as possible to its purpose.

24. Changes to these Terms

We may update these Terms to reflect changes in the Platform, the law or regulatory requirements. The current version is always published on this page together with its date. For material changes, we will notify Tenant administrators at least 30 days in advance. Continuing to use the Platform after a change takes effect means you accept the updated Terms.

25. Contact

For questions about these Terms, data protection or security, contact us at business@regbear.com or use our contact form.