The rules of the road, in plain English.

By accessing or using the Spoof Defense service ("Service"), you agree to be bound by these Terms of Service ("Terms"). If you do not agree to these Terms, you may not use the Service.

Spoof Defense provides email security, domain threat detection, and WHOIS intelligence services. The Service includes:

• Microsoft 365 and Google Workspace email protection (phishing detection, automated quarantine, alert notifications)
• AI-powered peer review of email threats
• Brand protection and domain impersonation detection
• WHOIS domain intelligence API
• Web portal and Splunk SIEM integration

You must create an account to use the Service. You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

• You must provide accurate and complete registration information
• You must promptly update your information if it changes
• You may not share your account with others
• You must notify us immediately of any unauthorized use

You agree not to use the Service to:

• Violate any applicable laws or regulations
• Infringe on the intellectual property rights of others
• Attempt to gain unauthorized access to our systems
• Interfere with the proper functioning of the Service
• Resell or redistribute the Service without authorization
• Use the data for malicious purposes such as phishing or fraud

API access is subject to rate limits and usage quotas based on your subscription plan. You must not exceed these limits or attempt to circumvent them.

Paid subscriptions are billed in advance on a monthly or annual basis. All fees are non-refundable except as required by law.

• Prices are subject to change with 30 days notice
• You authorize us to charge your payment method automatically
• Failed payments may result in service suspension

Our use of your data is governed by our Privacy Policy. By using the Service, you consent to the collection and use of your information as described therein.

When you connect your Microsoft 365 or Google Workspace tenant, you grant Spoof Defense permission to:

• Read incoming email — including headers, body content, embedded URLs, and attachment metadata — solely to detect phishing, business email compromise (BEC), and brand impersonation.
• Apply Gmail or Microsoft Graph labels to detected threats (e.g., SuspectedSpoof), and optionally move them to a quarantine folder or the spam/junk folder per your configured policy.
• Insert administrator-configured trust banners on legitimate vendor mail.
• Enumerate enrolled mailboxes and verify Workspace domain ownership during onboarding (Google admin.directory.user.readonly and admin.directory.domain.readonly scopes).
• Subscribe to Gmail push notifications and Microsoft Graph webhook subscriptions for real-time scanning.
• Send alert notifications to administrators from Spoof Defense's own email infrastructure (noreply@spoofdefense.com). Spoof Defense never composes or sends mail using your tenant's identity.

Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. See our Privacy Policy for full details.

AI Peer Review is disabled by default and must be explicitly enabled by a tenant administrator. When enabled, anonymized email metadata (and body content only if Body Scanning is also explicitly enabled) is sent to Anthropic for threat analysis under a zero-retention data processing agreement. Anthropic does not store or train on this data. AI analysis data is subject to our data retention settings and can be purged at any time.

The Service and its contents are protected by copyright, trademark, and other intellectual property laws. You may not copy, modify, or distribute any part of the Service without our written permission.

You agree to indemnify and hold harmless Spoof Defense from any claims arising from your use of the Service or violation of these Terms.

We may terminate or suspend your account at any time for violation of these Terms. You may cancel your account at any time through the account settings.

We may update these Terms from time to time. We will notify you of material changes by email or through the Service. Your continued use after such notice constitutes acceptance of the new Terms.

These Terms are governed by the laws of the State of Delaware, without regard to conflict of law principles.

For questions about these Terms, please contact us at: