Terms of Service

Last updated: 6 November 2026

These Terms of Service govern access to and use of SOCsimple. In these Terms, "SOCsimple," "we," "us," and "our" refer to the operator of the SOCsimple service, reachable at hello@socsimple.com.

By creating an account, requesting or accepting access, or using SOCsimple, you agree to these Terms.

If you are using SOCsimple on behalf of a company or other organization, you represent that you are authorized to accept these Terms on its behalf.

1. The service

SOCsimple is a detection content management platform designed to help users understand, review, manage, test, track, and deploy Wazuh detection content.

Features may include management of rules, decoders, CDB lists, environment synchronization, findings, drafts, deployment, activity history, and related workflows.

The features available to you may depend on your account, beta status, subscription, connected environment, Wazuh version, or other technical factors.

In these Terms, your Wazuh environment means the Wazuh manager, indexer, agents and related systems that you operate and connect to SOCsimple. It is yours: SOCsimple does not host, operate or administer it.

2. Private beta

SOCsimple is currently offered in private or limited-access beta.

Beta access may be provided selectively and does not guarantee future access, commercial availability, particular features, or pricing.

SOCsimple is free of charge during the beta. The beta is a period, not a plan: we intend to charge for the service once it ends, and we have not yet set pricing or plans. We will give you reasonable notice of the pricing and the date it takes effect, and continued use after that date will require a paid subscription. Your detection content stays on your own Wazuh manager throughout, so ending your use of SOCsimple does not affect it.

During beta:

• features may be added, changed, limited, or removed;
• workflows and interfaces may change;
• availability may be interrupted;
• we may impose usage limits;
• we may suspend or end beta access where reasonably necessary.

Unless we separately agree otherwise in writing, beta access does not include a guaranteed uptime, availability commitment, support response time, or service-level agreement.

3. Access and accounts

You must provide accurate information when requesting or creating an account.

You are responsible for:

• maintaining the confidentiality of your account credentials;
• activity performed through your account;
• maintaining appropriate user permissions within your organization;
• promptly notifying us if you believe your account has been compromised.

You may not share credentials in a manner that bypasses account controls or permits unauthorized use.

4. Authorized environments

You may connect SOCsimple only to systems, environments, infrastructure, accounts, and data that you are authorized to access and manage.

You are responsible for ensuring that your use of SOCsimple complies with your organization's security requirements and any obligations you have to customers or third parties.

If you use SOCsimple to manage environments for others, for example as a managed security service provider for your clients, you represent that you have, and will keep, each client's authorization to connect its environments, to process its data through SOCsimple, and to make the changes you make, and that you have told each client what it needs to know about that processing.

5. Detection changes and deployment

SOCsimple may provide functionality that allows authorized users to create, modify, review, test, or deploy detection content.

You acknowledge that changes to security monitoring and detection configuration can affect alerts, detection coverage, system behavior, and operational outcomes.

SOCsimple provides controls intended to make changes reviewable and traceable, but you remain responsible for determining whether a proposed change is appropriate for your environment.

You should review changes before deployment and maintain appropriate operational safeguards, backups, testing practices, and access controls.

6. Your Wazuh environment

SOCsimple is a management layer above your Wazuh environment. It reads your detection content, explains it, and records what changes. It does not change your Wazuh environment on its own: it writes to your manager only when a member of your team with permission to deploy starts an action that does so, and only in environments where an administrator has enabled deployment. Each deploy is recorded with who made it and the reason they gave. SOCsimple does not require a second person to approve a deploy; if your organization requires separate approval, give it before deploying. Deploying reloads your Wazuh ruleset. A deploy check writes your draft to the manager briefly and then puts the original back; if it cannot, SOCsimple tells you. Changes made in your Wazuh environment outside SOCsimple — by hand, by another tool, or by another account you have given access to — are shown to you when SOCsimple's next sync observes them. Before writing, a deploy reads the content it changes from your manager and is refused if that content is no longer what your change expects. This check runs when you deploy, not continuously while you work, and cannot prevent a change someone makes at the same moment from being overwritten. Observation depends on a successful sync, so SOCsimple does not promise to notice every external change as it happens, or to tell you who made it.

Because the environment is yours, the following remain your responsibility:

• Access to your manager. You control who holds credentials to your Wazuh manager's API, including other SOCsimple accounts. Rotating those credentials is how you withdraw access. Coordinating changes among the parties you have given access to is yours to manage; SOCsimple shows the changes it did not make as its sync observes them, but cannot tell you who made them.
• Upgrades. A minor Wazuh upgrade replaces Wazuh's own detection content. SOCsimple records that burst of change and attributes it to the release; it does not vet the new content. If your manager moves to a Wazuh major that SOCsimple does not yet support, SOCsimple pauses sync and deploy for that environment and keeps everything already synced intact. Support for a new major is not promised for a date, and migrating your content to it is your project.
• Rebuilds and address changes. If SOCsimple recognises that a manager has been rebuilt, restored, or moved to a new address, it offers to reconnect the environment that holds its history, or stops before pointing that history at a different installation, and records what you chose. It may not recognise every rebuild or restore. Whether the rebuilt manager should receive the content SOCsimple holds for it is your decision.
• Wazuh's own files. Wazuh's built-in rules, decoders and lists belong to Wazuh and are replaced on upgrade. SOCsimple reads them as Wazuh publishes them for your version and shows you where your manager's copy differs, but it does not manage or restore those files, and edits to them are not preserved across upgrades. To change a built-in's behavior, write Local content that overrides it; SOCsimple can manage that content and shows you when it changes outside SOCsimple.
• Tuning assistance. Where SOCsimple helps you build a change — proposing a suppression or child rule, marking a pattern as expected, or checking a change against a sample before deploying — you choose what the change contains and whether to run the check. Confirming that a deployed change fires, and does not silence more than you intended, is your responsibility.

7. Your content

You retain ownership of content you or your organization provide to SOCsimple, including your detection rules, decoders, lists, configuration, and related materials.

You grant us the limited rights necessary to host, process, transmit, display, analyze, back up, and otherwise handle that content solely as needed to operate, secure, support, and improve SOCsimple.

You represent that you have the rights necessary to provide that content to the service.

8. SOCsimple intellectual property

SOCsimple, including its software, interfaces, designs, workflows, branding, documentation, and related technology, is owned by us or our licensors.

Except for the limited right to use the service under these Terms, no ownership rights in SOCsimple are transferred to you.

The guides and other documentation shown inside SOCsimple are our confidential information. They are provided so that the authorized users of your account can use SOCsimple. You may share them within your organization with people who need them for that purpose, but you may not publish them or disclose them to anyone else without our written permission.

You may not, except where applicable law expressly permits otherwise:

• copy or redistribute SOCsimple;
• reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, underlying structure, or algorithms of SOCsimple;
• copy, scrape, publish, or redistribute SOCsimple's documentation, guides, or other in-product content, except as this section permits;
• sell, resell, rent, lease, sublicense, or otherwise make SOCsimple available to anyone other than the authorized users of your account;
• remove, obscure, or alter any proprietary notice, or any marking that identifies the person viewing SOCsimple;
• circumvent access controls or security measures;
• use SOCsimple, its documentation, or information obtained from it to build or help build a competing product or service, including by systematically copying its design or functionality;
• use SOCsimple's software, interfaces, or documentation (not your own content) to train or improve a machine-learning or artificial-intelligence model;
• probe, attack, disrupt, or interfere with the service;
• access the service using unauthorized automated means;
• attempt to obtain unauthorized access to another customer's account or data.

These restrictions do not limit your use of your own content, or of what SOCsimple shows you about it, for your own purposes, or your independent development of products that do not use SOCsimple's non-public materials.

Security research. If you believe you have found a vulnerability in SOCsimple, tell us at hello@socsimple.com and keep it confidential until we have had a reasonable opportunity to fix it. We will not treat good-faith research as a breach of these Terms where it stays within your own account and data, avoids degrading the service or accessing anyone else's data, and is reported to us promptly. This does not authorize testing of systems we do not operate.

Nothing in these Terms restricts rights granted under any applicable open-source license for software separately made available under such a license.

9. Feedback

If you provide suggestions, ideas, bug reports, or other feedback about SOCsimple, you allow us to use that feedback to develop and improve the product without obligation to you.

This does not give us ownership of your detection content or confidential customer data.

10. Acceptable use

You may not use SOCsimple:

• unlawfully;
• to access systems without authorization;
• to distribute malware or intentionally harmful code;
• to interfere with or degrade the service;
• to circumvent technical or account restrictions;
• to violate the rights of another person or organization;
• in a way that materially threatens the security or availability of SOCsimple or other users.

We may restrict or suspend access where reasonably necessary to investigate or prevent misuse or security risks.

11. Third-party services

SOCsimple may interoperate with third-party products and services, including Wazuh.

Those third-party services are not controlled by SOCsimple and may change independently.

Your use of a third-party service is governed by the agreement between you and that provider.

References to Wazuh do not imply ownership of or affiliation with Wazuh unless expressly stated.

12. Availability and changes

We aim to operate SOCsimple reliably, but we do not guarantee that the service will always be available, uninterrupted, error-free, or compatible with every environment.

We may modify the service as the product evolves.

Where practical, we will try to avoid changes that unnecessarily disrupt active customers.

13. Security

You are responsible for using appropriate credentials and permissions when connecting external environments to SOCsimple.

You must not intentionally provide credentials that grant broader access than reasonably required for your intended use.

If you become aware of a suspected security issue involving SOCsimple, please contact us promptly at hello@socsimple.com.

14. Suspension and termination

You may stop using SOCsimple at any time, and you can ask us to close your account.

We may suspend or close an account where reasonably necessary because of:

• violation of these Terms;
• fees that are due and remain unpaid after we have notified you;
• security risk, including a suspected compromise of the account;
• unlawful activity;
• material misuse;
• prolonged inactivity;
• termination of the beta program;
• discontinuation of the service.

Suspension is temporary. While an account is suspended, nobody at it can sign in and SOCsimple stops contacting its Wazuh systems, but nothing is deleted. We lift the suspension once the reason for it is resolved.

Closing an account ends access to it. Its saved Wazuh connections are deleted, and its other data is kept for a limited period and then deleted, as described in the Privacy Policy.

Where reasonable under the circumstances, we will try to provide notice before suspending or closing an account. We may suspend an account without notice where there is a security risk or unlawful activity. Your detection content stays on your own Wazuh managers throughout.

Termination does not affect provisions that by their nature should continue, including intellectual-property, limitation-of-liability, confidentiality- related, and dispute provisions.

15. Disclaimers

To the extent permitted by applicable law, SOCsimple is provided on an "as is" and "as available" basis.

We do not warrant that SOCsimple will detect every security issue, prevent every attack, identify every misconfiguration, or produce a particular security outcome.

SOCsimple is a detection management tool and should not be treated as a replacement for appropriate security operations, review, monitoring, backup, incident response, or professional judgment.

SOCsimple's findings, warnings, predictions and explanations of how Wazuh will process your content are provided for information to support your decisions. They are based on our analysis of Wazuh's published behavior for the versions we support and may not reflect every configuration, traffic pattern or version. You should verify them before relying on them.

Nothing in these Terms excludes rights or warranties that cannot legally be excluded.

16. Limitation of liability

To the maximum extent permitted by applicable law, SOCsimple and its operators will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for loss of profits, revenue, business, goodwill, data, or business opportunity arising from use of the service.

For free or beta use, and unless a separate written agreement provides otherwise, our aggregate liability arising out of or relating to SOCsimple will not exceed the greater of:

• the amount you paid us for the service during the 12 months before the event giving rise to the claim; or
• US $100.

Some jurisdictions do not allow certain limitations of liability, so some of these limitations may not apply to you.

17. Indemnity

To the extent permitted by law, if you are using SOCsimple on behalf of a business or organization, you agree to be responsible for claims arising from:

• your unlawful use of SOCsimple;
• systems you connect without appropriate authorization;
• content you provide in violation of another party's rights;
• your material violation of these Terms.

18. Governing law

These Terms are governed by the laws of the State of Israel, without regard to conflict-of-law principles. The competent courts in Israel will have exclusive jurisdiction over disputes arising out of or relating to these Terms, except where applicable law requires otherwise.

19. Changes to these Terms

We may update these Terms as SOCsimple evolves.

If changes are material, we may provide notice through the service, by email, or by another reasonable method.

Your continued use after updated Terms take effect constitutes acceptance where permitted by applicable law.

20. Confidentiality

Our information. Non-public information we share with you about SOCsimple, including unreleased features, roadmaps, pricing, and the documentation described in section 8, is our confidential information. Use it only to evaluate and use SOCsimple, share it only with your personnel and advisers who need it and are bound to keep it confidential, and protect it with at least reasonable care.

Your information. We treat your content, your connection details, and information about your organization, your clients and your environments as your confidential information. We use them only as these Terms and the Privacy Policy describe, limit access to the people who need it to operate, secure and support SOCsimple, and disclose them only to the service providers named in the Privacy Policy or where the law requires.

Neither duty covers information that is or becomes public through no fault of the party that received it, that it already had or develops independently, or that it is required by law to disclose. You may describe your own experience of SOCsimple in general terms. These duties continue after your use of SOCsimple ends.

21. Contact

Questions about these Terms may be sent to: hello@socsimple.com