Terms of Service

Last updated: 6 September 2026

These Terms of Service (the "Terms") are a contract between SilverLock SARL, a Société à responsabilité limitée (SARL) registered in Morocco with its registered office at Bluzelle Centre, 56 rue Brahim Roudani, Imm. 56, Appt. N°2, Océan, 10040 Rabat, Morocco ("SilverLock", "we", "us"), and the organisation that creates an account on, or otherwise uses, the AfriPhish platform ("Customer", "you").

AfriPhish (the "Service") is a product of SilverLock SARL. By creating an account, starting a free trial, clicking "I agree", or using the Service, you accept these Terms on behalf of your organisation and confirm that you have the authority to do so. If you do not agree, do not use the Service.

Use of the marketing website and its free tools is governed by the legal notice and terms of use. If you have signed a separate written agreement with us, that agreement prevails over these Terms where the two conflict.

1. Definitions

  • Account — the AfriPhish workspace created for the Customer, and every user login within it.
  • Authorised Users — the Customer's employees, contractors and other individuals whom the Customer enrols in the Service.
  • Customer Data — data the Customer or its Authorised Users submit to the Service, including the names, email addresses and phone numbers of the people the Customer enrols, and the results of simulations and training.
  • Simulations — the phishing, smishing, WhatsApp and related social-engineering exercises the Service sends to Authorised Users at the Customer's request.
  • Order — a subscription plan selected in the Service, on our pricing page, or in a written order form.

2. Eligibility and the Account

  1. The Service is offered to organisations, not consumers. You must sign up with a work email address at a domain your organisation controls; we refuse accounts on consumer mailbox providers.
  2. The person who opens the Account must be at least 18 years old and authorised to bind the Customer.
  3. You are responsible for every action taken through your Account, for keeping credentials confidential, and for enabling the security controls we offer (including two-step verification). Tell us at privacy@afriphish.com without delay if you suspect unauthorised access.
  4. You must keep the contact details on the Account accurate so that we can reach you about the Service.

3. Free trial

  1. A free trial gives one organisation a time-limited, seat-limited workspace (currently 14 days and 25 employees, as shown at sign-up). We may change trial parameters for new trials at any time.
  2. Trials are limited per organisation domain. Trial workspaces that reach the end of the period stop sending Simulations and training assignments; the Account and its data remain readable so you can export them or subscribe.
  3. We may suspend or delete a trial that stays inactive, that was opened with false information, or that is used in breach of section 6.

4. Subscriptions, fees and payment

  1. Paid plans, their seat limits and their features are described in the Service and on our pricing page at the time of the Order. Prices are stated exclusive of VAT and any other applicable taxes, which are added where required.
  2. Unless the Order says otherwise, subscriptions are billed annually in advance and renew automatically for successive terms of the same length, at the then-current price, unless either party gives written notice of non-renewal at least 30 days before the renewal date.
  3. Invoices are payable within 30 days. We may suspend the Service, after written notice, while an undisputed invoice is more than 15 days overdue.
  4. Fees are non-refundable except where these Terms or the law say otherwise. Seat upgrades during a term are pro-rated to the end of that term.

5. What we provide

  1. We will provide the Service substantially as described in our documentation, with reasonable skill and care, and we will maintain administrative, technical and physical safeguards designed to protect Customer Data.
  2. We aim for the Service to be available 24 hours a day. Planned maintenance is announced in advance where practical and scheduled outside African business hours where possible. Service-level commitments, where offered, are set out in the Order.
  3. Support is provided by email and, on higher plans, by the channels described in the Order.
  4. We may improve, add or retire features. We will give at least 30 days' notice before retiring a feature that materially reduces the Service's core functionality for your plan.

6. Your obligations — authorised simulation only

The Service sends deceptive messages by design. That is lawful when, and only when, it is done by an organisation to test its own people, with proper authority. You therefore agree that:

  1. You will only enrol individuals who are your employees, contractors, or members of an organisation that has expressly authorised you to test them.
  2. You have, and will maintain, the legal right under the laws that apply to you to run security-awareness Simulations against those individuals, including any information, consultation or consent obligations towards employees, works councils or staff representatives.
  3. You will never use the Service to target, deceive, phish or collect credentials from any person outside that authorised group, nor to test any third-party organisation without its written authorisation.
  4. You will not use Simulation content, landing pages, sending infrastructure or templates for any purpose other than running Simulations within the Service.
  5. You will use results for security-awareness purposes. You remain solely responsible for any employment, disciplinary or other decisions you take on the basis of Simulation or training results, and for complying with the labour and data-protection laws that apply to such decisions.
  6. You will comply with all applicable laws, including data-protection law (for example Morocco's Law 09-08, South Africa's POPIA, Nigeria's NDPA, Kenya's DPA, the GDPR where it applies) and anti-spam and telecommunications rules for the countries in which your Authorised Users are located.

We may suspend the Account immediately, and may notify the relevant authorities, if we reasonably believe the Service is being used against people who have not been authorised.

7. Acceptable use

You must not, and must not allow anyone else to:

  • attempt to gain unauthorised access to the Service, another customer's data, or our infrastructure;
  • probe, scan, overload, disrupt or reverse-engineer the Service, or bypass usage limits or security controls;
  • upload malware or unlawful content, or use the Service to send unlawful, defamatory or infringing material;
  • resell, sublicense or provide the Service to third parties, except to your own Authorised Users;
  • use the Service to build a competing product, or copy its content, templates or training courses outside the Service;
  • send Simulations from domains you do not own or are not authorised to use.

8. Customer Data and personal data

  1. Roles. For the personal data of Authorised Users that you enrol, you are the controller (or equivalent under your local law) and SilverLock is your processor, acting on your documented instructions. For the personal data of your own Account administrators (name, work email, login records, billing contacts), SilverLock is a controller as described in our privacy notice.
  2. Data processing agreement. Our data processing agreement, including the list of sub-processors, forms part of these Terms and is available from privacy@afriphish.com. We will only process Customer Data to provide the Service, to comply with the law, and as you instruct.
  3. Sub-processors. We use hosting, authentication, email and messaging providers to run the Service. The current list, and the countries in which they operate, is in the data processing agreement and summarised in the privacy notice. We will notify you before adding a sub-processor and you may object on reasonable data-protection grounds.
  4. Your warranties. You warrant that you have a lawful basis for providing Customer Data to us and for the processing you instruct, and that you have given the notices required by law to your Authorised Users.
  5. Security incidents. We will notify you without undue delay, and within 72 hours of confirming it, of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Data.
  6. Retention and deletion. You may export Customer Data at any time through the Service. Within 30 days of termination we delete or anonymise Customer Data, except where we must retain it by law; backups are purged in the ordinary cycle.
  7. Aggregated data. We may use data that is aggregated and de-identified so that it cannot reasonably identify the Customer or any individual, to operate, benchmark and improve the Service.

9. Confidentiality

Each party will keep the other's non-public information confidential, use it only to perform these Terms, and protect it with at least the care it uses for its own confidential information. This does not apply to information that is public through no fault of the recipient, already lawfully known to it, independently developed, or that must be disclosed by law (with prompt notice where permitted).

10. Intellectual property

  1. The Service, its software, templates, training content, scenarios, designs, reports and trade marks (including the AfriPhish name and mark) belong to SilverLock or its licensors. We grant you a limited, non-exclusive, non-transferable licence to use them within the Service, for your internal security-awareness purposes, for the term of your subscription.
  2. You retain all rights in Customer Data. You grant us the licence needed to host, process and display it in order to provide the Service.
  3. Reports and certificates generated for you may be used internally and shared with your auditors and regulators.
  4. If you send us feedback or suggestions, we may use them without obligation to you.
  5. Names of regulations and frameworks (POPIA, NDPA, ISO 27001, NIST CSF, SOC 2, PCI DSS and others) belong to their owners; references describe coverage, not endorsement.

11. Third-party services

The Service relies on third-party providers (for example for hosting, email delivery, WhatsApp messaging and identity). Their availability is outside our control. Where you connect your own third-party accounts (such as a WhatsApp Business sender or an identity provider), you are responsible for complying with that provider's terms.

12. Suspension and termination

  1. Either party may terminate these Terms for the other's material breach that is not cured within 30 days of written notice, or immediately if the other becomes insolvent.
  2. We may suspend the Service, with notice where practical, where we reasonably believe it is being used in breach of section 6 or 7, where suspension is needed to protect the Service or other customers, or where fees are overdue as set out in section 4.
  3. You may stop using the Service at any time; fees for the current term remain payable unless the Order says otherwise.
  4. On termination your right to use the Service ends, and section 8.6 applies to Customer Data. Sections that by their nature should survive (including 8, 9, 10, 13, 14 and 16) do so.

13. Warranties and disclaimers

  1. We warrant that the Service will perform substantially in accordance with its documentation. Your sole remedy for breach of this warranty is for us to correct the non-conformity or, if we cannot within a reasonable time, to refund the fees for the affected period.
  2. The Service is a training and simulation tool. It does not guarantee that your organisation will not be attacked, that every employee will recognise a real attack, or that you comply with any law or standard. Reports, scores, policy templates and course content are provided for information and do not constitute legal, audit or professional advice.
  3. Except as expressly stated in these Terms, and to the fullest extent permitted by law, the Service is provided "as is" and we disclaim all other warranties, express or implied, including fitness for a particular purpose and non-infringement.

14. Limitation of liability

  1. To the fullest extent permitted by law, neither party is liable for indirect, consequential, special or punitive loss, or for loss of profit, revenue, business, goodwill or data (other than Customer Data lost through our breach of section 8), however arising.
  2. To the fullest extent permitted by law, each party's total aggregate liability under or in connection with these Terms in any 12-month period is limited to the fees paid or payable by the Customer for the Service in that period (or, for a free trial, USD 100).
  3. Nothing in these Terms limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for breach of section 6 or 7, or for any liability that cannot be limited by law.

15. Indemnity

You will defend and indemnify SilverLock against third-party claims, and the resulting damages and reasonable costs, arising from Customer Data, from your use of the Service in breach of section 6 or 7, or from your breach of applicable law. We will defend and indemnify you against third-party claims that the Service, used in accordance with these Terms, infringes that third party's intellectual property rights, provided you notify us promptly and let us control the defence.

16. Governing law and disputes

These Terms are governed by the laws of the Kingdom of Morocco. The parties will first try in good faith to resolve any dispute through discussion between senior representatives for 30 days. Failing that, the courts of Rabat, Morocco have exclusive jurisdiction, without prejudice to any mandatory consumer or employment-law rules that may apply to individuals in other countries.

17. Changes to these Terms

We may update these Terms. For material changes we will give at least 30 days' notice by email to the Account owner or by a notice in the Service; the new Terms apply from the next renewal, or from the notice date for free trials. Continued use after that date is acceptance. The current version is always at this address.

18. General

These Terms, the Order and the data processing agreement are the entire agreement between the parties on their subject matter. If a provision is unenforceable, the remainder stays in force. Neither party may assign these Terms without the other's consent, except to a successor of its business. Notices to us go to sales@afriphish.com (commercial) or privacy@afriphish.com (data protection), or by post to the address above. Neither party is liable for delay caused by events outside its reasonable control. The English version of these Terms is authoritative; the French translation is provided for convenience.

Contact

SilverLock SARL · Bluzelle Centre, 56 rue Brahim Roudani, Imm. 56, Appt. N°2, Océan, 10040 Rabat, Morocco · sales@afriphish.com