Skip to content
Kandaro
Book a demo

Legal

Kandaro SOC terms

Effective 27 October 2026

1. What these SOC Terms are

These SOC Terms are an agreement between Kandaro (Kandaro, “we”, “us”) and the organisation that signs them (the Customer, “you”). They are the “SOC Terms” referred to in our terms of service (the Terms) and form part of the Agreement described there. Words in bold in the Terms mean the same here.

Company
Kandaro
Address
[Street and number], [Postal code] [City], The Netherlands
Chamber of Commerce (KvK)
[KvK number]
VAT number
[VAT number]

Without signed SOC Terms, Kandaro SOC proposes response steps and you carry them out yourself, in your own tools. Signing these SOC Terms is what allows Kandaro to carry out approved response actions in your tools for you. They apply from the date both parties have signed them, in writing or by electronic signature, and add to the Terms. Where they conflict with the Terms, these SOC Terms prevail for response actions, as section 3 of the Terms sets out.

2. Definitions

  • Response Action: a step in one of your tools that Kandaro SOC carries out for you, such as blocking an address, disabling or suspending an account, signing an account out, requiring a new password, isolating a machine or stopping a process. The Console lists the actions available for each tool.
  • Write Access: the access you give Kandaro to change something in a tool: an admin consent to our app, a credential you create, or Kandaro Connect running on your network.
  • Execute Mode: the setting under which Kandaro carries out approved Response Actions (shown in the Console as “Kandaro runs it after your approval”). Propose Mode: the default, under which Kandaro only proposes them (“Kandaro proposes, you run it”).
  • Approver: an Admin of your organisation who approves a Response Action in the Console.
  • Auto-block Rule: the optional rule in section 6 that blocks an internet address that touched one of your decoys without waiting for an approval.
  • Allowlist: the addresses and ranges you list in the Console that Kandaro never blocks.

3. Switching on Execute Mode

  • Your organisation starts in Propose Mode. Once both parties have signed these SOC Terms and you ask for it in writing, our team switches your organisation to Execute Mode. Each switch is recorded with its reason in your organisation’s audit log.
  • You decide which tools get Write Access, and you can give each tool only the access its actions need. Without Write Access to a tool, Kandaro cannot act in it.
  • You can go back to Propose Mode, pause all Kandaro actions with the pause switch in the Console, or withdraw Write Access in the Console or in the tool itself, at any time and without notice. We act on a written request to go back to Propose Mode without delay.

4. How a Response Action is carried out

Kandaro SOC triages and investigates automatically. When it finds that a step is needed, it proposes a Response Action with the evidence behind it, what the action will do and whether it can be undone. In Execute Mode:

  1. An Approver reviews the proposal and approves it in the Console, confirming who they are again at that moment. Each approval applies to that one action only.
  2. If you switch on two-person approval, a high-risk action, such as cutting a machine off the network, also needs a second Approver. We recommend you switch it on.
  3. A proposal that is not approved within 4 hours expires and nothing happens. An approved action that cannot be carried out within 15 minutes of its approval is not carried out at all.
  4. Kandaro carries out the action exactly as approved, through the Write Access you gave, checks the result with the tool where the tool allows it, and shows the outcome on the case. The proposal, approvals, action and outcome are recorded in your audit log.

The AI that helps investigate never approves a Response Action, never closes a case and never decides severity. Its explanations can be incomplete or wrong, as section 12.1 of the Terms says, and your Approver checks a proposal before approving it.

5. Built-in limits

To limit the damage of a mistake or of a misused account, Kandaro SOC applies these limits to every organisation. You cannot raise them, and we only change them in a way that makes them stricter, unless we tell your Admins first:

  • at most 10 Response Actions and 20 address blocks an hour, and at most 3 machines cut off per case an hour;
  • address blocks end by themselves, after 24 hours unless the approved action says otherwise;
  • addresses on your Allowlist are never blocked;
  • most Response Actions can be undone from the case. Some cannot, such as signing an account out everywhere, requiring a new password or stopping a process. The Console says so before the approval.

6. The Auto-block Rule

The Auto-block Rule is the only way Kandaro acts without an approval for each action. It is off until an Admin switches it on, it can only be switched on in Execute Mode, and an Admin can switch it off at any time. While it is on:

  • it only blocks an address on the internet that touched one of your decoys. It never acts on an address inside your own network, on accounts or on machines;
  • it only uses address blocks that end by themselves, in the tools you have given Write Access for this: your Kandaro block list, Cloudflare, Wazuh, Microsoft Defender or FortiGate;
  • it stops after the daily number of blocks you set in the Console (20 by default, at most 100), and after that proposes blocks for approval instead;
  • you keep your Allowlist up to date with the addresses that must never be blocked, such as your own outgoing addresses, partners and the scanners you run.

Every block the rule makes is recorded in your audit log and shown on the case. It can be undone there, except in a tool that only lets a block run out, which the case then says.

7. Your responsibilities

In addition to section 6 of the Terms, you:

  • only give Write Access to tools, and only approve actions on systems, accounts and addresses, that you are entitled to change, and only within your own organisation;
  • decide who your Admins and Approvers are, keep that list current, and make sure they understand what they approve;
  • keep at least one emergency account that Kandaro can never act on, kept out of the accounts your identity provider connector covers, so that a mistaken action on accounts cannot lock you out;
  • tell us in writing about systems that must never be cut off, such as safety or medical systems, and keep them out of the Write Access you give, or put their addresses on your Allowlist;
  • keep your own backups, recovery procedures and other security measures. Kandaro SOC is one layer of your security, as section 12.2 of the Terms says.

8. Our responsibilities

We:

  • only use Write Access to carry out Response Actions that were approved, or that the Auto-block Rule allows while it is on, and to check their result;
  • never use Write Access for anything else, never carry out an action other than the one approved, and never act on a target other than the one approved;
  • keep the credentials behind Write Access encrypted, limit who in our team can reach them, and record every use;
  • tell your Admins without undue delay when an action failed, could not be confirmed, or did something other than what was approved, and help you put it right;
  • tell you without undue delay, and in any case within 24 hours of becoming aware of it, if Write Access you gave us may have been exposed through a security incident on our side, so that you can withdraw it. The DPA applies to any incident involving personal data.

9. Pausing for safety

We may switch your organisation back to Propose Mode, or pause Response Actions or the Auto-block Rule, without prior notice, when we reasonably believe that carrying out actions is unsafe: for example when an Admin account of yours or a part of our own service may have been compromised, or when a tool behaves unexpectedly. We tell your Admins straight away, limit the pause to what is needed, and lift it once the reason is gone.

10. Availability

Triage, investigation, proposals and approved actions run automatically, around the clock. That does not include a person on duty: human support is as set out in section 13 of the Terms, and response times or an on-call service apply only if agreed in an order form. An action can be delayed or fail when the tool it runs in, your network or a provider we depend on is unavailable; Kandaro then reports it on the case.

11. Liability

Section 15 of the Terms applies to Response Actions, including its limit of liability. Under it, we are not liable for the consequences of a Response Action carried out as it was approved, or of the Auto-block Rule acting as described in section 6 while it was on. We are also not liable for an action that was not carried out because a proposal expired, a limit in section 5 was reached, the action was paused, or the tool could not be reached.

We are responsible, within the limits of section 15 of the Terms, for loss caused by our own failure to keep to these SOC Terms: carrying out an action that was not approved, carrying it out differently from how it was approved or on a different target, or using Write Access for anything other than section 8 allows. Section 16 of the Terms (indemnities) applies to the actions you approve and to the Auto-block Rule while you have it switched on.

12. Term and ending

  • These SOC Terms run for as long as your Kandaro SOC Subscription, and end automatically when it ends.
  • You may end these SOC Terms at any time with immediate effect by written notice. Your Kandaro SOC Subscription then continues in Propose Mode.
  • When they end, we switch your organisation to Propose Mode and switch off the Auto-block Rule straight away. Blocks that were still running end by themselves at their set time, or earlier if you undo them. Within 30 days we delete the credentials you gave us for Write Access. You withdraw consents and access you gave in your own tools.

13. Changes

Changes to these SOC Terms must be agreed in writing by both parties. Changes to the Terms apply as section 18 of the Terms sets out.

14. Signatures

The parties sign these SOC Terms in the version published on this page with the effective date shown above, or in a copy of it we send you for signature.

For the Customer
Organisation
Name
Role
Date
Signature
For Kandaro
Organisation
Name
Role
Date
Signature

15. Contact

To sign these SOC Terms, switch to Execute Mode or ask a question about them, use the contact form. To report a problem with a Response Action, choose technical support.