Terms and Conditions of Service

1. Acceptance of Terms

By accessing or using the DFIR Labs services, you agree to be bound by these Terms and Conditions.

These Terms and Conditions of Service ("Terms") constitute a legally binding agreement between you ("User," "you," or "your") and The DFIR Report ("DFIR Labs," "we," "us," or "our") regarding your use of our hands-on cloud-based environments designed for cybersecurity intrusion investigation training (the "Service"). Access to and use of the Service is expressly conditioned upon your acceptance of and compliance with these Terms. If you do not agree to these Terms, you are not authorized to access or use the Service.

2. License Grant and Scope of Use

Your access to DFIR Labs is based on a license with specific usage limitations.

• Personal License: Each license purchased is a "Personal License," granted to a single, named individual for their personal educational use only. It is strictly non-transferable. Account sharing is prohibited.
• Scope of Use: A Personal License is intended for individual skill development. It must not be used for corporate, commercial, or group training purposes. This includes, but is not limited to, internal employee training, "lunch and learn" sessions, or any scenario where the lab is used to educate individuals other than the named license holder. Use for such purposes requires a Business License (see Section 6).
• Isolated Lab Environments: Each lab environment provided through the Service is an isolated instance, provisioned and intended for use by a single authorized user at any given time. Progress, data, configurations, and any artifacts generated within a lab environment are specific to that user's session and are not transferable, shareable, or otherwise accessible across different user accounts.

3. Usage Restrictions and Prohibited Conduct

To maintain the integrity and purpose of our labs, certain activities are strictly forbidden.

• Prohibition on AI/ML Model Training: Users are expressly forbidden from using any data, artifacts, content, tools, or materials ("Lab Materials") found within, derived from, or associated with the Service for the purpose of training, developing, validating, or refining artificial intelligence (AI), machine learning (ML) models, or any similar algorithmic systems. This includes, but is not limited to, using Lab Materials for data mining, pattern recognition, or model generation activities.
• No External Use, Downloading, or Extraction: The downloading, copying, exfiltration, screen-scraping, or any form of external processing or storage of Lab Materials outside the designated Service environment is strictly prohibited. Users shall not attempt to replicate, reverse-engineer, or otherwise extract components of the lab environments or their content for use outside the Service.
• Prohibition on Data Download from Analytics Platforms: Users are expressly prohibited from downloading, exporting, or extracting any data from analytics platforms provided within the Service, including but not limited to Azure Log Analytics, Elastic, Splunk, and any other data analytics, SIEM, or log management platforms. These platforms are provided exclusively for cloud-based querying, analysis, and educational purposes within the designated Service environment. Any use of data from these platforms outside of the cloud environment, including but not limited to local storage, offline analysis, or external processing, is strictly forbidden without the explicit written permission of The DFIR Report. This restriction applies to all data types including logs, queries, query results, visualizations, dashboards, and any derivative content generated from these platforms.
• Prohibition on Commercial and Group Use: The Service under a Personal License is provided for the User's individual, non-commercial educational purposes only. Any form of commercial use is prohibited. This includes resale, redistribution, sublicensing, or using the Service to train others for a fee. Furthermore, as clarified in Section 2, use for internal business training is considered a commercial use and requires a Business License.

4. Case Access, Activation, and Duration

Understand how you can access lab cases and the timeframes involved.

• Acquisition of Case Access: Access to individual lab cases ("Cases") within the Service is obtained through the redemption of valid license activations ("Activations") or by applying eligible discount coupons ("Coupons"), in accordance with the terms specified at the point of purchase or issuance.
• Single Case Per Activation: Each Activation, whether purchased directly or obtained via a Coupon, grants the User the right to access one (1) specific Case from the available catalog at the time of redemption. The selection of the Case is made by the User when utilizing the Activation.
• Activation Deadline for Claimed Cases: Once a Case is claimed by a User (e.g., by assigning an Activation to a specific Case in their account), it must be formally activated (i.e., the lab environment initiated) by the User within three (3) calendar months from the date of claiming. Failure to activate a claimed Case within this specified period may result in the forfeiture of access to that particular Case, without eligibility for refund or credit.
• Duration of Access Post-Activation: Following successful activation of a Case, the User will have uninterrupted access to the selected Case's lab environment for a continuous period of two (2), seven (7), or fourteen (14) calendar days. The specific duration is determined by the option selected by the User at the time of purchase or checkout. This access period commences immediately upon activation and runs for consecutive days.
• Re-accessing Cases After Expiration: Upon the expiration of the designated access period for a Case, the User's access to that specific lab environment will automatically terminate. To regain access to a previously completed or expired Case, the User must utilize a new, valid Activation.

5. Coupon Terms and Conditions

Details regarding the use and validity of discount coupons.

• Coupon Validity Period: Unless explicitly stated otherwise in the terms and conditions accompanying a specific Coupon, all Coupons are valid for a period of twelve (12) calendar months from their official date of issuance. Expired Coupons hold no monetary or activation value and cannot be redeemed or extended.
• Activations per Coupon: Coupons may represent one or more Activations, corresponding to the specific subscription, promotion, or offer through which they were obtained. These Activations can be applied to any Case available in the DFIR Labs catalog during the Coupon's validity period, subject to Case availability.
• Interpretation of "No Time Restrictions": Any references to "no time restrictions" or similar phrasing in Coupon descriptions or promotional materials pertain to the User's flexibility to redeem the associated Activations at any point *within* the Coupon's twelve (12) month validity window. It does not imply indefinite validity beyond this period.

6. Business and Team Use

For any use beyond individual, personal education.

The use of DFIR Labs for any business purpose, including but not limited to internal employee training, requires a Business or Enterprise license. A Personal License is not sufficient for such use cases. We offer the following solutions for organizations:

• Business and Enterprise Licenses: We offer enterprise subscription plans and tailored licensing solutions designed to meet the needs of businesses, educational institutions, government agencies, and other organizations ("Enterprise Clients"). Under such agreements, each designated member of the Enterprise Client's team will be provisioned with an individual license and access to their own dedicated, isolated lab instance.
• Management Dashboard for Enterprise Clients: Enterprise Clients are provided with access to a centralized management dashboard. This dashboard facilitates the administration of licenses, assignment of Cases to team members, and provides tools for monitoring team usage and progress.
• Customized Solutions and Quotations: Organizations with specific requirements are encouraged to contact our sales department for a personalized consultation and a detailed quotation.

7. Fair Use Policy, System Integrity, and Enforcement

Maintaining a fair and secure environment is paramount.

• Reservation of Rights; Monitoring and Suspension: The DFIR Report reserves the absolute right, at its sole discretion, to monitor Service usage for compliance with these Terms and to protect system integrity. This includes, but is not limited to, comprehensive monitoring of all user activities within analytics platforms such as Azure Log Analytics, Elastic, Splunk, and other SIEM or log management platforms provided through the Service. We employ automated monitoring systems, activity logging, and audit capabilities to detect and prevent unauthorized downloading, exporting, copying, or external use of data from these platforms. All user interactions, queries, data access patterns, and system activities within these analytics platforms are subject to continuous monitoring and review. We may suspend or temporarily disable access for any User if activities indicative of abuse, misuse, security risks, or violation of these Terms are detected or reasonably suspected, including but not limited to attempts to circumvent data protection measures or unauthorized data extraction from analytics platforms.
• Termination for Cause; Prohibited Actions: Any material breach of these Terms, including but not limited to: (a) excessive or unauthorized account sharing; (b) attempts to resell, redistribute, or commercially exploit the Service without authorization; (c) efforts to reverse-engineer, decompile, disassemble, or otherwise attempt to discover the source code or underlying structure of the lab environments or Lab Materials; (d) introducing malicious software or attempting to disrupt the Service; or (e) any action that compromises the security or integrity of the Service or other users' data, will result in the immediate and permanent termination of the User's access to the Service. In such instances of termination for cause, the User will not be eligible for any refund, credit, or other compensation.
• Legal Remedies and Enforcement Actions: The DFIR Report reserves the right to pursue all available legal remedies for any breach of these Terms, including but not limited to violations of the analytics platform data restrictions specified in Section 3. User acknowledges that any unauthorized downloading, exporting, or external use of Lab Materials, particularly data from analytics platforms such as Azure Log Analytics, Elastic, Splunk, or other SIEM platforms, may cause irreparable harm to The DFIR Report for which monetary damages would be inadequate. Accordingly, The DFIR Report shall be entitled to seek injunctive relief, specific performance, and other equitable remedies without prejudice to any other rights or remedies it may have at law or in equity. In the event of any breach of these Terms, The DFIR Report may also seek to recover all damages, costs, and expenses incurred, including reasonable attorney fees and court costs. These Terms shall be governed by and construed in accordance with the laws of the jurisdiction where The DFIR Report is domiciled, and any legal action arising from these Terms shall be brought in the courts of competent jurisdiction in that location.

8. Support, Contact Information, and Modifications to Terms

How to reach us and important information about these terms.

For questions regarding these Terms, or if you require assistance or support with the Service, please contact our designated support channel via email at [email protected]. We endeavor to respond to all non-enterprise support inquiries within forty-eight (48) business hours (business hours being typically Monday to Friday, 9:00 AM to 5:00 PM in our operating time zone, excluding weekends and statutory public holidays).

Priority Support for Enterprise Clients: Enterprise subscription customers receive priority support with a guaranteed response time of twenty-four (24) hours from the initial request submission. This priority support SLA applies to all technical support inquiries, billing questions, and account management requests during business hours (Monday to Friday, 9:00 AM to 5:00 PM in our operating time zone, excluding weekends and statutory public holidays).

The DFIR Report reserves the right to modify or replace these Terms at any time. If a revision is material, we will make reasonable efforts to provide at least 30 days' notice prior to any new terms taking effect. What constitutes a material change will be determined at our sole discretion. Your continued use of the Service after any such changes become effective constitutes your acceptance of the new Terms.