Ir para o conteúdo
Flowguard Anti-DDoS
Create account

Terms of Contracting and Use of Flowguard Anti-DDoS

Version 1.0, published on October 31, 2026.

This translation is provided for information only. In case of any divergence, the Portuguese version prevails (clause 21.6 of the Terms of Contracting and Use).

Parties

FLOWSPEC SOLUTIONS LTDA, enrolled in the CNPJ under no. 53.730.044/0001-33, headquartered at Alameda Rio Negro, 503, conj. 2301, Alphaville, Barueri/SP, CEP 06454-000, hereinafter FLOWSPEC.

CUSTOMER: the legal entity identified by the corporate name and CNPJ provided in the Platform registration.

1. Definitions

  • Platform or Flowguard: the Flowguard Anti-DDoS software, accessed over the internet at flowguard.com.br, with its collection, analysis, detection and mitigation modules.
  • Account: the CUSTOMER's environment on the Platform, linked to a single CNPJ.
  • User: the natural person authorized by the CUSTOMER to access the Account.
  • Subscription: the right to use the Platform during a Cycle, monthly or annual, under the contracted Plan.
  • Plan: the contracted capacity tier, with a number of included Sensors (P1, P2 or P3), according to the table published on the website at the time of contracting.
  • Sensor or Exporter: the CUSTOMER's equipment registered on the Platform that sends flows (NetFlow, IPFIX or sFlow) or responds to SNMP queries.
  • Flows: the traffic records sent by the Sensors, with IP addresses, ports, protocols, volumes and timestamps.
  • Mitigation Rule: the BGP announcement generated by the Platform, which may be of two types:
    • FlowSpec: a filter based on traffic criteria;
    • RTBH: discarding of all traffic destined to an address.
  • BGP Session: the session between the CUSTOMER's router and the Platform (AS61620) through which the Mitigation Rules are sent.
  • Automatic Mode: the Platform announces the Mitigation Rules without human approval.
  • Manual Mode: the announcement depends on the approval of a User.
  • Customer Data: the Flows, the SNMP data, the prefixes, the configurations and the other data entered or generated in the Account.

2. Purpose

2.1. These Terms grant the CUSTOMER a license to use the Platform, provided over the internet as a service (SaaS), during the term of the Subscription. The license is non-exclusive, non-transferable and non-sublicensable, and serves to:

  • collect and analyze the Flows and the SNMP data of its Sensors;
  • detect anomalies and denial-of-service attacks;
  • generate and announce Mitigation Rules through the BGP Session.

The license does not transfer to the CUSTOMER any ownership right over the Platform.

2.2. The following fall outside the purpose of these Terms, and may be contracted separately:

  • the configuration of the CUSTOMER's equipment;
  • network consulting;
  • dedicated NOC and SOC services;
  • traffic diversion for cleaning (scrubbing);
  • the provision of an IP link or a mitigated link;
  • on-premises installation of the Platform.

2.3. Capacities above 10 Gbps are not contracted through the website and depend on a specific proposal, with on-premises installation.

3. Contracting, acceptance and Account

3.1. The Platform is offered only to legal entities with a valid CNPJ. The CUSTOMER declares that it has its own network or that it is authorized to operate the monitored network.

3.2. The CUSTOMER accepts these Terms by checking the acceptance box during registration. FLOWSPEC records the date, time, IP address and version of the Terms accepted. Payment of the Subscription confirms the acceptance.

3.3. The CUSTOMER warrants that the registration data are true and undertakes to keep them up to date.

3.4. The Account's CNPJ cannot be changed after registration. To change the CNPJ, a new Account must be created. The other User and company data may be changed by the CUSTOMER itself on the Account screen.

3.5. The CUSTOMER is responsible for safeguarding the access credentials and for all acts performed by its Users. The Platform allows the password to be changed and recovered without opening a ticket.

4. Plans, capacity and Sensors

4.1. The price, the capacity tier and the number of included Sensors are those published on the website at the time of contracting.

4.2. The CUSTOMER may contract additional Sensors. The price of each one is defined by the Plan tier.

4.3. FLOWSPEC verifies the capacity actually used. If the CUSTOMER exceeds the contracted tier:

  1. it receives a notice on the Platform, by e-mail and by WhatsApp;
  2. the FLOWSPEC team contacts it to propose a change of Plan;
  3. if the excess continues for more than 30 (thirty) days after the notice and the CUSTOMER does not regularize the Plan, FLOWSPEC may suspend the Subscription, in accordance with clause 17.

5. Price, payment and renewal

5.1. Payment is processed by a third-party payment platform, currently Eduzz. The rules of that platform apply to the payment method, billing and receipts.

5.2. The Subscription is renewed automatically at the end of each Cycle, with a new charge to the same payment method, until the CUSTOMER cancels the renewal.

5.3. The CUSTOMER may cancel the renewal at any time. The cancellation takes effect at the end of the Cycle already paid, and access continues until that date.

5.4. Prices may be adjusted once every 12 (twelve) months by the variation of the IPCA/IBGE index, with prior notice of 30 (thirty) days. The adjustment applies only to Cycles beginning after the notice.

5.5. FLOWSPEC issues the service invoice (nota fiscal de serviço) corresponding to each payment. Taxes apply in accordance with the legislation.

6. Refund

6.1. The CUSTOMER may request a full refund within 7 (seven) days from the purchase, through the payment platform or by e-mail at soc@flowspec.net.br.

6.2. After that period, there is no refund for withdrawal or lack of use, except in the cases provided for by law.

6.3. There is no free trial period. To get to know the Platform before contracting, the CUSTOMER has available the public demonstration with synthetic data and the documentation.

7. Activation and technical responsibilities of the CUSTOMER

7.1. Activation is carried out by the CUSTOMER itself in the Platform wizard. The steps are the type of protection, the Sensor (NetFlow and SNMP), the prefixes and the BGP Session.

7.2. The CUSTOMER declares that it is the holder of the IP prefixes it registers or that it is authorized to operate them. FLOWSPEC may confirm the holding through the public registro.br database or through verification by its team. It may also refuse or remove a prefix when:

  • the holding is not proven; or
  • the prefix overlaps with that of another customer.

7.3. The CUSTOMER is responsible for the configuration of its equipment, including:

  • the export of flows and the reported sampling;
  • SNMP;
  • the BGP Session on its side: authentication, import filters (accepting from the Platform only rules for its own prefixes) and prefix limits.

7.4. The collector address and port are sent by e-mail and are confidential information. The CUSTOMER may not disclose them to third parties.

7.5. The CUSTOMER must report through the Platform, before making them, any changes of equipment, address or ASN that affect the collection or the BGP Session.

8. Mitigation: operation, risks and responsibilities

8.1. The Platform detects events by traffic thresholds and by threat lists, and generates proposed Mitigation Rules. The detection profiles start disabled: it is up to the CUSTOMER to enable them and adjust the thresholds to its network.

8.2. The CUSTOMER chooses:

  • the operating mode, Automatic or Manual;
  • the delivery type: FlowSpec, RTBH or both;
  • where the rules are applied.

By choosing Automatic Mode, the CUSTOMER authorizes the announcement of Mitigation Rules without prior human approval.

8.3. A Mitigation Rule only takes effect when the CUSTOMER's router accepts and applies it, according to the configuration and routing policy defined by the CUSTOMER itself. FLOWSPEC has neither access to nor control over the CUSTOMER's equipment.

8.4. The CUSTOMER declares that it is aware that:

  • an RTBH rule discards all traffic destined to the affected address, including legitimate traffic;
  • all automatic detection is subject to false positives (a rule against legitimate traffic) and false negatives (an undetected attack);
  • the Platform reduces the impact of attacks, but does not guarantee that they will be eliminated or that the CUSTOMER's network will not become unavailable.

8.5. The Platform offers the Panic command, which withdraws all rules, and the Restore command. The CUSTOMER is responsible for monitoring the active rules.

8.6. FLOWSPEC is not liable for damages arising from Mitigation Rules applied in accordance with the CUSTOMER's choices and configuration described in this clause, except in the event of willful misconduct or gross negligence of FLOWSPEC.

9. Third-party threat lists

9.1. The reputation and threat lists maintained by third parties are offered as is, subject to the licenses of each source and without any warranty of accuracy or currency.

9.2. FLOWSPEC may add, change or remove sources at any time, including due to license requirements.

10. Availability, maintenance and updates

10.1. FLOWSPEC endeavors to keep the Platform available. There is no percentage availability guarantee (SLA), except under a specific contract.

10.2. Scheduled maintenance is announced at least 48 (forty-eight) hours in advance, through the channels of clause 20. Emergency maintenance may occur without notice.

10.3. FLOWSPEC may update the Platform, including by changing screens and functions, provided that it does not eliminate the main contracted function during the current Cycle.

11. Support

11.1. Technical support is provided by e-mail at soc@flowspec.net.br, Monday to Friday, from 8 a.m. to 6 p.m. (Brasília time), except national holidays.

11.2. The response times, counted in business hours within the hours above, are:

  • Level 1, up to 2 hours: Platform unavailable or mitigation not working;
  • Level 2, up to 4 hours: function degraded or with errors, with the Platform in operation;
  • Level 3, up to 8 hours: questions, guidance and requests.

The times are response times, not resolution times.

11.3. The telephone and WhatsApp number 21 99711-5461 is the commercial and notices channel.

11.4. The following fall outside support, and may be contracted separately:

  • the configuration of the CUSTOMER's equipment;
  • troubleshooting of the CUSTOMER's network;
  • third-party tools.

12. Acceptable use and prohibitions

12.1. The CUSTOMER may only monitor its own networks or networks it is authorized to operate.

12.2. The CUSTOMER is prohibited from:

  • reverse engineering, decompiling, copying or reproducing the Platform, its screens or its documentation;
  • reselling, sublicensing, assigning, offering as white label or making the Platform available to third parties;
  • using the Platform, or the information obtained from it, to develop a competing product;
  • performing load, penetration or vulnerability tests against the Platform without written authorization from FLOWSPEC;
  • circumventing capacity, Sensor or access limits;
  • sharing credentials with persons outside its organization.

13. Intellectual property and use of data

13.1. The Platform, the Flowguard trademark, the documentation and the other materials are owned by FLOWSPEC.

13.2. The Customer Data belong to the CUSTOMER. The CUSTOMER authorizes FLOWSPEC to process them to the extent necessary to provide the service.

13.3. FLOWSPEC may use aggregated and anonymized statistical data, which do not identify the CUSTOMER or natural persons, to improve detection and the Platform. The Customer Data are not used to feed third-party lists, feeds or products without the express and separate consent of the CUSTOMER.

14. Personal data protection

14.1. The CUSTOMER is the controller and FLOWSPEC is the processor, under the General Data Protection Law (LGPD, Lei 13.709/2018), of the Customer Data that are personal data, such as the IP addresses of the CUSTOMER's subscribers, including those shared through CGNAT. The processing follows Annex I.

14.2. The registration data of the CUSTOMER and of the Users are processed by FLOWSPEC as controller, in accordance with the Privacy Policy published on the website.

14.3. The CUSTOMER warrants that it has a legal basis to process the traffic data of its network and to share them with FLOWSPEC for the purposes of these Terms.

14.4. The Platform is not a connection log retention system for the purposes of the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet, Lei 12.965/2014). The CUSTOMER remains responsible for its own legal retention.

15. Confidentiality

15.1. The parties shall keep confidential the confidential information of the other party to which they have access, in particular:

  • the Customer Data;
  • the BGP Session credentials and passwords;
  • the collector addresses;
  • non-public technical and commercial information.

15.2. The confidentiality obligation continues for 2 (two) years after the end of the relationship.

16. Limitation of liability

16.1. The total liability of FLOWSPEC arising from these Terms is limited to the amount actually paid by the CUSTOMER in the 12 (twelve) months prior to the event that gave rise to the claim.

16.2. FLOWSPEC is not liable for loss of profits, loss of revenue, indirect or consequential damages, or for failures of third parties. Third parties include:

  • connectivity providers;
  • the payment platform;
  • the CUSTOMER's equipment and transit carriers;
  • events of fortuitous event or force majeure.

16.3. The limitations of this clause do not apply to cases in which the law prohibits limiting liability.

17. Suspension

17.1. FLOWSPEC may suspend access when payment is not confirmed within 5 (five) days after the due date.

17.2. Suspension may be immediate in the event of a breach of clause 12 or a risk to the security or stability of the Platform.

17.3. Upon suspension and termination, FLOWSPEC withdraws the announced Mitigation Rules and closes the BGP Session. No rules remain active without a current Subscription. The CUSTOMER must provide, in its network, for the withdrawal of these rules.

18. Rescission and termination

18.1. The CUSTOMER ends the relationship by canceling the renewal, in accordance with clause 5.3.

18.2. FLOWSPEC may end the relationship:

  • without cause, with 30 (thirty) days' notice and a proportional refund of the period paid and not used;
  • for breach of these Terms, immediately.

18.3. Upon termination:

  1. access is terminated;
  2. the provisions of clause 17.3 apply;
  3. the Customer Data are deleted within 30 (thirty) days, except where there is a legal retention obligation.

The Platform does not offer bulk export of the Customer Data.

18.4. The clauses on confidentiality, intellectual property, limitation of liability and jurisdiction survive termination.

18.5. Breach of the prohibitions on reverse engineering, copying, resale or competing use set forth in clause 12.2 subjects the CUSTOMER to a compensatory penalty equivalent to 12 (twelve) monthly fees of the contracted Plan, without prejudice to compensation for damages exceeding that amount.

19. Amendment of these Terms

19.1. The Terms are versioned and published on the website, with the number and date of each version.

19.2. Amendments are communicated 30 (thirty) days in advance by the registered e-mail. Price changes do not affect a Cycle already paid.

19.3. If it does not agree with an amendment, the CUSTOMER may cancel the renewal. Use of the Platform after the notice period constitutes acceptance of the new version.

20. Communications

20.1. Official communications from FLOWSPEC to the CUSTOMER are made by the e-mail registered in the Account and by notices on the Platform. The CUSTOMER must keep the e-mail up to date.

20.2. The CUSTOMER communicates with FLOWSPEC by e-mail at soc@flowspec.net.br.

21. General provisions

21.1. The parties are independent. These Terms do not create any corporate, employment or agency relationship.

21.2. Tolerance of a breach does not constitute a waiver or a novation.

21.3. The CUSTOMER may not assign its position without the consent of FLOWSPEC. FLOWSPEC may assign it in the event of a corporate reorganization, upon notice.

21.4. The nullity of one clause does not affect the others.

21.5. These Terms are governed by the laws of the Federative Republic of Brazil.

21.6. These Terms are drafted in Portuguese. The translations into English and Spanish are for information only and, in case of divergence, the Portuguese version prevails.

22. Jurisdiction

The courts of the District of Barueri/SP are elected to settle any matters arising from these Terms, waiving any other.

---

Annex I. Processing of personal data (FLOWSPEC as processor)

1. Data processed. The following are processed:

  • source and destination IP addresses, including those of the CUSTOMER's subscribers and of CGNAT (100.64.0.0/10);
  • the ports, protocols, volumes and timestamps of the Flows;
  • the ASN, interfaces and SNMP counters.

2. Purpose. The data are processed exclusively to provide the service: traffic analysis, detection, mitigation, support and security of the Platform.

3. Instructions. FLOWSPEC processes the data in accordance with these Terms and the documented instructions of the CUSTOMER.

4. Security. FLOWSPEC adopts the following measures:

  • encrypted web communication (TLS);
  • access restricted by user profile;
  • isolation of data by Account;
  • audit logging of actions;
  • a firewall that only accepts flows from registered Sensors.

5. Location. The data are kept on FLOWSPEC's own infrastructure, in Brazil.

6. Sub-processors. The following are used:

  • Eduzz, the payment platform, which receives only registration and payment data and never the Flows;
  • the messaging services used for the alerts and notices that the CUSTOMER enables, such as Telegram and WhatsApp. They receive only the content of the alerts.

The addition of a new sub-processor that receives Customer Data is notified 30 (thirty) days in advance.

7. Retention. The periods are:

  • raw Flows and Flows aggregated per minute: 7 (seven) days;
  • SNMP data and records of communication with threat list addresses: 30 (thirty) days.

Upon termination of the relationship, the data are deleted in accordance with clause 18.3.

8. Incidents. FLOWSPEC notifies the CUSTOMER of security incidents affecting its data within 48 (forty-eight) hours of becoming aware of them, with the information available.

9. Data subjects' rights. FLOWSPEC assists the CUSTOMER in responding to data subjects' requests, to the extent technically possible.

10. Audit. FLOWSPEC provides, once a year and upon written request, the information necessary to demonstrate compliance with this Annex.