KYC & Verification Policy

Nubesti sells professional offensive-security tooling. We do not activate paid access or allow tests to launch until the customer has completed Know Your Customer (“KYC”) and identity verification and paid the KYC / verification fee.

This policy forms part of the Terms of Service. It works with Billing & Renewals, Export Controls & Sanctions, and the Authorization Letter.

1. Who must complete KYC

KYC is mandatory for:

• The contracting organization (legal entity or sole trader)
• Beneficial owners or control persons we reasonably request
• Every user who can launch tests, change scope, or invite teammates
• Resellers or partners who buy on behalf of an end customer

A demo conversation does not replace KYC. Trial features that could touch live targets stay locked until verification is approved.

2. Customers pay for KYC

Identity verification is a paid service, not included in the subscription price.

• The KYC / verification fee is the amount shown at checkout, in the portal, or in your order form
• The fee is due in advance, in addition to plan, add-on, and tax charges
• You authorize Nubesti and its payment processors to charge the payment method on file for KYC fees
• Extra verified users, failed retries that require a new review, and periodic re-verification may be billed again
• KYC fees are non-refundable, including if we decline the account, you cancel before tests start, or a subscription is later refunded under other rules
• SLA credits never apply to KYC fees

If an order form states a different KYC price for that customer, the order form controls.

3. What we verify

We may require:

• Government-issued photo ID for authorized users
• Legal name, formation documents, and registered address of the company
• Proof that the signer can bind the company
• Beneficial-ownership or control information
• Proof of authorization to test the systems you designate (see the Authorization Letter)
• Screening against sanctions, watchlists, and fraud signals

We may use a third-party identity-verification provider. That provider is a subprocessor listed or described on Subprocessors.

4. When access starts

We may take payment for the plan and for KYC before review finishes. Tests cannot launch, APIs that start scans stay disabled, and paid seats stay inactive until KYC is approved.

If KYC is rejected or not completed within the window we set (typically 14 days), we may cancel unused subscription time. KYC fees already paid stay earned. Any unused prepaid subscription may be refunded minus KYC and payment-processing costs, unless law requires otherwise.

5. Ongoing duties

You must keep KYC information accurate. Tell us promptly if control of the company, authorized testers, or billing contacts change. We may freeze launches until re-verification is paid and approved.

We may request a fresh KYC at renewal, after a risk event, or when law or our banking partners require it.

6. Data and retention

KYC data is personal data. We use it to onboard you, prevent abuse of security-testing tools, comply with sanctions and anti-fraud rules, and keep records. See the Privacy Policy.

We retain KYC records for as long as the account exists and for a commercially reasonable period afterward (typically at least five years) unless a longer legal retention applies.

7. No guarantee of approval

Passing payment does not guarantee approval. We may decline or limit service where verification is incomplete, inconsistent, high-risk, or barred by export and sanctions rules.

8. Contact

KYC and billing: [email protected]
Privacy of KYC documents: [email protected]