Hacker News Reader

Comment by encryptluks2 | Hacker News Reader

From their ToS:

"You provide User Data and Personal Data to Evervault with the understanding that any security measures we provide may not be appropriate or adequate for your business, and you agree to implement Security Controls (as defined below) and any additional controls that meet your specific requirements. In our sole discretion, we may take any action, including suspension of your Evervault Account, to maintain the integrity and security of the Services or Data, or to prevent harm to you, us, customers, or others. You waive any right to make a claim against us for losses you incur that may result from such actions. You are solely responsible for the security of any Data on your website, your servers, in your possession, or that you are otherwise authorised to access or handle."

Yeah, no. You either practice what you preach in your advertising or don't advertise what you won't commit to.

View on HN

Thanks for pointing this out. I agree that the tone here doesn't align with what we want to commit to with our customers.

We'll do some work on improving this (probably removing the entire clause around waiving a right to claim) and ship the changes ASAP.

I don't see anything objectionable in here. What do you take issue with? There's always an onus on customers to ensure that the service being provided will actually meets their needs.

It doesn't align with their marketing terms: "Never have a data breach", "Core benefits: Zero Data Breaches", etc.

Promises like that, with liability waivers in the fine print, are always worthy of suspicion.

Generally speaking, I agree with you in principle, but I think the aim here is to basically be able to escape a big lawsuit if a company uses them but screws up the implementation and doesn't follow directions, then faces a loss, then sues Evervault to get their money back. It's not Evervault's fault if you can't follow simple directions, in other words. It's also not their fault if you use them for 99% of things but your dev team just slips up and forgets to integrate some piece with Evervault at some point along the way, thus creating a vector for data leakage and/or attack. Can't fix stupid :-)

But yeah I see your point too - you don't go by "what I think they intend", what gets argued in court is the LETTER of the law, not necessarily its intent. Both sides have a point here.

Oh - fair enough. I tend to treat all marketing/advertizing copy as a (not even necessarily close) approximation of the actual specs, anyway, so the fact that the tagline isn't borne out by the actual implementation didn't even strike me as incongruous. But yes, you're right that those don't line up.

As a sibling commenter said, though - it's not inherently suspicious that the company's covering their ass in the case of an incompetent user.

Reply on news.ycombinator.com