Terms of Service

Version 2026-10-06 · in effect from 6 October 2026

1. About these terms

These Terms of Service are an agreement between Quantamsecure Private Limited, a private limited company registered in India with its registered office at 898, Block H, 10th Street, Chennai, Tamil Nadu 600040, India, and the organisation that signs up for QureMail. They apply from 6 October 2026.

Please read them with our Privacy Policy, which explains how we handle personal data. If you have a separate signed agreement or order with us, that document wins where it differs from these terms.

2. Words we use

"We", "us" and "our" mean Quantamsecure Private Limited, which provides QureMail.
"You" and "your" mean the organisation (the business) that uses QureMail, not the individual who clicks to agree.
"Admin" means a person you give the admin role in QureMail. Admins manage settings, users, held mail and billing for you.
"Your users" means the people whose mail QureMail protects for you, and anyone you invite to sign in to QureMail.
"The service" means QureMail: the mail checking, the dashboard, the notices and reports we send, and everything we provide under these terms.
"Your mail" means mail sent to the domains and mailboxes you ask us to protect, including its contents, attachments and details such as sender, recipients and subject.

3. Your account and who may accept

QureMail is a service for businesses and other organisations. It is not for personal or household use.

The person who creates your organisation in QureMail, or who accepts an invitation to be an admin, agrees to these terms for you. By ticking the box to agree, that person confirms they have authority to bind you. If they do not have that authority, they must not create the organisation or accept the invitation.

When someone agrees, we record who agreed, which version of these terms and our Privacy Policy they agreed to, and when.

You must give accurate details when you sign up and keep them up to date. You are responsible for everything done under your organisation's accounts. Admins must keep their passwords and two-step sign-in codes private and tell us at once at support@quantamsecure.com if they think an account has been misused.

You may only add domains you own or control. We check ownership before we protect a domain.

4. What the service does

QureMail checks mail sent to your organisation for spam, phishing, fraud and harmful attachments and links, and acts on it according to your settings. Depending on your plan and settings, the service can:

check incoming mail and deliver it, deliver it with a warning, or hold it in quarantine.
refuse clearly harmful mail before it is accepted, where your mail reaches us directly through your MX records.
let your admins, and your users where you allow it, review held mail and release, block or delete it.
send your users a digest of their held mail with links that act on one message each.
send your admins reports and notices about your organisation's mail.
replace links in delivered mail with checked links and re-check each link when it is clicked (see section 7).
send a small share of uncertain mail to an AI check (see section 8).
learn from the reports your users and admins make about mail we got wrong.

Once we accept a message for you, we do not bounce it back to the sender and we do not silently throw it away. We deliver it, deliver it with a warning, or hold it where your admins can see it.

Held mail is kept for 30 days and then deleted automatically, unless someone releases or deletes it sooner.

5. How your mail reaches us, and the access you give us

You choose one of these ways of connecting, and you can change it later:

MX connection: you point your domain's MX records at QureMail. We receive your mail first, check it, and pass it on to your mail system.
Microsoft 365 rule connection: your Microsoft 365 admin adds a mail flow rule and connectors that send incoming mail through QureMail and back. Your MX records do not change.
Microsoft API connection: Microsoft delivers mail to your mailboxes first. With your Microsoft admin's consent, we are told when mail arrives, take a copy to check it, and act on it inside the mailbox. Because Microsoft delivers first, a message can sit in an inbox for a short time before we act on it.

If you connect a Microsoft 365 organisation, your Microsoft admin grants our app permissions in your Microsoft tenant. Depending on the connection and the features you turn on, these let us:

read the names and addresses in your directory (people, aliases, groups and shared mailboxes), so we accept mail only for addresses that exist.
with the Microsoft API connection, read messages and folders in the mailboxes you protect, move held mail into a hidden folder named "QureMail Quarantine" in each of those mailboxes, move it back when it is released, and replace a delivered message with a copy that carries a warning.
if an admin agrees in QureMail, read the sender, the date and the sender authentication results Microsoft recorded (not the subject or body) for the last 120 days of mail in protected inboxes, so mail from people you already correspond with is not flagged as a first contact.
if an admin agrees in QureMail, read the outside addresses your users send mail to, and when (not the subject, body or attachments), so replies from those people are treated as expected.

We use these permissions only to provide the service to you. You can remove them at any time in Microsoft 365. If you remove them while the service is running, the parts of the service that depend on them stop working.

6. Held mail and what your admins can see

Your admins can open a safe preview of held mail addressed to any of your users, and release, block or delete it. The preview removes scripts and blocks remote images, so opening it does not run anything in the message. Every preview, release and deletion is recorded in your organisation's audit trail.

Held mail is your users' work mail. Deciding who in your organisation may read it, and telling your users that their work mail is checked and may be reviewed, is your responsibility (see section 10).

7. Link checking and click records

On plans that include it, link checking is on by default for new organisations. An admin can turn it on or off, or exclude some of your mail from it, in Settings.

When link checking is on, we replace each link in incoming mail with a QureMail link. When someone clicks it, we check the destination at that moment and then send them on, show a warning, or block it. If the link downloads a file, we fetch the file, check it for harmful content and give the person the copy we checked.

For each click we record: a reference to the message, a coded reference to the recipients (not their addresses), a fingerprint of the link and the name of the site it points to, the result of the check, and the time. We keep click records for 12 months and then delete them. We use the address of the device that clicked for no more than about an hour, only to spot a link being used by many people it was not sent to, and we do not store it with the click record.

A link checked at click time can still change after the check. Link checking reduces risk. It does not remove it.

8. The optional AI check

The AI check is on unless an admin turns it off, or excludes some of your mail from it, in Settings. It applies only to a small share of mail from outside your organisation: mail our other checks find uncertain, or that looks like payment or sign-in fraud.

For that mail we send an AI model provider the message headers, a shortened text of the message, the names and types of any attachments, the names of the sites its links point to, and the results of our own checks. We never send attachment contents or full links. We use the provider under terms that do not let it use this data to train its models.

The AI check runs outside India, so it is not covered by our statement that scanning, storage and quarantine stay in your country (see our Privacy Policy).

The AI check can only make us more cautious. It never lets through mail our other checks would hold. If we get no answer in time, we hold the message, and we release it automatically if a later answer finds it harmless. We keep the result and its reasoning for 90 days so your admins can see why mail was held.

9. What the service cannot promise

No mail security service catches every harmful message or never holds a good one. Attackers change their methods every day. Some unwanted or harmful mail may reach your users, and some wanted mail may be held, tagged or delayed.

QureMail is one layer of protection. You should keep other reasonable safeguards, such as training your users, protecting accounts with two-step sign-in, and checking payment requests by phone.

You are responsible for decisions your admins and users make, including releasing held mail, opening attachments, following links and acting on requests in mail.

10. Your responsibilities

You agree to:

set up and keep your DNS records and Microsoft 365 settings as our setup steps describe, and tell us before you change them in a way that affects mail flow.
protect only domains and mailboxes that belong to you.
tell your users, as the law requires, that their work mail is checked by a service provider, that held mail may be reviewed by your admins, and that clicks on checked links are recorded.
have a lawful basis, under the laws that apply to you, for us to process your users' mail for you.
decide which of your people are admins and what they may see, and remove access when someone leaves.
keep your contact and billing details up to date so we can reach you.
follow section 11.

11. Acceptable use

You must not, and must not let anyone else:

use the service to send spam or any mail that breaks the law.
send attacks, malware or test phishing campaigns to anyone outside your organisation, or to us, without our written agreement.
try to get into accounts, mail or data that are not yours, or test, probe or scan the service for weaknesses without our written permission.
overload, disrupt or work around the limits or protections of the service.
copy, resell, rent or offer the service to others, or use it to build a competing service.
reverse engineer the service, except where the law allows it despite this term.
use checked links, block pages or our name to make your own messages look trusted.
upload or route content you have no right to process.

If you find a security weakness in QureMail, please tell us at support@quantamsecure.com and give us a fair chance to fix it before telling anyone else.

12. Trial and plans

A new organisation gets a free trial of 14 days on our Professional plan. You do not need to give payment details to start the trial.

Our plans differ in what they include, for example link checking, and in how many mailboxes they cover. Plan features and prices are shown in the dashboard or in your order. Some features work only with some connection methods, and the dashboard says so.

We charge by protected mailbox, counted as your billing page shows. If you protect more mailboxes than your plan covers, beyond a small margin, we may charge for the extra mailboxes from the next billing period.

13. Fees, payment and renewal

Fees are in Indian rupees and do not include taxes. Goods and Services Tax (GST) and any other applicable taxes are added at the rate in force when we invoice. Please give us your GSTIN if you want to claim input tax credit.

Payments are taken by our payment provider. By paying you also accept the payment provider's terms for the payment. We do not receive or store your full card details.

Paid plans renew automatically at the end of each billing period for the same period, at the price then shown for your plan, until you cancel. You can cancel at any time, and the cancellation takes effect at the end of the period you have paid for.

Fees are charged in advance for each billing period and, once paid, are generally non-refundable. As each billing period is charged as a whole, we are unable to offer refunds or credits for a period that has begun, including where the service is used for only part of it. Where exceptional circumstances arise, we will be glad to consider a refund request, and any refund is made at our sole discretion. If we end the service for our own convenience under section 24, we will refund the fees you have paid for the period after the end date. Nothing in these terms affects any right to a refund that you have under applicable law.

We may change our prices. We will tell your admins at least 30 days before a new price applies to you. It applies from your next renewal.

14. If a payment is missed

A missed payment never makes us bounce or block your mail. If a payment fails, we email your admins and try again up to three times over 7 days. If it still has not been paid, or a trial ends without a paid plan, your organisation gets a grace period of 14 days during which protection is unchanged and your admins see a notice.

If the fees are still unpaid after the grace period, protection is reduced. We keep checking your mail and keep stopping mail that carries known viruses. We stop holding other suspicious mail: it is delivered with a warning, or with the Microsoft API connection it stays in the inbox, and we keep recording and reporting it. Full protection returns as soon as payment is made.

Fees not paid when due remain owed. We may end the service under section 24 if fees stay unpaid for 30 days after we tell you in writing that they are overdue.

15. Personal data and our roles

When we process your users' mail and related data for you, we act on your instructions and only to provide the service. You decide why that data is processed. Our Privacy Policy explains how we handle it, and we will sign a data processing agreement with you on request.

For the account details of your admins and users (names, email addresses, sign-in records), for billing details and for support requests, we decide how the data is used, as our Privacy Policy explains.

Your mail stays yours. We use it only to provide, secure and improve the service for you, as described in these terms and our Privacy Policy. We do not sell it, and we do not use it for advertising.

To keep detection accurate, we learn from mail that your admins and users report as missed or wrongly held, and from patterns in the mail we check. What we keep from this is limited to what detection needs, and we never use your mail to train an outside AI provider's models.

16. Our staff's access to your mail

Our staff do not browse customer mail. A member of our staff can look at your organisation's mail records or held mail only when they need to, for example to answer your support request, to act on a report your users made, or to investigate a security problem.

To open your organisation's mail records, a member of our staff must select your organisation alone and record a reason. Their access is read-only and ends after a short time. Each such access is recorded in your organisation's audit trail, which your admins can see. Messages your users report to us are reviewed in a tool that shows only those reports. We keep the record of who looked and why even after your organisation's other data is erased.

17. Security

We take reasonable technical and organisational measures to protect your mail and data, appropriate to an email security service. These include encrypting data in transit where the other side supports it, encrypting stored held mail, keeping each customer's data separate, two-step sign-in for admins, recording important actions, and keeping encrypted backups that we test by restoring them.

If we become aware of a breach of security that affects your data, we will tell your admins without undue delay, give them the information we have, and take reasonable steps to limit the harm. We will also make any notifications the law requires of us.

18. Availability and support

We work to keep the service available all the time and we monitor it continuously. We do not promise that it will be uninterrupted or free of errors. We may carry out maintenance, and where it is planned and likely to affect you, we will try to tell you in advance.

If the part of the service that receives your mail cannot accept mail for a while, sending servers normally keep the mail and try again later. If our check of a clicked link cannot finish, the click shows a warning page with the destination rather than sending the person on unchecked. While the link service itself is down, checked links do not open until it is back.

You can reach support through the support page or at support@quantamsecure.com.

19. Confidentiality

Each of us may receive information from the other that is not public, such as your mail, your settings and reports, or our pricing and product plans. Each of us will keep the other's confidential information private, use it only for this agreement, and share it only with people who need it for this agreement and are bound to keep it private.

This does not apply to information that is or becomes public without fault, that the receiving party already had or developed independently, or that it must disclose by law. If the law requires disclosure, the receiving party will, where allowed, tell the other first and disclose only what is required.

20. Your data and our intellectual property

You keep all rights in your mail and the data you give us. You give us permission to process them only as needed to provide the service and as these terms describe.

We and our licensors keep all rights in QureMail, including its software, design, detection methods, reports and our name and marks. While you subscribe, we give you a limited, non-exclusive, non-transferable right to use the service for your organisation's own business.

Detection data we derive from the mail we check, such as fingerprints of harmful messages and statistics, belongs to us, provided it does not identify you or your users.

21. Feedback

If you send us ideas or suggestions, we may use them without any duty to you. This does not give us any right to your confidential information.

22. Early-access features

We may offer features marked as early access, pilot or preview. They may change or be withdrawn, may not work as well as the rest of the service, and are provided as they are, without the commitments in section 18. You can choose not to use them.

23. Suspension

We may suspend access to the service, or to part of it, if we reasonably need to in order to stop a serious security threat, to comply with the law, or because someone is using your account in breach of section 11. We will limit the suspension to what is needed, tell your admins as soon as we can and say why, and lift it once the reason is gone.

A suspension never makes us bounce mail we have already accepted for you, and with the Microsoft 365 rule connection we keep passing your mail through while your rule still sends it to us.

24. Ending the service

You can end the service at any time by closing your organisation in the dashboard (see section 25).

We can end the service by written notice if you seriously break these terms and do not fix the breach within 30 days of our notice, or immediately if the breach cannot be fixed or involves misuse under section 11. We can also end it for our own convenience by giving you at least 90 days' written notice.

When the service is ending, we give you time to move your mail settings away from us and we keep processing your mail during that time, so the end of the service does not leave your mail undelivered.

Sections that by their nature should continue after the end, including fees owed, confidentiality, limitation of liability, indemnities and governing law, continue.

25. Leaving and what happens to your data

You can leave without contacting us. An admin starts closing the organisation in Settings, confirms with their password (and two-step sign-in code where set up) and types the organisation's name. Every admin is told by email and can cancel the closing from that message.

The dashboard then guides you through the steps for your connection: pointing your MX records back to your mail system, removing the Microsoft 365 rule and connectors, or letting us remove our mailbox subscriptions. Changes to your DNS and your Microsoft 365 settings are made by you, and we check that mail has stopped reaching us before we close the organisation.

You choose what happens to held mail: release it all, or let it expire. You can download your mail log and your allow and block lists before you close. With the Microsoft API connection, held mail is already in your own mailboxes and stays there. After closing, you should also remove the QureMail app from Enterprise applications in Microsoft 365.

When the organisation is closed, sign-in stops, digests stop and digest links stop working. We erase your organisation's data 30 days after it is closed. If the closing was a mistake, contact us within those 30 days.

After erasure we keep only:

your organisation's audit trail, kept for its normal 12 months, as the record of the account and of the erasure.
monthly totals of your mail (counts only, with names and addresses removed), kept without a time limit.
billing and invoice records, which we keep as part of our financial and tax records.
the records of our staff's access to your mail (section 16).
the record of who agreed to these terms and which version, and when (section 3), as proof of notice and agreement.

Erased data can remain in our encrypted daily backups for up to 30 days after erasure, until those backups expire. Our monthly backups hold only the records listed above. We do not edit backups to remove single records, because that would damage our ability to restore them.

26. Warranties and disclaimer

Each of us confirms that it has the authority to enter into this agreement. We will provide the service with reasonable skill and care, substantially as described in these terms.

Apart from what these terms expressly say, the service is provided "as is" and "as available". To the extent the law allows, we give no other promises or warranties, express or implied, including about fitness for a particular purpose, merchantability or that the service will catch every threat or never hold good mail.

27. Limitation of liability

Neither of us is liable to the other for loss of profits, revenue, business, goodwill or data, or for any indirect, special or consequential loss, even if it was foreseeable.

Each party's total liability to the other arising out of or in connection with this agreement, in any twelve-month period, is limited to the fees you paid us for the service in the twelve months before the event that gave rise to the claim.

These limits do not apply to your duty to pay fees, to a party's liability under section 28, or to liability that cannot be limited by law, such as liability for fraud.

28. Indemnities

You will defend us against claims by third parties, and pay any resulting costs and damages, to the extent they arise from your use of the service in breach of section 11, from mail or data you had no right to have processed, or from your failure to meet your duties to your users under section 10.

We will defend you against claims by third parties that the service, used as these terms allow, infringes their intellectual property rights in India, and pay any resulting costs and damages. If such a claim is made, we may change the service so it no longer infringes, get you the right to keep using it, or end the service and refund fees paid for the unused period. This does not cover claims caused by your content or by combining the service with things we did not provide.

The party seeking protection must tell the other promptly, let it control the defence and settlement, and give reasonable help.

29. Events beyond our control

Neither of us is responsible for a delay or failure caused by events beyond reasonable control, such as natural disasters, war, civil unrest, government action, widespread failures of the internet, power or other providers, or large-scale attacks that a reasonable provider could not prevent. This does not excuse a duty to pay fees. If such an event stops the service for more than 30 days, either of us may end the service by written notice.

30. Changes to these terms

We may update these terms. Each version has a date and is published at /terms, with earlier versions kept so you can read the one you agreed to.

If a change is material, for example it affects your rights, your data or what you pay, we will tell your admins at least 30 days before it takes effect, and an admin will be asked to review and agree to the new version the next time they sign in. If you do not agree, you can leave under section 25 before the change takes effect.

Other changes, such as corrections and clarifications, take effect when we publish them, and we will show a notice in the dashboard.

31. Notices

We send notices about the service, billing and these terms by email to your admins and by notices in the dashboard. Please send legal notices to us at support@quantamsecure.com or by post to 898, Block H, 10th Street, Chennai, Tamil Nadu 600040, India.

32. Governing law and disputes

These terms are governed by the laws of India.

If a dispute arises, we will each first try in good faith to settle it by talking, for at least 30 days from written notice of the dispute. If it is not settled, the courts at Chennai, Tamil Nadu, have exclusive jurisdiction.

Either of us may still ask a court for urgent relief at any time.

33. General

If a court finds part of these terms unenforceable, the rest still applies. If one of us does not enforce a right at once, it may still enforce it later.

You may not transfer this agreement without our written consent. We may transfer it to a company in our group, or to whoever takes over our business, and we will tell you if we do.

These terms, your order (if any), and the Privacy Policy are the whole agreement between us about the service. They replace earlier discussions. Nothing in them creates a partnership or agency, and only you and we have rights under them.

34. Contact

Quantamsecure Private Limited, 898, Block H, 10th Street, Chennai, Tamil Nadu 600040, India.

Questions about these terms: support@quantamsecure.com. Privacy questions and grievances: support@quantamsecure.com.