Terms

Terms of service

For FileX Eraser for Business (eraser.cybxsan.com), its console, and the desktop applications distributed from it.

Last updated: 23 September 2026

1. What the service is

These terms cover three licensed desktop applications and the console and archive behind them:

• FileX Eraser for Business — file and folder erasure implementing NIST SP 800-88 Clear. Windows, macOS and Linux.
• FileX SSD Eraser — the same erasure, plus flash and encryption-at-rest detection, free-space overwrite and TRIM. Also Clear. Windows, macOS and Linux.
• FileX Drive Purge — a firmware sanitize issued to the drive itself, which is NIST SP 800-88 Purge. Windows and Linux, and only for external, removable, non-boot drives.

Each application produces a certificate recording what it did, which FileX can counter-sign and archive at a permanent public verification URL. Verifying a certificate is free, needs no account, and works offline.

A licence is required to erase. Earlier versions erased without one; from v3 onwards the applications check for an active licence before destroying anything. Section 4 explains how licences and activation work.

2. What each product does not do

File erasure is logical erasure. This applies to FileX Eraser for Business and FileX SSD Eraser. Overwriting a file is best-effort: on SSD and flash media, wear-levelling and over-provisioning may leave prior data in cells unreachable from software; on copy-on-write and journalling filesystems an overwrite may be written elsewhere, leaving the original recoverable from a snapshot; backups and cloud synchronisation may retain copies. Neither product performs drive-level Purge, firmware sanitize or cryptographic erase. This is not a forensic destruction guarantee, and you must not represent it as one. The same statement is carried inside every certificate.

Free-space wipe and TRIM reduce risk; they do not eliminate it. FileX SSD Eraser can overwrite unallocated space and ask the drive to release it, which on most modern drives makes ordinary recovery impractical. It cannot reach over-provisioned capacity or remapped bad blocks, which are never addressable by the host, and it is therefore probabilistic. The certificate records it as Clear, never Purge.

Drive Purge is bounded by what the drive reports. It refuses the boot disk, internal system disks, and any disk carrying a mounted filesystem, and it does not boot from external media, so it cannot sanitize the drive the machine is running from. Where a sanitize cannot be positively confirmed — the drive does not report completion, or a readback check does not pass — no certificate is issued at all and no drive is charged. A record saying "outcome unknown" is the one artefact we will not produce.

3. Erasure is irreversible — your responsibility

The software destroys data on purpose and the result cannot be undone. You are responsible for selecting what to erase, for holding any rights needed to erase it, and for maintaining backups of anything you did not intend to destroy. Preview the file list before confirming; it is shown for exactly this reason.

4. Licences, activation and drive packs

The file erasers are licensed per endpoint, per year. An endpoint is one machine. A licensed endpoint may perform unlimited erasures and obtain unlimited counter-signed certificates for the term; there is no per-job charge. Moving a licence to a replacement machine is free and unlimited — ask us, or release the endpoint in the console.

Drive Purge is licensed per drive sanitized, bought as a one-off pack. Drives do not expire. Before each sanitize the software reserves one drive from the pack over the network, and will not sanitize a drive it cannot reserve. A drive is consumed only when its sanitize is positively confirmed; a refused, failed, cancelled or unconfirmed run consumes nothing.

Licence keys. Keys bought online are issued and emailed at purchase by Dodo Payments, our merchant of record. An annual licence stays valid while its subscription is paid; it stops activating new machines if the subscription is cancelled, put on hold after a failed renewal, or refunded, and machines already activated run to the end of the period they were activated for.

Activation. An installation is activated once over the network. That exchange sends your licence key and a machine fingerprint — a derived identifier for the device, so that a licence for five endpoints is used on five — and nothing else; for keys bought online, the key and a short identifier derived from that fingerprint are passed to Dodo Payments, which enforces the machine count. No file names, no file contents. The software then holds a signed entitlement locally and runs without further network access for the remainder of the term. Sites that cannot reach the network may activate offline by exchanging a file through the console, after which the software makes no network call of any kind. Activation data is described in the Privacy policy.

Circumventing activation. You may not modify, patch or otherwise defeat the licence check, or share a key beyond the endpoint count you bought. A certificate produced by an installation that was not validly licensed is not eligible for counter-signature, and we may decline or withdraw it from the archive.

5. Refunds

Endpoint licences are refundable in full within 14 days of purchase if you have not counter-signed a certificate under them; after that, a cancelled licence runs to the end of its paid term and is not renewed.

Unused drives in a pack are refundable within 14 days of purchase. Drives already consumed are not, because the certificate each produced has been signed and published and that cannot be withdrawn. A refund may take a balance negative, which blocks further certification until it is restored; certificates already issued remain valid regardless.

An evaluation licence, and three evaluation drives, are granted once per organisation so the whole flow can be tested before any purchase. Ask us at info@cybxsan.com if you need longer or more to complete an evaluation.

6. The archive and the verification URL

An archived certificate is immutable and readable by anyone holding its identifier, without an account. That is what makes it evidence. Do not certify in named mode if the filenames would be sensitive when published — the default hashed mode exists for precisely that case.

We intend the verification endpoint to remain available indefinitely. If we ever cannot continue operating it, we will publish the counter-signing public key and the archived records so certificates stay verifiable without us. Offline verification already works today in the desktop application.

7. Acceptable use

You may not use the service to:

• destroy data you are not entitled to destroy, or that you are under a legal duty to preserve — including evidence subject to litigation hold or a regulatory investigation;
• misrepresent the assurance level of a certificate, including describing a Clear erasure as Purge, forensic destruction, or drive sanitisation;
• submit records describing erasures that did not occur;
• attempt to obtain counter-signatures other than through the documented flow;
• defeat, patch or circumvent the licence check, or use a licence key on more endpoints than you bought;
• point Drive Purge at a drive you are not entitled to destroy — it is irreversible and there is no preview of a firmware sanitize.

We may suspend an organisation that does these things. Certificates already issued stay valid: they were signed and published, and that cannot be unsaid.

8. What a counter-signature means

A FileX counter-signature attests to exactly one thing: that the record reached us unaltered and we computed its integrity hash ourselves. It is not an audit of your erasure practice, not a certification of your compliance posture, and not an independent observation that the underlying data is unrecoverable. The operator's own signature — a separate field, with its own signing context — is the claim that the erasure was performed.

9. Warranty and liability

The software and service are provided "as is", without warranties of any kind to the extent permitted by law. We do not warrant that erasure renders data unrecoverable by every means, and section 2 explains why no honest vendor could warrant that for logical erasure. For firmware sanitize, the guarantee is the drive’s, not ours: we issue the standard command, verify what the drive reports, and issue no certificate when it cannot be confirmed — but the erasure itself is performed by the device’s own controller.

To the extent permitted by law, our aggregate liability arising from the service is limited to the amount you paid us in the twelve months preceding the claim. We are not liable for lost data, lost profits, or indirect or consequential loss. Nothing here excludes liability that cannot lawfully be excluded.

10. Changes and termination

We may change these terms with notice on this page. Continued use after a change constitutes acceptance. You may stop using the service at any time; refunds remain available only within the windows in section 5. We may terminate for breach of section 7. If a licence lapses or is terminated, the applications stop erasing; verification of certificates already issued continues to work, offline and indefinitely.

11. Contact

CybXSan — info@cybxsan.com. See also the Privacy policy, the Data Processing Addendum and the Security page.