← Back to Allowist

Terms of Service

Effective date: October 17, 2026

These Terms of Service ("Terms") govern your use of Allowist, a service operated by Default Deny LLC ("Allowist", "we", "us"). By creating an account, installing an agent, or otherwise using the service, you agree to these Terms. If you are using Allowist on behalf of an organization, you represent that you have authority to bind that organization, and "you" refers to it.

1. The service

Allowist maintains External Dynamic Lists (EDLs): live lists of IP addresses, hostnames and URLs that your firewall fetches on a schedule. Entries come from agents installed on your devices, from sources you subscribe to, from addresses you add by hand or import, and from people you let in through Allow Links and Allow URL pages. Allowist publishes the list; your firewall enforces it. How your firewall is configured, and what it allows or denies, remains entirely your responsibility.

2. Accounts and access

  • You must provide accurate account information and keep it current.
  • Email addresses are confirmed with a one-time code before an account is active. Invitations to join an organization must be accepted by the invitee after confirming the invited address.
  • You are responsible for everything done under your account and your organization's agent tokens, API keys and webhooks. Keep tokens and keys confidential; rotate a token immediately if you believe it has been exposed.
  • Multi-factor authentication is available to every account and required for Allowist administrators. We recommend enabling it for all users with the Admin role.
  • You may not share credentials, probe or circumvent access controls, or attempt to access another organization's data.

    • 3. Agents and devices

    Agents run on devices you own or are authorized to manage. Each agent reports the device's public IP address, hostname, operating system, agent type and version, and a stable device identifier so that renamed devices keep their record and blocked devices stay blocked. Agents make outbound connections only. You are responsible for installing agents only on devices you are permitted to manage and for removing them when that permission ends.

    4. Acceptable use

    You agree not to use Allowist to:

  • allow traffic you are not authorized to allow, or add addresses you do not control to a list you do not administer;
  • interfere with the service, other customers, or the agent endpoint, including sending check-ins that misrepresent a device's address;
  • reverse engineer the service except where the law permits it;
  • resell the service without a written agreement with us;
  • violate any applicable law.

    • We may suspend access that we reasonably believe threatens the service or other customers, and will tell you why where it is safe to do so.

    5. Plans, billing and trials

  • Paid plans are billed in advance, monthly or annually, through PayPal. We do not receive or store your card details.
  • The Free plan is free indefinitely within its limits. Trials give temporary access to a paid plan's limits and features; when a trial ends without a subscription, the organization returns to the Free plan. Nothing is deleted, but additions beyond the Free limits are refused until you upgrade or remove items.
  • You may cancel at any time; the subscription remains active until the end of the period already paid. Plan limits apply from the next check-in or action after a change. When an organization is downgraded, items beyond the new limits are kept but stop updating after a grace period described in the documentation.
  • Prices may change with at least 30 days' notice; changes apply from your next renewal.

    • 6. Availability and support

    Allowist is designed to keep working during a disruption: agent check-ins are received through load-balanced endpoints so capacity can be added without changing the addresses you configure, firewalls keep their last fetched list if a fetch fails, and agents retry on their own. We nonetheless make no guarantee of uninterrupted service except as set out in a written service-level agreement for Enterprise customers. Support is provided by email according to your plan.

    7. Security

    We protect the service with measures that include encryption in transit, encryption of stored secrets, multi-factor authentication, least-privilege access for our staff, endpoint detection and response (CrowdStrike Falcon) on our servers, network-level firewalling of every server, and audit logging. Details are in the Privacy Policy. Security is a shared responsibility: you control who has access to your organization, which devices run agents, and how your firewall uses the list.

    8. Your data

    You own the data you put into Allowist. We use it only to provide and secure the service as described in the Privacy Policy. You can export your organization's data and audit log on plans that include export, and you can delete your organization at any time, after which its data is removed on the schedule described in the Privacy Policy.

    9. Disclaimer and limitation of liability

    Allowist is provided "as is". We do not warrant that the service will prevent any particular attack or that a list will always be current; an allow list reduces exposure but is one control among many. To the fullest extent permitted by law, Default Deny LLC is not liable for indirect, incidental, special or consequential damages, or for loss of data, revenue or profits, arising from your use of the service, and our total liability for any claim is limited to the amount you paid us in the twelve months before the claim arose.

    10. Termination

    You may stop using the service and delete your organization at any time. We may terminate or suspend an account that breaches these Terms, or on 30 days' notice if we discontinue the service. On termination your right to use the service ends; sections 8, 9 and 11 survive.

    11. General

    These Terms are governed by the laws of the State of Oregon, USA, without regard to conflict-of-law rules, and any dispute will be brought in the state or federal courts located in Oregon. If a provision is unenforceable, the rest remains in effect. These Terms, together with the Privacy Policy, are the entire agreement between you and us about the service. We may update these Terms; material changes will be announced in the dashboard or by email at least 14 days before they take effect, and continued use after that date is acceptance.

    12. Contact

    Questions about these Terms: use the Support page at allowist.com/support.html, or write to Default Deny LLC, Portland, Oregon, USA.