This User Agreement ("EULA") is a licence agreement between PremioGuard ("we", "us") and you, the person or organisation installing the PremioGuard desktop agent (the "Agent") on computers you administer. It governs the software running on those machines, separately from the Terms & Conditions, which govern the subscription and the cloud service.
By downloading, installing, or permitting the Agent to run on a computer, you accept this EULA. If you are accepting on behalf of an organisation, you confirm you are authorised to bind it. If you do not accept these terms, do not install the Agent, and remove any existing installation.
We grant you a limited, non-exclusive, non-transferable, revocable licence to install and run one copy of the Agent per Managed Computer activated under your subscription. The Agent may operate only on a computer you own or are lawfully authorised to administer.
The Agent and its components, including the executable, services, drivers, update components, and signal definitions, are licensed, not sold. Title remains with us and our licensors.
You may not copy, modify, translate, reverse engineer, decompile, disassemble, or create derivative works of the Agent except where that restriction is prohibited by applicable law and you have notified us. You may not rent, lease, lend, sell, sublicense, or provide commercial hosted access to the Agent.
The Agent runs as a background Windows service and performs the functions described in this section. These are its full capabilities; anything not described here is not something it does.
| Function | What it does |
|---|---|
| USB port control | Monitors device connection events and permits or blocks them according to the policy in force, at the operating-system level. |
| Threat scanning | Scans files and directories for known malicious content and for behaviour matching heuristic rules, and quarantines what matches. |
| Phishing interception | Evaluates network destinations against a blocklist of known malicious hosts and reports matches. |
| Application control | Prevents execution of applications not permitted by the policy, and enforces restrictions on installed software. |
| File transfer control | Permits, blocks, and records file transfers, and mirrors permitted content per a transfer policy. |
| Inventory and reporting | Collects the hardware, application, and security metadata described in section 7. |
| Policy synchronisation | Polls the service for the current policy, licence status, and feature entitlements. |
The Agent observes USB device connection events as the operating system reports them. When a connected device does not satisfy the policy in force, the Agent blocks the port so the device cannot exchange data, and records the event including the device's vendor and product identifiers, its class, the action taken, and the time.
The Agent evaluates files against published malicious-content definitions and against heuristic rules that assess structure and behaviour characteristic of malware. A detection quarantines the file: it is moved to a location excluded from normal access and reported to the service.
The Agent scans local storage and permitted file transfers. It does not decrypt encrypted archives it cannot read, does not inspect other users' in-memory data, and cannot examine the contents of a password-protected volume. A file that cannot be read cannot be scanned, and we do not claim that it is.
Heuristic detection can classify legitimate software as malicious. An Administrator can restore a quarantined file. You are responsible for testing policy changes before rolling them out across a fleet.
The scanner parses file structure in order to classify content, and malformed or deliberately corrupted files — including crafted image, audio, and video containers — are treated as hostile input. The parser rejects a file it cannot read rather than passing unparsed content through to the calling application.
Extension-based restrictions apply to a file's actual type, not only its name. A payload renamed to a permitted extension is still evaluated on its content. Where a file's type cannot be determined, it is treated as unclassified and the policy for unclassified content applies.
The Agent evaluates network destinations against a maintained list of hosts known to serve credential-harvesting or malicious content, and blocks the connection when a match is found, recording the destination and the action taken.
The Agent polls the service on a short interval for its current policy, licence status, and feature entitlements. Enforcement reflects the last policy successfully received; a change in the dashboard takes effect on the next successful poll, not immediately.
Where the service is unreachable, the Agent continues enforcing the last policy it received for a defined grace period, after which enforcement relaxes to the operating system's default behaviour rather than freezing a stale policy indefinitely. An Agent that cannot validate its licence does not pretend to be protected.
A centrally issued policy overrides conflicting local configuration. Locally excluded applications and devices are honoured only where the central policy does not override them.
The Agent transmits the metadata enumerated in section 3 of the Privacy Policy, and nothing beyond it. In summary it reports a hashed hardware identifier, USB connection metadata, installed-application inventory, security events, file-transfer records, and device command outcomes.
All communication is over encrypted transport to the service endpoint configured in the Agent. The Agent will not fall back to an unencrypted connection for validation.
The Agent requires a supported 64-bit Windows release, administrative rights to install the service and driver components, and outbound connectivity to the service for validation.
Endpoint security software legitimately consumes CPU, memory, and disk I/O, and scanning large archives or file transfers will be perceptible. The Agent may briefly hold a file handle while scanning it, which can make an application wait. This is inherent to inspecting files and is not a defect.
Two endpoint products that both filter filesystem and USB activity can conflict, producing duplicate alerts, blocked operations, or unstable behaviour. Where PremioGuard and another endpoint product are deployed together, validate the combination before fleet-wide rollout.
You may not use the Agent to:
Where the Agent is deployed on a computer used by a person who is not the account holder, you are responsible for informing that person that endpoint security software is monitoring the machine, as required by the law applying to you.
The Agent checks for updates and applies them according to the deployment policy in force. We may release updates that fix security defects, add detection coverage, or change how a function behaves. An update may change what a given policy blocks, and the version number identifies the build in use. Where a fleet requires a pinned version, that is a commercial arrangement.
This licence terminates automatically on expiry or termination of your subscription, on deletion of the account, or on breach of section 10. On termination, the Agent stops validating, the Managed Computer returns to the operating system's default behaviour, and you must uninstall the Agent using the standard Windows mechanism. We may require removal of the Agent where a licence is suspended for abuse.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE AGENT IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE AGENT WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT IT WILL DETECT, PREVENT, OR QUARANTINE ANY PARTICULAR THREAT.
Nothing in this EULA limits liability that cannot lawfully be limited, including for death or personal injury caused by negligence or for fraud. The liability caps in the Terms & Conditions apply to your use of the Agent as well as to your use of the service.