Terms of Service

This document is provided in English, which is the authoritative version; any translation is for convenience only and the English version prevails.

These Stack4Sec Terms of Service, together with any Order Form, Product-Specific Additional Terms, Acceptable Use Policy, Copyright and Intellectual Property Policy, AI Features Terms, Privacy Policy, Cookie Policy, Data Processing Addendum, Security Policy / Trust Center, Service Level Addendum, and any other terms expressly incorporated by reference, govern access to and use of the cybersecurity software-as-a-service solutions, websites, applications, platforms, APIs, software, documentation, reports, dashboards, content, artificial intelligence features, support, and related services made available by Stack4Sec, LLC, a Wyoming limited liability company.

For purposes of these Terms, "Stack4Sec," "Company," "we," "us," and "our" mean Stack4Sec, LLC. "Customer," "you," and "your" mean the person or entity accessing or using the Services. If you access or use the Services on behalf of an organization, you represent and warrant that you have authority to bind that organization, and that organization is the Customer.

Stack4Sec is a provider of Cybersecurity SaaS solutions. These Terms apply to all Stack4Sec products, services, platforms, applications, websites, APIs, software, modules, features, documentation, support, professional services, and related offerings, whether currently available or made available in the future.

Product-specific terms may apply to certain Stack4Sec products, modules, services, or features. If Product-Specific Additional Terms apply, they supplement these Terms and govern only the applicable product, module, service, or feature.

By creating an account, accessing the Services, clicking "I agree," executing an Order Form, or otherwise using any part of the Services, you agree to these Terms. If you do not agree to these Terms, you must not access or use the Services.

Stack4Sec provides Cybersecurity SaaS solutions and related technologies for cybersecurity, governance, risk, compliance, security operations, third-party risk management, evidence management, executive reporting, artificial intelligence-assisted analysis, and other cybersecurity-related use cases.

The Services are decision-support tools. The Services do not replace professional judgment, legal advice, regulatory advice, audit opinions, certification determinations, managed security services, incident response, forensic investigation, penetration testing, insurance, risk transfer, or any customer-specific cybersecurity program.

Customer remains solely responsible for its cybersecurity, compliance, audit, governance, regulatory, operational, and business decisions.

"Account" means an account created by or for Customer to access the Services.

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party.

"AI Features" means any artificial intelligence, machine learning, automated analysis, classification, scoring, summarization, recommendation, evidence review, anomaly analysis, risk analysis, content generation, or similar functionality made available through the Services.

"Authorized User" means any employee, contractor, consultant, advisor, representative, or other individual authorized by Customer to access or use the Services under Customer's Account.

"Beta Services" means alpha, beta, preview, experimental, evaluation, pre-release, free, trial, or otherwise non-generally available services or features.

"Customer Content" means data, information, files, evidence, documents, responses, comments, reports, configurations, environments, users, suppliers, third-party data, business information, personal data, security information, and other content submitted, uploaded, stored, generated, transmitted, or processed by or on behalf of Customer through the Services.

"Documentation" means usage instructions, technical materials, product documentation, help articles, specifications, policies, and other written materials made available by Stack4Sec.

"Order Form" means an online order, subscription checkout, signed order form, quote, invoice, statement of work, purchase order accepted by Stack4Sec, or other ordering document specifying the Services, plan, fees, term, usage limits, or commercial terms.

"Product-Specific Additional Terms" means additional terms applicable to a specific Stack4Sec product, service, module, brand, feature, or offering.

"Services" means all Stack4Sec cybersecurity SaaS solutions, products, platforms, applications, websites, APIs, software, dashboards, reports, AI Features, Documentation, professional services, support, and related services.

"Subscription Term" means the period during which Customer is authorized to access and use the applicable Services.

If there is a conflict among applicable documents, the following order controls unless expressly stated otherwise:

• a signed Order Form;
• a Data Processing Addendum, for personal data processing matters;
• Product-Specific Additional Terms;
• these Terms;
• the Acceptable Use Policy;
• other incorporated policies;
• Documentation.

Any Customer purchase order terms, procurement terms, vendor portal terms, online terms, or similar terms are rejected and do not modify these Terms unless expressly signed by Stack4Sec.

Customer may use the Services only if Customer can enter into a legally binding agreement and is not prohibited from using the Services under applicable law.

If an individual uses the Services on behalf of an organization, that individual represents and warrants that they have authority to bind the organization.

Customer is responsible for ensuring that all Authorized Users comply with these Terms.

Customer must provide accurate, current, and complete account, billing, and administrative information.

Customer is responsible for:

• maintaining the confidentiality of credentials;
• all activity under its Account;
• managing Authorized Users and permissions;
• promptly disabling access for users who no longer require access;
• maintaining secure devices, networks, authentication methods, and internal controls;
• promptly notifying Stack4Sec of suspected unauthorized access, credential compromise, or misuse.

Stack4Sec may suspend or terminate Accounts that use false, misleading, unlawful, infringing, or unauthorized information.

Subject to these Terms, the applicable Order Form, payment of fees, and compliance with usage limits, Stack4Sec grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable right during the applicable Subscription Term to access and use the Services solely for Customer's internal business purposes.

Customer receives no rights except those expressly granted. Stack4Sec reserves all rights not expressly granted.

The Services may be offered under free, trial, paid, business, enterprise, beta, promotional, or custom plans. Each plan may include limits on users, environments, assessments, data storage, reports, AI usage, API calls, exports, integrations, support, or other functionality.

Stack4Sec may modify, add, remove, suspend, discontinue, rename, rebrand, or replace plans, features, usage limits, or functionality at any time, subject to applicable law and any express commitments in a signed Order Form.

If Customer exceeds usage limits, Stack4Sec may require Customer to reduce usage, upgrade, pay additional fees, or suspend excess usage.

Customer shall pay all fees specified in the applicable Order Form or subscription plan. Unless otherwise stated:

• fees are due in advance;
• fees are non-cancelable and non-refundable;
• subscriptions renew automatically unless canceled before renewal;
• Customer authorizes Stack4Sec and its payment processors to charge the applicable payment method;
• Customer is responsible for taxes, duties, levies, VAT, sales tax, use tax, withholding, and similar charges, excluding taxes based on Stack4Sec's net income;
• overdue amounts may result in suspension or termination;
• unpaid amounts may accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law.

Stack4Sec may change pricing at renewal or as otherwise permitted by the applicable Order Form.

If Customer purchases an automatically renewing subscription, Customer authorizes Stack4Sec to charge the applicable payment method on a recurring basis until cancellation.

Stack4Sec will disclose material subscription terms before purchase, including price, billing frequency, renewal terms, and cancellation method.

Customer may cancel renewal through the account interface, billing portal, or another cancellation method made available by Stack4Sec. Cancellation takes effect at the end of the then-current Subscription Term unless otherwise stated.

Customer remains responsible for fees incurred before cancellation. Stack4Sec is not required to refund prepaid fees unless required by law or expressly agreed in writing.

Stack4Sec may offer free plans, trials, promotional access, or Beta Services at its discretion. Unless otherwise stated in writing:

• free, trial, promotional, and Beta Services may be modified, limited, suspended, or terminated at any time;
• Stack4Sec has no obligation to continue offering free access;
• Stack4Sec may convert, restrict, retire, or charge for features previously offered for free;
• free and Beta Services may be unsupported, incomplete, inaccurate, or unavailable;
• Customer is responsible for exporting Customer Content before expiration or termination.

Free, trial, promotional, and Beta Services are provided "as is," "as available," and without warranties, service levels, indemnities, credits, commitments, or liability to the maximum extent permitted by law.

Customer is solely responsible for:

• determining whether the Services meet Customer's requirements;
• configuring and using the Services properly;
• validating all outputs, reports, dashboards, scores, analyses, AI outputs, recommendations, and exports;
• ensuring the accuracy, legality, quality, and completeness of Customer Content;
• obtaining all required rights, consents, approvals, and authorizations;
• maintaining Customer's cybersecurity program, controls, policies, procedures, evidence, and remediation plans;
• managing Authorized Users, roles, permissions, and access;
• complying with applicable laws, regulations, contractual obligations, and industry standards;
• maintaining backups and copies of Customer Content outside the Services where appropriate;
• ensuring that regulated, sensitive, confidential, or restricted data is submitted only where permitted.

Stack4Sec is not responsible for Customer's failure to implement controls, remediate risks, maintain evidence, validate outputs, or comply with applicable requirements.

The Services and all outputs are provided for informational, organizational, analytical, and decision-support purposes only.

The Services do not constitute legal advice, regulatory advice, tax advice, audit opinion, certification, attestation, assurance report, cybersecurity guarantee, managed security service, incident response, penetration testing, forensic investigation, insurance, risk transfer, or professional advice unless separately agreed in writing.

Customer must consult qualified professionals before relying on the Services for legal, regulatory, audit, compliance, certification, cybersecurity, or business decisions.

Cybersecurity and compliance are risk-based, context-dependent, and continuously evolving. Stack4Sec does not warrant that Customer will be secure, compliant, certified, breach-free, vulnerability-free, or audit-ready.

Stack4Sec does not warrant that the Services will identify all risks, gaps, incidents, vulnerabilities, threats, control failures, misconfigurations, or deficiencies, or that any output will be accepted by auditors, regulators, customers, insurers, or third parties.

Customer assumes all responsibility for cybersecurity, compliance, audit, risk, and remediation decisions.

As between Customer and Stack4Sec, Customer retains ownership of Customer Content. Customer grants Stack4Sec a worldwide, non-exclusive, royalty-free license to host, process, transmit, store, copy, display, analyze, and use Customer Content solely as necessary to:

• provide, secure, maintain, and improve the Services;
• provide support;
• generate outputs requested by Customer;
• monitor usage and performance;
• prevent fraud, abuse, and security incidents;
• comply with law;
• enforce these Terms.

Customer represents and warrants that Customer has all rights, consents, permissions, and lawful bases necessary to submit Customer Content and allow Stack4Sec to process it.

Stack4Sec may collect and use telemetry, metadata, usage data, diagnostic data, performance data, aggregated statistics, and de-identified data derived from use of the Services to operate, secure, analyze, benchmark, improve, and develop the Services.

Stack4Sec will not use Aggregated Data or De-Identified Data to identify Customer or disclose Customer's confidential information except as permitted by these Terms or applicable law. Stack4Sec owns all rights in Aggregated Data and De-Identified Data.

Each party may receive Confidential Information from the other. The receiving party shall use Confidential Information only to perform obligations or exercise rights under these Terms, protect Confidential Information using reasonable care, and not disclose Confidential Information except to personnel, contractors, advisors, Affiliates, or service providers who need to know and are bound by confidentiality obligations.

Confidentiality obligations do not apply to information that is publicly available without breach, already known without restriction, independently developed, lawfully received from a third party, or required to be disclosed by law.

Stack4Sec will implement commercially reasonable administrative, technical, and organizational safeguards designed to protect the Services and Customer Content.

Customer acknowledges that no system is completely secure and that Stack4Sec does not guarantee absolute security, uninterrupted availability, or prevention of unauthorized access.

Customer is responsible for secure configuration, access management, identity controls, endpoint security, network security, backups, and internal governance.

Personal data will be processed in accordance with the Stack4Sec Privacy Policy and, where applicable, the Data Processing Addendum.

Customer is responsible for determining whether it is a controller, processor, business, service provider, contractor, covered entity, business associate, or other regulated party under applicable privacy laws.

Customer must not submit personal data, sensitive data, protected health information, payment card data, classified information, export-controlled technical data, children's data, or other regulated data unless expressly permitted by Stack4Sec in writing and covered by appropriate agreements.

AI Features are governed by these Terms and the Stack4Sec AI Features Terms. Customer acknowledges that AI outputs may be inaccurate, incomplete, outdated, biased, or unsuitable. AI outputs do not replace human review. Customer must independently validate all AI outputs before relying on them.

Stack4Sec may limit, modify, suspend, or discontinue AI Features at any time.

Customer shall comply with the Stack4Sec Acceptable Use Policy. Customer shall not use the Services to attack, scan, disrupt, overload, reverse engineer, scrape, copy, misuse, or interfere with the Services; upload malicious content; violate law or third-party rights; misrepresent outputs; or develop competing products.

Stack4Sec may suspend or terminate access for violations.

Stack4Sec and its licensors own all rights, title, and interest in and to the Services, software, APIs, user interfaces, workflows, templates, dashboards, reports, visualizations, AI Features, models, algorithms, scoring methods, documentation, trademarks, trade names, logos, and related intellectual property.

No ownership rights are transferred to Customer. Customer may not remove proprietary notices or use Stack4Sec branding without prior written consent.

Feedback provided by Customer may be used by Stack4Sec without restriction, attribution, or compensation.

Third-party cybersecurity frameworks, standards, laws, regulations, control catalogs, methodologies, and industry publications may be referenced by the Services for identification, interoperability, mapping, assessment workflow, and customer configuration purposes only. Unless expressly stated in writing, Stack4Sec does not provide, reproduce, license, replace, certify, distribute, or grant rights in official third-party framework or standard materials. Customer is responsible for obtaining and using official or licensed materials where required. Stack4Sec-created assessment questions, evidence guidance, implementation guidance, scoring methods, summaries, mappings, and recommendations are original Stack4Sec materials and are not official publications of any third-party framework owner, standards body, regulator, certification body, or industry organization.

The Services may integrate with or rely on third-party services, including hosting providers, infrastructure providers, AI providers, payment processors, identity providers, analytics providers, email providers, and other vendors.

Stack4Sec is not responsible for third-party services, outages, errors, data practices, security incidents, changes, or content. Customer's use of third-party services may be subject to separate terms.

If Stack4Sec provides API or integration access, Customer may use it only in accordance with Documentation, usage limits, and applicable policies.

Stack4Sec may suspend or revoke API access if Customer exceeds limits, creates risk, violates these Terms, or uses the API in an unintended manner. Customer is responsible for protecting API keys, tokens, credentials, and secrets.

Consulting, implementation, migration, customization, advisory, training, integration, or other professional services are not included unless expressly agreed in a separate Order Form or statement of work. Professional services may be subject to additional terms.

Stack4Sec may suspend access immediately if Customer fails to pay fees; violates these Terms; creates security, legal, operational, reputational, or business risk; exceeds usage limits; or if Stack4Sec suspects fraud, abuse, unauthorized access, or misuse.

Stack4Sec is not liable for losses arising from suspension under this Section.

These Terms begin when Customer first accepts them or uses the Services and continue until terminated.

Customer may terminate by canceling its subscription and ceasing use of the Services. Stack4Sec may terminate these Terms or any Account if Customer materially breaches these Terms, fails to pay fees, becomes insolvent, creates risk, violates law, or uses free, trial, promotional, or Beta Services that Stack4Sec discontinues.

Upon termination, Customer's access ends, Customer must stop using the Services, unpaid fees become immediately due, Stack4Sec may delete Customer Content after a reasonable retention period unless legally required to retain it, and Customer is responsible for exporting Customer Content before termination.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES ARE PROVIDED "AS IS," "AS AVAILABLE," AND "WITH ALL FAULTS."

STACK4SEC DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, AVAILABILITY, SECURITY, ERROR-FREE OPERATION, UNINTERRUPTED OPERATION, AND WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

STACK4SEC DOES NOT WARRANT THAT THE SERVICES WILL MEET CUSTOMER'S REQUIREMENTS, ACHIEVE COMPLIANCE, PREVENT CYBER INCIDENTS, OR PRODUCE COMPLETE, ACCURATE, CURRENT, OR SUITABLE OUTPUTS.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, STACK4SEC AND ITS AFFILIATES, OFFICERS, DIRECTORS, MEMBERS, MANAGERS, EMPLOYEES, CONTRACTORS, LICENSORS, SERVICE PROVIDERS, AND AGENTS WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, PUNITIVE, ENHANCED, OR LOST-PROFIT DAMAGES, INCLUDING LOST REVENUE, LOST BUSINESS, LOST GOODWILL, LOSS OF DATA, LOSS OF USE, BUSINESS INTERRUPTION, CYBER INCIDENTS, SECURITY BREACHES, REGULATORY PENALTIES, AUDIT FAILURE, COMPLIANCE FAILURE, PROCUREMENT FAILURE, OR THIRD-PARTY CLAIMS.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, STACK4SEC'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICES WILL NOT EXCEED THE GREATER OF THE AMOUNTS PAID BY CUSTOMER TO STACK4SEC FOR THE SERVICES GIVING RISE TO THE CLAIM IN THE THREE MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY OR ONE HUNDRED U.S. DOLLARS.

FOR FREE, TRIAL, PROMOTIONAL, OR BETA SERVICES, STACK4SEC'S TOTAL AGGREGATE LIABILITY WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS.

Customer will defend, indemnify, and hold harmless Stack4Sec and its Affiliates, officers, directors, members, managers, employees, contractors, licensors, service providers, and agents from and against any claims, damages, losses, liabilities, penalties, fines, costs, and expenses, including reasonable attorneys' fees, arising out of or related to Customer Content, Customer's use or misuse of the Services, Customer's violation of these Terms, Customer's violation of law or third-party rights, Customer's cybersecurity or compliance decisions, Customer's misrepresentation of Service outputs, Customer's failure to obtain required rights or consents, or acts or omissions of Authorized Users.

For paid subscriptions only, Stack4Sec will defend Customer against a third-party claim alleging that the Services, as provided by Stack4Sec and used in accordance with these Terms, directly infringe a U.S. patent, copyright, or trademark, and will pay damages finally awarded or agreed in settlement.

Stack4Sec has no obligation for claims arising from Customer Content, Customer modifications, combinations with non-Stack4Sec products, use outside Documentation, free services, Beta Services, third-party services, or Customer specifications.

Stack4Sec may procure continued use, modify, replace, or terminate affected Services with a pro rata refund of prepaid unused fees. This Section states Stack4Sec's sole liability and Customer's exclusive remedy for intellectual property infringement claims.

Customer shall comply with applicable export control, sanctions, import, anti-boycott, and trade compliance laws. Customer represents that it is not located in, organized under the laws of, or ordinarily resident in a sanctioned jurisdiction, and is not listed on any restricted party list.

Stack4Sec may suspend or terminate access if continued service may violate trade compliance laws.

The Services are not designed for use in life-critical, safety-critical, nuclear, aviation, medical, emergency response, military targeting, or other high-risk environments where failure could lead to death, personal injury, severe property damage, critical infrastructure disruption, or environmental harm.

Customer may not use the Services for High-Risk Use without Stack4Sec's prior written consent.

Stack4Sec may update the Services and these Terms from time to time. If Stack4Sec makes material changes to these Terms, it will provide notice by posting the updated Terms, sending notice, displaying in-product notice, or another reasonable method. Continued use after the effective date constitutes acceptance.

Customer agrees that contracts, notices, disclosures, signatures, consents, and communications may be provided electronically. Customer's electronic acceptance has the same legal effect as a handwritten signature to the maximum extent permitted by law.

These Terms are governed by the laws of the State of Wyoming, United States, without regard to conflict of law principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Any dispute arising out of or relating to these Terms or the Services will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, by one arbitrator, in Wyoming, in English, unless the parties agree otherwise.

Either party may seek injunctive or equitable relief in court for misuse of intellectual property, unauthorized access, confidentiality breaches, or security-related matters.

The parties waive the right to a jury trial. Disputes may be brought only on an individual basis and not as a class, collective, consolidated, representative, or private attorney general action.

Legal notices and inquiries may be sent to:

Stack4Sec, LLC 30 N Gould St, STE R Sheridan, WY 82801 United States Email: legal@stack4sec.com

Stack4Sec may provide notices through the Services, email, account interface, website posting, or other reasonable means.

Customer may not assign these Terms without Stack4Sec's prior written consent. Stack4Sec may assign these Terms in connection with a merger, acquisition, reorganization, sale of assets, financing, change of control, or transfer to an Affiliate.

If any provision is invalid, the remaining provisions remain effective. Failure to enforce a provision is not a waiver. The parties are independent contractors. These Terms do not create third-party beneficiary rights except for Stack4Sec's protected parties under disclaimers, limitations, and indemnities.

These Terms, together with incorporated documents and Order Forms, constitute the entire agreement between the parties regarding the Services.