Terms of Service

The Service is intended for business use only and not for personal, family, or household use. You must be at least 18 years old and legally able to enter into a binding agreement. The Service is intended for customers and users located in the United States.

The Service is designed to help organizations collect, organize, analyze, and manage cloud-security, compliance, and related documentation and evidence. The Service may:

• (a)connect to third-party cloud providers and related services, including AWS, Azure, Google Cloud, and similar platforms;
• (b)receive uploads of documents, PDFs, spreadsheets, screenshots, reports, narratives, and related materials; and
• (c)generate analyses, summaries, workflows, reports, control mappings, narratives, and related outputs.

We may modify, update, enhance, or discontinue any part of the Service at any time. Unless expressly stated in a separate written agreement, we do not guarantee that any feature will continue to be offered or that the Service will be uninterrupted or error-free.

You may need an account to use the Service. You agree to provide accurate, current, and complete information and to keep it updated.

You are responsible for:

• (a)maintaining the confidentiality of login credentials, API tokens, keys, and similar access mechanisms;
• (b)ensuring that permissions granted to SentrIQ are limited to what you choose to authorize;
• (c)all activities that occur under your account or through credentials you control; and
• (d)promptly notifying SentrIQ at security@sentriq.com or support@sentriq.com if you believe your account or credentials have been compromised.

"Customer Data" means information, content, materials, documents, configurations, metadata, logs, evidence, text, files, and other data that you or your authorized users submit, upload, transmit, connect, or otherwise make available to the Service, including data obtained through third-party integrations at your direction.

As between the parties, you retain all right, title, and interest in and to Customer Data. You grant SentrIQ a non-exclusive, worldwide, limited license to host, copy, process, transmit, analyze, display, and otherwise use Customer Data as necessary to:

• (a)provide, maintain, support, secure, and improve the Service;
• (b)generate outputs requested by you;
• (c)prevent fraud, misuse, and security incidents; and
• (d)comply with law and enforce these Terms.

You represent and warrant that you have all rights, permissions, notices, and consents necessary for Customer Data to be collected, used, and processed by SentrIQ as described in these Terms and the Privacy Policy.

SentrIQ may also collect and use usage, operational, and technical data relating to the provision and use of the Service ("Service Data"). SentrIQ may use Service Data, and Customer Data in de-identified and/or aggregated form, to operate, maintain, analyze, improve, and develop the Service and related products, provided such data does not identify you, your organization, or any individual.

You are solely responsible for:

• (a)the legality, accuracy, quality, and integrity of Customer Data;
• (b)obtaining and maintaining any third-party accounts, subscriptions, permissions, credentials, and consents needed for integrations;
• (c)configuring your own systems, cloud environments, access controls, and security settings;
• (d)reviewing, validating, and approving any outputs, recommendations, reports, or analyses before relying on them or acting on them;
• (e)maintaining your own backups and records as needed; and
• (f)complying with all laws, regulations, contractual obligations, and internal policies applicable to your use of the Service and your own systems and data.

Unless SentrIQ expressly agrees otherwise in writing, you will not submit to the Service:

• (a)classified information;
• (b)export-controlled data requiring special handling inconsistent with these Terms;
• (c)protected health information regulated by HIPAA;
• (d)payment card data subject to PCI DSS;
• (e)biometric identifiers or biometric information;
• (f)Social Security numbers, driver's license numbers, passport numbers, or similar government-issued identification numbers, except to the extent strictly necessary and expressly approved by SentrIQ in writing; or
• (g)any data subject to sector-specific legal or contractual requirements that require obligations beyond those set out in these Terms.

If you choose to upload documents or other content containing personal information, you will limit that information to what is reasonably necessary for the intended use of the Service.

You will not, and will not permit any third party to:

• (a)use the Service in violation of law or regulation;
• (b)use the Service to infringe, misappropriate, or violate any person's rights;
• (c)reverse engineer, decompile, disassemble, or otherwise attempt to discover source code, underlying models, or trade secrets of the Service, except to the extent such restriction is prohibited by law;
• (d)copy, modify, create derivative works from, mirror, frame, or resell the Service, except as expressly permitted by SentrIQ in writing;
• (e)use the Service to build, train, improve, or benchmark a competing product or service, or publish performance or benchmark results without SentrIQ's prior written consent;
• (f)interfere with or disrupt the integrity, availability, or performance of the Service;
• (g)circumvent or attempt to circumvent authentication, access controls, usage limits, or security measures;
• (h)upload, transmit, or introduce malware, ransomware, malicious code, or harmful content;
• (i)use the Service to perform unauthorized scanning, penetration testing, intrusion attempts, or similar activity against systems you do not own or have permission to test;
• (j)use the Service in connection with life-critical, safety-critical, or emergency-response use cases where failure of the Service could result in death, personal injury, or physical property damage;
• (k)access or use the Service for timesharing, service bureau, white-label, or other third-party commercial benefit unless expressly authorized in writing; or
• (l)misrepresent your identity or affiliation or submit false, misleading, or unlawful content.

The Service may interoperate with third-party services, platforms, or providers. Your use of those third-party services is governed by the terms and privacy policies of the applicable third parties, not SentrIQ. SentrIQ does not own or control third-party services and is not responsible for their availability, security, accuracy, acts, or omissions.

You authorize SentrIQ to access third-party services and data sources that you connect to the Service, solely as necessary to provide the Service at your direction. You are responsible for ensuring you are authorized to grant that access.

SentrIQ may make the Service, or certain features, available on a preview, beta, pilot, evaluation, early-access, or no-fee basis ("Preview Services"). Preview Services are provided "AS IS," may be incomplete, may contain bugs or errors, may be modified or discontinued at any time, and may be subject to additional limits.

SentrIQ may suspend or terminate Preview Services at any time, with or without notice. SentrIQ has no obligation to make any Preview Services generally available or continue any particular feature. Unless otherwise expressly agreed in writing, no service levels, support commitments, or data retention commitments apply to Preview Services.

The Service, including all software, technology, models, methods, designs, interfaces, documentation, and content made available by SentrIQ, and all related intellectual property rights, are and remain the exclusive property of SentrIQ and its licensors.

Subject to these Terms, SentrIQ grants you a limited, non-exclusive, non-transferable, non-sublicensable right during the applicable access period to use the Service for your internal business purposes.

As between the parties, you may use customer-specific reports and outputs generated for you from your Customer Data for your internal business purposes. However, SentrIQ retains all rights in and to the Service, underlying software, templates, methodologies, prompts, workflows, models, know-how, and any generalized improvements or learnings that do not identify you or disclose your confidential information.

If you provide feedback, suggestions, enhancement requests, or ideas relating to the Service, SentrIQ may use them without restriction or obligation.

The Service is a software tool intended to assist with information gathering, organization, analysis, and workflow support. The Service does not provide legal advice, audit advice, accounting advice, regulatory advice, or certification advice.

SentrIQ does not warrant or guarantee that use of the Service will:

• (a)satisfy any legal, regulatory, contractual, or security requirement;
• (b)make your systems secure;
• (c)prevent incidents, breaches, findings, or control failures;
• (d)result in passing any assessment, audit, certification, attestation, or authorization process; or
• (e)obtain, maintain, or renew any status or alignment relating to FedRAMP, StateRAMP, NIST 800-53, CMMC, SOC 2, ISO 27001, or any other framework or program.

You are solely responsible for your own environments, controls, remediation decisions, policies, submissions, certifications, attestations, and compliance determinations. You must independently review and validate all outputs and not rely on the Service as a substitute for qualified professional advice or independent technical review.

SentrIQ will treat Customer Data as confidential and will not disclose Customer Data except:

• (a)as authorized by you or your users;
• (b)as necessary to provide the Service;
• (c)as described in the Privacy Policy;
• (d)as required by law, legal process, or valid governmental request; or
• (e)in de-identified or aggregated form that does not identify you or any individual.

SentrIQ implements and maintains reasonable administrative, technical, and organizational safeguards designed to protect Customer Data against unauthorized access, use, alteration, and disclosure. However, no system or network is completely secure, and SentrIQ does not guarantee that unauthorized access, loss, corruption, or disclosure will never occur.

You acknowledge that SentrIQ is not responsible for vulnerabilities, misconfigurations, credential misuse, excessive permissions, outages, acts, or omissions in your own systems or in third-party environments you connect to the Service.

SentrIQ may suspend or terminate your access to all or any part of the Service immediately if:

• (a)you breach these Terms;
• (b)your use creates a security risk, legal risk, or material operational burden;
• (c)we are required to do so by law or third-party provider requirements;
• (d)you use Preview Services and SentrIQ decides to discontinue them; or
• (e)payment is overdue under any applicable order form or written agreement.

You may stop using the Service at any time. If you or SentrIQ terminate your access, your right to use the Service ends immediately. Subject to applicable law, legitimate business needs, and standard backup retention, SentrIQ may delete or make inaccessible Customer Data after termination within a commercially reasonable period.

Sections that by their nature should survive termination will survive, including sections relating to intellectual property, disclaimers, limitations of liability, indemnification, governing law, and any accrued rights or obligations.

Access to certain features or the full production version of the Service may require a separate order form, subscription agreement, quote, or other written agreement setting out pricing, term, scope, user limits, and payment obligations. Unless expressly stated otherwise in that written agreement, all fees are non-refundable and payable in U.S. dollars.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE AND ALL RELATED CONTENT, OUTPUTS, AND PREVIEW SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." SENTRIQ DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, RESULTS, OR THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE.

WITHOUT LIMITING THE FOREGOING, SENTRIQ DOES NOT WARRANT THAT ANY OUTPUT, ANALYSIS, NARRATIVE, RECOMMENDATION, OR REPORT GENERATED BY THE SERVICE IS COMPLETE, ACCURATE, CURRENT, OR SUFFICIENT FOR ANY PARTICULAR DECISION, AUDIT, OR COMPLIANCE PURPOSE.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL SENTRIQ OR ITS AFFILIATES, LICENSORS, OR SERVICE PROVIDERS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, DATA, BUSINESS OPPORTUNITY, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, SENTRIQ'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE GREATER OF:

• (a)THE AMOUNT PAID BY YOU TO SENTRIQ FOR THE SERVICE GIVING RISE TO THE CLAIM IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM; OR
• (b)ONE HUNDRED U.S. DOLLARS (US$100) IF NO FEES WERE PAID.

THE LIMITATIONS IN THIS SECTION APPLY REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE. Nothing in these Terms excludes or limits liability to the extent such exclusion or limitation is prohibited by law.

You will defend, indemnify, and hold harmless SentrIQ and its affiliates, officers, directors, employees, contractors, and agents from and against any third-party claims, actions, proceedings, damages, judgments, settlements, penalties, fines, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:

• (a)Customer Data;
• (b)your use of the Service;
• (c)your violation of these Terms;
• (d)your violation of applicable law;
• (e)your infringement, misappropriation, or violation of any third-party rights; or
• (f)your connected systems, environments, or third-party accounts.

These Terms are governed by the laws of the State of Texas, without regard to conflict of law principles. Any dispute arising out of or relating to these Terms or the Service will be brought exclusively in the state or federal courts located in [INSERT COUNTY], Texas, and each party consents to the personal jurisdiction and venue of those courts.

SentrIQ may update these Terms from time to time. If we make material changes, we will post the updated Terms on our website and update the "Effective Date" above. By continuing to use the Service after updated Terms become effective, you agree to the revised Terms.

These Terms constitute the entire agreement between you and SentrIQ regarding the Service, except for any separate written agreement between you and SentrIQ.

If any provision of these Terms is held unenforceable, the remaining provisions will remain in full force and effect.

SentrIQ's failure to enforce any provision of these Terms is not a waiver of that provision.

You may not assign or transfer these Terms without SentrIQ's prior written consent. SentrIQ may assign these Terms in connection with a merger, acquisition, corporate reorganization, or sale of substantially all assets.

The Service may be subject to U.S. export control and sanctions laws. You agree not to use the Service in violation of those laws.

SentrIQ Labs, Inc.

Email: support@sentriq.io