Terms of Service

1. Acceptance of Terms

1.1 Agreement. These Terms of Service ("Terms") are a legally binding agreement between Ciphero AI Technologies, Inc., a Delaware corporation ("Ciphero," "we," "us" or "our"), and you, governing your access to and use of our software, platform, websites, scripts, reports, assistants, advisories and related services (collectively, the "Services").

1.2 Who "You" Are. "You" means the individual using the Services and, if you use them on behalf of an organization, that organization. A "Consumer" is an individual who uses the Services primarily for personal, family or household purposes. A "Business Customer" is an organization, or an individual acting for the purposes of a trade, business, craft or profession. Where a provision applies differently to Consumers and Business Customers, the provision says so.

1.3 How You Accept. You accept these Terms by checking the box or clicking the button that indicates acceptance, by signing an order form that references these Terms, or, where we present these Terms to you before you begin, by requesting a check, creating an account or starting a subscription. Do not use the Services if you do not agree.

1.4 Authority. If you accept these Terms on behalf of an organization, you represent and warrant that you have authority to bind it, and "you" refers to that organization.

1.5 Privacy Policy. Our Privacy Policy, available on our website, explains how we collect and use personal information. You acknowledge that you have read it. The Privacy Policy is not part of these Terms and does not create contractual obligations.

1.6 Additional Terms. Some Services are subject to supplemental terms, including Section 15 for Cassandra and any order form or data processing agreement you sign with us. The order of precedence among these documents is set out in Section 14.2.

2. Eligibility and Accounts

2.1 Age. You must be at least eighteen (18) years old and have reached the age of majority where you live to use the Services. By using the Services, you represent that you meet these requirements.

2.2 Individuals and Businesses. The Services are available to both Consumers and Business Customers. Plans, features and pricing may differ between them, as described on our pricing page or in an order form. You must not register as a Consumer to obtain Services for a business, or as a Business Customer when you are not acting for a business.

2.3 Account Creation. Some Services require an account. You agree to: (a) provide accurate, current and complete information; (b) keep that information up to date; (c) keep your credentials secure and confidential; (d) take responsibility for all activity under your account, except activity caused by our breach of these Terms; and (e) notify us promptly at contact@ciphero.ai of any unauthorized use. Business Customers are responsible for the users they authorize and for their users' compliance with these Terms.

2.4 Suspension. We may suspend your access immediately if (a) you materially breach these Terms, (b) your use poses a security risk to the Services or to others, (c) fees are overdue as described in Section 4.6, or (d) suspension is required by law. Where reasonably practicable, we will notify you and restore access once the cause is resolved. Termination is governed by Section 13.

3. Services and Plans

3.1 Service Description. The Ciphero Platform (the "Platform") is software that secures and verifies AI interactions. We also offer Cassandra, a free check of the editor and browser extensions installed on a device, which is governed by Section 15 in addition to these Terms.

3.2 Plans. We offer free and paid plans for Consumers and Business Customers. Features, usage limits and prices for self-serve plans are shown on our pricing page at the time of purchase. Plans for Business Customers may instead be set out in an order form.

3.3 Your Deployment Responsibilities. You may deploy the Platform only on devices, accounts and cloud services that you own or are authorized to administer. If the Platform monitors devices or activity of other people, such as employees or household members, you are responsible for having a lawful basis to do so and for giving any notices and obtaining any consents the law requires. The Platform's outputs are not professional, security or legal advice, and you remain responsible for actions you take or do not take based on them.

3.4 Free Trials. We may offer free trials of paid plans. We will tell you the length of the trial and, if the trial converts to a paid plan, the price and the date your first charge will occur before you start it. Unless you cancel before the trial ends, a trial that you started with a payment method converts to the paid plan described when you signed up. A trial started without a payment method ends automatically.

3.5 Changes to the Services. We may update, improve or change the Services. If we discontinue a paid Service or make a change that materially reduces its core functionality during a paid subscription period, we will give you at least thirty (30) days' notice where practicable, and you may cancel and receive a prorated refund of prepaid fees for the unused portion of that period. We may change or discontinue free Services at any time.

4. Payment, Renewal and Cancellation

4.1 Fees. Fees for self-serve plans are shown at checkout. Fees for Business Customers on an order form are set out in that order form. Unless stated otherwise, fees are in US dollars and payable in advance.

4.2 Payment Authorization and Taxes. By providing a payment method, you authorize us and our payment processor to charge the fees for your plan, including recurring charges described in Section 4.3. Fees exclude taxes. You are responsible for applicable sales, use, value-added and similar taxes, other than taxes on our income. Business Customers invoiced by us must pay within thirty (30) days of the invoice date unless the order form says otherwise.

4.3 Automatic Renewal. UNLESS YOU CANCEL, PAID SUBSCRIPTIONS RENEW AUTOMATICALLY AT THE END OF EACH SUBSCRIPTION PERIOD FOR A PERIOD OF THE SAME LENGTH, AND WE WILL CHARGE YOUR PAYMENT METHOD THE THEN-CURRENT PRICE FOR YOUR PLAN. Before you subscribe, we will show you the price, the billing frequency, that the subscription renews until cancelled, and how to cancel, and we will ask for your affirmative consent. We will send an acknowledgment of these terms after you subscribe. For subscriptions with a term of one year or longer, we will send a reminder before renewal within the notice period required by applicable law and in any event at least fifteen (15) days before the renewal date.

4.4 Price Changes. We may change prices for future subscription periods. We will notify you at least thirty (30) days before a price change takes effect, and the change will apply from your next renewal. If you do not agree, you may cancel before the renewal date. Prices on a signed order form will not change during its term.

4.5 Cancellation. You may cancel a self-serve subscription at any time online through your account settings, in the same manner you signed up, or by emailing contact@ciphero.ai. Cancellation takes effect at the end of the current subscription period, and you will keep access until then. Business Customers on an order form may cancel as that order form provides.

4.6 Late Payment (Business Customers). If a Business Customer's undisputed fees are more than ten (10) days overdue after we give written notice, we may suspend the Services until payment is received. Overdue amounts may accrue interest at 1.5% per month or the maximum rate permitted by law, whichever is lower.

4.7 Refunds. Except as stated in these Terms or required by law, fees are non-refundable, including for partial subscription periods and downgrades. This does not affect any right to a refund or to withdraw from a contract that you have as a Consumer and that cannot be waived. If you are a Consumer in the European Economic Area, the United Kingdom or Switzerland, you may withdraw from a paid subscription within fourteen (14) days of purchase. If you expressly request that the Services start during that period, you will pay for the Services provided before you withdraw, to the extent the law permits.

4.8 Billing Disputes. You must notify us of a billing dispute within sixty (60) days of the charge or invoice, and we will work with you in good faith to resolve it. This does not limit any right you have under applicable law to dispute a charge with your card issuer.

5. Use of Services

5.1 License and Permitted Use. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, revocable right to access and use the Services for your lawful personal or internal business purposes during your subscription or, for free Services, while we make them available.

5.2 Prohibited Uses. You must not, and must not allow anyone else to:

• use the Services for any illegal or unauthorized purpose, or in violation of any law or third-party right;
• breach or circumvent any security, authentication, rate-limiting or usage-limiting measure;
• access any part of the Services not intended for you;
• interfere with or disrupt the Services or the servers and networks connected to them;
• transmit viruses, malware or other harmful code;
• reverse engineer, decompile or disassemble the Services, except to the extent applicable law expressly permits despite this restriction;
• use the Services to build, benchmark or train a competing product or service;
• resell, redistribute, sublicense or provide the Services to third parties without our written consent; or
• use automated means to access the Services or extract data from them, except through interfaces we provide for that purpose.

6. Intellectual Property and Data

6.1 Ciphero's Intellectual Property. The Services, including all software, scripts, algorithms, models, interfaces, content and documentation, are owned by Ciphero or its licensors and protected by intellectual property laws. Except for the rights expressly granted in these Terms, we reserve all rights. Nothing in these Terms grants you any right to use our trademarks, trade names or logos.

6.2 Customer Data. "Customer Data" means data, content and information that you or your users submit to the Services, including data sent by a Ciphero script you run. As between you and us, you retain all rights in Customer Data. You grant us a worldwide, non-exclusive, royalty-free license to host, copy, process, analyze and display Customer Data as needed to provide, secure, support and maintain the Services, to prevent abuse, and to comply with law.

6.3 Model Training. We do not use Customer Data to train machine-learning models made available to other customers, unless you opt in. This does not limit our use of Aggregated Data under Section 6.4.

6.4 Aggregated and Usage Data. We may collect data about how the Services are used and perform ("Usage Data") and may create data that is aggregated or de-identified so that it does not identify you, any individual or any device ("Aggregated Data"). We own Usage Data and Aggregated Data and may use them to operate, secure and improve our products, including to update lists of known threats, and for any other lawful purpose.

6.5 Reports and Outputs. Reports, findings and other outputs that the Services generate for you are provided for your own personal or internal business use. The underlying methods, algorithms, formats and templates remain Ciphero's property.

6.6 Feedback. If you give us feedback or suggestions about the Services, we may use them without restriction or compensation to you.

7. Privacy, Data Processing and Security

7.1 Personal Information. We handle personal information as described in our Privacy Policy and as required by applicable data protection law.

7.2 Data Processing Agreement. Where we process personal data on behalf of a Business Customer, our Data Processing Agreement ("DPA") applies and forms part of these Terms for that Business Customer. The DPA is available on request at contact@ciphero.ai and, where required, includes the terms necessary for international transfers.

7.3 Your Responsibilities. You represent that you have all rights, notices and consents needed to submit Customer Data to us and to allow us to process it under these Terms. You are responsible for ensuring that your use of the Services complies with laws that apply to you, your industry and your data.

7.4 Security. We maintain reasonable administrative, technical and physical safeguards designed to protect Customer Data, including controls aligned with SOC 2 where applicable. No security measure is perfect, and we cannot guarantee that Customer Data will never be accessed without authorization.

7.5 Security Incidents. If we confirm unauthorized access to Customer Data in our systems, we will notify affected customers without undue delay and as required by applicable law and any DPA, and we will take reasonable steps to contain and remediate the incident.

8. Confidentiality

8.1 Definition. "Confidential Information" means non-public information that one party (the "Discloser") discloses to the other (the "Recipient") in connection with the Services and that is marked confidential or that a reasonable person would understand to be confidential. Our Confidential Information includes non-public aspects of the Services and our pricing. Your Confidential Information includes your Customer Data.

8.2 Obligations. The Recipient will use the Discloser's Confidential Information only to exercise its rights and perform its obligations under these Terms, will protect it using at least reasonable care, and will disclose it only to its employees, contractors and advisers who need to know it and are bound by confidentiality obligations at least as protective as this Section 8.

8.3 Exceptions. Section 8.2 does not apply to information that: (a) is or becomes publicly available through no breach of these Terms; (b) the Recipient rightfully knew before disclosure; (c) the Recipient develops independently without using the Confidential Information; or (d) the Recipient rightfully obtains from a third party without a duty of confidentiality.

8.4 Compelled Disclosure. If the law requires the Recipient to disclose Confidential Information, it will, where legally permitted, give the Discloser prompt notice and reasonable help so the Discloser can seek a protective order, and will disclose only what is legally required.

8.5 Duration. These obligations continue for three (3) years after these Terms end, and for trade secrets and Customer Data, for as long as the information remains confidential.

9. Warranties and Disclaimers

9.1 Limited Warranty. For paid Services, we warrant that the Services will perform materially in accordance with their applicable documentation during your subscription period. This warranty does not apply to free Services, trials or Cassandra, or to problems caused by misuse, modification, or software, hardware or services not provided by us.

9.2 Exclusive Remedy. If you notify us of a breach of Section 9.1 during your subscription period, we will use commercially reasonable efforts to correct the non-conformity. If we cannot do so within thirty (30) days, either party may terminate the affected subscription and we will refund prepaid fees for the remaining portion of the subscription period. TO THE EXTENT PERMITTED BY LAW, THIS IS YOUR SOLE AND EXCLUSIVE REMEDY FOR BREACH OF SECTION 9.1.

9.3 Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN THESE TERMS, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE," AND WE DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE OR COMPLETELY SECURE.

9.4 No Guarantee of Protection. The Services are designed to help secure and verify AI interactions and to identify certain known risks. We do not guarantee that they will detect or prevent every threat, vulnerability or security incident, and they are not a substitute for your own security practices or for advice from a qualified security professional.

9.5 Consumers. If you are a Consumer, some jurisdictions do not allow the disclaimer of implied warranties or give you statutory rights that cannot be excluded. In those jurisdictions, Section 9.3 applies only to the extent the law permits, and any implied warranty that cannot be disclaimed is limited to the shortest period the law allows.

10. Indemnification

10.1 Your Indemnity. You will defend, indemnify and hold harmless Ciphero and its officers, directors, employees and agents from and against third-party claims, and the resulting losses, damages, fines, costs and reasonable attorneys' fees, to the extent arising from: (a) your breach of these Terms; (b) your violation of law or of a third party's rights; (c) Customer Data, including your lack of rights or consents to submit it; or (d) your running of a Ciphero script, or deploying the Services, on a device, account or system that you were not authorized to administer. If you are a Consumer, this Section 10.1 applies only to the extent the claim arises from your intentional misconduct, fraud or violation of law, and only to the extent permitted by applicable law.

10.2 Our Indemnity. For paid Services, we will defend you against any third-party claim alleging that the Services, as provided by us, infringe a United States patent, copyright or trademark or misappropriate a trade secret, and will pay damages and costs finally awarded or agreed in settlement.

10.3 Exclusions. Section 10.2 does not apply to claims arising from: (a) Customer Data; (b) modifications to the Services not made by us; (c) combination of the Services with products, services, data or processes not provided by us, where the claim would not have arisen without the combination; (d) your use of the Services in breach of these Terms; (e) your continued use after we provide a non-infringing alternative; or (f) free Services.

10.4 Mitigation. If the Services are, or in our opinion are likely to be, subject to an infringement claim, we may at our option: (a) obtain the right for you to continue using them; (b) modify or replace them so they are non-infringing without materially reducing functionality; or (c) if neither is commercially reasonable, terminate the affected subscription and refund prepaid fees for the remaining period. SECTIONS 10.2 TO 10.4 STATE OUR SOLE LIABILITY, AND YOUR EXCLUSIVE REMEDY, FOR INFRINGEMENT CLAIMS.

10.5 Procedure. The indemnified party must: (a) give the indemnifying party prompt written notice of the claim, although delay relieves the indemnifying party of its obligations only to the extent it is prejudiced; (b) give the indemnifying party sole control of the defense and settlement; and (c) provide reasonable cooperation at the indemnifying party's expense. The indemnifying party may not settle a claim in a way that admits fault by, or imposes non-monetary obligations on, the indemnified party without that party's written consent, which may not be unreasonably withheld. The indemnified party may join with its own counsel at its own expense.

11. Limitation of Liability

11.1 Liability Cap. SUBJECT TO SECTIONS 11.3 AND 11.4, CIPHERO'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES, UNDER ANY THEORY OF LIABILITY, SHALL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID TO CIPHERO FOR THE SERVICES GIVING RISE TO THE LIABILITY IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO IT, AND (B) ONE HUNDRED UNITED STATES DOLLARS (US$100). FOR CASSANDRA, FREE PLANS, TRIALS AND ANY OTHER SERVICE PROVIDED WITHOUT CHARGE, THE CAP IS ONE HUNDRED UNITED STATES DOLLARS (US$100).

11.2 Exclusion of Damages. SUBJECT TO SECTIONS 11.3 AND 11.4, IN NO EVENT SHALL CIPHERO BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, DATA OR USE, ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES, UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THEIR POSSIBILITY.

11.3 Exceptions. NOTHING IN THESE TERMS LIMITS OR EXCLUDES LIABILITY FOR (A) FRAUD OR FRAUDULENT MISREPRESENTATION; (B) GROSS NEGLIGENCE OR WILLFUL MISCONDUCT; (C) DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE; OR (D) ANY OTHER LIABILITY THAT CANNOT BE LIMITED OR EXCLUDED UNDER APPLICABLE LAW. SECTIONS 11.1 AND 11.2 DO NOT LIMIT A BUSINESS CUSTOMER'S OBLIGATION TO PAY FEES OR ITS OBLIGATIONS UNDER SECTION 10.1.

11.4 Consumers. If you are a Consumer, some jurisdictions do not allow the exclusion or limitation of certain damages, so some of the limitations in this Section 11 may not apply to you. If you are a Consumer in the European Economic Area, the United Kingdom or Switzerland, we are liable under the statutory provisions that apply to you for foreseeable loss caused by our breach of these Terms or our failure to use reasonable care and skill, and Sections 11.1 and 11.2 apply only to the extent that law permits.

11.5 Basis of the Bargain. You acknowledge that the fees for the Services, and our decision to offer some Services without charge, reflect the allocation of risk in these Terms, and that we would not provide the Services without these limitations.

11.6 Time to Bring Claims. To the extent permitted by law, any claim arising out of or relating to these Terms or the Services must be brought within one (1) year after the claim arises, or it is permanently barred.

11.7 Negotiated Agreements. Business Customers may agree different liability terms in a signed written agreement, which will govern to the extent it expressly states that it overrides this Section 11.

12. Dispute Resolution

12.1 Informal Resolution First. Before starting arbitration or a court action, the party raising a dispute must send the other a written notice describing the dispute, the relief sought and the sender's contact details. Notices to us go to contact@ciphero.ai and to the address in Section 16. The parties will try in good faith to resolve the dispute, including by a call if either asks, for sixty (60) days after the notice is received. Limitation periods are paused during that time. Compliance with this Section 12.1 is a condition to starting arbitration.

12.2 Agreement to Arbitrate. Except as provided in Section 12.3 or if you opt out under Section 12.9, you and Ciphero agree that any dispute, claim or controversy arising out of or relating to these Terms or the Services (a "Dispute") will be resolved by final and binding individual arbitration. The Federal Arbitration Act governs the interpretation and enforcement of this Section 12.

12.3 Exceptions. Either party may (a) bring an individual claim in small claims court if it qualifies and stays there; and (b) seek injunctive or other equitable relief in court to protect its intellectual property, Confidential Information or the security of the Services.

12.4 Rules and Fees. The arbitration will be administered by the American Arbitration Association ("AAA"). Disputes with Consumers are governed by the AAA Consumer Arbitration Rules, and all other Disputes by the AAA Commercial Arbitration Rules, each as in effect when the arbitration starts and as modified by this Section 12. For Consumers, we will pay filing, administrative and arbitrator fees as the AAA Consumer Arbitration Rules require, and the arbitrator may award attorneys' fees to the extent applicable law allows.

12.5 Location and Format. For Consumers, the arbitration will be conducted by video conference or telephone, on written submissions, or in person in the county where you live, at your choice. For Business Customers, any in-person hearing will take place in Wilmington, Delaware, unless the parties agree otherwise. A single arbitrator will decide the Dispute and may award any individual relief available in court, but only in favor of the individual party seeking relief and only to the extent needed to provide relief on that party's individual claim.

12.6 Delegation. The arbitrator decides all questions about the scope, validity, enforceability and applicability of this agreement to arbitrate, except that a court decides questions about Sections 12.7, 12.8 and 12.10 and whether a claim falls within Section 12.3.

12.7 Class Action and Jury Trial Waiver. YOU AND CIPHERO MAY BRING DISPUTES ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS, COLLECTIVE, CONSOLIDATED OR REPRESENTATIVE PROCEEDING. THE ARBITRATOR MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS EXCEPT AS PROVIDED IN SECTION 12.8. TO THE EXTENT ANY DISPUTE PROCEEDS IN COURT, YOU AND CIPHERO WAIVE ANY RIGHT TO A JURY TRIAL.

12.8 Mass Arbitration. If twenty-five (25) or more similar demands for arbitration are filed against Ciphero by the same or coordinated counsel or organizations, the AAA Mass Arbitration Supplementary Rules apply. Each claimant must still comply with Section 12.1. The demands will be administered in batches of up to fifty (50), with one arbitrator per batch, and the parties will cooperate in good faith on the process. Limitation periods are paused for demands awaiting their batch.

12.9 Consumer Opt-Out. If you are a Consumer, you may opt out of this agreement to arbitrate by emailing contact@ciphero.ai, from the email address associated with your use of the Services, within thirty (30) days after you first accept these Terms. Your email must state your name and that you opt out of arbitration. Opting out does not affect any other part of these Terms.

12.10 Severability of This Section. If a court finds that Section 12.7 is unenforceable as to a particular claim or request for relief, that claim or request will be severed and decided by a court under Section 12.11, after the individual arbitration of all remaining claims, and will never proceed in class arbitration. If any other part of this Section 12 is found unenforceable, the rest remains in effect.

12.11 Courts. Any Dispute not subject to arbitration will be decided exclusively by the state or federal courts located in Delaware, and both parties consent to their personal jurisdiction, except that a Consumer may also bring a claim in the courts where the Consumer lives if applicable law gives that right.

12.12 Changes to This Section. If we change this Section 12, the change will not apply to any Dispute of which either party gave notice under Section 12.1 before the change took effect. If you are a Consumer, you may reject the change by emailing us within thirty (30) days after it takes effect, in which case the previous version of this Section 12 continues to apply to you.

13. Term and Termination

13.1 Term. These Terms start when you first accept them and continue until terminated.

13.2 Termination by You. You may stop using the Services at any time. You may cancel a paid subscription as described in Section 4.5 and close your account through your account settings or by emailing contact@ciphero.ai.

13.3 Termination by Us. We may terminate these Terms or your access to paid Services: (a) if you materially breach these Terms and do not cure the breach within thirty (30) days after notice; (b) immediately, if your breach cannot be cured, involves illegal activity, or threatens the security or integrity of the Services or others; or (c) for any reason on at least thirty (30) days' notice, in which case we will refund prepaid fees for the unused portion of your subscription period. We may terminate access to free Services at any time.

13.4 Effect of Termination. When these Terms or a subscription end: (a) your right to use the affected Services ends; (b) a Business Customer must pay all fees accrued before termination, and fees for the remainder of a committed term if it terminates without cause; (c) each party must stop using and, on request, return or destroy the other's Confidential Information, subject to routine backups and legal retention requirements; and (d) on request made within thirty (30) days, we will make Customer Data available for export where the Services support it, after which we may delete it as described in our Privacy Policy.

13.5 Survival. Sections 4 (for amounts owed), 6, 8, 9.3 to 9.5, 10, 11, 12, 13.4, 13.5, 14 and 15.4 to 15.12, and any other provision that by its nature should survive, survive termination.

14. General Provisions

14.1 Governing Law. These Terms are governed by the laws of the State of Delaware and applicable US federal law, without regard to conflict of laws principles. If you are a Consumer, this choice of law does not deprive you of the protection of mandatory provisions of the law of the country or state where you live.

14.2 Entire Agreement and Order of Precedence. These Terms, together with any order form, DPA and supplemental terms that apply to you, are the entire agreement between you and Ciphero about the Services and supersede prior agreements on that subject. If they conflict, the following order applies: (a) a signed order form or agreement, where it expressly overrides these Terms; (b) the DPA, as to personal data; (c) Section 15, as to Cassandra; and (d) the rest of these Terms. Terms in any purchase order or similar document you send are void.

14.3 Changes to These Terms. We may update these Terms from time to time. We will post the updated Terms with a new "Last updated" date and, for material changes, give at least thirty (30) days' notice by email or in the Services before they take effect, unless a change is required by law or addresses a security issue, in which case it may take effect sooner. Changes apply only from their effective date and do not apply to Disputes of which either party gave notice before that date. If you do not agree to a change, you must stop using the affected Services and may cancel any paid subscription, and we will refund prepaid fees for the unused portion of the subscription period for a material change that adversely affects you. If you continue using the Services after the effective date, the updated Terms will apply to you. Changes to a signed order form require a written amendment signed by both parties.

14.4 Severability. If any provision of these Terms is held unenforceable, it will be enforced to the maximum extent permitted and modified to the minimum extent needed to make it enforceable, and the remaining provisions remain in full force. Section 12.10 governs severability within Section 12.

14.5 Assignment. You may not assign or transfer these Terms without our prior written consent, except that a Business Customer may assign them, with notice to us, to a successor in a merger, acquisition or sale of substantially all of its assets that is not our competitor. We may assign these Terms to an affiliate or to a successor in a merger, acquisition or sale of assets. Any other attempted assignment is void.

14.6 Notices and Electronic Communications. You consent to receive agreements, notices, disclosures and other communications from us electronically, and these satisfy any requirement that they be in writing. We may give notices to the email address associated with your account or check, or through the Services. Notices to us must be sent to contact@ciphero.ai, with legal notices also sent to the address in Section 16. A notice is effective when received, or for email, on the next business day after it is sent unless the sender receives a delivery failure.

14.7 Force Majeure. Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, including natural disasters, epidemics, war, terrorism, labor disputes, internet or utility failures, attacks on our systems by third parties not caused by our failure to maintain reasonable safeguards, and government actions. This does not excuse payment obligations.

14.8 Relationship. The parties are independent contractors. These Terms do not create an agency, partnership, joint venture or employment relationship.

14.9 Waiver. A failure or delay in enforcing a provision is not a waiver. A waiver is effective only if it is in writing and signed by the party granting it.

14.10 Export Controls and Sanctions. You will comply with all applicable export control and sanctions laws. You represent that you are not located in, organized under the laws of, or ordinarily resident in a country or region subject to comprehensive US sanctions, and that you are not on, or owned or controlled by a party on, any US government restricted-party list. You will not use or allow the Services to be used in violation of these laws.

14.11 No Third-Party Beneficiaries. These Terms do not give any rights to anyone other than you and Ciphero, except that the persons protected by Section 10.1 may rely on it.

14.12 Interpretation. Headings are for convenience only. "Including" and similar words mean "including without limitation." These Terms will not be construed against either party as the drafter.

14.13 US Government Users. The Services are "commercial computer software" and "commercial computer software documentation" and are provided to US government users only with the rights set out in these Terms.

14.14 Publicity. We may identify a Business Customer as a customer by name and logo in our marketing unless the Business Customer asks us in writing not to. We will not identify Consumers without their consent.

15. Supplemental Terms: Cassandra

This Section 15 applies to Cassandra, our free extension check, and prevails over the rest of these Terms where they conflict. Everything else in these Terms continues to apply to Cassandra.

15.1 What Cassandra Is. "Cassandra" means the free service available at ciphero.ai/cassandra, including: (a) the web pages that start, track and display a check; (b) the collector script we generate for your check (the "Script"); (c) the verdict, risk level, findings, remediation steps and written analysis that make up a check's report (the "Report"); (d) the question-and-answer assistant available on an unlocked Report (the "Assistant"); (e) the AI supply-chain advisories published at ciphero.ai/advisories and related email notifications (the "Advisories"); and (f) the emails we send in connection with any of these. Cassandra is part of the Services.

Cassandra is offered free of charge, without an account, to Consumers and Business Customers. Section 2.3 does not apply to Cassandra. Sections 2.1 (age), 5 (use of Services) and 6 (intellectual property and data) apply in full.

15.2 How You Accept. You accept these Terms for Cassandra when you request a check or a sign-in link: the form tells you, next to the button, that continuing accepts these Terms and our Privacy Policy, and links to both. You accept these Terms for Advisories by checking the acceptance box when you subscribe. Before the Script sends any data, it displays a notice that sending is subject to these Terms and asks you to confirm. If you open a Report or use the Assistant through a link that someone else gave you, you may do so only as these Terms permit.

15.3 Authority Over the Device. You may run the Script only on a device that you own or are expressly authorized to administer. If the device is owned or managed by an employer, client or other third party, you represent and warrant that you have that party's permission to run the Script and to disclose to us the information it collects, and that doing so complies with that party's policies and applicable law. You are solely responsible for obtaining any notices or consents that your use of Cassandra requires.

15.4 The Script. We grant you a limited, revocable, non-exclusive, non-transferable right to download and run the Script on an eligible device for the sole purpose of obtaining a check. The Script is Ciphero's intellectual property. You may read it, but you may not modify it (other than to inspect it), redistribute it, or use it or any part of it for another purpose.

The Script is provided in readable source form, and we publish a copy with a placeholder token at ciphero.ai/cassandra/script. You are responsible for reviewing the Script before you run it. By running it, you acknowledge that you have had the opportunity to do so, that you are running it voluntarily and with your own permissions on your own device, and that piping a downloaded script into a shell is a practice you have chosen to accept. The Script is designed to list extension identifiers and versions by folder name, to check a fixed list of places for the published traces of specific incidents and record the name of what matched, to list the names of AI tools and of API-key variables, to display every fact it has gathered, and to send those facts only after you confirm. It is designed not to read or transmit file contents or secret values, not to install, write, schedule or elevate anything, and not to send anything if you decline. We do not warrant that it will behave identically in every environment, and your device's configuration, permissions and other software are outside our control.

Each check's link and token are single-use and expire after a short period. You must not alter, fabricate or replay the data the Script sends, submit data from a device other than the one the Script ran on, or send data to a check you did not request.

15.5 Nature and Limits of the Results. A check's verdict is produced by fixed rules that compare what the Script reported against (a) lists of known-malicious extensions, public ones and our own, (b) the public marketplaces that editors install extensions from, and (c) published indicators of specific, named incidents, each as available to us at the time of the check. Cassandra does not inspect code, monitor behavior or detect unknown threats.

A "Clear" result means only that none of those sources matched at that time. It is not a statement that the device is free of malicious software, that an extension is safe, or that a compromise has not occurred. Results may contain false negatives and false positives. The lists and indicators we rely on are compiled by third parties and by us from public reports, and may be incomplete, out of date or wrong. Cassandra is not antivirus, endpoint protection, forensic analysis, incident response, a security audit or a penetration test, and it is not a substitute for any of them or for the advice of a qualified security professional.

The Report, remediation steps, written analysis and Advisories are general information only and are not professional, security, legal or other advice. Remediation steps may not suit your circumstances. You are responsible for decisions you make and actions you take or omit in reliance on Cassandra, including uninstalling or retaining software, rotating or revoking credentials, re-imaging devices, notifying others, or deciding not to act. If you believe a device has been compromised, engage a qualified incident-response professional.

15.6 Written Analysis and the Assistant. The written analysis in a Report and the Assistant's replies are generated by automated systems, including machine-learning models, from the facts in your check and from public information we hold about the relevant extensions and incidents. They are produced without human review before you see them and may be incomplete, inaccurate, out of date or misleading. They explain a verdict but cannot change it, and nothing they say creates a representation or warranty by Ciphero. The Assistant is not a person, is limited to a fixed number of exchanges per check, and may decline questions outside the scope of your check.

You must not enter passwords, API keys, tokens, private keys, other secrets, confidential information or personal data about other people into the Assistant, and you must not attempt to manipulate it into ignoring its instructions or producing content unrelated to your check. We may review Assistant conversations to prevent abuse, maintain safety and improve Cassandra, as described in our Privacy Policy. You are responsible for everything you enter.

15.7 Email, Sign-in Links and Reports. We send the Report to the email address you provide, and you represent that you are entitled to use that address. The link in that email both verifies the address and signs you in: anyone who has the link can open the Report, the Assistant and the follow-up options during its validity period. You are responsible for keeping the link confidential and for access that results from your disclosure or forwarding of it. Links expire, Reports may be withdrawn or deleted after a retention period, and the detailed data behind a Report is deleted on the schedule in our Privacy Policy. We do not promise that a Report will remain available.

15.8 Fair Use. Cassandra is a shared, free resource. In addition to Section 5.2, you must not:

• run the Script on, or submit data about, a device you are not authorized to administer;
• circumvent or interfere with the human check, rate limits, single-use tokens or any other protective measure;
• request checks or sign-in emails for addresses you do not control, or use Cassandra to send unsolicited email;
• use Cassandra to test whether malicious software evades detection, or otherwise to develop, tune or validate malicious software;
• access Cassandra by automated means, or extract, scrape, mirror or bulk-download the known-malicious lists, marketplace data, Advisories or Reports, including to build or train a competing product or dataset;
• reproduce or publish a Report, written analysis or Assistant conversation in a way that attributes to Ciphero a statement about a third party that Ciphero has not made; or
• use Cassandra in violation of a third party's rights or of any law.

We may impose limits, such as a number of checks per address per day, and may refuse, throttle, suspend or block any request, address, network or person. We may change, limit, suspend or discontinue Cassandra, in whole or in part, at any time.

15.9 Third-Party Data, Marketplaces and Advisories. Some of the known-malicious lists Cassandra uses are published by third parties under their own licenses, which we credit on the Cassandra pages, and marketplace information comes from public registries operated by third parties. We do not control those sources and do not guarantee their accuracy, availability or completeness. A registry that is unavailable may leave part of a check unanswered.

Advisories, Reports and written analysis describe incidents, extensions, packages and publishers on the basis of publicly available information, as cited, at the time of writing. Any statement that an extension or version is malicious, compromised or removed reflects that source material and the state of the lists at that time, is provided to protect users, and is not a statement by Ciphero about any person's intent or liability. Advisories are published as-is and may be revised or withdrawn at any time. Subscribing to Advisories is a double opt-in, and every Advisory email contains an unsubscribe link.

15.10 Commercial Follow-Up. Cassandra may present information about Ciphero's paid products and services. You have no obligation to buy anything. If you ask us to contact you, we will use the details you give us for that purpose as described in our Privacy Policy. Any purchase is governed by the rest of these Terms and any applicable order form.

15.11 Disclaimer and Limitation of Liability for Cassandra. CASSANDRA IS PROVIDED FREE OF CHARGE, "AS IS" AND "AS AVAILABLE." THE LIMITED WARRANTY IN SECTION 9.1 DOES NOT APPLY TO CASSANDRA. SECTIONS 9.3 TO 9.5 APPLY TO CASSANDRA IN FULL, AND WITHOUT LIMITING THEM, WE DISCLAIM ANY WARRANTY THAT CASSANDRA WILL DETECT ANY PARTICULAR MALICIOUS SOFTWARE, THAT ANY RESULT, ANALYSIS, REMEDIATION STEP, ASSISTANT REPLY OR ADVISORY IS ACCURATE OR COMPLETE, OR THAT THE SCRIPT WILL BE FREE OF ERRORS IN YOUR ENVIRONMENT.

SECTION 11 APPLIES TO CASSANDRA, INCLUDING THE US$100 CAP IN SECTION 11.1 AND THE EXCEPTIONS IN SECTIONS 11.3 AND 11.4. WITHOUT LIMITING SECTION 11, AND SUBJECT TO SECTIONS 11.3 AND 11.4, CIPHERO SHALL NOT BE LIABLE FOR ANY LOSS, DAMAGE, COST OR LIABILITY ARISING FROM (A) A THREAT THAT CASSANDRA DID NOT DETECT OR REPORT; (B) A RESULT, ANALYSIS, REMEDIATION STEP, ASSISTANT REPLY OR ADVISORY THAT WAS INACCURATE OR INCOMPLETE; (C) ANY ACTION YOU TOOK OR DID NOT TAKE IN RELIANCE ON CASSANDRA; (D) YOUR RUNNING OF THE SCRIPT ON A DEVICE YOU WERE NOT AUTHORIZED TO USE; OR (E) ACCESS TO A REPORT BY ANYONE WHO OBTAINED ITS LINK FROM YOU OR FROM YOUR MAILBOX. YOU ACKNOWLEDGE THAT THESE LIMITATIONS ARE AN ESSENTIAL BASIS OF OUR DECISION TO OFFER CASSANDRA WITHOUT CHARGE.

15.12 Indemnification. Section 10.1, including its limits for Consumers, applies to your use of Cassandra and covers claims arising from your running of the Script on a device you were not authorized to administer, your disclosure of a Report link, information you entered into the Assistant, and your use of a Report, written analysis or Advisory in a statement about a third party.

16. Contact Information

Questions about these Terms and legal notices may be sent to:

Ciphero AI Technologies, Inc.
99 Wall Street #1148
New York, NY 10005
Email: contact@ciphero.ai