SIMPLERISK TERMS OF SERVICE

These Terms of Service ("Terms") govern the purchase and use of SimpleRisk products and services. By purchasing, accessing, or using any SimpleRisk products or services, Customer agrees to be bound by these Terms.

1. DEFINITIONS

2. LICENSE GRANT AND SERVICE PROVISION

2.1 License Grant (All Deployments)

Subject to these Terms and payment of applicable fees, SimpleRisk grants Customer a non-exclusive, non-transferable license during the applicable term to:

• Access and use the SimpleRisk Service in accordance with these Terms
• Use the Extras specified in the applicable Order
• Allow unlimited users and risks (unless otherwise specified)

2.2 On-Premise Deployment Additional Rights

For On-Premise Deployments, the license additionally includes the right to:

• Install and operate the SimpleRisk Service software on Customer's infrastructure
• Create backups of the software and associated data
• Install on a development server as specified in the Order (if applicable)

2.3 Hosted Deployment Service Provision

For Hosted Deployments, SimpleRisk will:

• Provision and maintain all service infrastructure (including servers and databases)
• Configure domain name and CA-signed SSL certificates
• Provide ongoing system upgrades and maintenance
• Implement security controls and backup procedures
• Provide basic availability monitoring

3. SUPPORT AND MAINTENANCE

3.1 Included Support

All SimpleRisk Service licenses include SimpleRisk Silver Support:

• Email support
• Web-based support portal access
• Scheduled phone support
• Monday through Friday, 8 AM to 5 PM Central Time US (excluding holidays)
• One (1) business day standard response time
• Four (4) business hour response time for Severity 1/System Down issues

3.2 System Updates

• On-Premise: SimpleRisk provides software updates and the Customer is responsible for installation
• Hosted: SimpleRisk is responsible for all software and system updates

3.3 Quarterly Expert Sessions

All licenses include quarterly one-on-one Q&A sessions with a SimpleRisk GRC Subject Matter Expert to discuss GRC program strategy and implementation.

4. SERVICE AVAILABILITY AND DISASTER RECOVERY

4.1 Applicability

Section 4 applies only to Hosted (SaaS) deployments of the SimpleRisk Service and does not apply to On-Premise installations.

4.2 Uptime Commitment

We aim to provide 99.9% uptime for your Customer instance, as measured by SimpleRisk's AWS health checks. However, we cannot guarantee uninterrupted service and are not responsible for downtime due to factors outside our control.

4.3 Recovery Point Objective (RPO)

In the unlikely event of a data loss, the maximum amount of data that could be lost is twenty-three hours and fifty-nine minutes. This assumes the system goes down at 11:59 PM and the previous backup occurred at midnight the day before.

4.4 Recovery Time Objective (RTO)

Each Customer instance operates with built-in redundancy. In the event of user-related database errors, a simple database rollback can typically be completed within one hour during regular business hours. Disaster recovery procedures do not cover issues outside this scope.

4.5 Maintenance and Interruptions

Scheduled maintenance and unforeseen service interruptions may occur. We will make reasonable efforts to notify Customers of planned downtime and minimize disruption.

5. CUSTOMER RESPONSIBILITIES

5.1 General Responsibilities

Customer is solely responsible for:

• Performing all activities, decisions and actions associated with using the SimpleRisk Service, including the implementation, management and maintenance of any governance, risk and compliance processes, controls or assessments
• Ensuring proper use of the SimpleRisk Service in accordance with these Terms
• Maintaining confidentiality of login credentials and access controls

5.2 Data and Content Restrictions

6. RESTRICTIONS

Customer shall not:

• Copy, reproduce, modify, or create derivative works of the SimpleRisk Service or associated software
• Sell, rent, loan, license, sublicense, distribute, assign, or transfer the SimpleRisk Service
• Reverse engineer, decompile, or disassemble the SimpleRisk Service or attempt to access source code
• Allow any third party to perform any of the foregoing activities
• Use the SimpleRisk Service in any manner that violates applicable laws or regulations

7. INTELLECTUAL PROPERTY

7.1 SimpleRisk Ownership

SimpleRisk owns and retains all right, title, and interest (including all intellectual property rights) in and to the SimpleRisk Service, associated software, documentation, and any modifications or improvements thereof.

7.2 Customer Data Ownership

Customer owns and retains all right, title, and interest in and to the data stored within their SimpleRisk Service instance.

7.3 Reservation of Rights

Each party reserves all rights not expressly granted in these Terms. No licenses are granted by implication, estoppel, or otherwise.

8. CONFIDENTIALITY

8.1 Definition of Confidential Information

Each party acknowledges that it will obtain access to confidential and proprietary information of the other party, including information related to business, products, services, software, and technology. Confidential Information includes information that is:

• Clearly marked as confidential
• Disclosed orally with notice of confidential status
• Reasonably understood to be confidential and proprietary

Exceptions include information that: (a) is publicly available through no breach by receiving party; (b) was known by receiving party prior to disclosure; (c) is rightfully received from a third party without restriction; or (d) is independently developed without use of disclosing party's Confidential Information.

"Trade Secrets" means any Confidential Information, without regard to form, including technical or non-technical data, know-how, formulas, patterns, compilations, computer programs and software (including source code, object code, scripts, configurations, APIs, data models, database schemas, and software architecture), algorithms, product roadmaps and unreleased features, pricing and pricing models, discount structures, margins and cost information, business strategies and methodologies, customer and prospect lists, documentation of planned or implemented security controls, threat models, vulnerability information, penetration test results, audit findings and certifications, incident response plans, encryption keys and credentials, and assessment methodologies, which (i) derives economic value, actual or potential, from not being generally known to or readily ascertainable by other persons who can obtain economic value from its disclosure or use, and (ii) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.

"Affiliate" means any entity controlling, controlled by, or under common control with a party. References to a party's Confidential Information include the Confidential Information of such party's Affiliates, and each party's confidentiality obligations hereunder extend to and are enforceable with respect to disclosures made to or by its Affiliates.

8.2 Use and Protection

Neither party shall disclose the other party's Confidential Information or use it for any purpose other than performing obligations under these Terms. Each party shall protect the other's Confidential Information using the same measures used for its own confidential information of like importance, but no less than reasonable care.

8.3 Aggregate Data

SimpleRisk reserves the right to use and disclose reports and data in aggregate format where individual customer data cannot be identified or derived.

8.4 Trade Secret Survival

Notwithstanding any other provision of this Agreement, including any survival or termination provision, each party's obligations of confidentiality and restriction on use with respect to the other party's Trade Secrets shall survive indefinitely for so long as such information continues to qualify as a Trade Secret under applicable law.

8.5 Bankruptcy and Insolvency

The confidentiality obligations contained in this Agreement shall not be affected, diminished, or terminated by any bankruptcy, insolvency, receivership, restructuring, reorganization, assignment for the benefit of creditors, attachment, seizure, or similar proceeding, whether voluntary or involuntary and whether initiated by or against either party. Without limiting the foregoing, such obligations shall continue in full force and effect notwithstanding the rejection, disclaimer, or termination of this Agreement by a trustee, monitor, receiver, liquidator, debtor-in-possession, or other party acting on behalf of an insolvent party under any applicable law, including the U.S. Bankruptcy Code, Canada's Bankruptcy and Insolvency Act, and the Companies' Creditors Arrangement Act, or any successor or equivalent legislation.

8.6 Injunctive Relief

Each party acknowledges that the unauthorized disclosure or use of the other party's Confidential Information would cause irreparable harm and significant injury to such other party, the degree of which may be difficult to ascertain, such that money damages would not be a sufficient remedy. Accordingly, the non-breaching party shall be entitled to seek immediate injunctive relief enjoining any breach of this Section without being required to prove the inadequacy of monetary damages or to post a bond or other security, in addition to all other rights and remedies available at law or in equity. If either party employs an attorney to enforce any rights arising out of or relating to this Section, the prevailing party shall be entitled to recover its reasonable costs of enforcement, including attorneys' fees.

8.7 Breach Notification

Each party shall notify the other party within seventy-two (72) hours of discovering any unauthorized use or disclosure of the other party's Confidential Information, and shall cooperate in good faith with the other party to regain possession of the Confidential Information and prevent further unauthorized use.

9. FINANCIAL TERMS

9.1 Fees and Payment

• Fees as specified in applicable Orders are due within thirty (30) days of invoice date
• All payments in U.S. dollars
• Late payment fee of 1.0% per month (or maximum allowed by law) on undisputed overdue amounts
• For Hosted Deployments: SimpleRisk may suspend service upon 15+ days delinquency after written notice

9.2 Taxes

Customer is responsible for all taxes imposed on payments to SimpleRisk, except taxes on SimpleRisk's net income.

9.3 Renewals

• Subscription will automatically renew for additional periods equal to your initial term unless either party provides written notice of non-renewal at least thirty (30) days before the end of the current term
• Renewal pricing subject to SimpleRisk's then-current rates unless otherwise agreed
• SimpleRisk will provide renewal notice prior to term expiration

10. TERM AND TERMINATION

10.1 Term

These Terms begin when Customer first purchases SimpleRisk products or services and continue for the term specified in the applicable Order.

10.2 Termination for Cause

Either party may terminate upon written notice if the other party fails to cure a material breach within fifteen (15) days of written notice. 

10.3 Termination for Convenience

The Customer may terminate at any time upon written notice, however, termination does not entitle Customer to a refund of any fees already paid or payable. 

10.4 Effect of Termination

Upon termination:

• All licenses and access rights immediately cease
• Customer must cease use and return or destroy Confidential Information
• SimpleRisk will destroy Customer confidential data, however, we may retain a copy of Customer data as part of our backup systems for a limited period, in accordance with our data retention policies and legal obligations
• Sections 6, 7, 8, 11, 12, 13, and 14 survive termination

11. WARRANTIES AND DISCLAIMERS

11.1 Disclaimer

11.2 Indemnification

SimpleRisk shall defend and indemnify Customer against third-party claims that the SimpleRisk Service infringes upon patents, copyrights, or trademarks when used in accordance with these Terms, subject to:

• Prompt notice of claims
• Customer cooperation in defense
• SimpleRisk control over defense and settlement
• Settlement fully releases Customer and is monetary only

Exclusions include claims arising from: Customer modifications, combinations with third-party products, continued use after modification to avoid infringement, use outside Terms scope, or Customer misconduct.

SimpleRisk may elect to: (a) secure continued use rights; (b) replace with non-infringing equivalent; (c) modify to avoid infringement; or (d) terminate and refund prepaid fees pro rata.

12. LIMITATION OF LIABILITY

13. EXPORT CONTROL

SimpleRisk's obligations are subject to all applicable U.S. and foreign export/import laws and regulations. Customer shall not export or re-export the SimpleRisk Service except in full compliance with all applicable laws.

14. GENERAL PROVISIONS

14.1 Governing Law

These Terms shall be governed by Texas law, without reference to conflict of laws principles.

14.2 Assignment

Customer may not assign these Terms without SimpleRisk's prior written consent (not unreasonably withheld), except to affiliates. SimpleRisk may assign to successors in connection with merger, acquisition, or asset sale.

14.3 Force Majeure

Neither party shall be liable for delays or failures in performance due to causes beyond reasonable control, provided prompt written notice is given and the delay does not exceed thirty (30) days.

14.4 Independent Contractors

The parties are independent contractors. No joint venture, partnership, or agency relationship is created.

14.5 Entire Agreement

These Terms, together with applicable Orders, constitute the entire agreement and supersede all prior understandings. SimpleRisk may update these Terms by providing thirty (30) days written notice to Customer.

14.6 Severability

If any provision is deemed invalid or unenforceable, the remaining provisions shall remain in full force and effect.

14.7 Contact Information