Terms of Service

1. Acceptance of Terms

By accessing or using Pretorin's compliance automation platform ("Service"), you agree to be bound by these Terms of Service ("Terms"). If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

If you do not agree to these Terms, you may not access or use the Service.

2. Description of Service

Pretorin provides an AI-powered compliance automation platform that helps organizations manage security controls, generate documentation, and prepare for compliance audits. The Service includes:

• AI-assisted generation of compliance documentation in OSCAL format
• Control tracking and evidence management
• Auditor portal for assessment collaboration
• Integration with security frameworks (NIST, FedRAMP)
• API access for programmatic control

3. Account Registration

To use the Service, you must create an account. You agree to:

• Provide accurate, current, and complete information
• Maintain and update your account information
• Keep your password secure and enable multi-factor authentication
• Accept responsibility for all activities under your account
• Notify us immediately of any unauthorized access or security breach

We reserve the right to suspend or terminate accounts that violate these Terms or for any other reason at our discretion. Without limiting the foregoing, Pretorin may immediately suspend your access to the Service if: (a) your account is past due; (b) your use poses a security risk to the Service or other users; (c) your use may subject Pretorin to third-party liability; or (d) your use is in violation of applicable law. Pretorin will use commercially reasonable efforts to notify you prior to any suspension, except where immediate suspension is necessary to prevent harm.

4. Acceptable Use

You agree not to use the Service to:

• Violate any applicable laws or regulations
• Infringe on intellectual property rights of others
• Upload malicious code, viruses, or harmful content
• Attempt to gain unauthorized access to our systems or other users' accounts
• Interfere with or disrupt the Service's operation
• Use automated tools to scrape or extract data without permission
• Generate false or misleading compliance documentation
• Share your account credentials with unauthorized parties
• Use the Service to create documentation that misrepresents your actual security posture or compliance status
• Generate compliance evidence for controls that are not actually implemented
• Use AI-generated content to deceive auditors, assessors, or regulatory bodies
• Submit AI-generated documentation as human-certified without proper review
• Use the Service or any information obtained from the Service to build, train, or improve a competing product or service, including any AI or machine learning model that performs functions similar to the Service
• Exceed any usage limits, rate limits, or fair-use thresholds communicated through the Service or applicable documentation

5. Your Data and Content

5.1 Ownership

You retain ownership of all data, documents, and content you upload to the Service ("Your Content"). By using the Service, you grant us a limited license to process Your Content solely for the purpose of providing the Service.

5.2 AI Processing

The Service uses artificial intelligence to analyze Your Content and generate compliance documentation. You understand that:

• AI-generated content should be reviewed for accuracy before use
• We do not use Your Content to train or fine-tune AI models
• AI outputs are tools to assist, not replace, human judgment and expertise
• You may disable AI-driven features for your organization at any time

Section 19 (AI Data Processing and Customer Controls) describes in detail which features use AI, which third-party model providers process Your Content, how long each category of AI-related data is retained, and how to opt out of AI-driven features.

5.3 Responsibility

You are solely responsible for the accuracy and legality of Your Content and any compliance documentation you submit to regulatory bodies or auditors.

5.4 Data Processing and Usage Rights

Pretorin is granted a limited, worldwide license to:

• Process Your Content to provide the Service features you request
• Generate derivative compliance documents based on Your Content
• Create anonymized, aggregated statistical data for service improvement, product development, benchmarking, and industry analysis, and Pretorin retains a perpetual, irrevocable, royalty-free license to use such anonymized data even after termination of your account
• Perform necessary backups, security scans, and technical maintenance

Pretorin will NOT:

• Use Your Content to train AI models without explicit written consent
• Share Your Content with third parties except as required to provide the Service or as required by law
• Use identifiable customer data for marketing without permission
• Retain Your Content longer than necessary after account termination, except as required by law

5.5 Feedback

If you provide suggestions, ideas, enhancement requests, or other feedback regarding the Service ("Feedback"), you grant Pretorin a perpetual, irrevocable, worldwide, royalty-free license to use, modify, and incorporate such Feedback into the Service or any Pretorin product without obligation or compensation to you. Feedback does not constitute Your Content.

5.6 AI-Generated Content Limitations and Responsibilities

IMPORTANT NOTICE: The Service uses artificial intelligence to assist with compliance documentation generation. You acknowledge and agree that:

• AI Assistance Only: AI-generated content is advisory and assistive in nature. It does NOT constitute legal advice, audit opinions, or certification.
• No Guarantee of Accuracy: While we strive for accuracy, AI may produce incomplete, incorrect, or outdated information. All AI outputs must be reviewed by qualified personnel.
• Your Responsibility: You are solely responsible for verifying accuracy of all AI-generated documentation; ensuring compliance with applicable regulations and standards; reviewing and approving all materials before submission to auditors or regulatory bodies; and, maintaining qualified compliance personnel to oversee the Service's use.
• No Liability for AI Errors: Pretorin is not liable for any compliance failures, audit findings, certification denials, or penalties resulting from reliance on AI-generated content.
• Professional Review Required: AI outputs should be reviewed by qualified compliance professionals, legal counsel, or auditors before use in official submissions.

6. Intellectual Property

6.1 Pretorin Intellectual Property

Pretorin retains all right, title, and interest in and to:

• The Service platform, infrastructure, and underlying technology
• All software, source code, object code, algorithms, and methodologies
• All artificial intelligence models, model weights, model parameters, training data, machine learning algorithms, neural network architectures, and fine-tuned configurations
• All proprietary processes, techniques, know-how, and trade secrets used to provide the Service
• All improvements, enhancements, modifications, and derivative works of the above
• All OSCAL templates, compliance frameworks, and automation logic proprietary to Pretorin
• Aggregated, anonymized data and insights derived from use of the Service
• All trademarks, service marks, trade names, logos, and branding

Nothing in these Terms transfers ownership or grants any license to Pretorin's proprietary technology, algorithms, or methodologies beyond the limited right to use the Service as intended. You receive a limited, non-exclusive, non-transferable license to use the Service in accordance with these Terms.

6.2 Prohibited Activities

You expressly agree NOT to:

• Reverse engineer, decompile, disassemble, or attempt to derive source code or algorithms from the Service
• Use the Service to develop competing products or services
• Benchmark or conduct competitive analysis without written consent
• Extract, scrape, or harvest AI models, training methodologies, or system prompts
• Access the Service to build a similar or competitive service
• Copy, reproduce, modify, distribute, sell, lease, or create derivative works of any part of the Service or Pretorin's proprietary frameworks or templates
• Attempt to isolate, identify, or extract any component of our AI models
• Use knowledge gained from the Service to circumvent or replicate our technology

6.3 Confidential and Proprietary Information

You acknowledge that the Service contains trade secrets and confidential proprietary information of Pretorin. You agree to:

• Maintain the confidentiality of any non-public aspects of the Service
• Not disclose system architecture, API specifications, or technical implementation details
• Implement reasonable security measures to prevent unauthorized access
• Not use Pretorin's confidential information for any purpose other than using the Service as authorized

7. Payment and Billing

If you subscribe to a paid plan:

• Fees are billed in advance on a monthly or annual basis and subscriptions automatically renew for successive periods of the same duration unless you cancel before the renewal date
• All fees are non-refundable except as required by law
• We may change pricing with 30 days' notice before your next billing cycle
• Failure to pay may result in suspension or termination of access
• Overdue amounts accrue interest at the lesser of 1.5% per month or the maximum rate permitted by applicable law
• You are responsible for all applicable taxes, duties, and government levies (excluding taxes based on Pretorin's net income)

8. Service Availability

We strive to maintain high availability but do not guarantee uninterrupted access. The Service may be temporarily unavailable for maintenance, updates, or circumstances beyond our control. We will provide reasonable notice of planned maintenance when possible.

9. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

We do not warrant that:

• The Service will meet your specific requirements
• The Service will be uninterrupted, timely, secure, or error-free
• AI-generated content will be accurate or suitable for any particular purpose
• Use of the Service will result in successful compliance certification

COMPLIANCE DISCLAIMER: The Service is a tool to assist with compliance documentation and does NOT guarantee compliance certification, audit passage, or regulatory approval. Compliance is your responsibility.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, PRETORIN SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR REVENUES, WHETHER INCURRED DIRECTLY OR INDIRECTLY, OR ANY LOSS OF DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES.

Our total liability for any claims arising from these Terms or the Service shall not exceed the amount you paid us in the twelve (12) months preceding the claim.

Specific Exclusions: Our liability limitations include but are not limited to:

• Failed audits or compliance certifications
• Loss of government contracts or business opportunities
• Regulatory fines or penalties
• Reputational harm or business interruption
• Inaccurate AI-generated content
• Third-party claims based on Your Content

Exception: Nothing in these Terms limits liability for:

• Death or personal injury caused by negligence
• Fraud or fraudulent misrepresentation
• Willful misconduct or gross negligence
• Violations that cannot be limited under applicable law

11. Indemnification

You agree to indemnify, defend, and hold harmless Pretorin and its officers, directors, employees, and agents from any claims, damages, losses, liabilities, and expenses (including reasonable attorneys' fees) arising from: (a) your use of the Service; (b) Your Content, including any claim that Your Content infringes third-party intellectual property rights; (c) your violation of these Terms; (d) your misuse or misrepresentation of AI-generated outputs; or (e) your failure to comply with applicable laws or regulations in connection with your use of the Service.

12. Termination

You may terminate your account at any time through the account settings or by contacting support. We may terminate or suspend your access immediately, without prior notice, for any reason, including breach of these Terms.

12.1 Effect of Termination

Upon termination:

• Your right to use the Service ceases immediately
• All licenses granted to you immediately cease
• You must cease all use of the Service and delete or destroy all copies of Pretorin materials in your possession
• You may request export of Your Content before termination
• Your Content will be deleted within 30 days unless you export it or law requires retention
• We may retain certain information as required by law or for legitimate business purposes
• Sections 5.4 (Data Processing and Usage Rights), 5.5 (Feedback), 6 (Intellectual Property), 9 (Disclaimer of Warranties), 10 (Limitation of Liability), 11 (Indemnification), 14 (Governing Law), and 17 (Security) survive termination

13. Changes to Terms

We may modify these Terms at any time. We will notify you of material changes via email or through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the modified Terms.

14. Governing Law

These Terms shall be governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to its conflict of law provisions. Any dispute arising from these Terms that cannot be resolved through good-faith negotiation within thirty (30) days shall be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules. The arbitration shall be conducted in Wilmington, Delaware by a single arbitrator. Judgment on the arbitration award may be entered in any court of competent jurisdiction. Either party may seek injunctive or other equitable relief in the state or federal courts of Delaware to protect its intellectual property or confidential information.

15. Miscellaneous

• Entire Agreement: These Terms constitute the entire agreement between you and Pretorin regarding the Service.
• Severability: If any provision is found unenforceable, the remaining provisions continue in effect.
• Waiver: Failure to enforce any right does not waive that right.
• Assignment: You may not assign these Terms without our consent. We may assign our rights and obligations.
• Force Majeure: Pretorin is not liable for failure or delay in performance caused by circumstances beyond our reasonable control, including acts of God, war, terrorism, natural disasters, government actions, labor disputes, or network/infrastructure failures.
• Independent Contractors: The parties are independent contractors. These Terms do not create a partnership, joint venture, agency, or employment relationship.

16. Customer Representations and Warranties

You represent and warrant that:

• You have full authority to enter into these Terms and bind your organization
• Your use of the Service complies with all applicable laws and regulations
• Your Content does not infringe third-party intellectual property rights
• You have obtained all necessary rights and consents to upload Your Content
• You will not use the Service for any unlawful or unauthorized purpose
• Information you provide during registration and use is accurate and current
• You are not located in, under the control of, or a national or resident of any embargoed country
• You are not on any U.S. Government denied party list

Breach of these representations may result in immediate termination without refund.

17. Security and Data Breach Notification

17.1 Security Measures

Pretorin implements commercially reasonable technical and organizational measures to protect Your Content, including encryption, access controls, and security monitoring. However, no system is completely secure.

17.2 Customer Security Obligations

You are responsible for:

• Maintaining secure account credentials and access controls
• Configuring appropriate permissions for users in your organization
• Monitoring your account for suspicious activity
• Implementing security measures required by your industry or contracts

17.3 Incident Notification

In the event of a confirmed security incident affecting Your Content, Pretorin will:

• Notify you without unreasonable delay upon confirmation
• Provide available information about the nature and scope of the incident
• Take reasonable steps to mitigate the incident and prevent recurrence
• Cooperate with your investigation as reasonably requested

17.4 Limitation

Pretorin is not liable for security incidents resulting from your actions, including weak passwords, credential sharing, or failure to implement multi-factor authentication.

18. Export Controls and Regulatory Compliance

18.1 Export Compliance

The Service and related technology may be subject to U.S. export control laws, including the Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR). You agree to:

• Comply with all applicable export control laws and regulations
• Not access the Service from embargoed countries or restricted territories
• Not provide access to the Service to individuals on denied party lists
• Obtain any necessary export licenses before using the Service for controlled purposes

19. AI Data Processing and Customer Controls

This section describes how the Service uses artificial intelligence, what choices you have about that use, and how AI-related data is handled and retained. It supplements Sections 5.2 and 5.6 and controls in the event of any inconsistency with them.

19.1 Which Features Are AI-Driven

The following capabilities use AI models to process Your Content. All of them are optional and can be disabled under Section 19.2:

• Narrative and document drafting: control implementation narratives, system scope narratives, inherited and shared-responsibility narratives, policy document generation, document section enhancement, and targeted text refinement
• Analysis and review: control posture analysis and gap identification, independent policy and scope review, risk summarization, third-party and vendor questionnaire scoring, and accessibility (Section 508 / VPAT) conformance assessment
• Evidence and audit support: evidence-to-control mapping suggestions and audit procedure recommendations
• Framework-specific drafting: CMMC and SPRS remediation advisory, CCI implementation narratives, and POA&M mitigation text
• Conversational assistance: the dashboard AI assistant, which answers questions about your compliance state
• Semantic search (RAG): vector embeddings generated from your uploaded documents and evidence text so that the features above can retrieve relevant context

Non-AI functionality — including control tracking, evidence storage, document management, the auditor portal, deterministic scoring, reporting, and API access — does not depend on these features and remains fully available if you opt out.

19.2 Opting Out of AI-Driven Features

You may opt out of AI-driven features at the organization level. Opting out is available through either of the following channels:

• Self-service setting: an organization owner or administrator can disable AI feature processing in the Service under Settings → AI Feature Processing. The change applies to your entire organization and takes effect for subsequent AI requests.
• Written request: you may instead request an opt-out by emailing [email protected] or by using the contact form on our website.

Effect of opting out. While your organization is opted out, the Service does not perform AI processing for your organization. AI requests are blocked at a single enforcement point ahead of any model provider, so no AI feature will transmit Your Content to a model provider, and the AI features listed in Section 19.1 are unavailable to all users in your organization. Existing content that was previously generated with AI assistance is retained and remains editable by you.

Timing. Pretorin will give effect to a validated opt-out request within five (5) business days. The self-service setting normally takes effect within minutes.

Record of requests. Each change to your organization's AI opt-out status is recorded in an immutable audit log, including the requesting user and the time of the change. Opting out carries no penalty, price change, or reduction in non-AI functionality. You may re-enable AI features at any time using the same setting.

Opting out of AI-driven features is separate from, and in addition to, our commitment in Section 19.4 that Your Content is never used to train or fine-tune AI models. That commitment applies whether or not you opt out.

19.3 Choosing Your AI Model

If you do not opt out entirely, you retain a narrower choice: an organization owner or administrator may select which approved model backs your AI features under Settings → AI Models. Where a selection is not made, the Service applies a documented default model. Available models are limited to entries in Pretorin's governed model catalog.

19.4 How Your Content Is Processed by AI

• Inference only; no training. Pretorin performs no model training or fine-tuning on Your Content. We operate no training pipelines, training datasets, or model checkpoints. Your Content is used only to produce a response to a specific request you initiate.
• Third-party model providers. AI processing is performed by third-party hosted model providers acting as our subprocessors — currently OpenAI as the primary provider, with Microsoft Azure OpenAI as a failover provider. A reserved open-weight failover tier, accessed through OpenRouter, may be used for batch policy-document generation only; because that route reaches third-party-hosted model weights, we treat it as third-party data egress and hold it in reserve. Our providers do not use content submitted through their APIs to train or improve their models under the terms applicable to our accounts.
• No-store instruction. On every AI request we instruct the provider not to store the request or response in provider-side application state.
• Provider abuse-monitoring caveat. You should be aware that our primary provider may nonetheless retain request content transiently for abuse and misuse monitoring, currently for up to thirty (30) days, unless a zero-retention arrangement is separately approved and enabled for our account. Pretorin does not currently represent that a formal Zero Data Retention arrangement is in place. If your regulatory obligations require zero provider-side retention or a specific processing boundary, contact us to discuss deployment options before submitting regulated content.
• Tenant isolation. Every AI request, retrieval operation, and audit record is scoped to a single organization. The Service does not share AI context, prompts, or embeddings across customers.
• Aggregated data. Any use of anonymized, aggregated data under Section 5.4 excludes use of Your Content to train or fine-tune AI models.

19.5 AI Data Retention

Retention differs by category of AI-related data:

• Prompt content and model output: transient. Sent to the provider with a no-store instruction and not persisted in Service application state, subject to the provider abuse-monitoring caveat in Section 19.4.
• AI run audit metadata: retained on a rolling twelve (12) month target. This record contains the model and version, prompt identifier and version, cryptographic (SHA-256) hashes of the input and output rather than the underlying text, the reported confidence value, the tool-call trace, and the chain of any human overrides.
• Semantic search embeddings: retained for the life of your account or the life of the source record, and deleted when you delete the source document or evidence item, or when your organization is deleted.

19.6 Human Review of AI Output

No AI output is automatically applied to a compliance record. Every AI-produced artifact is created as a draft that a user in your organization must review and explicitly accept before it becomes part of your record of truth. Creating a draft never advances a control to an approved or completed state; that promotion is always a human action and is captured in the audit log. Where the Service's own confidence signal for an output falls below a defined threshold, the output is additionally flagged and gated from streamlined approval and export. These controls reduce but do not eliminate the risks described in Sections 5.6 and 9, and they do not shift responsibility for review away from you.

19.7 Changes to AI Data Processing

Pretorin's privacy lead, accountable to our chief executive, owns these AI disclosures and keeps them consistent across the Terms, the Privacy Policy, and our other customer-facing materials. We review them before any release that changes how AI processes Your Content, and at least annually. Where a change to AI data handling is material to you, we will notify impacted customers at least thirty (30) days before it takes effect where feasible. If a change to AI data handling is unacceptable to you, you may opt out under Section 19.2 or terminate under Section 12.

20. Audit Rights

20.1 Pretorin Audits

Pretorin may conduct periodic audits to verify compliance with these Terms, including use within authorized scope and proper licensing.

20.2 Third-Party Audits

For customers subject to regulatory requirements:

• Pretorin will reasonably cooperate with your auditors or assessors
• You must provide reasonable notice and schedule audit activities
• Auditors must sign confidentiality agreements
• Audit costs are your responsibility unless otherwise agreed

20.3 SOC 2 / Security Certifications

Information about Pretorin's security certifications and audit reports may be requested through appropriate channels and subject to confidentiality obligations.

21. Contact Information

For questions about these Terms of Service, please contact us through the contact form on our main website at www.pretorin.com.