AccuSights Terms of Service

© 2026 AccuSights, Inc. · 2058 N. Western Ave, Chicago, IL 60647 · +1 (773) 747-7490 · [email protected] (subject "ATTN: Legal Notice")

Plain-language summary (not part of the agreement)

This box is a courtesy. If it differs from the numbered sections below, the numbered sections control.

• Who you are contracting with. These Terms are with AccuSights, Inc. (a Delaware corporation) for the AccuSights platform, Assess, Comply, CMMC Accelerator, AI Governance, Secure Office, Continuous Compliance and related professional services. Managed security (SOC/MDR and vCISO, together "Protect") is sold only by AccuSights LLC under a separate, signed Protect Services Agreement. The two companies are separate; neither is liable for the other.
• How you agree. You accept these Terms by checking the box at signup or by signing an Order Form that references them. The person accepting must have authority to bind your organization.
• What you buy is on the Order Form. Services, quantities, fees and term live on the Order Form. Your purchase-order terms do not apply.
• Billing. Fees are due net 30 (or charged to your card on file). Subscriptions renew automatically for the same term unless you give 30 days' notice. Renewal price increases are capped at 5% unless your Order Form says otherwise.
• We are not a regulator, certifier or auditor. We are not a C3PAO, DoD, the Cyber AB, HHS/OCR, the PCI SSC, the AICPA or an ISO certification body. Our readiness deliverables are point-in-time and informational, not legal advice, and we cannot guarantee that you will pass any assessment or audit. Your compliance decisions, SPRS scores and affirmations are yours.
• Readiness Re-Performance Commitment. If, within 6 months after we deliver a Readiness Completion Report marking a control "Ready," your formal assessor finds that control deficient, we will re-perform the readiness work for that control at no charge, subject to the conditions in Section 11. That is the exclusive remedy; there are no refunds or assessor-fee reimbursements.
• Our liability is capped. Each party's total liability is limited to the fees you paid or owe for the specific Offering at issue in the 12 months before the event (or US $1,000 for free or trial use). Neither party is liable for indirect or consequential damages. Standard carve-outs (fraud, willful misconduct, gross negligence, payment, indemnity, IP) apply.
• Your data. You own your data. Do not upload CUI unless you have ordered a CUI-capable enclave, and do not give us PHI unless we have signed a Business Associate Agreement. You can export your data for 30 days after termination; we delete it after 60 days.

1. Parties; Entity Map; Acceptance

1.1 Parties. These Terms of Service (these "Terms") are a binding agreement between AccuSights, Inc., a Delaware corporation with its principal office at 2058 N. Western Ave, Chicago, IL 60647 ("AccuSights," "we," "us" or "our"), and the person or legal entity identified in the account registration or an Order Form ("Customer," "you" or "your"). These Terms, together with each Order Form, each Service Schedule, the DPA and the Policies, form the "Agreement."

1.2 Entity map; AccuSights LLC; AccuSights UAE. AccuSights, Inc. is the contracting party for the Platform, AccuSights Assess, AccuSights Comply, CMMC Accelerator, AI Governance, Secure Office, Continuous Compliance, Professional Services, Trials and the Empower Partner Program (collectively, the "Inc. Offerings"). AccuSights LLC, an Illinois limited liability company and wholly owned subsidiary of AccuSights, Inc., is the sole contracting party for AccuSights Protect (SOC-as-a-Service / managed detection and response, and vCISO / CISO-as-a-Service) (the "Protect Offerings"), which are provided only under the separate AccuSights LLC Protect Services Agreement (the "Protect Services Agreement"). These Terms do not govern the Protect Offerings, and an Order Form under these Terms cannot add a Protect Offering. AccuSights Technology Consultants LLC (Dubai, United Arab Emirates), doing business as AccuSights UAE, operates accusights.ae and AccuSights' UAE operations. It is a separate legal entity and a separate data controller for personal data collected through accusights.ae and UAE operations; it is not a party to this Agreement or to any agreement with AccuSights, Inc. or AccuSights LLC's customers under the U.S. agreements, and neither AccuSights, Inc. nor AccuSights LLC is liable for its acts, omissions or obligations.

1.3 No joint liability. AccuSights, Inc. and AccuSights LLC are separate legal persons and separate contracting parties. Neither entity is liable for, guarantees, or assumes the obligations of the other; a breach or default by one entity is not a breach or default by the other; and no claim against one entity may be asserted against, or offset against amounts owed to, the other. Nothing in this Agreement makes either entity the agent of the other except as stated in Section 1.4.

1.4 Billing agent. Customer acknowledges that AccuSights, Inc. may act as billing and collection agent for AccuSights LLC, so that invoices for Protect Offerings may be issued by, and payments remitted to, AccuSights, Inc. on behalf of AccuSights LLC. Acting as billing agent does not make AccuSights, Inc. a party to the Protect Services Agreement or liable for the Protect Offerings.

1.5 Acceptance. Customer accepts these Terms, and the Agreement becomes effective, on the earliest of: (a) the date Customer (or an individual acting on Customer's behalf) checks the acceptance box during account registration or in-Service re-acceptance ("I have read and agree to the AccuSights Terms of Service, Acceptable Use Policy and Privacy Policy (Version 2026.10)."); (b) the effective date of an Order Form that references these Terms; or (c) the date Customer first accesses or uses any Service. If you do not agree to these Terms, do not register, access or use the Services.

1.6 Authority. The individual accepting these Terms represents and warrants that he or she (a) is at least 18 years old, (b) has full legal authority to bind Customer to this Agreement, and (c) has provided accurate identifying information for Customer. If the individual lacks that authority, that individual is personally bound as "Customer."

1.7 Version. These Terms are Version 2026.10. The exact text of each version, with its SHA-256 fingerprint, is archived at accusights.com/legal/archive and recorded in AccuSights' acceptance log at the time of acceptance. The version that governs an Order Form is the version identified in that Order Form.

1.8 Electronic transactions. The parties agree to conduct this transaction by electronic means, and agree that electronic records, click-through acceptances, typed signatures and in-Service signatures satisfy any requirement that the Agreement be in writing or signed, under the federal Electronic Signatures in Global and National Commerce Act and the Illinois Uniform Electronic Transactions Act (815 ILCS 333).

2. Definitions

Capitalized terms have the meanings given here or where first used in bold.

"Affiliate" means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of more than 50% of the voting interests.

"AI Tools" means artificial-intelligence and machine-learning features made available within the Services, including features powered by third-party foundation models, and "AI Output" means content generated by AI Tools.

"Authorized User" means an employee, contractor or agent of Customer (or, for MSP-Purchased Subscriptions, of the End Customer) whom Customer authorizes to use the Services under Customer's account.

"BAA" means the AccuSights Business Associate Agreement, if and when executed by Customer and the applicable AccuSights entity.

"CUI" means Controlled Unclassified Information as defined in 32 C.F.R. Part 2002, including Federal Contract Information that constitutes CUI, and any information marked or required to be handled as CUI.

"Customer Data" means all data, documents, evidence, configurations, credentials, logs, assessment responses and other content that Customer or its Authorized Users upload to, connect to, or make available through the Services, and the results of processing that content for Customer.

"Customer-Responsible Event" has the meaning in Section 13.

"Deliverables" means reports, gap assessments, system security plans, policies, plans of action and milestones, readiness reports, roadmaps, templates and other work product that AccuSights delivers to Customer under a Service Schedule, SOW or Order Form.

"De-identified Data" means data derived from Customer Data or usage of the Services from which all identifiers of Customer, its Authorized Users and any natural person have been removed such that the data cannot reasonably be used to identify Customer or any individual.

"Documentation" means AccuSights' then-current user guides, service descriptions and Service Schedules for the Services.

"DPA" means the AccuSights Data Processing Addendum posted at accusights.com/legal/dpa, as updated in accordance with Section 18.

"End Customer" means, for an MSP-Purchased Subscription, the organization for whose benefit an MSP purchases and administers the Services.

"Fees" means the amounts payable for the Services as stated in an Order Form, SOW or the applicable price list.

"MSP" means a managed service provider, managed security service provider or other IT services firm that purchases Services for use on behalf of one or more End Customers.

"Offering" means a distinct Service line identified in the Order Form or Documentation (for example, the Platform, Assess, Comply, CMMC Accelerator, AI Governance, Secure Office, Continuous Compliance, or a Professional Services engagement).

"Order Form" means an ordering document (including an in-Service "Add Service" order, an order addendum, or an executed AccuSights Order Form template) that references these Terms and is accepted by both parties electronically or in writing.

"Partner" means a participant in the AccuSights Empower Partner Program.

"PHI" means protected health information as defined at 45 C.F.R. § 160.103.

"Policies" means the AccuSights Acceptable Use Policy, Privacy Policy, Cookie Notice, Subscription, Renewal, Cancellation & Refund Policy (the "Refund Policy"), Vulnerability Disclosure Policy and other policies posted at accusights.com/legal, each as updated in accordance with Section 18.

"Readiness Completion Report" means a Deliverable so titled in which AccuSights records, for each in-scope control, a status of "Ready," "Not Ready" or "Risk Accepted."

"Risk Acceptance" has the meaning in Section 12.4.

"Security Breach" means a confirmed unauthorized access to, or acquisition, disclosure, alteration or destruction of, Customer Data in AccuSights' possession or control caused by AccuSights' breach of its security obligations under Section 8.6 or the DPA.

"Service Schedule" means an AccuSights-published description of an Offering, including its scope, features, limits and any Offering-specific terms, that is identified in an Order Form or the Documentation.

"Services" means the Platform, the Offerings ordered by Customer, Deliverables, Documentation, support and any related services AccuSights provides under this Agreement, but excludes the Protect Offerings.

"SOW" means a statement of work for Professional Services that references these Terms.

"Subscription" means Customer's right to access and use an Offering for the Subscription Term stated in the Order Form.

"Subscription Term" means the initial term stated in an Order Form and each Renewal Term.

3. The Services

3.1 Platform. The AccuSights platform (the "Platform") is a hosted software-as-a-service application, including the customer portal, integrations, evidence collection, control mapping, dashboards, AI Tools and the website at accusights.com and its subdomains. Customer controls which systems, integrations, evidence and information it connects to or provides through the Platform.

3.2 AccuSights Assess. "Assess" comprises cyber-risk and data-protection assessments, including risk assessments, gap analyses, vulnerability and configuration reviews, and executive reporting, as described in the applicable Service Schedule.

3.3 AccuSights Comply. "Comply" comprises compliance-readiness and continuous-compliance services for frameworks including CMMC 2.0, NIST SP 800-171, HIPAA, SOC 2, ISO/IEC 27001, PCI DSS, GDPR, NIS2 and financial-sector GRC frameworks (FFIEC and related guidance), including control mapping, evidence guidance, policy templates, remediation tracking and readiness reporting.

3.4 CMMC Accelerator. "CMMC Accelerator" is a packaged Comply engagement focused on CMMC 2.0 and NIST SP 800-171 readiness, including scoping guidance, SSP and POA&M support, and a Readiness Completion Report. CMMC Accelerator is a readiness service only and is subject to Section 10.

3.5 AI Governance. "AI Governance" comprises assessment and program-development services for Customer's use of artificial intelligence, mapped to frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001, including inventories, policies and risk registers.

3.6 Secure Office. "Secure Office" comprises baseline security-hardening and configuration services for small and mid-sized organizations (for example, identity, email and endpoint baseline configuration guidance and validation), as described in the Service Schedule. Secure Office is not a managed security service and does not include monitoring, detection or response.

3.7 Continuous Compliance. "Continuous Compliance" is a Subscription under which the Platform continuously collects evidence, monitors control status and compliance metrics, and surfaces drift and remediation tasks. Continuous Compliance monitors compliance posture; it does not monitor for, detect or respond to security threats or incidents.

3.8 Professional Services. "Professional Services" means consulting, implementation, remediation-support, training and similar services performed under an SOW or Order Form on a fixed-fee, milestone or time-and-materials basis.

3.9 Trials and free use. AccuSights may offer any Service on a free, trial, beta, evaluation or reduced-fee basis ("Trial"). A Trial begins on first access and ends on the earliest of the stated Trial period, the start of a paid Subscription for the same Offering, or termination by AccuSights at any time on notice. Trials are provided "AS IS" without warranty, support commitment or service level, may be limited in features or capacity, and AccuSights may delete Trial data at the end of the Trial without further notice. Section 16.2(b) applies to Trials.

3.10 Changes to Services. AccuSights may update, add, modify or discontinue features of the Services during a Subscription Term, provided that AccuSights will not materially reduce the core functionality of a paid Offering during its Subscription Term without providing a materially equivalent substitute. If AccuSights discontinues an Offering entirely and offers no substitute, Customer's sole remedy is termination of the affected Subscription and a pro-rata refund of prepaid, unused Fees for it.

3.11 Support. AccuSights provides support for paid Subscriptions as described in the Documentation. Support is provided in English during AccuSights' business hours (Central Time) unless the Order Form states otherwise.

4. Order Forms; Order of Precedence; Purchase Orders

4.1 Ordering. Customer orders Services by (a) executing an Order Form or SOW, (b) placing an in-Service order or "Add Service" order that generates an Order Form addendum, or (c) purchasing a self-service Subscription in the Platform. Each Order Form identifies the Offerings, quantities or scope, Subscription Term, Fees and billing terms, and is governed by the version of these Terms it references. Customer's Affiliates may purchase under this Agreement by executing their own Order Form, in which case the Affiliate is "Customer" for that Order Form.

4.2 Order of precedence. If documents in the Agreement conflict, the following order controls, highest first: (a) the Order Form or SOW (only as to the Services it covers, and only where it expressly identifies the Section of these Terms it overrides); (b) the applicable Service Schedule; (c) these Terms; (d) the DPA (except that the DPA controls as to the processing of personal data); (e) the Policies. A BAA, once executed, controls as to PHI. Documentation and marketing materials are not part of the Agreement and do not modify it.

4.3 Customer purchase orders and vendor forms. AccuSights may accept Customer's purchase order for administrative convenience only. Any pre-printed, standard, click-through or portal terms in a Customer purchase order, vendor registration form, supplier code, invoice-processing system or similar document are rejected, are void, and do not become part of the Agreement, even if AccuSights acknowledges, signs or performs against the document.

4.4 No modification of signed Order Forms. During its Subscription Term, an executed Order Form or SOW may be changed only by a written amendment or addendum accepted by both parties. Section 18 does not permit AccuSights to change an executed Order Form or SOW unilaterally.

5. Accounts; Authorized Users; MSP-Purchased Subscriptions; Partner-Referred Purchases

5.1 Account registration. Customer must register an account and provide accurate, complete and current registration and billing information and keep it updated. Customer designates one or more administrators ("Admins") who may provision Authorized Users, configure integrations and accept orders on Customer's behalf. Customer is bound by the acts of its Admins and Authorized Users.

5.2 Credentials and security. Customer is responsible for maintaining the confidentiality of all credentials, for enabling multi-factor authentication for all Authorized Users where offered, and for all activity under its account, whether or not authorized by Customer, except to the extent caused by AccuSights' breach of Section 8.6. Customer will notify AccuSights promptly at [email protected] (subject "ATTN: Security") of any suspected unauthorized use of its account.

5.3 Authorized User conduct. Customer will ensure that its Authorized Users comply with this Agreement and the Acceptable Use Policy. Authorized User seats are for named individuals and may be reassigned only when the prior user no longer requires access.

5.4 MSP-Purchased Subscriptions. An MSP may purchase Subscriptions for use on behalf of End Customers ("MSP-Purchased Subscriptions"). For each MSP-Purchased Subscription: (a) the MSP is "Customer" under this Agreement and is solely responsible to AccuSights for Fees, for the End Customer's and its users' compliance with this Agreement, and for all Customer Data uploaded on the End Customer's behalf; (b) the MSP represents that it has authority from the End Customer to procure the Services, to connect the End Customer's systems, and to grant AccuSights the rights in this Agreement with respect to the End Customer's data; (c) the MSP will ensure that the End Customer is bound by terms at least as protective of AccuSights as this Agreement, and AccuSights is an intended third-party beneficiary of those terms; (d) AccuSights may, but is not obligated to, provide support directly to an End Customer at the MSP's request; (e) the End Customer is not a party to this Agreement and has no claims against AccuSights under it except as stated in a direct agreement between AccuSights and the End Customer; and (f) AccuSights is not responsible for the MSP's services, configurations, advice, pricing or representations to the End Customer.

5.5 Partner-referred purchases (Empower). Customer may have been referred to AccuSights by a Partner in the AccuSights Empower Partner Program, and a Partner may receive a commission on Customer's purchases. A Partner is an independent business; it is not AccuSights' agent, has no authority to bind AccuSights, quote non-published pricing, or make any representation or warranty about the Services, and AccuSights is not responsible for the Partner's statements, services or advice. This Agreement is solely between Customer and AccuSights, and any separate agreement between Customer and a Partner is solely between them. Customer may ask AccuSights at any time whether a Partner is attributed to its account. Where a Partner delivers Assess or Comply engagements in the Platform for Customer (a Platform Partner), the Partner, not AccuSights, is responsible for the professional judgment exercised in that engagement unless AccuSights has agreed in an Order Form to deliver the engagement itself.

6. Fees; Billing; Renewal; Taxes

6.1 Fees. Customer will pay the Fees stated in each Order Form or SOW, or, for self-service purchases, the then-current published price at the time of purchase. Except as expressly stated in this Agreement or the Refund Policy, all Fees are non-cancellable and non-refundable, and quantities purchased may not be decreased during a Subscription Term.

6.2 Invoicing and payment. Unless the Order Form states otherwise, (a) Subscription Fees are invoiced annually in advance, (b) Professional Services Fees are invoiced per the milestones stated in the SOW, and (c) invoiced amounts are due within thirty (30) days of the invoice date in U.S. dollars. Where Customer has provided a payment card or ACH authorization ("Payment Method"), Customer authorizes AccuSights (including as billing agent for AccuSights LLC) to charge the Payment Method for all Fees when due, including renewal Fees and true-up charges. Customer will keep its Payment Method current. Payments are made without setoff, deduction or counterclaim.

6.3 Late payment. Amounts not paid when due accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law, from the due date until paid. If any undisputed amount remains unpaid ten (10) days after its due date, AccuSights may, on written notice, suspend Customer's access to the Services (and, as billing agent, may notify AccuSights LLC to do the same for the Protect Offerings under the Protect Services Agreement) until all past-due amounts are paid. Customer will reimburse AccuSights' reasonable costs of collection, including attorneys' fees, for amounts not paid within thirty (30) days after the due date.

6.4 Good-faith disputes. Customer may withhold a disputed amount only if, before the due date, it notifies AccuSights in writing of the specific amount disputed and the basis for the dispute, pays all undisputed amounts, and cooperates diligently to resolve the dispute within thirty (30) days.

6.5 Overuse and true-up. Fees for Subscriptions purchased for a limited quantity or scope (for example, number of users, endpoints, frameworks, entities, integrations or assessments) are reconciled against actual usage at least at the end of each billing period. If Customer's usage exceeds the purchased quantity or scope, AccuSights may invoice the excess at the per-unit rate in the Order Form or, if none, AccuSights' then-current list price, pro-rated for the remainder of the Subscription Term, and Customer's purchased quantity is increased accordingly for the remainder of the Subscription Term and any Renewal Term. Overage charges are payable within thirty (30) days of invoice, or fourteen (14) days of notice where no invoice is otherwise scheduled. Deployment of a license in an environment other than the one it is purchased for (for example, a workstation license on a server) is an overuse chargeable at list price.

6.6 Automatic renewal. Each Subscription automatically renews at the end of its Subscription Term for successive periods equal in length to the expiring term (each, a "Renewal Term") unless either party gives the other written notice of non-renewal at least thirty (30) days before the end of the then-current Subscription Term. Customer may give non-renewal notice through the account settings page in the Platform or by email to [email protected] (subject "ATTN: Legal Notice"). AccuSights will send Customer a renewal reminder, identifying the renewal date and the renewal Fees, at least forty-five (45) days before the end of any Subscription Term of twelve (12) months or longer.

6.7 Renewal pricing. Fees for a Renewal Term will not increase by more than five percent (5%) over the Fees for the immediately preceding Subscription Term for the same quantities and scope, unless the Order Form states a different cap or a different price, or the renewal adds Offerings, quantities or scope. AccuSights will notify Customer of any renewal price increase no later than the renewal reminder under Section 6.6.

6.8 Taxes. Fees exclude all sales, use, value-added, goods and services, withholding, excise and similar taxes, duties and levies ("Taxes"). Customer is responsible for all Taxes arising from its purchases other than taxes on AccuSights' net income. If AccuSights is required to collect Taxes, it will invoice them and Customer will pay them unless Customer provides a valid exemption certificate. If Customer must withhold any Tax from a payment, Customer will gross up the payment so that AccuSights receives the full invoiced amount.

6.9 Refunds. Refunds are available only as expressly stated in this Agreement (Sections 3.10, 14.2, 15.2, 17.5(c) and 18.3) or in the Refund Policy. The Readiness Re-Performance Commitment (Section 11) provides re-performance only, not refunds.

7. Intellectual Property; License; Restrictions; Feedback; AI Tools; De-identified Data

7.1 AccuSights ownership. AccuSights and its licensors own all right, title and interest, including all intellectual property rights, in and to the Services, the Platform, the Documentation, the AI Tools, all templates, control libraries, mappings, methodologies, questionnaires, software, know-how and Deliverables (excluding Customer Data and Customer Confidential Information incorporated in them), and all improvements, modifications and derivative works of any of them ("AccuSights Materials"). AccuSights Materials are protected by United States and international copyright, trademark, trade-secret and other laws. Except for the licenses expressly granted in this Agreement, no rights in AccuSights Materials are granted, by implication, estoppel or otherwise.

7.2 License to the Services. Subject to this Agreement and payment of Fees, AccuSights grants Customer a limited, non-exclusive, non-transferable (except under Section 25.1), non-sublicensable, revocable license during the Subscription Term to access and use the Services, within the quantities and scope purchased, solely for Customer's internal business purposes (or, for MSP-Purchased Subscriptions, for the internal business purposes of the identified End Customer).

7.3 License to Deliverables. Subject to payment of the applicable Fees, AccuSights grants Customer a perpetual, non-exclusive, non-transferable (except under Section 25.1) license to use, reproduce and modify Deliverables for Customer's internal compliance and security programs, including to provide them to Customer's auditors, assessors, regulators, insurers, customers and prospective customers in connection with Customer's own compliance activities. Customer may not sell, license or otherwise commercialize Deliverables or AccuSights' templates, or use them to provide services to third parties, except that an MSP may use Deliverables for the End Customer for which they were prepared.

7.4 Restrictions. Customer will not, and will not permit any Authorized User or third party to: (a) copy, modify, translate, or create derivative works of the Services or AccuSights Materials, except as permitted in Section 7.3; (b) reverse engineer, decompile, disassemble or otherwise attempt to derive source code, models, prompts, weights, algorithms or non-public methodologies of the Services; (c) sell, resell, rent, lease, sublicense, distribute, time-share or provide the Services as a service bureau to third parties, except as permitted for MSP-Purchased Subscriptions or under a separate Partner agreement; (d) access the Services to build, train or improve a competing product or service, or for competitive benchmarking; (e) publish or disclose to third parties any performance, benchmark or comparative analysis of the Services without AccuSights' written consent; (f) remove, obscure or alter proprietary notices; (g) use the Services to scan, test, assess or collect data from any system, network or account that Customer does not own or is not expressly authorized to assess; (h) upload or transmit malicious code, or interfere with the integrity or performance of the Services; (i) circumvent usage limits, authentication or security controls; (j) use the Services in violation of the Acceptable Use Policy, applicable law, or third-party rights; (k) frame, mirror or scrape the Services; or (l) use AI Output to develop or train machine-learning models. On AccuSights' request, Customer will promptly delete any materials obtained in breach of this Section.

7.5 Authorization to assess. Customer represents and warrants that it owns, or has all necessary rights, consents and authorizations to permit AccuSights to access, scan, assess, collect evidence from and process, every system, network, cloud tenant, account, device and data source that Customer connects to or designates within the Services, including systems hosted by third parties, and that doing so will not violate any law or third-party agreement.

7.6 Feedback. If Customer or any Authorized User provides suggestions, ideas, enhancement requests or other feedback about the Services ("Feedback"), Customer grants AccuSights a perpetual, irrevocable, worldwide, royalty-free, fully paid, sublicensable license to use, disclose, reproduce, modify and commercialize the Feedback for any purpose, without obligation or attribution. Feedback is provided "AS IS," and Customer represents that it is not subject to any third-party right that would restrict AccuSights' use of it.

7.7 AI Tools and AI Output. The Services include AI Tools, some of which are powered by third-party foundation models identified in the DPA subprocessor list. Customer acknowledges and agrees that: (a) AI Output is generated probabilistically, may be inaccurate, incomplete, biased, outdated, or inconsistent with applicable frameworks, and is not a substitute for professional judgment; (b) Customer will review, validate and take responsibility for all AI Output before relying on it, submitting it to an assessor, auditor or regulator, or incorporating it into any policy, SSP, POA&M, attestation, affirmation or filing; (c) AI Output may be similar or identical to output generated for other customers and is not unique to Customer; (d) Customer Data is not used to train AccuSights' or any third party's foundation models; AccuSights accesses its AI subprocessors only through enterprise API terms that prohibit training on customer data; (e) Customer will not input into AI Tools any data that Customer is not permitted to disclose to AccuSights and its subprocessors under this Agreement, including CUI (absent an ordered enclave) and PHI (absent a BAA); and (f) as between the parties and to the extent permitted by law, Customer owns AI Output generated for Customer, subject to AccuSights' rights in the underlying AccuSights Materials and to Section 7.7(c).

7.8 De-identified Data and usage data. AccuSights may collect and use data about the configuration, performance and use of the Services ("Usage Data") and may create and use De-identified Data, in each case to operate, secure, support, benchmark, improve and develop the Services and AI Tools, to produce aggregate industry and threat statistics, and for any other lawful purpose, during and after the Term, provided that AccuSights will not disclose Usage Data or De-identified Data in any form that identifies Customer or any individual. AccuSights retains a perpetual, irrevocable, worldwide, royalty-free license to Usage Data and De-identified Data.

7.9 Third-party components and integrations. The Services may include or interoperate with third-party software, open-source components, endpoint agents, cloud services and integrations ("Third-Party Components"). Third-Party Components are subject to their own license terms, which are identified in the Documentation and which control as to those components. If Customer elects an integration or agent provided by a third party (for example, an endpoint agent), Customer agrees to that provider's terms, AccuSights is not responsible for the Third-Party Component or its provider, and AccuSights makes no warranty regarding it. AccuSights is not responsible for third-party services that Customer connects to the Platform (such as cloud tenants, identity providers or ticketing systems), for their availability, or for changes to their APIs that affect an integration.

7.10 Trademarks. "AccuSights," the AccuSights logo, "Empower," "Compliance into Security," "Security Through Compliance" and the names of the Offerings are trademarks of AccuSights, Inc. Customer may not use them without AccuSights' prior written consent except to identify AccuSights as its provider in a factual manner. Customer will not use any Cyber AB, CMMC, DoD, HHS, PCI SSC, AICPA or ISO marks in connection with Deliverables in a manner that implies that AccuSights or Customer holds a status, accreditation or certification it does not hold. AccuSights is not affiliated with, endorsed by, or accredited by the Cyber AB or DoD.

8. Customer Data; Privacy; Data Protection; CUI and PHI Gates

8.1 Ownership. As between the parties, Customer owns all right, title and interest in Customer Data. AccuSights acquires no rights in Customer Data other than the licenses in this Section 8 and Section 7.8.

8.2 License to Customer Data. Customer grants AccuSights and its subprocessors a non-exclusive, worldwide, royalty-free license during the Term to host, copy, transmit, process, analyze, display and create derivative works of Customer Data solely (a) to provide, secure, support and improve the Services for Customer, (b) to generate Deliverables and AI Output for Customer, (c) to create De-identified Data under Section 7.8, and (d) as otherwise instructed by Customer or required by law.

8.3 Customer responsibility for Customer Data. Customer is solely responsible for the accuracy, quality, legality and completeness of Customer Data, for the means by which it was acquired, and for obtaining all consents, notices and authorizations required to provide Customer Data to AccuSights and to permit the processing described in this Agreement. Customer will not provide AccuSights with any data that Customer is not permitted to disclose.

8.4 Data Processing Addendum. The DPA is incorporated into this Agreement and governs AccuSights' processing of personal data contained in Customer Data. For Customers subject to the California Consumer Privacy Act, AccuSights acts as a "service provider" or "contractor" as described in the DPA. For Customers subject to the EU or UK General Data Protection Regulation, the DPA includes the processor terms required by Article 28 and incorporates the applicable standard contractual clauses.

8.5 CUI Gate. The Services are designed and operated for compliance-readiness work and are not, by default, authorized for the storage, processing or transmission of CUI. Customer will not upload, transmit, store or otherwise make available to AccuSights any CUI, ITAR-controlled technical data, export-controlled technical data or classified information unless and until Customer has ordered, and AccuSights has provisioned, a CUI-capable enclave or offering expressly identified as such in an Order Form (a "CUI Enclave"). Readiness activities under Comply and CMMC Accelerator can be, and by default will be, performed using policies, procedures, configurations, screenshots, control narratives and de-identified or redacted samples that do not themselves contain CUI. If Customer provides CUI to AccuSights outside a CUI Enclave, Customer does so in breach of this Agreement; AccuSights may delete or quarantine the data without liability; and Customer is solely responsible for any resulting incident, notification or contractual consequence with the U.S. Government or its prime contractor. Absent a CUI Enclave, AccuSights does not represent that the Services satisfy DFARS 252.204-7012, NIST SP 800-171 or FedRAMP Moderate-equivalent requirements for a cloud service provider handling CUI.

8.6 Security. AccuSights will maintain a written information-security program with administrative, technical and physical safeguards designed to protect the confidentiality, integrity and availability of Customer Data, as described in the DPA's Security Measures Annex, including encryption of Customer Data in transit and at rest, role-based access control, multi-factor authentication for AccuSights personnel, logging and monitoring of production systems, vulnerability management, and annual independent security testing. AccuSights will notify Customer of a Security Breach in accordance with the DPA.

8.7 PHI Gate; HIPAA. The Services are designed to be performed without AccuSights creating, receiving, maintaining or transmitting PHI. Customer will not upload, transmit or grant AccuSights access to PHI unless the parties have first executed a BAA, in which case the BAA governs AccuSights' handling of PHI. Absent an executed BAA, AccuSights is not a "business associate" of Customer within the meaning of 45 C.F.R. § 160.103, and Customer is solely responsible for any PHI it discloses to AccuSights. Customer acknowledges that it, and not AccuSights, is the covered entity or business associate responsible for its own HIPAA compliance, and that AccuSights does not act as Customer's HIPAA Privacy Official or Security Official (45 C.F.R. § 164.308(a)(2), § 164.530(a)).

8.8 Data location. Customer Data is hosted in the United States (Microsoft Azure, East US 2 region, as primary; Amazon Web Services, U.S. regions) unless the Order Form states otherwise. AccuSights may process Customer Data outside the hosting region for support and subprocessing as described in the DPA.

8.9 Backups; Customer copies. AccuSights maintains backups of the Platform for disaster recovery. Backups are not a substitute for Customer's own retention of its evidence, policies and records. Customer is responsible for maintaining copies of Customer Data and Deliverables it needs for its own records, audits and regulatory obligations.

9. Confidentiality

9.1 Definition. "Confidential Information" means non-public information disclosed by one party ("Discloser") to the other ("Recipient") in connection with this Agreement that is marked confidential or that a reasonable person would understand to be confidential, including, for AccuSights, the AccuSights Materials, pricing, roadmaps and security information, and, for Customer, Customer Data and Customer's security findings. Confidential Information excludes information that Recipient can show (a) was publicly available without breach, (b) was known to Recipient without restriction before disclosure, (c) was received from a third party without restriction and without breach of an obligation to Discloser, or (d) was independently developed without use of Discloser's Confidential Information.

9.2 Obligations. Recipient will (a) use Confidential Information only to perform or receive the Services and exercise its rights under this Agreement, (b) protect it with at least the care it uses for its own similar information and no less than reasonable care, and (c) disclose it only to its and its Affiliates' employees, contractors, professional advisors and (for AccuSights) subprocessors who need to know it and are bound by obligations at least as protective. Recipient is responsible for the acts of those to whom it discloses.

9.3 Compelled disclosure. Recipient may disclose Confidential Information to the extent required by law, regulation, subpoena or court order, provided it gives Discloser prompt notice (where legally permitted), discloses only what is required, and reasonably cooperates with Discloser's efforts to limit or protect the disclosure.

9.4 Duration; return. These obligations last for the Term and five (5) years after, except that obligations for trade secrets and Customer Data last as long as the information remains a trade secret or Customer Data, respectively. On termination and request, each party will return or destroy the other's Confidential Information, subject to Section 17.7 and to retention in routine backups and as required by law.

9.5 Security findings. Customer's vulnerability, assessment and readiness findings are Customer's Confidential Information. AccuSights will not disclose them to any assessor, regulator, insurer or other third party except at Customer's direction or as required by law.

9.6 Equitable relief. A breach of this Section 9 may cause irreparable harm for which damages are inadequate, and the Discloser may seek injunctive relief without posting bond, in addition to other remedies.

10. Compliance-Readiness Terms; Not a Regulator, Certifier or Auditor; Not an MSSP

10.1 Nature of the Services. The Services help Customer identify, organize, implement, evidence and monitor security and compliance controls. They are diagnostic, preparatory, advisory and informational. AccuSights does not certify, accredit, attest to, guarantee or determine Customer's compliance with any law, regulation, framework or standard, and does not guarantee that Customer will achieve any certification, attestation, score, authorization, contract award or audit outcome. Compliance determinations are made only by the applicable regulator, accredited assessor, auditor or certification body, each of which exercises independent judgment that AccuSights cannot control.

10.2 Not a regulator, certifier or auditor. AccuSights is not, and does not act as, (a) the U.S. Department of Defense, the Cyber AB (CMMC Accreditation Body), a CMMC Third-Party Assessment Organization (C3PAO), the Defense Contract Management Agency or DIBCAC; (b) the U.S. Department of Health and Human Services, its Office for Civil Rights, or a HIPAA auditor; (c) the PCI Security Standards Council, a Qualified Security Assessor or an Approved Scanning Vendor; (d) the AICPA or a licensed CPA firm issuing SOC reports; (e) an ISO/IEC accredited certification body; (f) a supervisory authority under GDPR or NIS2; or (g) any other regulator, auditor of record, assessor of record or certification authority. AccuSights is not a C3PAO and is not a Cyber AB Registered Provider Organization, and is not affiliated with, endorsed by, or accredited by the Cyber AB or the U.S. Department of Defense. AccuSights holds itself out only as the provider of the readiness, assessment and platform services described in the Documentation.

10.3 CMMC. For CMMC 2.0 and NIST SP 800-171 Services: (a) AccuSights does not conduct CMMC certification assessments and does not issue CMMC certifications or Level determinations; only DoD determines CMMC status, and only an authorized C3PAO (Level 2) or DIBCAC (Level 3) conducts certification assessments; (b) Customer is solely responsible for its self-assessments, for the accuracy of scores it submits to the Supplier Performance Risk System (SPRS), for the annual and per-assessment affirmations required by 32 C.F.R. Part 170 and DFARS 252.204-7021, and for designating its own "Affirming Official"; no AccuSights person is Customer's Affirming Official or will sign any affirmation, attestation or representation to DoD or a prime contractor on Customer's behalf; (c) Customer acknowledges that, under 32 C.F.R. § 170.8 and the Cyber AB Code of Professional Conduct, an organization that has consulted for a client may not participate in that client's Level 2 certification assessment within three (3) years, and AccuSights will not assess, and Customer will not ask AccuSights or any C3PAO affiliated with AccuSights to assess, any scope on which AccuSights has consulted; (d) AccuSights makes no representation about whether Customer's contracts require CMMC, at what Level, or when; and (e) AccuSights does not use the terms "certify," "pre-certify," "certified-ready" or similar to describe its Services, and Customer will not describe AccuSights' Services or Deliverables to any third party in those terms.

10.4 HIPAA. For HIPAA Services: (a) AccuSights is not a business associate of Customer absent an executed BAA (Section 8.7); (b) AccuSights does not serve as Customer's Privacy Official or Security Official and does not make privacy-rule, breach-risk-assessment, clinical, coding or billing determinations; (c) Customer remains responsible for conducting and documenting its own risk analysis under 45 C.F.R. § 164.308(a)(1)(ii)(A), for its policies, workforce training, breach determinations and notifications, and for its responses to HHS/OCR; and (d) AccuSights' HIPAA Deliverables are inputs to Customer's compliance program, not Customer's compliance program.

10.5 SOC 2, PCI DSS, ISO/IEC 27001 and other attestations. SOC reports are issued only by licensed CPA firms under AICPA attestation standards; PCI Reports on Compliance and Attestations of Compliance are issued only by QSAs or by Customer under PCI SSC rules; ISO/IEC certifications are issued only by accredited certification bodies. AccuSights' readiness Services are separate from, and are not, those attestations. To preserve auditor independence, AccuSights will not perform readiness Services and attestation services for the same Customer and scope, and Customer will select its auditor, assessor or certification body independently. AccuSights may, at Customer's request, introduce Customer to independent assessors, but does not control them, and will disclose in writing any fee-sharing or referral arrangement with an assessor before making an introduction.

10.6 Point-in-time nature. Assessments, scans, findings, scores, gap reports, Readiness Completion Reports and other Deliverables reflect the systems, configurations, evidence and information reviewed as of the date of review, applying the frameworks and interpretations current at that time. They may become inaccurate immediately after delivery because of changes in Customer's environment, personnel, vendors, scope, threat landscape, framework requirements or assessor interpretations. Continuous Compliance reduces, but does not eliminate, this limitation, and reflects only the data sources connected and reporting at the time.

10.7 No legal advice. AccuSights is not a law firm and does not provide legal advice. Deliverables, control mappings, policy templates and AI Output are not legal opinions, and no attorney-client relationship is created. Customer should consult its own counsel about its legal and contractual obligations, including whether particular laws or contract clauses apply to it.

10.8 Not a managed security service provider. The Inc. Offerings, including the Platform, Assess, Comply, CMMC Accelerator, AI Governance, Secure Office and Continuous Compliance, are not managed security services. Under these Terms, AccuSights, Inc. does not provide security monitoring, threat detection, incident response, containment, remediation execution, log management, endpoint protection or security operations, and does not assume custody of, control over, or ongoing operational responsibility for Customer's systems, networks or security infrastructure. Continuous Compliance monitors compliance posture and control status, not security events. Managed security services (SOC-as-a-Service / MDR and vCISO) are provided only by AccuSights LLC, only under the separate Protect Services Agreement, and only when Customer has executed that agreement. Nothing in these Terms creates a duty on the part of AccuSights, Inc. to detect, prevent, contain or respond to any security incident affecting Customer.

10.9 No third-party reliance. Deliverables are prepared solely for Customer's use. Customer may provide Deliverables to its assessors, auditors, regulators, insurers and customers under Section 7.3, but AccuSights owes no duty to, and accepts no liability toward, any person other than Customer, and Customer will not represent to any third party that AccuSights has certified, attested to, or assumed responsibility for Customer's security or compliance posture.

11. Readiness Re-Performance Commitment

11.1 Commitment. If, within six (6) months after AccuSights delivers a Readiness Completion Report under an Assess or Comply engagement (including CMMC Accelerator) stating that the in-scope controls are "Ready," Customer's formal assessment or audit of the same framework and scope by an independent, appropriately accredited or licensed assessor (for example, a C3PAO, a HIPAA auditor, a licensed CPA firm issuing a SOC 2 report, a QSA, or an ISO/IEC 27001 certification body) finds a deficiency in a control that AccuSights marked "Ready," AccuSights will re-perform the readiness Services for the affected controls at no additional charge (the "Readiness Re-Performance Commitment").

11.2 Conditions. The Readiness Re-Performance Commitment applies only if each of the following is true: (a) Customer implemented all AccuSights recommendations relating to the affected controls before the assessment, and recorded no Risk Acceptance on the affected controls; (b) there was no material change to Customer's environment, systems, scope, boundaries, vendors or personnel after the Readiness Completion Report; (c) Customer notifies AccuSights in writing within thirty (30) days after receiving the assessment result and provides AccuSights the assessor's written findings for the affected controls; and (d) the deficiency relates to a control and scope for which AccuSights was engaged and which AccuSights marked "Ready."

11.3 Continuous Compliance subscribers. For Customers with an active Continuous Compliance Subscription, the Readiness Re-Performance Commitment applies throughout the Subscription Term with respect to controls that the Platform reported as "Ready" or "Passing" at the time of the assessment, subject to the same conditions in Section 11.2, for as long as the Subscription remains active and paid.

11.4 Exclusive remedy. Re-performance under this Section 11 is Customer's sole and exclusive remedy, and AccuSights' entire liability, for any deficiency, failed control, non-passing determination, scoring outcome or other result of any assessment, audit or certification. AccuSights does not refund Fees, pay or reimburse assessor, auditor, C3PAO, QSA or certification-body fees, pay for re-assessment, or pay any damages of any kind in connection with an assessment outcome. Nothing in this Section 11 is a guarantee, warranty or representation that Customer will pass, achieve or maintain any certification, attestation, score or compliance status.

11.5 Exclusions. The Readiness Re-Performance Commitment does not apply to (a) findings resulting from assessor discretion or interpretation on matters not addressed in the Readiness Completion Report; (b) changes to a framework, assessment guide or regulatory interpretation after the Readiness Completion Report; (c) any Customer-Responsible Event; (d) controls marked "Not Ready," "Risk Accepted," "Not Applicable" or "Out of Scope"; (e) Trials; or (f) engagements delivered by a Partner rather than by AccuSights.

12. Customer Responsibilities; Customer Risk Acceptance

12.1 General. Customer is responsible for (a) its own security and compliance program and all decisions about it; (b) implementing, funding, operating and maintaining controls; (c) the accuracy, completeness and timeliness of all information, evidence, answers and access it provides; (d) designating a knowledgeable point of contact with authority to make decisions; (e) providing timely access to systems, personnel and evidence; (f) reviewing Deliverables and AI Output before relying on them; (g) maintaining backups, business continuity and incident-response capabilities; (h) its Authorized Users, MSPs, vendors and other third parties; and (i) compliance with laws applicable to its business, including data-protection, export, and government-contracting laws.

12.2 Reliance on Customer information. AccuSights will rely on information, evidence and representations provided by Customer and its personnel without independent verification unless the Service Schedule expressly includes verification. Deliverables are only as accurate as the information on which they are based.

12.3 Timely action. Customer will act on recommendations, alerts and remediation tasks within the timeframes stated in the Deliverable or Platform, and will keep its Platform data (including asset inventories, scope and personnel) current.

12.4 Risk Acceptance mechanism. Any recommendation, finding, remediation task or control requirement that Customer declines, defers, modifies or fails to implement by its stated due date is recorded in the Platform as a "Risk Acceptance," identifying the control, the recommendation, the Customer decision and the Customer individual who made it. Customer may record a Risk Acceptance expressly; a recommendation not implemented within thirty (30) days after its stated due date (or, if none, within sixty (60) days after delivery) is deemed a Risk Acceptance. Customer acknowledges that it alone decides whether to accept a risk, that each Risk Acceptance is Customer's informed business decision, and that AccuSights has no liability of any kind for any consequence of an accepted, deferred or unimplemented recommendation. Risk Acceptances are Customer Confidential Information and are available to Customer in the Platform and on export.

12.5 Cyber insurance. Customer acknowledges that AccuSights is not an insurer, that its Fees are not priced to assume the risk of Customer's security incidents or compliance outcomes, and that Customer is responsible for maintaining cyber-liability and other insurance appropriate to its risk.

13. Customer-Responsible Events

13.1 Definition. "Customer-Responsible Event" means any loss, damage, incident, finding, deficiency, delay or claim to the extent arising from or related to any of the following:

(a) recommendations, remediation tasks or findings that Customer did not implement, implemented late, implemented incorrectly, modified, declined or deferred, including any Risk Acceptance; (b) alerts, notifications, tasks or reports that Customer ignored, did not acknowledge, or did not act on; (c) acts or omissions of Customer's employees, contractors or other insiders, whether negligent or malicious; (d) phishing, social engineering, credential theft, credential sharing, session hijacking or other compromise of credentials or accounts not caused by AccuSights' breach of Section 8.6; (e) misconfiguration of, or changes to, Customer's systems, cloud tenants, identity providers, networks, applications or integrations by Customer or its other vendors; (f) agents, connectors, integrations or telemetry sources that Customer disabled, uninstalled, failed to deploy, or that stopped reporting, and any resulting gaps in data; (g) systems, assets, locations, entities, data or processes that were outside the scope stated in the Order Form, SOW or Platform, or that Customer did not disclose; (h) inaccurate, incomplete, outdated, falsified or misleading inputs, evidence, answers, inventories or representations provided by or on behalf of Customer; (i) end-of-life, end-of-support, unpatched or unsupported hardware, software, firmware or services in Customer's environment; (j) failures, outages, breaches or acts of Customer's other vendors, service providers, cloud providers, MSPs or Partners; (k) Force Majeure Events (Section 25.3); (l) nation-state attacks, zero-day exploits, supply-chain compromises or novel attack techniques that were not detectable or preventable by commercially reasonable means at the time; (m) Customer's provision of CUI or PHI in breach of Section 8.5 or 8.7; (n) Customer's use of the Services in breach of this Agreement or the Acceptable Use Policy; or (o) Customer's failure to maintain backups, business-continuity or incident-response capabilities.

13.2 No liability. AccuSights has no liability of any kind, under any theory, for any Customer-Responsible Event, and Customer-Responsible Events are excluded from the Readiness Re-Performance Commitment, the warranties in Section 14, and AccuSights' indemnification obligations. This Section 13.2 applies before, and independently of, the limitations in Section 16; the cap in Section 16.2 is not consumed by claims arising from Customer-Responsible Events.

13.3 Customer indemnity. Third-party claims arising from Customer-Responsible Events are covered by Customer's indemnity in Section 15.3.

14. Warranties; Disclaimers

14.1 Mutual warranties. Each party represents and warrants that it is duly organized and in good standing, that it has the authority to enter into this Agreement, and that its performance will not violate any agreement by which it is bound.

14.2 AccuSights limited warranty. AccuSights warrants that (a) the paid Services will perform materially in accordance with the Documentation during the Subscription Term, and (b) Professional Services and Deliverables will be performed in a professional and workmanlike manner consistent with generally accepted industry standards for comparable services. Customer must report a breach of this warranty in writing within thirty (30) days after discovery, identifying the nonconformity. Customer's sole and exclusive remedy, and AccuSights' entire liability, for breach of this warranty is, at AccuSights' option, (i) re-performance or correction of the nonconforming Service or Deliverable, or (ii) if AccuSights cannot correct it within a commercially reasonable time, termination of the affected Service and refund of the Fees paid for the nonconforming Service (for Subscriptions, the prepaid Fees for the remainder of the Subscription Term). This warranty does not apply to Trials, to Third-Party Components, or to nonconformities caused by a Customer-Responsible Event.

14.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN SECTION 14.2 AND SECTION 11, THE SERVICES, DELIVERABLES, AI OUTPUT, DOCUMENTATION AND ALL OTHER ACCUSIGHTS MATERIALS ARE PROVIDED "AS IS" AND "AS AVAILABLE," AND ACCUSIGHTS AND ITS AFFILIATES, LICENSORS AND SUPPLIERS DISCLAIM ALL OTHER WARRANTIES, REPRESENTATIONS AND CONDITIONS, EXPRESS, IMPLIED OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, QUIET ENJOYMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING, USAGE OR TRADE. WITHOUT LIMITING THE FOREGOING, ACCUSIGHTS DOES NOT WARRANT THAT (A) THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, SECURE OR FREE OF HARMFUL COMPONENTS; (B) THE SERVICES OR DELIVERABLES WILL IDENTIFY EVERY VULNERABILITY, MISCONFIGURATION, GAP, RISK, THREAT OR NON-COMPLIANCE; (C) CUSTOMER WILL ACHIEVE OR MAINTAIN COMPLIANCE WITH ANY LAW, REGULATION, FRAMEWORK OR STANDARD, OR ANY CERTIFICATION, ATTESTATION, SCORE, AUTHORIZATION OR CONTRACT AWARD; (D) CUSTOMER WILL NOT EXPERIENCE A SECURITY INCIDENT OR REGULATORY ACTION; OR (E) AI OUTPUT WILL BE ACCURATE OR COMPLETE. CUSTOMER ACKNOWLEDGES THAT SECURITY AND COMPLIANCE ARE CONTINUOUSLY EVOLVING, THAT NO ASSESSMENT CAN ENSURE THE SECURITY OR COMPLIANCE OF ANY SYSTEM, AND THAT IT USES THE SERVICES AT ITS OWN RISK. SOME JURISDICTIONS DO NOT ALLOW CERTAIN DISCLAIMERS, IN WHICH CASE THEY APPLY TO THE MAXIMUM EXTENT PERMITTED.

15. Indemnification

15.1 By AccuSights. AccuSights will defend Customer against any claim, suit or proceeding brought by an unaffiliated third party alleging that the Platform or Deliverables, as provided by AccuSights and used in accordance with this Agreement, infringe a United States patent, copyright or trademark or misappropriate a trade secret (an "Infringement Claim"), and will pay damages finally awarded against Customer by a court of competent jurisdiction, or agreed in a settlement approved by AccuSights, in connection with the Infringement Claim.

15.2 Exclusions; remedies. AccuSights has no obligation for an Infringement Claim to the extent arising from (a) Customer Data or Customer materials; (b) modification of the Services by anyone other than AccuSights; (c) combination of the Services with products, data or processes not provided by AccuSights, where the claim would not have arisen without the combination; (d) Third-Party Components; (e) use in breach of this Agreement or after AccuSights has notified Customer to stop; (f) Customer's compliance with AccuSights-disfavored specifications supplied by Customer; or (g) Trials. If the Services are or may become subject to an Infringement Claim, AccuSights may, at its option and expense, (i) procure the right for Customer to continue using them, (ii) modify or replace them with a non-infringing functional equivalent, or (iii) if neither is commercially reasonable, terminate the affected Subscription and refund prepaid, unused Fees. This Section 15 states AccuSights' entire liability, and Customer's exclusive remedy, for infringement or misappropriation claims.

15.3 By Customer. Customer will defend AccuSights, its Affiliates (including AccuSights LLC) and their officers, directors, employees, contractors and agents against any claim, suit, proceeding, investigation or demand brought by a third party (including a regulator, governmental body, End Customer, or Customer's own customers) arising from or related to (a) Customer Data, including any allegation that it infringes or misappropriates a third party's rights, violates law, or was provided without required consents; (b) Customer's violation of applicable law, including data-protection, export, government-contracting, HIPAA, and FTC requirements; (c) Customer's or its Authorized Users' use of the Services in breach of this Agreement or the Acceptable Use Policy, including scanning or assessing systems without authorization; (d) any Customer-Responsible Event; (e) Customer's provision of CUI or PHI in breach of Section 8.5 or 8.7; (f) Customer's representations to third parties about its security or compliance posture, including SPRS scores, affirmations, attestations and certifications; or (g) for MSP-Purchased Subscriptions, any claim by an End Customer, and will pay damages, fines, penalties, costs and attorneys' fees finally awarded or agreed in settlement in connection with such claims.

15.4 Procedure. The indemnified party will (a) give the indemnifying party prompt written notice of the claim (a delay only relieves the indemnifying party to the extent it is prejudiced), (b) give the indemnifying party sole control of the defense and settlement, except that the indemnifying party may not settle in a way that admits fault by, or imposes non-monetary obligations on, the indemnified party without its consent, not unreasonably withheld, and (c) provide reasonable cooperation at the indemnifying party's expense. The indemnified party may participate with its own counsel at its own expense.

16. Limitation of Liability

16.1 Exclusion of damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND EXCEPT FOR EXCLUDED CLAIMS, NEITHER PARTY NOR ITS AFFILIATES, LICENSORS OR SUPPLIERS WILL BE LIABLE UNDER OR IN CONNECTION WITH THIS AGREEMENT, HOWEVER CHARACTERIZED AND UNDER ANY THEORY OF LIABILITY (CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, STATUTE, INDEMNITY OR OTHERWISE), FOR ANY: (A) INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY OR PUNITIVE DAMAGES; (B) LOST PROFITS, LOST REVENUE, LOST SAVINGS, LOSS OF BUSINESS OPPORTUNITY OR LOSS OF GOODWILL OR REPUTATION; (C) BUSINESS INTERRUPTION OR LOSS OF USE; (D) RANSOM, EXTORTION OR SIMILAR PAYMENTS; (E) COSTS OF BREACH NOTIFICATION, CREDIT MONITORING, IDENTITY PROTECTION, CALL CENTERS, FORENSIC INVESTIGATION, PUBLIC RELATIONS OR CRISIS MANAGEMENT; (F) REGULATORY, GOVERNMENTAL OR CONTRACTUAL FINES, PENALTIES, ASSESSMENTS OR SANCTIONS; (G) AMOUNTS PAYABLE TO THIRD PARTIES, INCLUDING CUSTOMER'S CUSTOMERS, END CUSTOMERS, ASSESSORS OR PRIME CONTRACTORS; (H) COSTS OF PROCURING SUBSTITUTE SERVICES, RE-ASSESSMENT OR RE-AUDIT; OR (I) LOSS, CORRUPTION OR INACCESSIBILITY OF DATA TO THE EXTENT CUSTOMER FAILED TO MAINTAIN BACKUPS; IN EACH CASE EVEN IF THE PARTY WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE. THE DAMAGES LISTED IN (B) THROUGH (I) ARE EXCLUDED WHETHER THEY WOULD OTHERWISE BE CHARACTERIZED AS DIRECT OR INDIRECT.

16.2 Cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND EXCEPT FOR EXCLUDED CLAIMS, THE TOTAL AGGREGATE LIABILITY OF EACH PARTY AND ITS AFFILIATES, LICENSORS AND SUPPLIERS, ARISING OUT OF OR RELATED TO THIS AGREEMENT, UNDER ALL THEORIES OF LIABILITY AND FOR ALL CLAIMS COMBINED, WILL NOT EXCEED: (A) THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO ACCUSIGHTS FOR THE SPECIFIC OFFERING GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM; OR (B) IF NO FEES WERE PAID OR PAYABLE FOR THAT OFFERING (INCLUDING TRIALS AND FREE USE), ONE THOUSAND U.S. DOLLARS (US $1,000). FOR CLARITY, LIABILITY RELATING TO ONE OFFERING IS MEASURED ONLY AGAINST FEES FOR THAT OFFERING (FOR EXAMPLE, LIABILITY RELATING TO COMPLY IS MEASURED ONLY AGAINST COMPLY FEES), FEES FOR THE PROTECT OFFERINGS ARE NEVER COUNTED TOWARD THE CAP UNDER THIS AGREEMENT, AND MULTIPLE CLAIMS DO NOT ENLARGE THE CAP. THE CAP IN THIS SECTION 16.2 APPLIES IN ADDITION TO, AND AFTER, SECTION 13.2.

16.3 Super-cap (only by Order Form). The parties may agree in a negotiated, executed Order Form that AccuSights' aggregate liability for its own confirmed Security Breach, caused by AccuSights' breach of Section 8.6 or the DPA, will instead be capped at two (2) times the amount in Section 16.2(a) (the "Super-Cap"). The Super-Cap applies only if the Order Form expressly elects it; it is never the default, is never implied, and, where elected, is the exclusive cap for Security Breach claims and does not stack with Section 16.2.

16.4 Excluded Claims. "Excluded Claims" means (a) a party's fraud, willful misconduct (including conduct that would constitute willful and wanton misconduct under Illinois law) or gross negligence; (b) Customer's obligations to pay Fees; (c) Customer's indemnification obligations under Section 15.3; (d) AccuSights' indemnification obligations under Section 15.1, provided that AccuSights' aggregate liability under Section 15.1 will not exceed two (2) times the amount in Section 16.2(a); and (e) either party's infringement or misappropriation of the other party's intellectual property rights, including Customer's breach of Section 7.4(a) through (e). Excluded Claims are not subject to Section 16.1 or Section 16.2.

16.5 Basis of the bargain; not an insurer. The parties agree that the exclusions and limitations in this Section 16, Section 11, Section 13 and Section 14 are an agreed allocation of risk, are reflected in the Fees, and are an essential basis of the bargain, without which AccuSights would not provide the Services at these Fees. Customer acknowledges that AccuSights is not an insurer of Customer's security or compliance, that no readiness or assessment service can eliminate risk, and that Customer is responsible for maintaining insurance appropriate to its risk. These limitations apply notwithstanding the failure of essential purpose of any limited remedy and apply to Subscriptions purchased through an MSP or referred by a Partner.

16.6 Separate entities. For clarity, the cap in this Section 16 applies to AccuSights, Inc. under this Agreement; any liability of AccuSights LLC is governed solely by the Protect Services Agreement and its own cap (the greater of the fees paid for Protect in the prior 12 months and $1,000), and the caps are not aggregated, shared or combined.

17. Term; Termination; Suspension; Data Export and Deletion

17.1 Term. This Agreement begins on acceptance under Section 1.5 and continues until all Subscriptions and SOWs have expired or been terminated and Customer's account is closed (the "Term"). Each Subscription runs for its Subscription Term as renewed under Section 6.6.

17.2 Termination for cause. Either party may terminate this Agreement or an affected Order Form on written notice if the other party (a) materially breaches this Agreement and fails to cure the breach within thirty (30) days after written notice describing it, except that the cure period for non-payment is ten (10) days; or (b) becomes insolvent, makes a general assignment for the benefit of creditors, has a receiver or trustee appointed, files or has filed against it a petition in bankruptcy that is not dismissed within sixty (60) days, or ceases to do business in the ordinary course.

17.3 Termination for convenience by Customer. Customer may terminate a Subscription for convenience only by non-renewal under Section 6.6 or as stated in the Refund Policy. Termination for convenience does not relieve Customer of Fees for the remainder of the then-current Subscription Term, which remain due and are not refunded.

17.4 Suspension. AccuSights may suspend Customer's or an Authorized User's access to all or part of the Services, immediately and with notice to Customer (which may be after the fact where advance notice is impracticable), if AccuSights reasonably determines that (a) Customer's use poses a security threat to the Services, AccuSights, other customers or third parties; (b) Customer has breached the Acceptable Use Policy or Section 7.4, 7.5, 8.5 or 8.7; (c) suspension is required by law, court order or a governmental authority; (d) an account has been compromised; or (e) amounts are past due as described in Section 6.3. AccuSights will limit a suspension to what is reasonably necessary, will notify Customer of the reason, and will restore access promptly after the cause is resolved. Fees continue to accrue during a suspension caused by Customer.

17.5 Effect of termination. On expiration or termination of a Subscription or this Agreement: (a) all licenses and access rights for the affected Services end; (b) Customer will pay all Fees accrued or payable through the effective date, and, if AccuSights terminated for Customer's breach, all Fees for the remainder of the Subscription Term become immediately due; (c) if Customer terminated for AccuSights' uncured material breach, AccuSights will refund prepaid Fees for the unexpired portion of the terminated Subscription Term; and (d) each party will return or destroy the other's Confidential Information under Section 9.4, subject to Section 17.6.

17.6 Data export. For thirty (30) days after the effective date of expiration or termination (the "Export Window"), AccuSights will make Customer Data and Deliverables then held in the Platform available for export by Customer in a commonly used, machine-readable format through the Platform's export features, provided that Customer's account is not suspended for non-payment. AccuSights may charge its then-current professional-services rates for export assistance beyond the Platform's self-service features.

17.7 Deletion. Beginning sixty (60) days after the effective date of expiration or termination, AccuSights will delete or de-identify Customer Data in its production systems, and will purge Customer Data from backups within ninety (90) days after the effective date of expiration or termination in the ordinary course of backup rotation, except that AccuSights may retain (a) Customer Data as required by law or legal hold, (b) acceptance records, Order Forms, invoices, Risk Acceptance logs and audit logs needed to evidence the Agreement and its performance, and (c) De-identified Data and Usage Data. Deleted Customer Data cannot be recovered.

17.8 EU/EEA switching. A Customer established in a member state of the European Union or European Economic Area may, during a Subscription Term, request to switch to another data-processing service or to its own infrastructure by written notice to [email protected] (subject "ATTN: Legal Notice"), subject to a maximum notice period of two (2) months. AccuSights will provide reasonable assistance to facilitate switching in accordance with Regulation (EU) 2023/2854 (the "Data Act"), and the affected Order Form will terminate at the end of the notice period or earlier on Customer's written confirmation that migration is complete. Customer remains liable for Fees accrued through termination; any early-termination fees stated in the Order Form apply to the extent permitted by the Data Act. AccuSights will not impose switching charges prohibited by the Data Act.

18. Changes to these Terms and the Policies

18.1 Notice. AccuSights may modify these Terms, the DPA, a Service Schedule or a Policy by posting the revised version at accusights.com/legal with a new version number and effective date, and by giving Customer at least thirty (30) days' prior notice by email to Customer's Admins and by in-Platform notice. The notice will include a summary of the changes.

18.2 Prospective effect. Modifications take effect only on the stated effective date and apply prospectively. Modifications to Section 24 (Governing Law; Disputes) do not apply to any dispute of which either party notified the other in writing before the effective date.

18.3 Material adverse changes. If a modification materially reduces Customer's rights or materially increases Customer's obligations under a paid Subscription (a "Material Adverse Change"), Customer may terminate the affected Subscription by written notice to [email protected] (subject "ATTN: Legal Notice") delivered before the effective date, in which case AccuSights will refund prepaid, unused Fees for the terminated portion. Changes required by law, changes that add new Offerings or features, price changes taking effect at renewal under Section 6.7, and clarifications that do not change the parties' substantive rights are not Material Adverse Changes.

18.4 Acceptance of changes. Customer's continued use of the Services after the effective date, or its acceptance of the revised Terms in the Platform, constitutes acceptance of the modification. AccuSights may require Authorized Users to re-accept revised Terms at next login after the notice period.

18.5 Executed Order Forms. Nothing in this Section 18 permits AccuSights to change the Fees, quantities, Subscription Term, or negotiated terms of an executed Order Form or SOW during its Subscription Term (Section 4.4). Revised Terms apply to an executed Order Form only from its next Renewal Term, unless the Order Form provides otherwise or Customer accepts the revised Terms earlier.

19. Insurance

AccuSights maintains technology errors & omissions and cyber liability insurance with carriers rated A- or better; a certificate of insurance is available on request. AccuSights' insurance does not expand its liability under this Agreement.

20. Export Controls; Sanctions; Anti-Corruption

20.1 Export controls. The Services and AccuSights Materials are subject to United States export-control and sanctions laws, including the Export Administration Regulations and regulations of the Office of Foreign Assets Control, and may be subject to other jurisdictions' laws (together, "Export Controls"). Customer will comply with all Export Controls, will not export, re-export, transfer or make the Services available in violation of them, and will not use the Services for any purpose prohibited by them.

20.2 Sanctions representations. Customer represents and warrants that neither it nor any of its Affiliates, Authorized Users or End Customers (a) is organized under the laws of, located in, or ordinarily resident in a country or territory subject to comprehensive U.S. sanctions (currently Cuba, Iran, North Korea, Syria, and the Crimea, so-called Donetsk People's Republic and Luhansk People's Republic regions of Ukraine), (b) is listed on, or owned or controlled by a person listed on, the OFAC Specially Designated Nationals and Blocked Persons List or any other U.S. restricted-party list, or (c) will provide access to the Services to any such person.

20.3 Anti-corruption. Each party will comply with the U.S. Foreign Corrupt Practices Act and other applicable anti-bribery laws, and will not offer, pay, promise or authorize any payment or thing of value to any government official or other person to improperly obtain or retain business or an advantage in connection with this Agreement.

21. Government Customers; DIB Flow-Downs

21.1 U.S. Government end users. The Services are "commercial products" and "commercial services" (including "commercial computer software" and "commercial computer software documentation") as defined at FAR 2.101 and are provided to U.S. Government end users only with the rights set forth in this Agreement, consistent with FAR 12.211, 12.212 and DFARS 227.7202.

21.2 Limited flow-downs. Customers that are contractors or subcontractors to the U.S. Government ("DIB Customers") may be subject to clauses that they must flow down to their suppliers. The parties agree that: (a) AccuSights, Inc. is not a party to Customer's government contracts, does not process CUI absent a CUI Enclave (Section 8.5), and is not a "covered contractor information system" operator for Customer under DFARS 252.204-7012; (b) accordingly, DFARS 252.204-7012, 252.204-7019, 252.204-7020 and 252.204-7021 do not apply to the Services except to the extent Customer has ordered a CUI Enclave and the applicable Order Form expressly accepts those clauses; (c) FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems) applies only to the extent Federal Contract Information is processed in the Services at Customer's direction, and AccuSights' security program under Section 8.6 is intended to satisfy its fifteen requirements; and (d) no other government-contract clause is flowed down to AccuSights unless expressly listed and accepted in an executed Order Form. Customer will not designate AccuSights as a subcontractor in any government contract deliverable without AccuSights' written consent.

21.3 No agency. Nothing in the Services or Deliverables is a representation to the U.S. Government, and AccuSights does not make representations, certifications or affirmations to the U.S. Government on Customer's behalf.

22. Publicity

AccuSights may identify Customer as a customer by name and logo in customer lists on its website and in sales materials, in a factual manner and in accordance with any trademark guidelines Customer provides, unless Customer opts out by email to [email protected] (subject "ATTN: Legal Notice"). Any press release, case study, testimonial or public statement describing Customer's results requires Customer's prior written consent. Customer will not issue any public statement about AccuSights, or describe AccuSights' Services in marketing or to regulators, in a manner inconsistent with Section 10.

23. Notices

23.1 To AccuSights. Legal notices to AccuSights must be sent by email to [email protected] with the subject line "ATTN: Legal Notice," with a copy by nationally recognized courier or certified mail to AccuSights, Inc., Attn: Legal Notice, 2058 N. Western Ave, Chicago, IL 60647, and are effective on receipt of the email, or the next business day if received outside business hours.

23.2 To Customer. AccuSights may give notices to Customer by email to the Admin email addresses on Customer's account, by in-Platform notification, or by courier or mail to the address on the Order Form. Email and in-Platform notices are effective when sent. Customer will keep its notice addresses current.

23.3 Operational communications. Routine communications, including renewal reminders, invoices, security alerts and service announcements, may be sent by email or in-Platform, and Customer consents to receive them electronically.

24. Governing Law; Venue; Jury Waiver; Class Action Waiver; Time to Bring Claims

24.1 Governing law. This Agreement and all claims arising out of or related to it or the Services are governed by the laws of the State of Illinois, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act do not apply.

24.2 Venue. Any action arising out of or related to this Agreement or the Services will be brought exclusively in the state courts located in Cook County, Illinois, or the United States District Court for the Northern District of Illinois, Eastern Division, and each party irrevocably submits to the personal jurisdiction and venue of those courts and waives any objection based on inconvenient forum. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.

24.3 Jury waiver. TO THE EXTENT PERMITTED BY LAW, EACH PARTY KNOWINGLY, VOLUNTARILY AND INTENTIONALLY WAIVES ITS RIGHT TO A TRIAL BY JURY IN ANY ACTION ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE SERVICES.

24.4 No class actions. EACH PARTY AGREES THAT ANY CLAIM WILL BE BROUGHT ONLY IN ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED OR REPRESENTATIVE PROCEEDING.

24.5 Time to bring claims. Except for claims to collect unpaid Fees and Excluded Claims under Section 16.4(a) and (e), any claim arising out of or related to this Agreement or the Services must be filed within one (1) year after the claimant knew or reasonably should have known of the facts giving rise to it, or it is permanently barred.

24.6 Attorneys' fees. In any action by AccuSights to collect unpaid Fees, the prevailing party is entitled to recover its reasonable attorneys' fees and costs. Otherwise each party bears its own fees and costs.

24.7 Informal resolution. Before filing any action (other than for injunctive relief or collection of Fees), a party will give the other written notice describing the dispute, and the parties' senior representatives will confer in good faith for at least thirty (30) days to attempt resolution.

25. General

25.1 Assignment. Customer may not assign or transfer this Agreement or any Order Form, by operation of law or otherwise, without AccuSights' prior written consent, except to a successor in a merger, acquisition or sale of all or substantially all of its assets that is not a competitor of AccuSights, on written notice and assumption of all obligations. AccuSights may assign this Agreement to an Affiliate or to a successor in a merger, acquisition, reorganization or sale of all or substantially all of its assets or of the relevant business line, on notice to Customer. Any prohibited assignment is void.

25.2 Independent contractors. The parties are independent contractors. This Agreement does not create a partnership, joint venture, agency, fiduciary, franchise or employment relationship. AccuSights may use subcontractors and subprocessors, and remains responsible for their performance.

25.3 Force majeure. Neither party is liable for failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including acts of God, natural disaster, epidemic, war, terrorism, civil unrest, labor disputes, governmental action, failures of the internet, utilities or third-party hosting or telecommunications providers, and cyberattacks not caused by the affected party's breach of this Agreement ("Force Majeure Events"), provided the affected party uses reasonable efforts to mitigate and resume performance.

25.4 Severability. If any provision of this Agreement is held invalid or unenforceable, it will be enforced to the maximum extent permissible and modified to the minimum extent necessary to make it enforceable, and the remaining provisions will remain in full force.

25.5 Waiver. No waiver is effective unless in writing and signed by the waiving party, and no waiver of any breach is a waiver of any other or subsequent breach.

25.6 Entire agreement. This Agreement (these Terms, the Order Forms, SOWs, Service Schedules, DPA, any executed BAA, and the Policies) is the complete and exclusive agreement between the parties regarding its subject matter, and supersedes all prior and contemporaneous agreements, proposals, representations and understandings, written or oral, including any prior version of the AccuSights Terms of Service. No terms in any Customer purchase order, vendor portal or other Customer document apply (Section 4.3). Each party acknowledges that it has not relied on any representation not expressly set out in this Agreement.

25.7 Interpretation. Headings are for convenience only. "Including" means "including without limitation." No rule of strict construction applies against either party. The plain-language summary at the top of these Terms is not part of the Agreement.

25.8 Third-party beneficiaries. Except as stated in Sections 5.4(c), 15.3 and 16.6 (which benefit AccuSights LLC and AccuSights' Affiliates), there are no third-party beneficiaries of this Agreement.

25.9 Counterparts; records. Order Forms and SOWs may be executed electronically and in counterparts. A printed or electronically stored copy of this Agreement and of any acceptance record or electronic notice is admissible to the same extent as a paper original.

25.10 Survival. Sections 1.3, 1.4, 6 (as to accrued Fees), 7.1, 7.3, 7.4, 7.6, 7.7, 7.8, 8.1, 8.3, 8.5, 8.7, 9, 10, 11 (for its stated period), 12.4, 12.5, 13, 14.3, 15, 16, 17.5 through 17.7, 21, 23, 24 and 25, and any other provision that by its nature should survive, survive expiration or termination of this Agreement.

AccuSights Terms of Service — Version 2026.10 — Effective November 1, 2026. Previous versions: accusights.com/legal/archive. Questions: [email protected] (subject "ATTN: Legal Notice").