Terms of Service

By creating an account, accessing a ControlFrame workspace, or signing an order form that incorporates these terms, the customer and its authorized users agree to be bound by them. A person accepting on behalf of an organization represents that they are authorized to do so.

ControlFrame provides audit evidence collection, custody, review, and export infrastructure, including private-runner collection, governed artifact storage, control mapping, and evidence-package generation, as described on this site and in the applicable order form. Features, deployment tier, and scope are set by the order form and may vary by customer.

The customer is responsible for the accuracy of account information, for the acts of its authorized users, and for keeping credentials and any enterprise single sign-on configuration secure. ControlFrame must be notified promptly of any suspected unauthorized access to an account or workspace.

The service may not be used to violate law, infringe another party's rights, transmit malicious code, attempt to bypass access controls or rate limits, misrepresent evidence or verification results, or interfere with the service's operation or other customers' use of it.

ControlFrame and its licensors retain all rights, title, and interest in the platform, including its software, design, and documentation. These terms grant the customer a limited, non-exclusive, non-transferable right to access and use the service for its own internal business purposes during the subscription term. No other rights are granted.

ControlFrame will provide the service with reasonable skill and care and in substantial conformity with its published documentation. Except as expressly stated in these terms or an order form, the service is provided without warranties of any other kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement, to the maximum extent permitted by law.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits or lost data, arising from these terms or the service. Each party's total liability arising out of these terms is limited to the amounts paid or payable by the customer under the applicable order form in the twelve months before the claim arose, except where the order form states a different limit or where liability cannot be limited by law.

These terms apply for as long as the customer has an active order form or account, and either party may terminate an order form on the terms it states. ControlFrame may suspend or terminate access for a material breach of these terms, including acceptable-use violations, that is not cured after notice. On termination, access ends and each party's accrued obligations survive, including confidentiality, fees owed, and limitation of liability.

The governing law and venue for a customer relationship are specified in the applicable order form or enterprise agreement. Where none is specified, no governing law is asserted by this page.

ControlFrame may update this baseline document from time to time; the effective date above reflects the version currently in force. Material changes affecting an active order form take effect for that customer only as the order form's own amendment process allows.