PLATFORM LEGAL

Platform terms

Last updated: August 20, 2026

These terms govern access to and use of the Veriqora continuous cyber assurance platform, including its workspaces, evidence workflows, integrations, reports, and related services.

1. Agreement and scope

These terms form an agreement between Veriqora, Inc. (“Veriqora”) and the organization or person accepting an order form, trial, invitation, or other authorized access to the platform (“Customer”). An order form or separately signed agreement may add to or modify these terms. If there is a conflict, the signed order form or agreement controls.

2. The service

Veriqora provides software for managing cybersecurity and assurance activities, including risks, controls, policies, evidence, tests, findings, remediation, vendors, audits, reports, and connected cloud environments. Features, usage limits, support, service levels, subscription dates, and fees may be specified in an order form. Evaluation, preview, and beta features may change or be withdrawn and are provided for testing rather than production reliance unless agreed otherwise.

3. Accounts and authorized users

Customer controls who may access its workspace and is responsible for authorized users, role assignments, identity-provider configuration, account security, and lawful use. Users must keep credentials confidential, use multi-factor authentication when required, and promptly report suspected unauthorized access. Customer must ensure that account and tenant information remains accurate.

4. Customer data and evidence

Customer retains its rights in information submitted to or collected through its workspace, including evidence, policies, audit materials, integration results, personnel and vendor records, and other customer content (“Customer Data”). Customer grants Veriqora the limited rights needed to host, process, transmit, back up, secure, and otherwise provide the service. Customer is responsible for having the rights and lawful basis needed to provide Customer Data and for configuring access, retention, integrations, and exports appropriately.

5. Integrations and connected environments

Customer may authorize connections to Amazon Web Services, identity providers, and other third-party services. Customer is responsible for approving scopes and permissions and for the acts and terms of third-party services. Veriqora will use authorized connection data to provide requested collection and assurance functions. Customer should use least-privilege roles and must not provide static cloud credentials when a supported delegated-access method is available.

6. Assurance and automated features

Veriqora supports evidence and decision workflows but does not provide legal advice, perform an independent audit, issue a certification, or guarantee security or compliance. Results depend on Customer Data, configuration, scope, tests, reviewers, and external systems. Automated or AI-assisted suggestions may be incomplete or inaccurate and require qualified human review before use in consequential decisions.

7. Acceptable use

Customer and users must not misuse the service; violate law or third-party rights; access another tenant or account without authorization; probe or disrupt the service outside an approved security-testing process; introduce malware; evade controls or limits; scrape or resell the service; reverse engineer it except where law prohibits restriction; misrepresent assurance results; or use the service to create unlawful, deceptive, discriminatory, or harmful content.

8. Confidentiality and security

Each party must protect the other party’s non-public business, technical, and security information using reasonable care and use it only for the agreement. Veriqora will maintain administrative, technical, and organizational safeguards appropriate to the service. No system is completely secure, and Customer remains responsible for its own systems, endpoints, identities, backups, and incident response.

9. Privacy and data processing

The Platform Privacy Notice explains how Veriqora handles personal information. Where Veriqora processes personal data for Customer as a processor or service provider, an applicable data processing addendum or signed agreement governs that processing. Current service-provider disclosures should be reviewed on Veriqora’s public subprocessor page before production use.

10. Ownership and feedback

Veriqora and its licensors retain rights in the platform, software, documentation, designs, and service improvements. No rights are granted except the limited right to use the service during an authorized subscription or evaluation. Customer may provide feedback, and Veriqora may use that feedback without identifying Customer or disclosing Customer confidential information.

11. Fees, suspension, and termination

Fees, taxes, payment dates, renewal, and cancellation are governed by the applicable order form. Veriqora may suspend access when reasonably necessary to address a security threat, unlawful use, material breach, or overdue undisputed fees, using notice where practicable. On termination, access ends and Customer should export required data before the applicable retrieval period expires. Retention or deletion obligations in a signed agreement or applicable law continue to apply.

12. Warranties and disclaimers

Any express service warranty appears in the applicable signed agreement. To the extent permitted by law and except for an express warranty, the service is provided “as is” and “as available.” Veriqora disclaims implied warranties, and does not warrant uninterrupted operation, error-free results, or achievement of any audit, certification, regulatory, or security outcome.

13. Liability

Liability allocations and any caps are governed by the applicable signed agreement. Where no signed agreement specifies them, each party’s liability is limited to the fullest extent permitted by applicable law, and neither party is liable for indirect, special, incidental, exemplary, punitive, or consequential damages. Nothing excludes liability that cannot lawfully be limited.

14. Changes and contact

Veriqora may update these terms as the service and legal requirements evolve. Material changes will be communicated through the service, email, or another reasonable channel before they take effect when required. Questions or legal notices may be sent to hello@getveriqora.com. Formal notice details and governing law should be stated in the applicable order form or signed agreement.