Terms of Service

1. Agreement & Eligibility

By creating an account, signing an order form, or using the Service, you agree to these Terms on behalf of yourself and, if applicable, the organization you represent ("Customer"). The Service is intended for business use by people acting for an organization, and not for personal, family, or household use. You must be legally able to enter into a binding contract. Do not use the Service if you do not agree to these Terms.

2. Accounts

You must provide accurate account information, keep authentication credentials secure, and promptly remove access for people who no longer need it. Customer is responsible for activity under its accounts and for selecting appropriate roles, access controls, and identity providers. Notify us promptly at security@certiqa.app if you suspect unauthorized access.

3. Plans, Trials & Payment

Plan features, usage limits, billing interval, fees, and any special terms are those shown at checkout or in the applicable signed order form. At checkout we show, in a statement you accept before paying, the price, the billing interval, the renewal terms, how to cancel, the refund rule, how tax is handled and what happens if a payment fails; we keep a record of what was shown and accepted. Prices exclude taxes, which are calculated at checkout and added to the price. Customer authorizes CertiQA and its payment processor to charge the payment method for fees and applicable taxes. Subscriptions renew automatically for successive billing periods until cancelled. Customer can cancel at any time in the billing settings; cancellation takes effect at the end of the current paid period unless the order form says otherwise, and access continues until then. We email the workspace administrators of an annual plan 30 days before each renewal, with the date, the price and how to cancel. A free trial has the duration and included usage shown when offered, does not require payment details unless checkout says otherwise, and does not convert to a paid plan unless Customer affirmatively selects and authorizes one.

Fees are non-refundable except where required by law or expressly stated in an order form or checkout. Customer is responsible for applicable taxes, excluding taxes on CertiQA's income. If a renewal payment fails, we email the workspace administrators and the payment may be retried. If it is still unpaid 7 days after the first failed payment, we suspend paid features and test runs until it is paid; we do not delete data because a payment failed, and paying lifts the suspension. A returned or disputed ACH debit counts as a failed payment. Any ACH debit authorization presented by the payment processor at checkout also applies.

Plan usage allowances (credits, runs, minutes) reset each billing period and unused allowance does not roll over. Pre-paid credit packs bought separately do not expire, cannot be transferred or exchanged for cash, are non-refundable except where required by law, and end if the workspace is deleted. We may correct an evident billing error and will provide notice of material pricing changes before they apply to a renewal.

4. The Service

We grant Customer a limited, non-exclusive, non-transferable right during the subscription term to access and use the Service for its internal business purposes, subject to its plan, documentation, and these Terms. The Service may be changed, updated, or discontinued. Any availability commitment, response time, or service credit applies only if expressly stated in a signed order form. The general Service is provided without an uptime SLA.

5. Acceptable Use

Customer must use the Service lawfully and only for systems, accounts, agents, APIs, and data it owns or is authorized to test. Customer must not use the Service to access or disrupt third-party systems without authorization, violate privacy or security rights, distribute malware, evade usage limits, interfere with the Service, or reverse engineer it except where law does not permit that restriction. Customer must configure tests to avoid unintended real transactions, messages, account changes, or other harmful side effects, and must maintain suitable backups and recovery plans for systems it tests.

Customer must not submit payment card data, government identifiers, health data, children's data, or other sensitive or regulated information unless the parties have agreed in writing that the Service and applicable safeguards are suitable for that data. Customer is responsible for its test targets, test data, configurations, credentials, and the consequences of running tests.

6. Customer Data

As between the parties, Customer retains its rights in data, code, prompts, test cases, configurations, and other material it submits to the Service ("Customer Data"). Customer grants CertiQA a limited worldwide license to host, copy, transmit, modify as technically necessary, and otherwise process Customer Data only to provide, secure, support, and improve the Service for Customer, comply with law, and enforce these Terms. Customer represents it has the rights and permissions necessary to provide Customer Data and authorize this processing.

CertiQA will not use Customer Data to train foundation models. AI features may send content to the model provider configured for the workspace; the provider's terms and settings govern its processing. Customer should review the provider and avoid submitting information it is not authorized to disclose. When CertiQA processes personal data on Customer's behalf, the parties must execute a Data Processing Addendum before that processing begins; the DPA will govern in case of conflict on data protection matters.

Customer may export or delete workspace data using available product features. Data retention, archival, and deletion periods are described in the Privacy Policy and may be subject to backup cycles and legal retention requirements.

7. Intellectual Property

CertiQA and its licensors own the Service, software, documentation, branding, and related intellectual property. Except for the limited access right expressly granted above, no rights are transferred to Customer. Customer grants feedback without restriction or obligation, but this does not transfer Customer Data or confidential information. Third-party and open-source components remain subject to their own licenses.

8. Third-Party Services & AI

The Service may connect to third-party services selected or authorized by Customer. Those services are governed by their own terms and privacy practices, and CertiQA is not responsible for their availability, content, or acts. AI-generated suggestions, scores, test cases, and reports can be incomplete or incorrect and are not professional advice, a security guarantee, or a certification. Customer must independently review and validate results before relying on them or taking action.

9. Confidentiality

Each party may receive non-public information that the disclosing party identifies as confidential or that reasonably should be understood as confidential ("Confidential Information"). The recipient will use it only to perform under these Terms, protect it using reasonable care, and disclose it only to personnel and service providers who need it and are bound to protect it. These duties do not apply to information the recipient can show was public without breach, already known without duty, independently developed, or lawfully received from another source. A recipient may disclose information when legally required, after giving notice where legally permitted.

10. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." CERTIQA DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. CERTIQA DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR THAT TEST RESULTS WILL FIND EVERY DEFECT OR PREDICT PRODUCTION BEHAVIOR. THESE DISCLAIMERS DO NOT LIMIT WARRANTIES THAT CANNOT LAWFULLY BE DISCLAIMED.

11. Indemnification

Customer will defend CertiQA and its personnel against a third-party claim arising from Customer Data, Customer's use of the Service in violation of these Terms or law, or Customer's unauthorized testing of a system, and will pay damages and reasonable legal fees finally awarded or included in a settlement Customer approves. CertiQA will promptly notify Customer and allow Customer to control the defense, provided Customer may not settle a claim in a way that admits fault by or imposes obligations on CertiQA without its written consent. This section does not apply where prohibited by law.

12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, DATA, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY. EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO CERTIQA FOR THE SERVICE IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM.

"Excluded Claims" means Customer's payment obligations, a party's fraud or willful misconduct, and liabilities that cannot be limited under applicable law. This section allocates risk between the parties and applies regardless of the form of action.

13. Suspension & Termination

These Terms apply while Customer uses the Service. Either party may terminate for a material breach not cured within 30 days after written notice. CertiQA may suspend access immediately to address a security threat, unlawful use, material risk to the Service or others, or overdue fees after notice and an opportunity to cure where practicable. We will limit a suspension to the affected scope where reasonably possible. Upon termination, Customer's access ends and data is handled under the Privacy Policy and any DPA or order form.

14. General

California law governs these Terms, excluding its conflict-of-law rules. The state and federal courts located in California have exclusive jurisdiction, subject to mandatory law. Neither party is liable for delay caused by events beyond its reasonable control. Customer may not assign these Terms without CertiQA's written consent, except to a successor in a merger or sale of substantially all its assets; CertiQA may assign them to an affiliate or successor. These Terms are the entire agreement on their subject and replace prior discussions on that subject. If a provision is unenforceable, the rest remains effective. A waiver must be in writing. Notices to CertiQA go to legal@certiqa.app; notices to Customer go to its account email or order-form address. Changes to these Terms will be posted with a new effective date; material changes will apply prospectively after notice, and continued use after the effective date constitutes acceptance only to the extent permitted by law.

15. Contact

For questions about these Terms, contact legal@certiqa.app.