This policy applies to everyone who uses ezGRC (the "Service"), provided by Zeros and Ones LLC. It is part of the ezGRC Terms of Service. In short, use ezGRC to run your own compliance program, and don't use it to harm anyone.
You may not use the Service to:
- Break the law, or help anyone else break it, including privacy, export-control, and sanctions laws.
- Access systems or data you aren't authorized to access. Only connect cloud accounts, identity providers, and other systems your organization owns or is authorized to monitor.
- Attack or probe the Service: no vulnerability scanning, penetration testing, or load testing against ezGRC without our written permission. (We welcome responsible disclosure at security@zerosandones.us; see our security.txt.)
- Interfere with the Service or other customers: no attempts to bypass tenant isolation, usage limits, rate limits, or the trial export gate, and no automated access in a way that imposes an unreasonable load.
- Upload malicious content, such as malware or code designed to damage or gain unauthorized access.
- Misrepresent compliance status: don't use the Service or your Trust Center to publish compliance claims, certifications, or audit results that you don't actually hold, or to impersonate another organization.
- Store data the Service isn't designed for without appropriate controls, including payment card numbers, government identification numbers, or special-category health data, unless necessary for your compliance program and properly access-restricted.
- Send spam or unsolicited messages through Service features (for example vendor questionnaires or Trust Center notifications).
- Resell or share access outside your organization, except through an agreement with us.
- Build a competing product using the Service, its templates, or its framework mappings.
AI features
Don't use AI features to generate content that is unlawful, deceptive, or infringing, or attempt to extract other customers' data or our system prompts. Review AI output before relying on it.
Enforcement
If we reasonably believe this policy has been violated, we may remove content, suspend access, or terminate the account, as described in the Terms. Where practical, we will notify you first and give you a chance to fix the issue.
Report abuse to security@zerosandones.us.