These Terms of Service (the "Terms") are an agreement between Zeros and Ones LLC, a Florida limited liability company with its principal office at 2875 S Orange Ave, STE 500 #6340, Orlando, FL 32806 ("Zeros and Ones", "we", "us"), and the organization that creates an account or buys a subscription ("Customer", "you"). They govern your use of ezGRC, including the ezgrc.app web application, its APIs, the public Trust Center feature, related support, and documentation (together, the "Service").
If you accept these Terms for an organization, you confirm you have authority to bind it. If you don't have that authority or don't agree, don't use the Service.
1. Definitions
- Customer Data: all data, documents, evidence, policies, configurations, and other content that you or your Users submit to the Service, or that the Service collects from your systems at your direction (for example, through a connected AWS account or identity provider).
- Order: the plan you select at checkout on ezgrc.app, a written order form signed by both parties, or a purchase made through a cloud marketplace. An Order states the plan (tier), add-ons, term, and fees.
- User: an individual you authorize to use the Service under your account, including employees, contractors, and external auditors you invite.
- Subscription Term: the period stated in the Order, including any renewal.
- Documentation: the user guides and help content we publish for the Service.
2. The Service
2.1 Access. During the Subscription Term, and subject to these Terms and payment of fees, we grant you a non-exclusive, non-transferable right for your Users to access and use the Service for your internal business purposes, within the limits of your plan.
2.2 Plans. Plans, included features, framework limits, and included seats are described on our pricing page (https://ezgrc.app/pricing) as of the date of your Order. We may improve the Service over time. We will not materially reduce the core functionality of your plan during a paid Subscription Term.
2.3 Seats. Each plan includes a number of admin and contributor seats. You may exceed your seat count by up to 10% for up to 90 days without charge. After that, additional seats are billed at the per-seat rates on the pricing page in effect at the time of your Order, and true-up occurs at renewal.
2.4 AI features. The Service includes AI-assisted features (such as summaries, gap analysis, questionnaire drafting, and control suggestions). AI output can be wrong or incomplete. You are responsible for reviewing it before relying on it, including before submitting anything to an auditor, customer, or regulator. We do not use Customer Data to train AI models that are shared with other customers.
2.5 Not an audit or legal opinion. The Service helps you organize and monitor a compliance program. It does not provide an audit, certification, attestation, or legal advice, and using it does not guarantee that you will pass an audit or comply with any law or framework. Certifications are issued by independent auditors you engage.
2.6 Third-party services. The Service may connect to third-party services that you choose (for example AWS, identity providers, or ticketing tools). Your use of those services is governed by your agreements with those providers. We are not responsible for third-party services, and we access them only as you authorize.
3. Free trial
3.1 We may offer a free trial (currently 14 days on eligible plans). During a trial:
- the Service is provided as is, without any warranty, service-level commitment, or support obligation;
- exports and auditor-facing sharing (for example audit package export, evidence bundle downloads, auditor access, and Trust Center publishing) may be disabled until you purchase a paid plan; and
- we may end or change the trial at any time.
3.2 If you don't purchase a paid plan by the end of the trial, your account becomes read-only. We keep your Customer Data for 30 days after the trial ends so you can purchase and continue, then we delete it as described in Section 11.
4. Fees, billing, and renewal
4.1 Fees. You agree to pay the fees in your Order. Unless the Order says otherwise, fees are quoted and payable in US dollars, annually in advance.
4.2 Payment. For direct purchases you can pay by card or ACH through our payment processor, or by invoice where offered. Invoices are due within 30 days of the invoice date. We may suspend the Service if an undisputed amount is more than 30 days overdue, after giving you at least 10 days' written notice.
4.3 Multi-year terms. Multi-year terms and their discounts are as stated on the pricing page at the time of your Order (currently 8% off list for 2 years and 12% off for 3 years). Multi-year fees are billed annually unless the Order says otherwise.
4.4 Founding-customer pricing. If you accept founding-customer pricing at checkout, you receive the discount stated in the Order for the full Subscription Term. In return, you agree to a two-year Subscription Term and to the commitments listed at checkout (a case study, permission to use your name and logo as a customer, and one reference call per year). We will get your approval on any case study text before publishing it.
4.5 Renewal. Subscriptions renew automatically for successive terms equal to the initial term (or one year, if the initial term was longer than one year), unless either party gives notice of non-renewal at least 30 days before the end of the current term. You can turn off auto-renewal in the billing settings at any time.
4.6 Renewal price cap. At renewal, the fees for the same plan, add-ons, and seat counts will not increase by more than seven percent (7%) over the fees for the immediately preceding 12 months. This cap does not apply to added seats, added frameworks, added add-ons, a change to a higher tier, or discounts that were expressly limited to the initial term.
4.7 Taxes. Fees exclude taxes. You are responsible for sales, use, VAT, GST, and similar taxes on your purchase, other than taxes on our net income. If we are required to collect a tax, we will add it to your invoice.
4.8 Refunds. Fees are non-refundable except as stated in our Refund Policy (https://ezgrc.app/legal/refunds) or where these Terms say otherwise.
5. Purchases through cloud marketplaces
If you buy the Service through AWS Marketplace or another cloud marketplace:
- the marketplace provider bills you and collects payment, and the pricing, term, and renewal shown in the marketplace offer apply;
- the end-user license agreement attached to the marketplace offer (for AWS Marketplace, the Standard Contract for AWS Marketplace, unless a different agreement is attached) governs your purchase; and
- these Terms apply to the extent they do not conflict with that agreement. If they conflict, the marketplace agreement controls for that purchase.
6. Your responsibilities
6.1 You are responsible for your Users' compliance with these Terms and the Acceptable Use Policy (https://ezgrc.app/legal/aup), and for keeping account credentials secure.
6.2 You are responsible for the accuracy and legality of Customer Data, and for having all rights, notices, and consents needed for us to process it as described in these Terms and the Data Processing Addendum.
6.3 If you connect a cloud account or other system, you are responsible for granting only the permissions you intend. Our recommended AWS integration uses a read-only role; you can review and revoke it at any time.
6.4 You will notify us promptly at security@zerosandones.us if you become aware of unauthorized access to your account.
7. Customer Data and privacy
7.1 Ownership. As between the parties, you own Customer Data. You grant us a limited right to host, copy, process, transmit, and display Customer Data only as needed to provide, secure, and support the Service, and as you direct.
7.2 Data Processing Addendum. Our Data Processing Addendum (https://ezgrc.app/legal/dpa) applies to personal data in Customer Data and forms part of these Terms.
7.3 Security. We maintain administrative, technical, and physical safeguards designed to protect Customer Data, described in Annex 2 of our Data Processing Addendum (https://ezgrc.app/legal/dpa/).
7.4 Usage data. We may collect technical and usage data about how the Service is used (for example feature usage and performance metrics) to operate, secure, and improve the Service. We will only use usage data outside the Service in aggregated or de-identified form that does not identify you or any individual.
7.5 Privacy Policy. Our Privacy Policy (https://ezgrc.app/legal/privacy) explains how we handle personal data about Users and website visitors.
7.6 Trust Center content. If you publish a Trust Center through the Service, you control what is published and who can access it. Content you make public is public.
8. Our intellectual property
We and our licensors own the Service, the Documentation, and all related software, templates, framework mappings, and content we provide (other than Customer Data), including improvements. These Terms don't transfer any ownership to you. If you give us feedback or suggestions, we may use them without obligation to you.
You will not, and will not allow anyone to: (a) copy, modify, or create derivative works of the Service, except for templates and policies we expressly provide for you to adapt; (b) reverse engineer or attempt to extract source code, except to the extent the law allows despite this restriction; (c) resell, sublicense, or provide the Service to third parties, except as permitted by a reseller or partner agreement with us; (d) access the Service to build a competing product; or (e) bypass usage limits or security measures.
9. Confidentiality
Each party may receive non-public information from the other that is marked confidential or that a reasonable person would understand to be confidential ("Confidential Information"). Customer Data is your Confidential Information. The receiving party will use the other party's Confidential Information only to perform under these Terms, protect it with at least reasonable care, and share it only with its employees, contractors, and service providers who need to know it and are bound by similar obligations. This doesn't apply to information that is or becomes public through no fault of the receiving party, was already known to it, is independently developed, or is rightfully received from a third party. A party may disclose Confidential Information if required by law, after giving reasonable notice to the other party where legally allowed.
10. Warranties and disclaimers
10.1 We warrant that, during a paid Subscription Term, the Service will perform materially as described in the Documentation, and we will not materially decrease the overall security of the Service. Your exclusive remedy for a breach of this warranty is for us to fix the non-conformity, or, if we can't within a reasonable time, for you to terminate the affected Order and receive a pro-rata refund of prepaid fees for the remaining term.
10.2 EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE IS PROVIDED "AS IS" AND WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE ERROR-FREE OR UNINTERRUPTED, THAT AI OUTPUT WILL BE ACCURATE, OR THAT USE OF THE SERVICE WILL RESULT IN A SUCCESSFUL AUDIT OR CERTIFICATION.
11. Term, termination, and your data
11.1 These Terms apply from when you first accept them until all Orders have ended.
11.2 Either party may terminate an Order if the other party materially breaches these Terms and doesn't cure the breach within 30 days after written notice.
11.3 If we terminate for your breach, you pay any unpaid fees for the rest of the Subscription Term. If you terminate for our breach, we refund prepaid fees for the remaining term.
11.4 Data export. During the Subscription Term, and for 30 days after it ends, you can export Customer Data using the Service's export features (the account will be read-only during the 30 days after it ends). After that period, we delete Customer Data from the production Service, and from backups on their normal rotation (within 35 days), unless the law requires us to keep it.
11.5 Sections that by their nature should survive (including fees owed, confidentiality, intellectual property, disclaimers, limitation of liability, and indemnification) survive termination.
12. Limitation of liability
12.1 EXCEPT FOR EXCLUDED CLAIMS, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, OR GOODWILL, EVEN IF ADVISED OF THEIR POSSIBILITY.
12.2 EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE FEES PAID AND PAYABLE BY YOU TO US FOR THE SERVICE IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE LIABILITY. FOR A FREE TRIAL, OUR TOTAL LIABILITY IS LIMITED TO US$100.
12.3 "Excluded Claims" means: (a) your obligation to pay fees; (b) a party's indemnification obligations; (c) a party's breach of Section 9 (Confidentiality), other than breaches involving Customer Data, which are subject to Section 12.4; and (d) a party's gross negligence, fraud, or willful misconduct.
12.4 For claims arising from our breach of our data-security obligations, our total liability will not exceed two (2) times the amount in Section 12.2.
13. Indemnification
13.1 By us. We will defend you against any third-party claim alleging that the Service, as provided by us, infringes that third party's intellectual property rights, and pay the resulting damages and costs finally awarded or agreed in settlement. If such a claim occurs or is likely, we may modify the Service, get you a right to keep using it, or terminate the affected Order and refund prepaid fees for the remaining term. This doesn't apply to claims caused by Customer Data, third-party services, combinations with things we didn't provide, or use in breach of these Terms.
13.2 By you. You will defend us against any third-party claim arising from Customer Data or your use of the Service in breach of these Terms or the law, and pay the resulting damages and costs finally awarded or agreed in settlement.
13.3 Process. The indemnified party must promptly notify the other, give it control of the defense and settlement (no settlement may impose obligations on the indemnified party without its consent), and provide reasonable cooperation.
14. General
14.1 Governing law and venue. These Terms are governed by the laws of the State of Florida, without regard to conflict-of-law rules. The state and federal courts located in Orange County, Florida have exclusive jurisdiction, and each party consents to them.
14.2 Changes to these Terms. We may update these Terms. If a change is material, we will notify you at least 30 days before it takes effect (by email or in the Service). Changes apply to your next renewal, unless they are required by law or you accept them earlier. Your current Subscription Term continues under the version you accepted.
14.3 Publicity. We won't use your name or logo as a customer without your permission, except as agreed under founding-customer pricing (Section 4.4).
14.4 Assignment. Neither party may assign these Terms without the other's consent, except to a successor in a merger, acquisition, or sale of substantially all its assets, with notice.
14.5 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control (other than payment obligations).
14.6 Export and sanctions. You will not use the Service in violation of US export control or sanctions laws, or from or for the benefit of a country, region, or person subject to comprehensive US sanctions.
14.7 Notices. Notices to us go to legal@zerosandones.us and our postal address above. Notices to you go to the account owner's email address.
14.8 Entire agreement. These Terms, together with the Order, the Data Processing Addendum, the Acceptable Use Policy, the Service Level Agreement, and the Refund Policy, are the entire agreement on this subject. If they conflict, the order of precedence is: the Order, the Data Processing Addendum, these Terms, then the other policies. Terms in a purchase order you send us don't apply.
14.9 Other. If a provision is unenforceable, the rest remains in effect. A failure to enforce a provision is not a waiver. The parties are independent contractors.
Questions about these Terms: legal@zerosandones.us.