Terms of Service

2.1 Subscription right. Subject to the agreement and payment of applicable Fees, Provider grants Customer a limited, non-exclusive, non-transferable right during the Subscription Term to access and use the Services for Customer's internal business operations.

2.2 Deployment model. Services may be Provider-hosted, Customer-hosted or otherwise deployed as stated in the Order Form. For Customer-hosted deployments, Customer is responsible for its infrastructure, operating environment, backups, network access and patching except as an Order Form assigns to Provider.

2.3 Support and availability. Provider will supply the support and any service levels stated in the Order Form. No uptime percentage or service credit applies unless expressly agreed in writing.

Customer will appoint account administrators who may manage users, roles, settings, integrations and Customer Data. Each login is for one named individual and must not be shared; credentials and authentication factors must be protected, and suspected unauthorised access reported promptly.

Customer must not, and must not permit anyone to:

• use the Services unlawfully, fraudulently, to harm others, or to violate third-party rights;
• introduce malware or interfere with the integrity, security or operation of the Services;
• probe, scan or test a vulnerability without Provider's prior written authorisation;
• circumvent access, framework, seat, usage, licence-validation or security controls;
• sell, sublicense, rent or provide the Services as a service bureau unless an Order Form permits it;
• copy, modify, translate, reverse engineer or derive source code except where non-waivable law permits it; or
• remove proprietary notices or upload content Customer has no right to use.

5.1 Ownership. As between the Parties, Customer retains all rights in Customer Data. Customer grants Provider the limited rights necessary to host, process, transmit, protect, support and otherwise handle Customer Data to provide the Services.

5.2 Customer obligations. Customer is responsible for the accuracy, quality and legality of Customer Data and for providing all notices, instructions, permissions and lawful bases needed for its processing.

5.3 Data processing. Where Provider processes personal data on Customer's behalf, the applicable data processing agreement governs that processing.

The Services may include optional artificial-intelligence or machine-learning features. AI output may be incomplete, inaccurate or unsuitable; it is an aid, not legal, safety, audit, certification or compliance advice. Customer must apply qualified human review before relying on or acting upon an output.

Provider will not use Customer Data to train a general-purpose model unless Customer gives express permission or the applicable product terms clearly disclose that use.

Customer may connect integrations, infrastructure, model providers or other third-party services. Provider does not control and is not responsible for third-party products, their availability, changes or data practices.

8.1 Provider safeguards. For systems under its control, Provider will maintain administrative, technical and organisational safeguards appropriate to the nature of the Services and the risks described in the agreement.

8.2 Shared responsibility. Customer must securely configure and administer its deployment, users, integrations, endpoints, backups and infrastructure. A compliance-management platform does not replace Customer's security programme.

Customer will pay the Fees, in the currency and on the dates stated in the Order Form. Fees exclude applicable taxes, duties and levies. Renewal, price changes, upgrades, downgrades and usage limits are governed by the Order Form.

Trial, preview and beta features may be limited, changed or withdrawn at any time and are supplied for evaluation on an “as available” basis without service levels. Customer must not use a beta feature for production, safety-critical or legally determinative activity unless Provider has expressly approved that use in writing.

Each receiving Party will protect the other Party's Confidential Information with at least reasonable care, use it only to perform or exercise rights under the agreement, and disclose it only to personnel and contractors bound by appropriate confidentiality duties.

Provider and its licensors retain all rights in the Services, documentation, software, designs, methods and related intellectual property. No framework publisher's standard, certification mark or proprietary assessment content is transferred to Customer by the Services.

These Terms continue while Customer has an active Order Form, trial or authorised access. Either Party may terminate an affected Order Form for a material breach not cured within thirty days after written notice. On termination, Customer may export Customer Data during any post-termination period stated in the Order Form or data-retention policy.

EXCEPT FOR EXPRESS WARRANTIES IN THE AGREEMENT AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES, TRIALS, OUTPUTS AND PROFESSIONAL SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”.

The Services support internal readiness and compliance management. They do not provide legal advice, guarantee compliance, issue a certification, replace an accredited auditor or assessor, or guarantee that an authority or certification body will accept Customer's controls or evidence. References to third-party frameworks do not imply affiliation, endorsement or certification by their publishers or governing bodies.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE OR CONSEQUENTIAL LOSS ARISING FROM THE AGREEMENT.

Except for claims that cannot lawfully be limited, each Party's total aggregate liability arising out of the agreement will not exceed the Fees paid or payable for the affected Services during the twelve months before the first event giving rise to liability.

Provider may improve or change the Services during a Subscription Term but will not materially reduce the core functionality purchased under an Order Form without a reasonable substitute or remedy. Provider will give at least thirty days' notice of a material change to these Terms unless a shorter period is reasonably required by law or an urgent security concern.

17.1 Governing law. Unless an Order Form states otherwise, the agreement is governed by the laws of India, without regard to conflict-of-law rules.

17.2 Notices. Legal notices to Provider must be sent to legal@avyntis.in.net.

Neither Party may assign the agreement without the other's consent, not to be unreasonably withheld, except to an affiliate or in connection with a merger or sale of substantially all relevant assets. The Parties are independent contractors. If a provision is unenforceable, it will be modified to the minimum extent necessary and the remaining provisions continue.