Terms of Service

Effective: June 14, 2026

These Terms of Service ("Terms") are a binding agreement between Cabreza, Inc. ("Cabreza," "we," "us," or "our") and the organization on whose behalf you accept them ("Customer," "you," or "your"). They govern your access to and use of the Cabreza platform, websites, applications, APIs, and related services (collectively, the "Services").

By creating an account, clicking "I agree," or using the Services, the individual accepting these Terms represents that they are authorized to bind the Customer, and the Customer agrees to these Terms. If you do not agree, do not use the Services.

The Services are for business and organizational use only. Account registration requires a valid work email address; personal webmail accounts are not accepted. These Terms apply to self-serve plans. Enterprise customers may instead sign a separate master agreement and order form, which controls over these Terms where it conflicts.

1. Definitions

  • "Account" — the Customer's registered organizational workspace.
  • "Authorized Users" — individuals the Customer permits to use the Services under its Account (employees, contractors, agents).
  • "Customer Content" — data, documents, files, and information that the Customer or its Authorized Users submit to, upload to, or create in the Services, including the Customer's Digital Twin (its private inventory of its own environment) and any documents the Customer generates using the Services.
  • "Platform Intelligence" — the entity, vulnerability, regulatory, standards, and threat-intelligence data Cabreza compiles, curates, and makes available through the Services, including the shared corpus and intelligence about organizations derived from public and licensed sources (see Section 7 and the Intelligence Sourcing & Takedown Policy).
  • "Generated Output" — content produced by the Services' AI features at the Customer's direction, including AI-drafted compliance and standards documents and assistant responses.
  • "Credits" — the prepaid usage units consumed by metered features (see Section 5).
  • "Documentation" — Cabreza's then-current user and developer documentation for the Services.
  • "Order" — the plan selection, checkout, or order form under which the Customer subscribes.
  • "Feedback" — suggestions, ideas, enhancement requests, or other feedback that the Customer or its Authorized Users provide to Cabreza about the Services.
  • Capitalized terms not defined here have the meaning given in the Privacy Policy, Acceptable Use Policy, Developer/API Terms, and Data Processing Addendum, each incorporated into these Terms by reference.

2. The Services and License

2.1 Right to Use

Subject to these Terms and payment of applicable fees, Cabreza grants the Customer a non-exclusive, non-transferable, non-sublicensable right during the subscription term to access and use the Services and Documentation for the Customer's internal business purposes, in accordance with the Customer's plan and any usage limits (such as active-target caps, seat counts, and Credit allowances).

2.2 What the Services Include

The Services may include, depending on plan: the Digital Twin (the Customer's private environment inventory), content generation (AI-drafted compliance and standards documents), Cooper (an AI assistant), Horizon (third-party intelligence and monitoring), Feeds and Corpus (curated intelligence and reference content), Search, and a developer API and MCP server. Cabreza may add, modify, or discontinue features; we will not materially reduce the core functionality of a paid plan during a paid term without reasonable notice. If Cabreza materially reduces core functionality of a paid plan mid-term, the Customer may terminate the affected subscription and receive a prorated refund of prepaid, unused fees attributable to the remainder of the term.

2.3 Reservation of Rights

The Services are licensed, not sold. As between the parties, Cabreza retains all right, title, and interest in and to the Services, the Platform Intelligence, the Documentation, all software, models, and underlying technology, and all intellectual property therein. No rights are granted except as expressly stated.

2.4 Restrictions

The Customer will not, and will not permit any Authorized User or third party to: (a) reverse engineer, decompile, or disassemble the Services except to the extent applicable law permits despite this restriction; (b) rent, lease, lend, resell, or operate a service bureau with the Services; (c) use the Services or any Generated Output or Platform Intelligence to build a competing product or to train any machine-learning model (competing or otherwise); (d) remove or alter any proprietary notices; (e) circumvent usage limits, access controls, or security features; (f) share access credentials or API keys with unauthorized persons; (g) use the Services in violation of the Acceptable Use Policy; (h) benchmark, performance-test, or publish comparative evaluations of the Services without Cabreza's prior written consent; or (i) systematically analyze, reverse-engineer, or attempt to derive the generation methodology, output structure, or prompting patterns of the Services by studying outputs or by any other means. Additional rules for the developer API are in the Developer/API Terms.

2.5 Trademarks and Publicity

(a) Customer Use of Cabreza Marks. Cabreza grants the Customer a limited, non-exclusive, non-transferable right to use Cabreza's name and marks solely to identify the Services in the Customer's internal documentation and compliance filings. All use must conform to Cabreza's then-current brand guidelines, and any goodwill generated inures to Cabreza.

(b) Cabreza Use of Customer Name. Cabreza may reference the Customer's name and logo to identify the Customer as a customer in marketing materials, case studies, customer lists, and similar contexts. Such use is subject to the Customer's reasonable brand guidelines as communicated in writing, and the Customer may revoke this right on written notice; Cabreza will remove the reference within a reasonable time after receiving such notice.

(c) No Endorsement. Nothing in these Terms implies that either party endorses the other's products, services, or business, or that either party is affiliated with or sponsored by the other.

3. Accounts, Authorized Users, and Security

3.1 Registration

You agree to provide accurate, current, and complete registration information and to keep it updated. You are responsible for all activity under your Account and for your Authorized Users' compliance with these Terms.

3.2 Authority and Seats

You represent that each Authorized User is acting within the scope of your organization and that you have authority to provide any Customer Content you submit. Seat-based plans require a license for each Authorized User.

3.3 Credentials and API Keys

You must keep credentials and API keys confidential and notify us promptly of any suspected unauthorized use. API keys are displayed once at creation and are tied to your Account's permissions (see Developer/API Terms).

3.4 Support Access

To provide support and operate the Services, authorized Cabreza personnel may, in limited circumstances, access your Account or temporarily act within it on your behalf — for example, to diagnose an issue or fulfill a support or provisioning request. Such access is restricted to authorized personnel, time-limited, recorded in an internal audit log, and used only for legitimate support, security, billing, and operational purposes. This is further described in the Privacy Policy.

4. AI Features, Generated Output, and No Professional Advice

4.1 How AI Works in the Services

Certain features use third-party foundation models, accessed exclusively through AWS Bedrock, to process inputs and produce Generated Output. Inputs may include Customer Content (such as your Digital Twin data, uploaded documents, and assistant messages) and Platform Intelligence. Processing is for inference only. Cabreza does not use Customer Content to train foundation models, and our AI sub-processor processes inputs to provide the Services and not to train its own models. The specific models and model providers used may change over time as the Services evolve; Cabreza will give advance notice through the Services or by email of a material change to the foundation models powering AI features (for example, switching model provider or model generation). Routine version upgrades within the same model family do not require notice. See the Privacy Policy and Data Processing Addendum for sub-processor details.

4.2 "As Is" / No Professional Advice

Generated Output — including AI-drafted compliance documents, standards mappings, posture summaries, discoveries, and assistant responses — is provided for informational purposes only and may contain errors, omissions, or inaccuracies. It is not legal, regulatory, compliance, engineering, security, financial, or professional advice, and creates no professional or fiduciary relationship. Generated Output is produced by automated means and is not reviewed by Cabreza personnel before delivery to you. The Customer is solely responsible for independently reviewing, verifying, and validating all Generated Output before relying on it or using it for any compliance, regulatory, operational, or business decision. Cabreza does not warrant the accuracy, completeness, or fitness of any Generated Output, including any document generated to address NERC CIP, IEC 62443, NIS2, or any other standard, regulation, or framework.

Generated Output must not be submitted to any regulator, auditor, or certification body without independent review and validation by a qualified professional. Cabreza makes no representation that any Generated Output satisfies any regulatory, certification, or audit requirement.

To the maximum extent permitted by law, Cabreza's liability for any claim arising from Generated Output — including claims based on regulatory non-compliance, inaccuracy, or failure to detect a risk — is subject to and governed by the limitations in Section 13, and is not excluded from those limitations by any professional-advice doctrine, fitness-for-purpose theory, or similar principle.

4.3 The Cooper Assistant

Cooper acts as an automated tool at the Customer's direction and does not create obligations binding on third parties. The Customer is solely responsible for reviewing any record Cooper creates or modifies before relying on it (see Section 4.2). Cooper can take actions within your Account at your direction — such as creating or updating records, adding monitored targets, or initiating research — and you are responsible for actions taken through the assistant under your Account. Certain bulk actions (higher-volume changes as described in the Documentation) require your confirmation before they are applied; that confirmation step is not a substitute for human review.

4.4 Ownership of Generated Output

As between the parties, the Customer owns the documents it generates using the Services and any Customer Content it provides. To the extent any Cabreza intellectual property is inseparably incorporated into Generated Output, Cabreza grants the Customer a non-exclusive, royalty-free, perpetual license to use, copy, and distribute such Generated Output (including the embedded Cabreza IP) for the Customer's internal business purposes and external compliance submissions.

Cabreza retains all rights in the Services, the underlying models and prompts, the Platform Intelligence, and any templates, blueprints, or structural patterns. The Customer grants Cabreza the licenses in Section 6. Cabreza may incorporate de-identified structural patterns derived from platform usage into reusable platform templates. For purposes of this Section, "structural patterns" means document schema, section ordering, heading taxonomy, and formatting conventions that have been stripped of all Customer-specific text, identifiers, and operational detail; this does not permit deriving patterns attributable to any individual Customer's configuration or control profile. See also Section 6.4.

4.5 Security Incidents

If Cabreza becomes aware of a security incident affecting Customer Content, Cabreza will notify the Customer without undue delay and as further described in the Data Processing Addendum and Privacy Policy.

4.6 AI Operational Incidents

If Cabreza becomes aware of a systematic failure in the AI features that has materially affected the accuracy of Generated Output delivered to the Customer, or of a security compromise affecting Customer Content in transit to AI sub-processors, Cabreza will notify the Customer without undue delay. Cabreza is not liable for model-provider outages or failures beyond its reasonable control, subject to Section 16.

5. Plans, Credits, Fees, Renewal, and Payment

5.1 Plans and Free Tier

The Services are offered in plans, including a free tier and paid tiers. Plan features, usage limits, and prices are as described at checkout or in your Order. Some features are marked "coming soon" and are not available until released; we do not guarantee delivery dates for unreleased features.

5.2 Credits

Metered features consume Credits. Credits are issued in buckets: plan-grant Credits reset each billing period and do not roll over (use-it-or-lose-it); purchased Credits do not expire and roll over; bonus Credits are granted at our discretion. When Credits are exhausted, metered features stop until more are available. Purchased Credit packs are non-refundable except as required by law.

5.3 Fees, Billing, and Taxes

Paid plans are billed through our payment processor. You authorize recurring charges for your subscription and any add-ons. Fees are exclusive of taxes, which you are responsible for (other than taxes on Cabreza's income). Except as required by law or expressly stated, fees are non-refundable and payments are non-cancelable for the paid term.

5.4 Subscription Term, Renewal, and Cancellation

Paid subscriptions renew automatically for successive terms equal to the then-current term unless you cancel before the renewal date. You may cancel at any time through the Services or your self-service billing portal; cancellation takes effect at the end of the current paid term. Renewal is at the then-current price for your plan; Cabreza will give at least 30 days' advance notice by email to the account's billing contact of any price change applying on renewal.

5.5 Trials

Trials, where offered, convert to or expire per the terms presented at signup. We may modify or discontinue trials at any time.

6. Customer Content

6.1 Ownership

As between the parties, the Customer owns its Customer Content.

6.2 License to Operate the Services

The Customer grants Cabreza a worldwide, non-exclusive license to host, copy, process, transmit, display, and otherwise use Customer Content solely to provide, secure, support, and improve the Services for the Customer, including by sending it to sub-processors (such as AWS Bedrock for AI features) as needed to deliver requested functionality. This license does not permit Cabreza to use Customer Content to train foundation models or to disclose it to other customers, except as de-identified aggregate data per Section 6.4. This license terminates upon expiration or termination of the Customer's subscription, except to the extent Cabreza retains Customer Content during the post-termination export period described in Section 6.5 and Section 11.4, in which case the license continues solely as needed to fulfill that export obligation.

6.3 Responsibility for Customer Content

You represent that you have the rights necessary to submit your Customer Content and that it does not violate law or third-party rights. You are responsible for the accuracy and legality of Customer Content.

6.4 Aggregated and De-Identified Data

Cabreza may generate aggregated, de-identified statistics and benchmarks from usage of the Services (for example, anonymized "organizations like you" cohort signals). Such data is stripped of identifiers, subject to a minimum-cohort-size floor, excludes the Customer's own data from its own benchmarks, and never identifies the Customer or attributes data to a named organization. Cabreza owns this aggregated data. See also Section 4.4 for the treatment of de-identified structural patterns.

6.5 Data Portability

The Customer may export its Customer Content through the Services as described in the Privacy Policy. On request, Cabreza will make Customer Content available for export for a limited period following termination, after which it is deleted in accordance with our deletion practices.

6.6 Feedback

If the Customer or its Authorized Users provide Feedback to Cabreza, the Customer grants Cabreza a perpetual, irrevocable, worldwide, royalty-free license to use, reproduce, modify, and incorporate such Feedback into the Services or otherwise without restriction or obligation to the Customer. Feedback is not Customer Content and Cabreza has no confidentiality obligation with respect to it.

6.7 DMCA Notice and Takedown

Cabreza respects third-party intellectual property rights. Cabreza designates a copyright agent ([DMCA agent — to be designated]) to receive notices of alleged copyright infringement in Customer Content. Cabreza will follow a notice-and-counter-notice procedure consistent with the Digital Millennium Copyright Act. To submit a notice, contact the designated agent with the information required by 17 U.S.C. § 512(c)(3). Cabreza may terminate accounts of repeat infringers.

7. Platform Intelligence and Third-Party Content

7.1 Provided "As Is"

The Platform Intelligence — including entity data, vulnerability and advisory records, standards and regulatory reference content, feeds, and intelligence derived from public sources — is compiled from public and third-party sources and is provided for informational purposes only, without warranty of accuracy or completeness.

7.2 Shared Corpus

Platform Intelligence is shared across customers. Intelligence Cabreza compiles about an organization (a "target") may be visible to any customer that monitors that organization. The Customer does not own the Platform Intelligence and may use it only within the Services per these Terms.

7.3 Third-Party Source Restrictions

Some reference content (such as certain standards and regulatory documents) is subject to publisher restrictions on redistribution and AI ingestion, which Cabreza enforces. You must not extract, redistribute, or use such content except as the Services permit.

7.4 Intelligence About Third Parties

The Services compile intelligence about organizations and individuals who are not customers, from public sources. The Customer must use such intelligence lawfully and in accordance with the Acceptable Use Policy and the Intelligence Sourcing & Takedown Policy, and must not use it to harass, stalk, or unlawfully target any person or organization.

8. Privacy and Data Protection

Our collection and use of personal data is described in the Privacy Policy. Where Cabreza processes personal data on the Customer's behalf, the Data Processing Addendum applies. The Services are hosted in the United States. Data-residency options may be available to Enterprise customers.

9. Acceptable Use

Your use of the Services is subject to the Acceptable Use Policy, incorporated by reference. We may suspend or limit access for violations or for conduct that threatens the security, integrity, or availability of the Services or others.

10. Confidentiality

Each party may receive the other's non-public information ("Confidential Information"). The receiving party will: (a) use it only to perform under these Terms; (b) protect it using measures at least as protective as it uses for its own similar confidential information, and no less than commercially reasonable measures; and (c) not disclose it to third parties except to employees, contractors, and advisors who need it to fulfill the receiving party's obligations and are bound by confidentiality obligations at least as protective as these Terms.

This does not apply to information that is or becomes public through no fault of the receiving party, was independently developed by the receiving party without use of Confidential Information, or was rightfully received from a third party without restriction. Either party may disclose Confidential Information as required by law or legal process, provided it gives the other party reasonable prior notice where permitted and cooperates with any request for a protective order.

Cabreza's Confidential Information includes the non-public aspects of the Services and Platform Intelligence; the Customer's Confidential Information includes its Customer Content.

Confidentiality obligations survive for five (5) years after termination or expiration of these Terms, except that obligations with respect to information constituting a trade secret continue for as long as that information remains a trade secret under applicable law.

11. Term, Suspension, and Termination

11.1 Term

These Terms apply while you use the Services or have an Account. Subscriptions renew per Section 5.4 until canceled.

11.2 Termination by You

You may cancel your subscription or delete your Account at any time through the Services. Account deletion is processed as described in the Privacy Policy, including a recovery window before permanent deletion.

11.3 Suspension and Termination by Us

We may suspend or terminate access (a) for material breach not cured within a reasonable period, (b) for non-payment — Cabreza will provide notice of a payment failure and may suspend access if the failure is not cured within 10 days of such notice, (c) for violations of the Acceptable Use Policy, or (d) as needed to protect the Services, users, or third parties. We may also terminate a free plan at any time on reasonable notice.

11.4 Effect of Termination

On termination, your right to use the Services ends. We will make Customer Content available for export for a limited period on request, then delete it per the deletion practices described in the Privacy Policy. Shared Platform Intelligence and aggregated de-identified data are not Customer Content and may persist after termination. The following provisions survive termination: Sections 2.3, 2.4, 2.5(c), 4.2, 4.4 (ownership and the embedded-IP license), 6.1 (ownership), 6.4, 6.5 (export and deletion), 6.6, 7, 10, 12, 13, 14, 15, and 16. The operating license in Section 6.2 does not survive termination except to the extent needed to fulfill the export obligation in Section 6.5.

12. Warranties and Disclaimers

EXCEPT AS EXPRESSLY STATED, THE SERVICES, PLATFORM INTELLIGENCE, AND GENERATED OUTPUT ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE FULLEST EXTENT PERMITTED BY LAW, CABREZA DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT ANY OUTPUT OR INTELLIGENCE WILL BE ACCURATE OR COMPLETE. We do not guarantee that the Services will detect every vulnerability, exposure, or risk, or that any compliance content will satisfy any legal or regulatory requirement. Cabreza does not provide a service-level or uptime commitment for the Services except as expressly stated in an Order or Enterprise agreement.

13. Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY LAW: (a) NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR GOODWILL — the "lost data" exclusion in this clause (a) applies to availability and performance claims and does not limit claims for breach of confidentiality under Section 10, which are instead subject to the cap in clause (b) below; AND (b) EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE AMOUNTS PAID BY THE CUSTOMER TO CABREZA IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. These limits do not apply to: (i) a party's liability for fraud or willful misconduct; (ii) the Customer's payment obligations; (iii) amounts owed under either party's indemnification obligations (Section 14); or (iv) a party's breach of its confidentiality obligations (Section 10), which are subject to the cap in clause (b) but not excluded from these Terms by any other limitation. Some jurisdictions do not allow certain limitations; in that case the limitations apply to the maximum extent permitted.

14. Indemnification

By the Customer. The Customer will defend and indemnify Cabreza against third-party claims arising from (a) Customer Content, (b) the Customer's use of the Services or Platform Intelligence in violation of these Terms, the Acceptable Use Policy, or law, or (c) the Customer's misuse of intelligence about third parties.

By Cabreza. Cabreza will defend and indemnify the Customer against third-party claims alleging that the Services, as provided by Cabreza and used in accordance with these Terms, infringe that third party's patent, copyright, trademark, or trade secret. If the Services are or may become the subject of such a claim, Cabreza may, at its option, (i) procure the right for the Customer to continue using the Services, (ii) modify or replace the Services to make them non-infringing, or (iii) terminate the affected Services and refund any prepaid, unused fees. These options are Cabreza's sole obligation and the Customer's sole remedy with respect to any IP infringement claim covered by this section. This obligation does not apply to claims arising from: Customer Content; the Customer's combination of the Services with non-Cabreza products; modifications not made by Cabreza; use in violation of these Terms; the Customer's modification of Generated Output after delivery; or the Customer's continued use of a superseded version of the Services after Cabreza offered a non-infringing update.

The indemnifying party controls the defense; the indemnified party will provide reasonable cooperation and may participate with its own counsel.

15. Governing Law and Disputes

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-laws rules. The parties consent to the exclusive jurisdiction of the state and federal courts located in Delaware and waive objections to venue.

16. General

  • Changes to these Terms. We may update these Terms; material changes will be notified through the Services or by email, and continued use after the effective date constitutes acceptance.
  • Entire Agreement. These Terms, the incorporated policies, and any Order are the entire agreement and supersede prior agreements on the subject, including any prior Terms of Use or End User License Agreement.
  • Assignment. You may not assign these Terms without our consent; we may assign in connection with a merger, acquisition, or sale of assets.
  • Force Majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control. The affected party will give the other party prompt notice of the force majeure event and will use commercially reasonable efforts to resume performance as soon as practicable.
  • Severability; No Waiver. If any provision is unenforceable, the rest remains in effect; failure to enforce is not a waiver.
  • Export and Sanctions. You will comply with applicable export-control and sanctions laws and represent you are not located in an embargoed jurisdiction or on a restricted-party list.
  • Electronic Communications. You consent to receive notices and disclosures electronically.
  • Relationship. The parties are independent contractors; these Terms create no partnership, agency, or joint venture.

17. Contact

Cabreza, Inc. — legal@cabreza.com — 18 Manassas Dr, Middletown, Delaware 19709, US