Terms of Service

Effective November 8, 2026

These terms are an agreement between CloudOneSoftware LLC, a New Jersey limited liability company ("we", "us"), and the organization that signs up for AssuranceGraph ("you"). AssuranceGraph is the software at assurancegraph.ai and app.assurancegraph.ai, including the web app, its API and the Sovereign Node software (together, "the Service"). The person who accepts these terms confirms they have authority to bind their organization.

1. What the Service does

AssuranceGraph helps you prepare for a CMMC Level 2 assessment. It scores the 110 NIST SP 800-171 requirements using the method in 32 CFR 170.24, keeps your System Security Plan and POA&M in step with the evidence you record, and produces exports such as OSCAL files.

The Service is a readiness tool. We are not a C3PAO, a Registered Practitioner Organization or a law firm, and using the Service does not certify you, guarantee that you will pass an assessment, or replace the judgment of your assessor or advisers. Scores the Service calculates come from the information you enter. You are responsible for the accuracy of any score you submit to SPRS or any affirmation your Affirming Official makes.

2. Accounts and users

• You sign in through the identity provider we support. Keep sign-in credentials secret and tell us promptly at contact@cloudonesoftware.com if you believe an account has been compromised.
• You decide who joins your workspace and which role each person has. You are responsible for what your users do in the Service.
• You must be a business or government organization. The Service is not for personal or household use.

3. Plans, payment and taxes

• Paid plans (Essentials, Professional and Enclave) are subscriptions billed monthly or yearly in advance, at the prices shown when you subscribe.
• Payments are handled by Stripe, which sells your subscription to you through its Link service and acts as merchant of record for the purchase. Stripe charges your payment method, calculates and collects any sales tax or VAT, and issues your invoices and receipts. Link's terms and privacy policy, which you accept at checkout, apply to the payment itself; these terms apply to your use of the Service.
• Subscriptions renew automatically at the end of each billing period until cancelled.
• You can change plans or cancel at any time from Manage billing in the app. A cancellation takes effect at the end of the current billing period, and you keep access until then. When you upgrade, the price difference for the rest of the period is prorated. Except where the law requires otherwise, we do not refund partial billing periods.
• We may change prices for future billing periods. We will tell you at least 30 days before a price change applies to your subscription.
• Pilot workspaces may be offered without charge for a limited time. We will tell you before a pilot workspace needs a paid plan.

4. Your data

• You own the information you put into the Service ("Customer Data"). You give us permission to host, process and display Customer Data only to provide, secure and support the Service for you.
• Our Privacy Policy explains what we collect and who helps us run the Service.
• You can export your Customer Data while your workspace is active. After your subscription ends, you can ask us to export or delete it; unless you ask otherwise, we delete Customer Data within 90 days after the end of your subscription, except where we must keep records by law.

5. Controlled Unclassified Information

The hosted Service is designed to hold compliance records about your environment, such as requirement status, evidence descriptions, file hashes, policies and plans. Do not upload Controlled Unclassified Information (CUI) itself to the hosted Service unless we have agreed in writing that your workspace may hold it. Sovereign Mode, available on the Enclave plan, runs AI drafting for CUI on hardware inside your own boundary; you are responsible for securing that hardware and the network it sits on.

6. Acceptable use

You agree not to:

• use the Service to break the law, including export control and sanctions laws;
• probe, scan or test the security of the Service without our written permission, or try to get around its access controls or rate limits;
• access another organization's workspace or data;
• resell or sublicense the Service, or use it to build a competing product;
• upload malicious code or content you don't have the right to use.

We may suspend access that puts the Service, other customers or the law at risk. Where we can, we will tell you first and give you a chance to fix the problem.

7. Our responsibilities

We will run the Service with reasonable care and industry-standard security, including encryption in transit, tenant isolation in the database and a tamper-evident audit log. We may update the Service over time; we will not make changes that materially reduce its core functions during a paid billing period. We will notify you without undue delay if we confirm a security incident that affects your Customer Data.

8. Intellectual property and feedback

We own the Service, its software and its content, except Customer Data. If you send us suggestions, we may use them without obligation to you.

9. Confidentiality

Each side will protect the other's non-public information with at least reasonable care and use it only for the purposes of this agreement.

10. Warranties and disclaimers

Except as stated in these terms, the Service is provided "as is" and "as available". To the extent the law allows, we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement, and we do not warrant that the Service will be uninterrupted or error-free or that it will produce any particular assessment result.

11. Limitation of liability

To the extent the law allows, neither side is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or contracts. Each side's total liability arising out of these terms is limited to the amounts you paid for the Service in the 12 months before the event that gave rise to the claim. These limits do not apply to your payment obligations, to a breach of section 6, or to liability that cannot be limited by law.

12. Indemnity

You will defend and indemnify us against third-party claims arising from Customer Data you upload without the right to do so or from your breach of section 6.

13. Term and termination

These terms apply while you use the Service. Either side may end them if the other materially breaches them and does not fix the breach within 30 days of notice. Sections 4, 8 to 12 and 14 continue after the terms end.

14. General

• These terms are governed by the laws of the State of New Jersey, without regard to its conflict-of-laws rules. The state and federal courts located in New Jersey have exclusive jurisdiction.
• We may update these terms. We will post the new version here with a new effective date and, for material changes, tell you by email or in the app at least 30 days before they apply.
• A signed agreement between you and us, such as an order form, takes precedence over these terms where they conflict.
• Neither side is responsible for delays caused by events beyond its reasonable control.
• You may not assign these terms without our consent, except to a successor of your business. If a provision is unenforceable, the rest remains in effect.

15. Contact

CloudOneSoftware LLC, 62 Danforth Ave, Jersey City, NJ 07305
contact@cloudonesoftware.com