Terms and privacy

These Terms of Service ("Terms") govern access to and use of MetisForge and related products and websites provided by MetisGrid ("MetisGrid", "we", "us") (the "Service"). By creating an account, accepting an order, or using the Service, you agree to these Terms on behalf of yourself and the organisation you represent ("Customer", "you"). If you do not have authority to bind that organisation, do not use the Service.

If Customer has signed a separate agreement or order form with MetisGrid, that agreement controls where it conflicts with these Terms.

1. The Service

MetisForge helps security teams design, run and report on tabletop exercises and related training. Features, AI capabilities and limits depend on Customer's subscription tier and order. We may improve, change or retire features, and will not materially reduce the core functionality of a paid subscription during its term.

2. Accounts and access

• Customer is responsible for its users, their credentials and all activity under its accounts. Keep credentials confidential and notify us promptly at info@metisgrid.com of any suspected unauthorised access.
• Access is licensed per named user or per organisation, as stated in the order. Accounts may not be shared between individuals.
• Administrators control their organisation's users, roles, groups, report releases and optional features.

3. Customer content

• Ownership. Customer owns all content it and its users submit to the Service, including scenarios, answers, reports and uploaded documents ("Customer Content"), and all output generated for Customer from it.
• Licence to us. Customer grants MetisGrid a limited licence to host, process, transmit and display Customer Content solely to provide, secure and support the Service. We do not use Customer Content to train AI models.
• Responsibility. Customer is responsible for the legality of Customer Content and for having the rights to submit it. Customer will sanitise material before uploading: remove credentials, live secrets, personal data that is not needed, and regulated data (such as payment card, health or government identifier data). The Service is not designed to store such data.
• Privacy. Our handling of personal information is described in our Privacy Policy.

4. AI features

The Service uses AI to draft scenarios, suggest content and analyse exercise results. AI output may be inaccurate or incomplete. It is provided to assist qualified professionals and must be reviewed before it is relied on. Customer remains responsible for decisions made using the Service, including scores and report findings.

5. Acceptable use

Customer will not, and will not permit anyone to:

• access or attempt to access another customer's data, or probe, scan or test the Service's vulnerabilities without our written permission;
• attempt to extract other customers' information, system instructions or credentials from the AI features (for example by prompt injection), or use the AI features to produce harmful, unlawful or deceptive material;
• upload malware, live exploit code aimed at third parties, or content that infringes others' rights;
• reverse engineer, copy or resell the Service, or use it to build a competing product;
• use the Service in violation of law or export controls, or interfere with its operation or other users.

We may suspend access that we reasonably believe threatens the security or integrity of the Service or other customers, and will notify Customer promptly when we do.

Security research. We welcome responsible disclosure. Report suspected vulnerabilities to info@metisgrid.com; please do not access data that is not yours, and give us reasonable time to respond before any disclosure.

6. Security

We maintain administrative, technical and organisational safeguards designed to protect Customer Content, as described in our Privacy Policy, including encryption in transit and at rest, database-enforced tenant isolation and access logging. We will notify Customer without undue delay after confirming a breach affecting Customer Content.

7. Subscriptions, fees and trials

• Fees, tiers, user counts and terms are set out in the order or the pricing presented at purchase. Unless stated otherwise, subscriptions renew for the same term and fees are payable in advance and non-refundable.
• Trials and pilots are provided free of charge, as-is, for evaluation, and may end at any time.
• We may change prices for a renewal term with at least 30 days' notice.

8. Third-party products

The Service may integrate with or reference third-party products and frameworks (for example MITRE ATT&CK). Their use is subject to their own terms, and MetisGrid is not responsible for them.

9. Intellectual property

MetisGrid owns the Service, its software, designs, templates and documentation, and all improvements to them. Feedback is welcome and may be used without obligation. Except for the rights expressly granted in these Terms, no rights are granted to either party.

10. Confidentiality

Each party will protect the other's non-public information with at least reasonable care, use it only to perform under these Terms, and disclose it only to those who need to know it and are bound by similar obligations, or as required by law.

11. Term, termination and data return

• These Terms apply while Customer uses the Service. Either party may terminate for the other's material breach not cured within 30 days of notice.
• On termination, access ends. Customer may export its content before the end of the subscription; on written request, we delete Customer Content within 30 days, except where retention is required by law. Backups expire on a rolling schedule.

12. Warranties and disclaimers

MetisGrid warrants that it will provide the Service with reasonable skill and care. Except as expressly stated, the Service is provided "as is" and "as available", and MetisGrid disclaims all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. Tabletop exercises and training improve readiness but do not guarantee that any incident will be prevented or handled successfully.

13. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, and each party's total liability arising out of these Terms is limited to the amounts paid or payable by Customer for the Service in the 12 months before the event giving rise to the claim. These limits do not apply to Customer's payment obligations, either party's breach of confidentiality, or liability that cannot be limited by law.

14. Indemnity

Customer will defend and indemnify MetisGrid against third-party claims arising from Customer Content or Customer's use of the Service in breach of these Terms. MetisGrid will defend and indemnify Customer against third-party claims that the Service, as provided by us, infringes their intellectual property rights.

15. General

• Changes. We may update these Terms by posting a new version with a new effective date; material changes take effect for existing paid subscriptions at renewal, or earlier with notice where required by law or security.
• Governing law. These Terms are governed by the laws of the jurisdiction in which MetisGrid is established, without regard to conflict-of-laws rules, and disputes will be heard by the courts of that jurisdiction.
• Assignment. Neither party may assign these Terms without consent, except to a successor in a merger or acquisition.
• Force majeure. Neither party is liable for delays caused by events beyond its reasonable control.
• Entire agreement. These Terms, the Privacy Policy and any order form are the entire agreement between the parties on their subject.

16. Contact

MetisGrid · info@metisgrid.com

MetisGrid ("MetisGrid", "we", "us") provides MetisForge and related products for cybersecurity tabletop exercises, training and after-action reporting (the "Service"). We build the Service for security teams, and we hold ourselves to the standard our customers apply to their own systems. This policy explains what information we handle, why, how we protect it, and the choices you have.

Questions about this policy or your data: info@metisgrid.com.

1. Our roles

• For your organisation's content (scenarios, exercise answers, reports, uploaded documents and similar material), we act as a processor / service provider: we process it on your organisation's behalf and under its instructions. Your organisation is the controller.
• For account, billing and website information, we act as a controller.

If your organisation has a separate agreement with us (for example a data processing agreement), that agreement takes precedence where it differs from this policy.

2. Information we handle

Account information. Name, work email address, organisation, role in the Service (for example facilitator, analyst or administrator) and authentication data. Passwords are handled by our authentication provider and are never stored by us in readable form.

Customer content. Material you and your colleagues create or upload: scenarios and their injects, exercise answers, chat messages, facilitator notes and scores, after-action reports, training records and documents added to your knowledge library.

Usage and technical information. Records of sign-ins and actions in the Service, error and performance logs, and records of requests made to AI services (time, feature, size, cost and outcome). Our hosting providers process network information such as IP addresses to deliver and protect the Service.

Communications. Messages you send us, such as support or access requests.

We do not ask for, and the Service is not designed to hold, payment card data, government identifiers, health records or other special categories of personal data. Please do not enter them (see section 6).

3. How we use information

• To provide, operate and secure the Service, including the AI features you choose to use.
• To support you and respond to requests.
• To monitor reliability, detect and investigate misuse, and keep the Service secure.
• To meet legal obligations and enforce our Terms of Service.

We do not sell personal information, we do not use your content to advertise, and we do not use your content to train AI models.

4. AI features

Some features send content to third-party AI model providers to generate output: scenario drafts, report analysis, suggestions during an exercise, and search over your knowledge library. In each case:

• The request is assembled on our servers from information the requesting user is already permitted to see. Access is checked by the database before anything is sent, so the AI never receives another organisation's data. A prompt-injection attempt (instructions hidden in text you enter or upload) cannot widen what the AI can see, because the AI has no access to data beyond the request itself.
• We use providers under commercial API terms that do not permit them to train models on the content we send. Where a routing service offers the control, we exclude providers that retain or train on prompts.
• AI output is advisory. Facilitators review scenarios and scores; nothing the AI produces is shown to participants without a person's action.

Optional features that an organisation administrator must switch on (for example live answer analysis during an exercise) may use additional providers; they stay off until enabled. A current list of our subprocessors is available on request from info@metisgrid.com.

5. How we protect information

• Encryption. All traffic to the Service uses TLS. Data is encrypted at rest (AES-256) by our hosting and database providers, including backups and stored documents.
• Tenant isolation in the database. Every table that holds customer content is protected by row-level security policies, so separation between organisations is enforced by the database itself, not only by the application.
• Least-privilege roles. Participants see only what an exercise has revealed to them; answer keys, scoring guides and facilitator material are withheld from participants by the database.
• Secrets management. Service credentials and AI provider keys are kept in an encrypted vault and are never sent to browsers.
• Accountability. Administrative changes (roles, keys, licences, AI settings, report sharing) are recorded in an internal audit log with a fixed retention period, for security investigations.
• Data minimisation. The text of AI requests and responses is deleted from our logs after 90 days; only usage records (time, feature, size, cost) are kept for billing and capacity planning.
• Ongoing review. We test changes before release and review the Service for injection, access-control and AI-specific risks. We will notify affected customers without undue delay if we confirm a breach of their data.

No system is perfectly secure, but we design the Service so that a fault in one layer does not expose customer data on its own.

6. Your responsibilities for content you upload

Tabletop exercises work best with realistic detail, but realism does not require live secrets. Before uploading documents or entering exercise content, remove or replace credentials and keys, internal hostnames and IP addresses, account names, customer, patient or employee data, and anything you would not share with a vendor. The Service asks uploaders to confirm this before each upload. After-action reports can describe weaknesses in your environment; share them only with people who need them, using the Service's release controls.

7. Sharing

We share information only:

• with subprocessors that host, secure and operate the Service (cloud hosting and database, authentication, email delivery and AI model providers), under contracts that limit their use of it to providing services to us;
• within your organisation, as your administrators configure (for example releasing a report to a group);
• when required by law or to protect the rights, safety and security of our users, the public or MetisGrid;
• in a business transfer, such as a merger or acquisition, under commitments at least as protective as this policy.

8. Where information is stored

The Service is hosted in the United States. If you access it from elsewhere, your information is transferred to and processed in the United States, with the safeguards described here and, where required, standard contractual clauses.

9. Retention

• Account information: while the account is active and for a short period afterwards for security and legal records.
• Customer content: until your organisation deletes it, or, on written request when your subscription ends, deleted within 30 days. Backups expire on a rolling schedule.
• AI request content: 90 days. Audit log: a configured retention period (one year by default).

10. Your rights

Depending on where you live, you may have rights to access, correct, delete or export your personal information, and to object to or restrict certain processing. Where your information is part of your organisation's content, please contact your organisation's administrator first; we will help them respond. You can also write to info@metisgrid.com. We will not discriminate against you for exercising these rights.

11. Cookies and local storage

The Service uses your browser's local storage to keep you signed in and to remember interface preferences. We do not use advertising or cross-site tracking cookies, and our website does not use third-party analytics.

12. Changes

We will post changes to this policy on this page and update the effective date. If a change materially affects how we handle customer content, we will notify organisation administrators in advance.

13. Contact

MetisGrid · info@metisgrid.com