Terms of Service

These Terms of Service ("Terms") govern access to and use of MetisForge and related products, websites and services (collectively, the "Service") provided by MetisGrid ("MetisGrid", "we", "us" or "our").

1. Parties, Acceptance and Definitions

Customer and Users

"Customer" means the organization that purchases or registers for the Service, or on whose behalf an account is created.

"User" means an individual authorized by Customer to access the Service, including administrators, facilitators, participants and observers.

Customer agrees to these Terms by executing an Order, accepting them in the Service, or using the Service. The individual accepting on Customer's behalf represents that they have authority to bind Customer.

Each User agrees to Sections 2 (Accounts), 7 (Acceptable Use) and 11 (Confidentiality) by accessing the Service. Users are not individually responsible for Customer's payment, indemnification or other organizational obligations.

Order of precedence

If Customer and MetisGrid enter into an Order, master services agreement or other written agreement covering the Service, that agreement controls to the extent of any conflict with these Terms. The Data Processing Addendum controls for matters concerning processing of Personal Data.

Definitions

"Order" means an order form, online purchase, subscription selection or other document that specifies the Service, subscription term, fees and quantities purchased by Customer and references these Terms.

"Customer Content" means information, documents, exercise materials, scenarios, injects, responses, notes, scores, reports and other content submitted to or created within the Service by or for Customer.

"Personal Data" means information relating to an identified or identifiable natural person, as that concept is defined under applicable data-protection law.

"Documentation" means MetisGrid's then-current user documentation for the Service.

"DPA" means the MetisGrid Data Processing Addendum.

"Security Incident" has the meaning in Section 8.

2. Eligibility, Accounts and Administration

The Service is intended for business and professional use and is not directed to individuals under 18 years of age.

Customer is responsible for:

• ensuring that its Users are authorized to use the Service;
• maintaining the confidentiality and security of account credentials;
• activity conducted through its accounts;
• configuring Users, roles, groups, permissions and report access appropriately; and
• promptly notifying MetisGrid of suspected unauthorized access.

Each User is responsible for keeping their own credentials confidential and for activity under their account. Individual User credentials may not be shared unless the applicable subscription expressly allows shared accounts.

Customer administrators may manage Users, permissions, exercise access and other organizational settings. Customer administrators accept these Terms and the DPA on Customer's behalf.

3. Orders, Subscriptions and Fees

Subscription terms, fees, authorized Users, usage limits and purchased functionality are specified in the applicable Order.

Unless an Order states otherwise:

• subscriptions are billed in advance;
• fees are non-refundable except where expressly provided by these Terms or required by law;
• subscriptions renew for the same subscription period unless either party gives notice of non-renewal at least 30 days before the renewal date;
• price changes apply only to a renewal term and will be communicated at least 30 days before renewal; and
• Customer may cancel renewal by notice to MetisGrid.

Trials, evaluations and pilot services may be limited or discontinued at any time unless otherwise stated in an Order.

Customer is responsible for applicable taxes other than taxes based on MetisGrid's net income.

4. Customer Content

Ownership

As between Customer and MetisGrid, Customer retains all rights it has in Customer Content. MetisGrid does not acquire ownership of Customer Content.

License to MetisGrid

Customer grants MetisGrid a non-exclusive, limited license to host, store, copy, transmit, process and display Customer Content only as reasonably necessary to:

• provide and support the Service;
• maintain the security, integrity and reliability of the Service;
• perform Customer's instructions;
• comply with applicable law; and
• enforce these Terms.

AI model training

MetisGrid will not use Customer Content to train artificial-intelligence or machine-learning models, except for model configuration or fine-tuning that Customer expressly requests in writing for Customer's own use.

MetisGrid will require AI subprocessors that process Customer Content on its behalf not to use that Customer Content to train their models, except where Customer expressly authorizes such use in writing.

Customer responsibilities

Customer is responsible for having the rights, permissions and lawful basis necessary to submit and process Customer Content through the Service.

Customer and Users must not submit credentials, passwords, private cryptographic keys, authentication secrets or other information that could directly enable unauthorized access to a production system. Fictional credentials created for exercise purposes are permitted.

Customer should minimize unnecessary Personal Data or regulated information contained in Customer Content.

Customer may include confidential technical and cybersecurity information reasonably necessary to use the Service. Such information is Customer Confidential Information under these Terms.

Customer must not submit protected health information, payment-card information, government identification numbers or other specially regulated information where doing so would impose legal obligations on MetisGrid that have not been expressly agreed in writing.

5. AI Features

The Service uses artificial intelligence to generate or assist with scenarios, injects, questions, analysis, scoring, recommendations, reports, search and related functionality.

Output quality

AI-generated output may be inaccurate, incomplete, non-unique or unsuitable for a particular purpose. Customer is responsible for applying professional judgment before relying on AI-generated output.

MetisGrid does not represent that AI-generated output:

• identifies every relevant threat, control weakness or response issue;
• establishes regulatory or legal compliance;
• constitutes legal, audit, forensic or professional advice;
• predicts how an actual incident will occur or be handled; or
• guarantees cybersecurity readiness or effectiveness.

Human review of scoring

AI-assisted scoring and evaluation of exercise responses is advisory. Scores, grades and assessments produced with AI assistance are presented to a facilitator or administrator designated by Customer for review and may be overridden before they are finalized. The Service does not finalize an evaluation of an individual's performance solely by automated means.

Employment and consequential decisions

The Service is designed to assess cybersecurity exercises, training activities and organizational readiness.

The Service is not designed or authorized to make, or to serve as the sole or determinative basis for, decisions concerning an individual's hiring, termination, promotion, compensation, discipline, certification, access to training or other material terms of employment. Customer is responsible for ensuring that any use of Service output in such decisions complies with applicable law, including laws governing automated decision systems and high-risk AI systems.

AI providers

MetisGrid uses third-party AI providers as subprocessors. Customer Content is provided to those providers only as reasonably necessary to perform the applicable AI function and subject to contractual restrictions applicable to the provider.

AI providers do not receive autonomous access to Customer's MetisGrid environment or databases. MetisGrid uses server-side access-control and tenant-isolation mechanisms designed to restrict information supplied to an AI service to information authorized for the applicable request.

AI functionality is an integral part of the Service.

6. Privacy and Data Processing

MetisGrid's Privacy Notice describes how MetisGrid processes Personal Data in connection with the Service.

Where MetisGrid processes Personal Data on Customer's behalf as a processor or service provider, the DPA applies to that processing and is incorporated into these Terms.

The Privacy Notice is provided for transparency and does not create warranties or contractual obligations beyond those expressly stated in these Terms, an Order, the DPA or another written agreement between the parties.

7. Acceptable Use

Customer and Users will not, and will not permit others to:

• access or attempt to access another customer's information;
• circumvent authentication, authorization, tenant isolation or usage restrictions;
• probe, scan or test the Service for vulnerabilities except in accordance with the MetisGrid Vulnerability Disclosure Policy or with MetisGrid's prior written authorization;
• use prompt injection, model manipulation or similar techniques to attempt to obtain another customer's information, system secrets, credentials or non-public system instructions;
• upload or distribute malware or malicious code;
• use the Service to conduct unauthorized attacks, credential theft, unlawful surveillance or other unlawful activity;
• knowingly submit content that infringes third-party rights;
• interfere with or disrupt the Service;
• reverse engineer the Service except to the extent such restriction is prohibited by law;
• resell or sublicense the Service unless expressly authorized; or
• use the Service in violation of applicable laws, sanctions or export-control requirements.

MetisGrid may suspend access where it reasonably believes continued access presents a material security, legal or operational risk. Where practicable, MetisGrid will notify Customer before suspension, limit the suspension to the affected Users or functionality, and work with Customer to restore access promptly.

8. Security

MetisGrid maintains the administrative, technical and organizational safeguards described in the Security Addendum, designed to protect Customer Content against unauthorized access, use, alteration and disclosure.

No information system can be guaranteed to be completely secure.

"Security Incident" means unauthorized access to, acquisition of, use of, or disclosure of Customer Content in MetisGrid's possession or control that MetisGrid has reasonably determined to have occurred.

Security Incidents do not include unsuccessful attempts or activities that do not compromise Customer Content, such as unsuccessful log-in attempts, blocked attacks, port scans or other unsuccessful network activity.

MetisGrid will notify affected Customers without undue delay, and in any event within 48 hours, after MetisGrid becomes aware of a Security Incident. Notification will be sent to Customer's administrator of record and may be provided in phases as information becomes available.

The Security Addendum forms part of these Terms.

9. Third-Party Services and Subprocessors

The Service may interoperate with third-party services, frameworks or content. Customer's use of third-party products or services may be governed by the terms of the applicable third party.

MetisGrid uses subprocessors to host, secure, operate and support the Service. MetisGrid remains responsible for the acts and omissions of its subprocessors to the same extent MetisGrid would be responsible if performing the services directly.

MetisGrid maintains a current list of subprocessors at the Subprocessor List page and will notify Customer of changes as provided in the DPA.

10. Intellectual Property

MetisGrid retains all right, title and interest in and to the Service, including software, source code, platform architecture, user-interface designs, templates, methodologies, prompts, Documentation, trademarks, branding, and improvements and modifications to those materials ("MetisGrid Technology").

Except for the rights expressly granted in these Terms, no intellectual-property rights are transferred between the parties.

Output

"Output" means content generated by the Service specifically for Customer from Customer Content, including AI-generated scenarios, injects, reports and analyses.

As between Customer and MetisGrid, and to the extent permitted by applicable law, Customer owns Output. MetisGrid assigns to Customer any rights MetisGrid may have in Output, excluding MetisGrid Technology incorporated in it.

To the extent MetisGrid Technology, including templates, frameworks and pre-existing materials, is incorporated in Output, MetisGrid grants Customer a perpetual, non-exclusive, royalty-free license to use, copy and modify that MetisGrid Technology solely as part of the Output for Customer's internal business purposes.

Customer acknowledges that AI-generated Output may not be unique, may be similar to output generated for other customers, and may not qualify for intellectual-property protection.

Feedback

Customer may provide suggestions or feedback about the Service. MetisGrid may use such feedback without restriction or obligation, provided it does not disclose Customer Confidential Information or identify Customer without consent.

11. Confidentiality

"Confidential Information" means non-public information disclosed by one party to the other that is identified as confidential or that reasonably should be understood to be confidential given its nature and the circumstances of disclosure. Customer Content is Customer Confidential Information. The non-public features, pricing and security details of the Service are MetisGrid Confidential Information.

Confidential Information does not include information that the receiving party can demonstrate:

• is or becomes publicly available without breach of an obligation;
• was lawfully known to the receiving party without restriction before disclosure;
• was received lawfully from a third party without confidentiality obligations; or
• was independently developed without use of the disclosing party's Confidential Information.

The receiving party will:

• use Confidential Information only as necessary to perform or receive services under the parties' agreement;
• protect it using at least reasonable care;
• disclose it only to personnel, contractors and subprocessors who need access and are subject to confidentiality obligations; and
• not disclose it to other persons except as permitted by these Terms.

If disclosure is required by law, subpoena or governmental order, the receiving party may disclose the required information and, where legally permitted, will provide reasonable advance notice to the disclosing party and cooperate in seeking protective treatment.

These confidentiality obligations survive termination for five years. Obligations concerning trade secrets continue for as long as the information qualifies for trade-secret protection under applicable law.

12. Term, Termination, Export and Deletion

These Terms remain effective while Customer maintains an account or subscription.

Either party may terminate an Order for material breach if the breach is not cured within 30 days after written notice, or immediately if the breach is incapable of cure.

MetisGrid may terminate or suspend the Service for nonpayment that continues 15 days after written notice.

Customer may terminate for convenience at the end of the then-current subscription term by non-renewal under Section 3.

Export

During the subscription term, Customer may download reports using Service functionality and may request a copy of Customer Content in a commonly used machine-readable format. For 30 days following termination or expiration ("Export Period"), MetisGrid will make Customer Content available for export on request.

Deletion

Within 30 days after the end of the Export Period, MetisGrid will delete Customer Content from active systems, except where retention is required by law or reasonably necessary to establish, exercise or defend legal claims.

Residual copies in backups will be deleted or overwritten within 90 days after deletion from active systems and will not be restored for ordinary business use.

Survival

Sections 4 (Ownership and license to Customer Content as to retained copies), 10, 11, 13, 14, 15, 17 and 18, and any payment obligations accrued before termination, survive termination.

13. Warranties and Disclaimers

Service warranty

MetisGrid warrants that paid Services will perform materially in accordance with the Documentation and will be provided in a professional and workmanlike manner.

Customer's exclusive remedy, and MetisGrid's sole obligation, for breach of this warranty is for MetisGrid to use commercially reasonable efforts to correct the non-conformity, and if MetisGrid cannot do so within 30 days after written notice, Customer may terminate the affected Order and receive a refund of prepaid fees for the remainder of the subscription term.

Disclaimers

Except as expressly stated in these Terms or an Order, and to the maximum extent permitted by law, the Service is provided "as is" and "as available." MetisGrid disclaims implied warranties including merchantability, fitness for a particular purpose and non-infringement.

MetisGrid does not warrant that the Service will be uninterrupted or error-free or that use of the Service will prevent, identify or successfully resolve any actual cybersecurity incident.

Tabletop exercises, simulations, scoring, analytics and recommendations are tools to support professional judgment and organizational readiness. They do not guarantee security outcomes.

Beta features

MetisGrid may make preview, beta or early-access features available. Beta features are provided as-is, may be modified or withdrawn at any time, are excluded from the Service warranty and any service-level commitment, and may not be suitable for production use. Customer's use of beta features is at its own discretion.

14. Indemnification

Customer indemnity

Customer will defend MetisGrid against a third-party claim arising from:

• Customer Content that infringes third-party rights;
• Customer's unlawful use of the Service;
• Customer's use of Output in employment or other consequential decisions contrary to Section 5; or
• Customer's material violation of Section 7,

and will pay damages, costs and reasonable attorneys' fees finally awarded or agreed in settlement.

MetisGrid IP indemnity

MetisGrid will defend Customer against a third-party claim alleging that the Service, when used as authorized, directly infringes a United States patent, copyright or trademark, and will pay damages, costs and reasonable attorneys' fees finally awarded or agreed in settlement.

MetisGrid has no obligation to the extent a claim results from:

• Customer Content;
• modifications not made by MetisGrid;
• combinations with products or services not supplied or authorized by MetisGrid;
• use contrary to Documentation or these Terms; or
• continued use after MetisGrid has provided a non-infringing replacement or workaround.

If an infringement claim is reasonably likely, MetisGrid may obtain the right for Customer to continue using the Service, modify or replace the affected functionality, or terminate the affected Service and refund prepaid fees covering the unused portion of the applicable subscription.

Procedure

An indemnified party must promptly notify the indemnifying party of a claim, provide reasonable cooperation, and permit the indemnifying party to control the defense and settlement.

The indemnifying party may not settle a claim in a manner that admits fault by or imposes non-monetary obligations on the indemnified party without that party's consent, not to be unreasonably withheld.

15. Limitation of Liability

To the maximum extent permitted by law, neither party will be liable for indirect, incidental, consequential, special, exemplary or punitive damages, or for loss of profits, revenue, goodwill or business opportunity arising from the Service or these Terms, even if advised of the possibility.

General cap

Except as provided below, each party's aggregate liability arising from or relating to the Service, these Terms and the DPA will not exceed the amounts paid or payable by Customer to MetisGrid for the Service during the 12 months immediately preceding the event giving rise to liability.

Enhanced cap

For liability arising from:

• breach of Section 11 (Confidentiality);
• breach of the DPA;
• a Security Incident caused by MetisGrid's failure to comply with the Security Addendum; or
• a party's indemnification obligations under Section 14,

each party's aggregate liability will not exceed two times the amounts paid or payable by Customer during that 12-month period.

Free Service

For a free trial or free Service for which Customer has paid no fees, aggregate liability will not exceed USD $100.

Exclusions

Nothing in these Terms limits:

• Customer's obligation to pay fees properly due;
• liability for fraud, gross negligence or willful misconduct; or
• liability that cannot legally be limited or excluded.

16. Changes to These Terms

MetisGrid may update these Terms from time to time. The current version, with its version number and effective date, is posted at the Terms page.

For existing paid subscriptions, a material change that adversely affects Customer's contractual rights takes effect at the next renewal, unless the change is required earlier by law, regulation or a material security need.

MetisGrid will provide at least 30 days' notice of material changes to Customer's administrator of record. Non-material changes take effect when posted.

Continued use of the Service after a change takes effect constitutes acceptance. Customer may terminate by non-renewal if it does not accept a material change.

17. General

Governing law and venue

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-laws principles. The parties consent to the exclusive jurisdiction of the state and federal courts located in Delaware for disputes arising from these Terms, unless an Order specifies another forum. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Export compliance

The Service is subject to United States export-control and sanctions laws. Customer represents that neither Customer nor any User is located in, or is a national or resident of, a country or territory subject to comprehensive United States sanctions, or is listed on a United States government restricted-party list.

Notices

Legal notices to MetisGrid must be sent to legal@metisgrid.com and to MetisGrid, P.O. Box 1105, Wilmington, DE 19899, USA. Legal notices to Customer will be sent to the email address of Customer's administrator of record. Notices are effective on receipt, or one business day after email transmission if no delivery failure is received.

Publicity

Neither party will use the other party's name or logo in marketing materials without prior written consent.

Assignment

Neither party may assign these Terms without the other party's consent, except in connection with a merger, acquisition, corporate reorganization or sale of substantially all relevant assets, provided the successor assumes the assigning party's obligations.

Force majeure

Neither party is liable for delay or failure caused by circumstances beyond its reasonable control, except for payment obligations.

Independent contractors

The parties are independent contractors. These Terms do not create a partnership, joint venture, agency or employment relationship.

Waiver

Failure to enforce a provision does not waive the right to enforce it later.

Severability

If a provision is found unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions will remain effective.

Entire agreement

These Terms, applicable Orders, the DPA, the Security Addendum, the Vulnerability Disclosure Policy as applicable to Users, and any other agreement expressly incorporated by reference constitute the parties' entire agreement concerning the Service and supersede prior agreements concerning the same subject.

The Privacy Notice describes MetisGrid's privacy practices but does not independently create contractual obligations unless expressly incorporated into an Order, the DPA or another written agreement.

18. Contact

MetisGrid P.O. Box 1105 Wilmington, DE 19899, USA legal@metisgrid.com