Terms of Service

1. Acceptance of Terms

These Terms of Service ("Terms") form a binding agreement between you ("you," "your," or "Customer") and Viosoph, LLC, a Nebraska limited liability company with a principal address of 1022 Brickyard Dr, Hooper, NE 68031 ("Viosoph," "we," "us," or "our"). They govern your access to and use of frameworkmapper.com, the FrameworkMapper application, our APIs, and any related products or services we provide (collectively, the "Service").

By creating an account, accepting an invitation, accessing the Service, or clicking "I agree," you confirm that you have read, understood, and agreed to be bound by these Terms and our Privacy Policy. If you are entering into these Terms on behalf of an organization, you represent that you have the authority to bind that organization, and "you" includes that organization.

If you do not agree, do not use the Service.

2. Eligibility & Accounts

You must be at least 18 years old and capable of forming a legally binding contract to use the Service. The Service is intended for business use; it is not directed at consumers.

You agree to:

• Provide accurate, current, and complete information when creating or updating your account.
• Keep your authentication credentials confidential and not share them.
• Notify us promptly at security@frameworkmapper.com if you suspect unauthorized access to your account.
• Be responsible for all activity that occurs under your account, whether or not authorized by you.

We may refuse, suspend, or terminate accounts at our discretion, including where we determine an account violates these Terms or threatens the security or operation of the Service.

3. Description of the Service

FrameworkMapper is a software-as-a-service application that helps cybersecurity practitioners and the organizations they serve perform compliance assessments and tool-coverage mapping against industry frameworks, including the CIS Critical Security Controls, the NIST Cybersecurity Framework v2.0, NIST SP 800-53, NIST SP 800-171, CMMC Levels 1 and 2, the HIPAA Security Rule, GovRAMP, the CJIS Security Policy, and the Texas Cybersecurity Framework. The Service includes assessment authoring, scoring, reporting, certificate generation, AI-generated gap-optimization narratives, tool inventory tracking, incident-response planning and readiness features, and partner-to-client collaboration features.

We may add, remove, modify, or deprecate features at any time. We will give reasonable notice of material changes that affect a paid feature you currently rely on.

4. Subscriptions, Credits & Billing

4.1 Plans

The Service is offered through free accounts, recurring subscription bundles (billed monthly or annually), and one-time purchases such as assessment credits and add-on assessments. Plan features, pricing, and entitlements are described on our Pricing page and in your account dashboard, and are subject to change. Existing subscribers will be notified of price changes at renewal.

4.2 Payment

Payments are processed by Square, Inc. By providing payment information, you authorize us (through Square) to charge the payment method you provide for the amounts due under your selected plan or purchase, including any applicable taxes. You agree that Square's terms and privacy policy apply to its collection and use of your payment information.

If a payment fails, we may suspend or downgrade your account until payment is current. We may retry the charge in accordance with Square's standard practices.

4.3 Renewals

Subscriptions automatically renew at the end of each billing cycle for another cycle of the same length unless you cancel before the renewal date. You can cancel from your portal settings; cancellation takes effect at the end of the then-current cycle, and you retain access until that date.

4.4 Refunds

Except where required by applicable law, fees are non-refundable. We do not provide refunds or credits for partial subscription periods, unused assessment credits, downgrades, or feature changes you do not use. We may, at our discretion, issue a refund for documented service unavailability of more than 72 consecutive hours that materially impaired your ability to use the Service.

4.5 Taxes

Listed prices are exclusive of taxes unless otherwise stated. You are responsible for all applicable sales, use, VAT, GST, and similar taxes, except for taxes on our net income. If you are tax-exempt, you may submit valid exemption documentation through the in-app process; we will apply the exemption prospectively once verified.

4.6 Discounts

Education, nonprofit, and promotional discounts are available subject to verification. We may revoke a discount if eligibility is not maintained or if the discount is being used in a way inconsistent with its intended purpose.

4.7 Retention extensions

Shared assessments are retained for 12 months by default. You may purchase up to two 12-month retention extensions per assessment. Extension fees are non-refundable.

5. Acceptable Use

You agree not to:

• Use the Service in violation of any law or regulation, including export-control, sanctions, anti-corruption, and privacy laws.
• Upload, transmit, or process content you do not have the right to share, or that infringes any third-party right (including intellectual property, privacy, or publicity rights).
• Upload personally identifiable information about minors, protected health information about identifiable patients, payment-card data, or any government-classified information.
• Probe, scan, or test the vulnerability of the Service or circumvent any access, authentication, or rate-limiting mechanism, except as authorized in writing under our coordinated-disclosure program.
• Reverse-engineer, decompile, or attempt to extract source code from the Service, except to the extent permitted by law.
• Use the Service to build a competing product, to scrape data systematically, or to train a generative AI model.
• Resell, sublicense, lease, time-share, or use the Service as a service bureau on behalf of a third party, except as expressly permitted in our partner program.
• Introduce malware, send spam, or otherwise interfere with the Service or other users.
• Impersonate any person or organization, or misrepresent your affiliation with any person or organization.

We reserve the right to investigate and take any action we believe is appropriate, including suspending or terminating accounts, removing content, and cooperating with law enforcement.

6. Your Content

6.1 Ownership

You retain all rights in the data, text, files, scores, notes, evidence descriptions, tool selections, and other materials you submit to or generate through the Service ("Customer Content"). We do not claim ownership of Customer Content.

6.2 License to us

You grant Viosoph a worldwide, non-exclusive, royalty-free license to host, store, copy, transmit, display, modify (only to the extent necessary to format or present), and process Customer Content solely for the purpose of providing and improving the Service to you, including disclosure to the sub-processors identified in our Privacy Policy. This license terminates when you or we delete the Customer Content, except as necessary to comply with legal obligations or for backup/audit purposes.

6.3 Sharing within the Service

FrameworkMapper supports sharing of assessments between partner and client organizations. When you initiate a share, you authorize us to make the shared assessment available to the recipient organization. You are responsible for ensuring you have the right to share what you share.

6.4 Backups and exports

You can download an encrypted backup of any assessment you own from the assessment page. Backup files are wrapped with a password you choose at export time; we cannot recover that password if you lose it.

6.5 Aggregated and de-identified data

We may use aggregated and de-identified data derived from the Service (data that no longer identifies you, your organization, your customers, or any individual) for analytics, research, benchmarking, product improvement, and marketing. We do not include sensitive details from your free-text notes in any external publication.

7. Intellectual Property

The Service, including the FrameworkMapper application, the website, the user interface, the underlying mappings between security tools and control frameworks (the "Mapping Database"), our reports and templates, the FrameworkMapper name and logo, and all related intellectual property, are owned by Viosoph or our licensors and are protected by copyright, trademark, and other laws.

Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, revocable license to access and use the Service solely for your internal business purposes during your subscription. No other rights are granted by implication, estoppel, or otherwise.

Public framework definitions (e.g., NIST publications, the CIS Controls catalog) remain the intellectual property of their respective publishers. We display them under fair use, public domain, or applicable license.

Feedback, suggestions, and ideas you provide about the Service are non-confidential, and you grant us a perpetual, worldwide, royalty-free license to use them without restriction or compensation.

8. AI-Generated Mappings

The cross-framework tool-to-control mappings displayed in the FrameworkMapper application (the "Mapping Database") are built and refined using third-party large-language-model APIs (currently Anthropic) operating on public framework definitions and our public tool catalog. No customer-specific data is sent to AI providers for this purpose; see our Privacy Policy for details. You acknowledge:

• The Mapping Database may be inaccurate, incomplete, or outdated, and may not reflect current threats, regulations, vendor capabilities, or auditor interpretations.
• The Mapping Database is informational and is not a substitute for professional security, legal, or regulatory advice.
• You are solely responsible for reviewing and validating mappings before relying on them for compliance, audit, procurement, or remediation decisions.
• The Mapping Database is shared across all customers; we do not warrant that any particular mapping is unique to you or tailored to your environment.

9. Confidentiality

"Confidential Information" means non-public information disclosed by one party to the other under or in connection with the Service. Customer Content is your Confidential Information. The Service, our pricing, our roadmap, and our security measures are our Confidential Information. Each party will use the same degree of care to protect the other's Confidential Information that it uses to protect its own (and no less than reasonable care), and will use Confidential Information only as necessary to perform under these Terms or use the Service.

Confidential Information does not include information that is or becomes public without breach, was rightfully known before disclosure, is independently developed, or is rightfully received from a third party without confidentiality obligation.

10. Third-Party Services

The Service integrates with third-party services (such as Square for payments, Google for sign-in, Anthropic for AI). Your use of those services is governed by their own terms and privacy policies. We are not responsible for the availability, accuracy, content, or practices of third-party services. If a third-party service becomes unavailable or modifies its terms, we may discontinue or modify the corresponding feature without liability.

11. Disclaimers

Without limiting the foregoing:

• The Service does not provide security itself. FrameworkMapper assists you in describing and assessing your security controls and tool inventory. It does not implement, configure, monitor, or enforce any security control on your systems. You are solely responsible for the security of your systems, data, and users.
• Compliance is your responsibility. Use of FrameworkMapper does not, by itself, render your organization compliant with any framework, regulation, contract, or audit standard. Compliance status is determined by auditors, regulators, and contracting authorities — not by us.
• Mappings are best-effort. The mappings between tools and controls are derived from public information, vendor documentation, and AI inference. They may contain errors, gaps, or interpretive choices that differ from your auditor's view. Validate before relying on them.
• Certificates are statements of self-assessment. Any certificate, badge, or maturity score generated by the Service reflects information you entered, not an independent audit. We make no representation about the accuracy of the underlying inputs.
• No availability guarantee. We do not promise the Service will be uninterrupted, error-free, or free from loss of data. We do not offer a contractual SLA except as separately agreed in writing.

Some jurisdictions do not allow the exclusion of certain warranties, so some of the exclusions above may not apply to you. In that case, the excluded warranties are limited to the minimum scope and duration permitted by law.

12. Limitation of Liability

The limitations and exclusions in this section apply to the fullest extent permitted by applicable law and survive termination of these Terms. They are a fundamental part of the bargain between you and us; if any of them is held unenforceable, the remaining limitations apply to the maximum extent permitted.

13. Indemnification

You will defend, indemnify, and hold harmless Viosoph and their officers, directors, employees, contractors, and agents from and against any third-party claims, damages, liabilities, losses, costs, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) your use of the Service in violation of these Terms or applicable law; (b) Customer Content, including any claim that Customer Content infringes a third-party right or violates privacy or data-protection law; (c) your acts or omissions in sharing assessments with clients or partners; or (d) your reliance on or distribution of AI Output or any certificate, badge, or report generated by the Service.

We will promptly notify you of any such claim and reasonably cooperate with your defense at your expense. We may participate in the defense with counsel of our choosing at our own expense.

14. Termination

You may terminate your account at any time from your portal settings. We may suspend or terminate your access to the Service at any time, with or without cause, and with or without notice, including for non-payment, violation of these Terms, threats to the security or integrity of the Service, or required compliance with law.

Upon termination:

• Your right to access and use the Service ends immediately.
• Outstanding fees become due and payable.
• Your encrypted assessment payloads are wiped and the underlying organization records may be cascade-deleted, as described in our Privacy Policy.
• The following sections survive termination: 4.4 (no refunds), 6.1 (your ownership), 6.5 (de-identified data), 7 (intellectual property), 9 (confidentiality), 11 (disclaimers), 12 (limitation of liability), 13 (indemnification), 15 (governing law), 16 (dispute resolution), 18 (general), and any other provision that by its nature should survive.

15. Governing Law

These Terms and any dispute arising out of or related to them or the Service are governed by the laws of the State of Nebraska, without regard to its conflict-of-laws rules and excluding the United Nations Convention on Contracts for the International Sale of Goods.

16. Dispute Resolution

16.1 Informal resolution

Before filing a claim against the other, you and we agree to try to resolve the dispute by sending a written notice describing the claim and the requested relief to the contact below (for us) or to the email on file (for you). The parties will negotiate in good faith for at least 30 days after the notice is received before initiating any formal action.

16.2 Venue

Any claim that is not resolved through informal resolution must be filed in the state or federal courts located in Dodge County, Nebraska. You and we consent to the personal jurisdiction of those courts and waive any objection based on inconvenient forum.

16.3 No class actions

You and we agree to bring claims only in an individual capacity, and not as a plaintiff or class member in a class, collective, or representative action. The parties expressly waive the right to a jury trial to the maximum extent permitted by law.

16.4 Time to file

Any claim must be filed within one (1) year after the cause of action accrues, or it is forever barred, except where applicable law prohibits this limitation.

17. Changes to These Terms

We may update these Terms from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, provide additional notice (such as an email or a banner on the Service) at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Terms. If you do not agree, stop using the Service before the effective date.

18. General

• Entire agreement. These Terms (together with the Privacy Policy and any order form, signed addendum, or written agreement between us) are the entire agreement between you and us regarding the Service and supersede any prior agreements.
• Severability. If any provision is held unenforceable, the remaining provisions remain in full force, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.
• No waiver. Our failure to enforce a provision is not a waiver of our right to do so later.
• Assignment. You may not assign or transfer these Terms or any rights or obligations under them without our prior written consent. We may assign these Terms in connection with a merger, acquisition, financing, or sale of assets, or to an affiliate, on notice to you.
• Independent contractors. We are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, fiduciary, or employment relationship.
• Force majeure. Neither party is liable for delays or failures caused by events beyond reasonable control, including natural disasters, war, civil unrest, labor disputes, internet or utility outages, or third-party service failures.
• Notices. We may give notice to you by email to the address on file or by posting in the Service. You must give notice to us using the contact below.
• Export and sanctions. You represent that you are not located in, organized under, or ordinarily resident in a country subject to U.S. comprehensive sanctions, and are not on any U.S. government restricted-party list.
• U.S. government. The Service is a "Commercial Product" within the meaning of FAR 2.101 and is licensed to U.S. government end users only with the rights granted to all other end users under these Terms.

19. Contact

For questions, notices, or legal correspondence:

Viosoph, LLC
Attn: Legal
1022 Brickyard Dr
Hooper, NE 68031
United States
Email: legal@frameworkmapper.com