Terms of Service

Effective Date: October 1, 2026 Last Updated: October 1, 2026

These Terms of Service ("Terms") are a binding agreement between ComplAI Solutions, LLLP, doing business as Garde1 ("Garde1," "we," "us," or "our"), and the customer organization or individual accepting these Terms ("Customer," "you," or "your").

By clicking "I agree," creating an account, starting a trial, accepting an order form, or using the Services, you agree to these Terms. If you accept for an organization, you represent that you have authority to bind that organization.

1. Order of Precedence

If documents conflict, the order of precedence is:

1. A mutually executed order form, statement of work, or enterprise agreement.
2. These Terms.
3. The Privacy Policy.
4. Any support, service-level, or data-processing addendum expressly incorporated by reference.

No marketing page, product screen, readiness score, report, chat response, help article, or sales statement changes these Terms unless it is included in an executed written agreement.

2. Services

Garde1 provides a CMMC readiness and mock-assessment platform operated by ComplAI Solutions, LLLP (Garde1), which is pursuing Registered Provider Organization (RPO) authorization from the Cyber AB. The Services may include organization scoping support, system security plan drafting, shared-responsibility mapping, evidence collection workflows, automated checks, LLM-assisted review, control-readiness views, remediation planning, assessor-preparation materials, and related support.

Garde1 is not a Certified Third-Party Assessment Organization (C3PAO), does not perform the official CMMC assessment, does not issue CMMC certification, and does not represent the Cyber AB, the Department of Defense, or any C3PAO. A C3PAO or other authorized assessor is solely responsible for any official CMMC assessment.

3. Assessment Outputs and No Guarantee

The Services generate readiness materials, mock-assessment outputs, reports, recommendations, summaries, scores, document drafts, control narratives, and other artifacts ("Assessment Outputs"). Assessment Outputs are for internal readiness, assessor preparation, planning, and evidence organization only.

Assessment Outputs are not legal advice, audit opinions, official assessment determinations, CMMC certification decisions, government approvals, or guarantees of readiness. We do not guarantee that:

• Any Assessment Output is complete, accurate, current, or free from error.
• You will pass an official CMMC assessment or achieve any certification level.
• A C3PAO, assessor, prime contractor, government agency, auditor, or regulator will agree with any Assessment Output.
• The Services will identify every gap, vulnerability, misconfiguration, missing document, evidence deficiency, or compliance issue.
• Any remediation plan will satisfy a specific assessor or control objective.

You are responsible for reviewing Assessment Outputs, validating facts, correcting inaccuracies, deciding whether to rely on any output, and obtaining qualified legal, compliance, security, or C3PAO advice where appropriate.

4. Customer Data and Input Dependency

The Services depend on Customer Data, connector permissions, uploaded evidence, organization profile facts, boundary and scoping decisions, third-party platform APIs, and instructions supplied by you or your authorized users. You represent that you have all rights and permissions needed to provide Customer Data and authorize connectors.

Garde1 is not responsible for inaccurate, incomplete, stale, unavailable, unauthorized, or misleading Customer Data, connector output, third-party API data, evidence, scoping decisions, or user instructions. If Customer Data or connector access is wrong or incomplete, Assessment Outputs may also be wrong or incomplete.

5. Authorized Use

You may use the Services only for your internal security, CMMC readiness, mock-assessment, documentation, evidence-management, and remediation-planning purposes. You must not:

• Monitor systems, tenants, accounts, or data you do not own or have written authority to assess.
• Use the Services to make official CMMC certification decisions.
• Represent any Assessment Output as an official CMMC assessment, C3PAO finding, or government approval.
• Reverse engineer, scrape, overload, interfere with, or bypass security controls of the Services.
• Upload unlawful content or data you are not authorized to process.
• Upload controlled unclassified information (CUI). The Services are not authorized to store or process CUI, and uploads that are flagged as CUI, or whose CUI status is uncertain, are refused.
• Use the Services to build or benchmark a competing product without written permission.
• Violate export controls, sanctions, privacy laws, or third-party rights.

We may suspend access if we reasonably believe use of the Services creates security, legal, operational, payment, or third-party risk.

6. Trials, Subscriptions, Renewal, and Cancellation

If offered, a free trial provides temporary access for the stated trial period, currently 14 days unless a different period is shown at signup or in an order form. Trial access may be limited and may end automatically at expiration.

We will not charge a paid subscription fee unless you submit payment information and affirmatively select a paid plan or accept an order form. If a trial is configured to convert to a paid subscription, the checkout or order flow will disclose the conversion date, amount, billing cadence, and cancellation method before you are charged.

Paid subscriptions renew for the same billing interval unless cancelled before the renewal date or unless an order form states otherwise. You may cancel through the billing or account settings made available in the product, by using the cancellation flow supplied by our payment processor, or by contacting support before renewal. Cancellation stops future renewal charges but does not automatically refund prior charges.

Fees are non-refundable except where required by law or expressly stated in an order form. We may suspend or terminate access for non-payment, chargebacks, fraud risk, or material breach.

7. Privacy and Security

Our Privacy Policy describes how we collect, use, disclose, and protect personal information and Customer Data. You are responsible for providing legally sufficient notices and obtaining any required consents from your users, personnel, contractors, and third parties whose data you submit to the Services.

We use commercially reasonable technical and organizational safeguards designed to protect the Services. No system is perfectly secure, and we do not guarantee that unauthorized access, security incidents, data loss, or service interruptions will never occur.

8. Third-Party Services and Integrations

The Services may depend on cloud providers, identity providers, security tools, payment processors, LLM providers, email providers, hosting providers, customer-authorized connectors, and other third-party services. We are not responsible for third-party outages, API changes, rate limits, data quality, terms, pricing, security incidents, or discontinued functionality.

9. Intellectual Property

You retain ownership of Customer Data. We retain ownership of the Services, software, models, prompts, workflows, templates, designs, documentation, know-how, and other Garde1 technology. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable right to use the Services during your active subscription or trial.

You grant us a limited right to process Customer Data to provide, secure, support, troubleshoot, and improve the Services, and to create aggregated or de-identified operational metrics (such as usage and performance) that do not identify you or disclose Customer Data. Customer Data is not used to train or fine-tune any model, ours or a third party's.

10. Confidentiality

Each party may receive confidential information from the other. The receiving party will use confidential information only to perform under these Terms, protect it using at least reasonable care, and disclose it only to personnel, contractors, advisors, subprocessors, or representatives who need to know it and are bound by confidentiality obligations.

Confidentiality obligations do not apply to information that is public through no breach, already known without restriction, independently developed without use of confidential information, lawfully received from a third party, or required to be disclosed by law.

11. Disclaimers

Except as expressly stated in these Terms or an executed order form, the Services and Assessment Outputs are provided "as is" and "as available." To the maximum extent permitted by law, we disclaim all warranties, whether express, implied, statutory, or otherwise, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, completeness, availability, and error-free operation.

We do not warrant that the Services will satisfy any CMMC requirement, pass any assessment, meet your specific needs, detect all issues, generate complete documents, produce assessor-approved evidence, or remain compatible with all third-party systems.

12. Limitation of Liability

To the maximum extent permitted by law, Garde1 will not be liable for indirect, incidental, special, consequential, exemplary, enhanced, or punitive damages; lost profits; lost revenue; lost business opportunities; lost contracts; failed bids; procurement delays; failed official assessments; failure to obtain certification; reputational harm; business interruption; loss of goodwill; data loss; cost of substitute services; or third-party claims arising from your reliance on Assessment Outputs.

Except for your payment obligations, your misuse of the Services, your infringement or misappropriation of our intellectual property, or either party's confidentiality obligations, each party's total liability arising out of or relating to these Terms is limited to the amounts paid or payable by you to Garde1 for the Services during the 12 months before the event giving rise to the claim.

The exclusions and limitations in this section apply regardless of legal theory, whether in contract, tort, negligence, strict liability, statute, or otherwise, and even if a remedy fails of its essential purpose.

13. Indemnification

You will defend, indemnify, and hold harmless Garde1 and its owners, personnel, contractors, and affiliates from third-party claims, damages, costs, and expenses, including reasonable attorneys' fees, arising from or relating to Customer Data, unauthorized connector use, your breach of these Terms, your violation of law, your misuse of Assessment Outputs, or your representation that Garde1 outputs are official CMMC assessment results or certification decisions.

14. Termination

Either party may terminate according to an applicable order form. We may suspend or terminate access for material breach, non-payment, security risk, legal risk, misuse, or discontinued service availability. Upon termination, your right to use the Services ends. We may retain and delete Customer Data according to the Privacy Policy and applicable order form.

15. Changes

We may update these Terms from time to time. Material changes will be posted at the canonical Terms URL and, where appropriate, presented through the product for acceptance. Continued use after the effective date of updated Terms constitutes acceptance when permitted by law; where express acceptance is required, access may be conditioned on acceptance.

16. Governing Law and Disputes

These Terms are governed by Tennessee law, excluding conflict-of-law rules. The parties will first try to resolve disputes through good-faith business escalation. Any litigation not subject to an executed dispute-resolution addendum will be brought in the state or federal courts located in Tennessee, and each party consents to those courts.

17. General

These Terms, together with the documents incorporated by reference, are the entire agreement for the Services and supersede prior or contemporaneous statements about the same subject. If a provision is unenforceable, the rest remains in effect. Neither party waives rights by delaying enforcement. You may not assign these Terms without our consent. We may assign them in connection with a merger, acquisition, reorganization, or sale of substantially all assets.

18. Contact

ComplAI Solutions, LLLP d/b/a Garde1
Nashville, Tennessee, USA
[email protected]