Terms of Service

2.1 License Grant

Subject to these Terms and timely payment of applicable fees, IronShield grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Service solely for your internal compliance management purposes during the term of your subscription.

2.2 Authorized Users

You are responsible for all actions taken by your Authorized Users. You agree to:

• Maintain accurate and up-to-date account information at all times
• Ensure Authorized Users are aware of and comply with these Terms
• Promptly notify IronShield of any unauthorized access or suspected security breach at [email protected]
• Keep all login credentials confidential and not share them across users
• Immediately revoke access for any Authorized User who leaves your organization or no longer requires access

2.3 Acceptable Use

You agree not to:

• Use the Service for any unlawful purpose or in violation of applicable federal, state, or local law
• Upload, enter, or transmit Controlled Unclassified Information (CUI), Covered Defense Information (CDI), Federal Contract Information (FCI), classified information, or ITAR-controlled technical data into the Service
• Enter Compliance Assessment Data that you know to be false, fabricated, or materially inaccurate
• Backdate compliance records, assessment results, or POA&M entries to create a false compliance history
• Attempt to access Compliance Assessment Data belonging to another Customer
• Reverse engineer, decompile, or extract source code from the Service
• Use the Service to store or transmit malicious code or conduct security attacks
• Interfere with or disrupt the integrity or performance of the Service or its underlying infrastructure
• Access the Service using automated means, bots, or scrapers without IronShield's prior written consent
• Resell, sublicense, or provide access to the Service to third parties without prior written consent
• Train or fine-tune machine learning or AI models using data accessed through the Service
• Use the Service to generate compliance documentation intended to deceive a government agency, prime contractor, or assessor

IronShield may make Beta Features available at no charge or reduced fee. Beta Features are provided “AS IS” without warranty of any kind. IronShield reserves the right to modify, suspend, or discontinue Beta Features at any time without notice or liability.

Demo accounts are subject to these Terms in their entirety. IronShield may limit functionality, data retention periods, or access duration for demo accounts. Compliance Assessment Data entered during a demo period is retained for 90 days following the end of the demo period, after which it will be permanently deleted unless the account converts to a paid subscription. IronShield is not responsible for loss of demo data after this period.

4.1 No Certification Guarantee

4.2 Not a C3PAO or Assessor

IronShield is not a Certified Third-Party Assessment Organization (C3PAO) and does not conduct official CMMC assessments. Nothing provided through the Service constitutes an official CMMC assessment, certification, or validation.

4.3 SPRS Score Estimates

SPRS scores calculated by the Service are estimates based on information you provide. They are not official DoD scores and have not been validated by any government agency. You are solely responsible for any SPRS score you submit to the government through the SPRS portal or otherwise.

4.4 Not FedRAMP Authorized

4.5 No Government Affiliation

IronShield is not endorsed by, affiliated with, or sponsored by the Department of Defense, the Cyber AB, NIST, DCSA, or any federal agency or department.

4.6 Not Legal or Professional Advice

Nothing in the Service constitutes legal, regulatory, cybersecurity, or professional compliance advice. You should consult qualified legal and cybersecurity professionals for advice specific to your situation and contracts.

IronShield's platform is designed to help defense contractors accurately assess and document their cybersecurity posture. The following provisions reflect the gravity of using compliance data in connection with government contracts.

5.1 Customer Warranty of Accuracy

By using the Service, you warrant that all Compliance Assessment Data you enter into the platform accurately reflects your organization's actual cybersecurity posture and control implementation status to the best of your knowledge. You agree to promptly update any Compliance Assessment Data that becomes inaccurate or incomplete.

5.2 Independent Verification Required

Before submitting any SPRS score, POA&M, System Security Plan, or other compliance documentation to the government, a prime contractor, or a C3PAO assessor, you are solely responsible for independently verifying that all data is accurate, complete, and current. IronShield is not responsible for any government submission you make using data generated or stored by the Service.

5.3 False Claims Act Acknowledgment

You acknowledge that knowingly submitting false SPRS scores or compliance certifications to the U.S. government may constitute a violation of the False Claims Act (31 U.S.C. §§ 3729–3733) and the False Statements Act (18 U.S.C. § 1001), which can result in civil and criminal penalties including treble damages, per-claim penalties, and debarment. IronShield bears no liability for any such submissions.

5.4 Platform Misuse

IronShield reserves the right to immediately suspend or terminate access to the Service, without prior notice or liability, if IronShield reasonably believes the Service is being used to: (a) fabricate or falsify compliance documentation intended for government submission; (b) enter materially inaccurate SPRS scores; or (c) otherwise facilitate a violation of the False Claims Act or False Statements Act. IronShield also reserves the right to preserve relevant data and cooperate with law enforcement or government investigations in such circumstances.

6.1 Ownership

You retain all ownership rights to Customer Data. By submitting Customer Data to the Service, you grant IronShield a limited license to process, store, and use Customer Data solely to provide the Service and as described in our Privacy Policy.

6.2 Compliance Assessment Data — Heightened Protection

IronShield treats Compliance Assessment Data as sensitive business information. IronShield will not use Compliance Assessment Data for advertising, analytics, product improvement, AI model training, or any purpose other than service delivery. IronShield will not disclose Compliance Assessment Data to any third party except as expressly permitted by these Terms, required by applicable law, or directed by you.

6.3 Data Processing Agreement

Where IronShield processes personal data on your behalf as a data processor, such processing is governed by a Data Processing Agreement (DPA). Enterprise customers may execute a DPA by contacting [email protected]. In the event of a conflict between the DPA and these Terms with respect to the processing of personal data, the DPA controls.

6.4 No CUI Warranty

Customers on paid plans agree to pay all applicable fees as set forth in their order form or subscription agreement. All fees are stated in US dollars.

Fees are non-refundable except as expressly stated in these Terms or required by applicable law. IronShield reserves the right to modify pricing with at least thirty (30) days' written notice. Continued use of the Service after a price change constitutes acceptance of the new pricing. If a pricing change is not acceptable, your sole remedy is to terminate your subscription before the change takes effect.

Accounts more than fifteen (15) days past due may be suspended. Accounts more than thirty (30) days past due may be terminated. IronShield reserves the right to charge interest on overdue balances at 1.5% per month or the maximum rate permitted by law, whichever is lower.

All fees are exclusive of applicable taxes. You are responsible for all taxes associated with your purchase except for taxes based on IronShield's net income.

IronShield retains all right, title, and interest in and to the Service, including all software, algorithms, interfaces, documentation, and any improvements or derivative works thereof. Nothing in these Terms transfers any IronShield intellectual property to you.

You grant IronShield a non-exclusive, royalty-free license to use aggregated, anonymized, de-identified usage data derived from your use of the Service for platform improvement and analytics purposes, provided such data cannot reasonably be used to identify you, your organization, or your compliance posture. IronShield will not use Compliance Assessment Data for this purpose.

Any feedback, suggestions, or ideas you submit to IronShield regarding the Service may be used by IronShield without restriction or compensation.

IronShield's total cumulative liability shall not exceed:

• Free, demo, or beta accounts: one hundred dollars ($100)
• Paid accounts: the greater of (a) fees paid by you in the twelve (12) months preceding the claim, or (b) ten thousand dollars ($10,000)

These limitations apply regardless of the legal theory on which the claim is based and even if IronShield has been advised of the possibility of such damages. IronShield's liability for claims arising from gross negligence or willful misconduct is not limited by this section to the extent prohibited by applicable law.

You agree to indemnify, defend, and hold harmless IronShield and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable attorneys' fees) arising out of or related to:

• Your use of the Service in violation of these Terms
• Your Customer Data, including any claim that it infringes any third-party right
• Your violation of any applicable law or regulation
• Any government submission you make using data from the Service, including any False Claims Act investigation or proceeding arising from your SPRS submissions
• Any misrepresentation of your compliance status to a government agency, prime contractor, or assessor
• Your upload of CUI, classified information, or ITAR-controlled data in violation of Section 2.3

These Terms remain in effect for the duration of your access to the Service. Either party may terminate these Terms upon written notice if the other party materially breaches these Terms and fails to cure such breach within thirty (30) days of written notice.

IronShield may immediately suspend or terminate your access without notice if: (a) you fail to pay applicable fees after fifteen (15) days' notice; (b) you violate Sections 2.3 or 5; (c) IronShield reasonably believes continued access poses a security or legal risk; or (d) required by applicable law or government authority.

Upon termination, your license to use the Service ceases immediately. IronShield will provide a 30-day data export period during which you may download your Customer Data in standard formats. After 30 days, IronShield will permanently delete all Customer Data including backups using NIST SP 800-88 compliant methods. IronShield will provide written deletion confirmation upon request.

Sections 1, 4, 5, 6, 8, 9, 10, 11, 12, 13, and 14 survive termination of these Terms.

These Terms are governed by the laws of the State of Delaware, without regard to its conflict of law provisions. Any dispute arising out of or related to these Terms shall be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules. The arbitration shall be conducted in English and the award may be entered in any court of competent jurisdiction.

Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent irreparable harm. Claims for $25,000 or less may be brought in small claims court at either party's election.

Any claims must be brought within two (2) years of the event giving rise to the claim. Claims not brought within this period are permanently barred.

14.1 Entire Agreement

These Terms, together with any applicable order form, DPA, or subscription agreement, constitute the entire agreement between the parties with respect to the Service and supersede all prior agreements, understandings, and representations.

14.2 Amendments

IronShield may update these Terms at any time. We will notify account administrators of material changes via email and in-platform notice at least fourteen (14) days before changes take effect. Non-material changes take effect upon posting. Continued use after the effective date constitutes acceptance. If a material change is not acceptable, your sole remedy is to terminate your subscription before the change takes effect.

14.3 Severability

If any provision of these Terms is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force.

14.4 Waiver

Failure by either party to enforce any right under these Terms does not constitute a waiver of that right.

14.5 Assignment

You may not assign these Terms or your rights hereunder without IronShield's prior written consent. IronShield may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of its assets, provided that the assignee assumes all obligations under these Terms.

14.6 Force Majeure

Neither party is liable for delays or failures caused by circumstances beyond its reasonable control, including natural disasters, government actions, internet disruptions, or cyberattacks, provided the affected party gives prompt notice and uses reasonable efforts to resume performance.

14.7 Relationship of the Parties

IronShield and Customer are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between the parties.

14.8 Export Controls

You agree to comply with all applicable US export control laws and regulations, including the Export Administration Regulations (EAR) and ITAR. You will not access or use the Service in any manner that would cause IronShield to violate applicable export control laws.

For questions about these Terms: