Terms of Service

By creating an account, purchasing a plan, or otherwise accessing or using ComplianceAnvil (the "Service"), you agree to these Terms of Service (the "Terms"). If you do not agree, do not use the Service.

If you accept these Terms on behalf of a company, agency, or other organization, you represent that you have authority to bind that organization, and "you" refers to both you and that organization.

To use the Service you must:

• be at least 18 years old;
• have the legal capacity to enter into a binding contract;
• not be barred from receiving United States software or services under applicable law, sanctions, or export-control rules; and
• provide accurate registration and billing information.

The Service is designed for business use in the United States. We do not offer it for personal or household purposes.

You are responsible for all activity that occurs under your account.

• Keep your credentials confidential and do not share logins between people.
• Use a unique, strong password, and enable any additional authentication controls we make available.
• Notify us promptly at support@complianceanvil.com if you believe your account has been accessed without authorization.

We may suspend or reset access to protect an account or the platform. We may also require re-authentication before you perform sensitive actions such as changing billing details, changing roles, or exporting data.

The Service is organized around an organization workspace. The person who creates the workspace becomes its owner and may invite additional members and assign roles such as administrator, manager, employee, or auditor.

You acknowledge and agree that:

• the organization — not the individual member — controls the workspace and its content;
• organization owners and administrators can view, modify, export, and delete workspace content, including content contributed by other members;
• organization owners and administrators can add or remove members and change their roles;
• the organization is responsible for the conduct of its members and for ensuring their use complies with these Terms;
• the organization is responsible for having a lawful basis to upload any information about its employees, contractors, customers, or vendors; and
• if a member's relationship with the organization ends, access management is the organization's responsibility.

Where seat limits apply to your plan, the organization is responsible for staying within them.

ComplianceAnvil is a compliance readiness platform for small and mid-sized businesses. Depending on your plan, it may provide:

• a guided readiness assessment and risk scoring;
• program packs and framework alignment mapping;
• a control workspace for tracking control implementation status;
• generated policy and documentation templates, including a System Security Plan builder;
• a Plan of Action and Milestones (POA&M) tracker;
• employee training courses, knowledge checks, and completion records;
• evidence collection and document storage workflows;
• the Compliance Academy educational library and certificates of completion; and
• progress reviews and ongoing monitoring prompts.

We may add, change, or remove features. We will not make a material reduction to a feature you are actively paying for without notice and, where appropriate, a prorated credit or refund.

This section is central to your agreement and should be read together with our Disclaimer.

ComplianceAnvil helps you prepare. It does not certify, audit, or approve you.

• ComplianceAnvil is not a certification body, accreditation body, or assessment organization.
• ComplianceAnvil does not issue CMMC certifications, ISO certifications, or any other accredited certification.
• ComplianceAnvil does not act as a CMMC Third-Party Assessment Organization (C3PAO) unless separately and expressly authorized in a written agreement.
• ComplianceAnvil is not a government agency and provides no government approval, endorsement, or authorization.
• Scores, readiness percentages, gap lists, and mappings are informational planning aids. They are not audit findings, assessment results, or determinations of compliance.
• Certificates issued by the Compliance Academy evidence completion of ComplianceAnvil educational material only. They are not professional certifications or credentials.
• Framework references are educational and readiness-oriented. ISO-related content is alignment guidance only and does not reproduce licensed standard text; obtaining the standards themselves is your responsibility.

You remain solely responsible for your own compliance obligations, for the accuracy of what you submit to any assessor, customer, prime contractor, or government body, and for any decisions you make based on the Service.

The Service is offered on a free tier and on paid plans. Paid offerings fall into two categories:

One-time purchases grant the access described at the point of sale for the stated access period and do not renew automatically.

Subscriptions renew automatically for successive terms until cancelled.

Your entitlements — including which document library, program packs, seat count, branding customization, and features you may use — are determined by the plan in force on your organization. Feature availability by plan is described on our pricing page.

Prices are in United States dollars and exclude any applicable taxes, which are calculated and collected at checkout where required.

Payments are processed by Stripe, Inc. We do not receive or store your full card number, card security code, or bank credentials. Your use of checkout is also subject to Stripe's terms and privacy policy.

By purchasing, you authorize us and Stripe to charge your selected payment method for the amounts due, including recurring charges for subscriptions and any applicable taxes.

You agree to keep your billing information current. If a charge is declined or reversed, we may retry the charge, request an updated payment method, and restrict paid features until the balance is settled.

Receipts and invoices are available from your billing area and are emailed to the address on the account.

Subscriptions renew automatically at the end of each billing period — monthly plans on a monthly cycle and annual plans on an annual cycle — at the then-current price for your plan, unless you cancel before the renewal date.

You authorize these recurring charges until you cancel. We will notify you in advance of a price increase that would apply to your renewal, and you may cancel before it takes effect.

One-time purchases, including Starter and Guided Setup, do not renew and are not charged again.

You may cancel a subscription at any time from your billing area.

Cancellation stops future renewals. It is not retroactive and does not by itself refund amounts already charged.

When you cancel, your paid access continues until the end of the billing period you have already paid for. At the end of that period, the organization reverts to the free tier and paid features become unavailable. Your data is retained as described in our Privacy Policy so you can export it or resume later.

Upgrades take effect immediately. Stripe prorates the change, charging the difference for the remainder of the current period, and the higher plan's entitlements become available right away.

Downgrades take effect at the end of the current billing period. You keep the higher plan's entitlements until then, and the lower plan applies from the next period. Downgrading may reduce your seat count, document library access, program pack availability, and other features. You are responsible for reducing usage to fit the lower plan; content that exceeds the new limits may become read-only or inaccessible until you upgrade again or remove it.

Moving between monthly and annual billing follows the same rules.

Refunds are governed by our Refunds & Cancellation Policy, which forms part of these Terms.

In summary:

• A customer's initial eligible purchase may be refund-requested within 14 calendar days. This covers the first Starter purchase and the first payment on a Professional or Business subscription.
• Renewal payments are generally non-refundable unless required by law or caused by a verified billing error.
• Guided Setup is refundable before scheduled work begins; once a session or substantial custom work has begun, fees for completed work are non-refundable.
• Cancelling stops future renewal charges. You keep access through the end of an already-paid period unless a refund is issued or access must be suspended for abuse.
• Duplicate or erroneous charges are refunded after verification.

Refund requests go to support@complianceanvil.com. Nothing in these Terms limits rights you may have under mandatory consumer-protection law that cannot be waived.

"Your Content" means everything you or your organization submits to the Service: assessment answers, business profile details, policies and documents you generate or edit, uploaded evidence, control notes, POA&M entries, vendor and incident records, branding assets, and support messages.

You retain all ownership of Your Content. We claim no ownership over it.

You grant us a limited, non-exclusive, worldwide license to host, store, copy, transmit, display, and process Your Content solely to operate, secure, support, and improve the Service for you, and to comply with law. This license ends when Your Content is deleted, except for copies retained in routine backups for the period described in our Privacy Policy.

You are responsible for the accuracy, legality, and appropriateness of Your Content, and for maintaining your own copies of anything you consider important.

The Service includes workflows for uploading and organizing compliance evidence. When you use them:

• upload only material you have the right to upload and share with the members of your workspace;
• do not upload classified information, controlled unclassified information beyond what your plan and your own authorization permit, payment card data, or health information unless you have separately confirmed in writing with us that your configuration supports it;
• do not upload material that contains malware or that you know to be unlawful; and
• remember that organization owners and administrators can access, export, and delete uploaded material.

We apply access controls, tenant isolation, and expiring download links to stored files. We do not review, validate, or certify the sufficiency of any evidence you upload. Determining whether a piece of evidence satisfies a control is your responsibility and your assessor's.

You agree to use the Service lawfully and in a way that does not harm us, other customers, or third parties. Our Acceptable Use Policy provides additional detail and is incorporated into these Terms.

You must not:

• access or attempt to access another organization's workspace, data, or files;
• probe, scan, or test the security of the Service except through a channel we designate for that purpose;
• circumvent or attempt to circumvent authentication, authorization, entitlement, plan, seat, or rate limits;
• reverse engineer, decompile, or attempt to derive source code from the Service, except where that restriction is unenforceable by law;
• scrape, crawl, or bulk-extract the Service or its content by automated means without our written permission;
• resell, sublicense, or provide the Service to third parties as your own service, or use it to deliver consulting deliverables to your own clients, unless we have agreed to that in writing;
• copy, redistribute, or publish our templates, course material, mappings, or documentation outside your organization, except for the completed documents you generate for your own organization's use;
• misrepresent your ComplianceAnvil use as a certification, accreditation, assessment result, or government approval;
• upload malware or interfere with the integrity or performance of the Service; or
• use the Service to violate any law, sanctions program, or export-control restriction.

We may investigate suspected violations and take action, including suspension or termination.

The Service — including its software, design, ComplianceAnvil™ and Forge Technology Solutions branding, templates, course content, control mappings, scoring methodology, and documentation — is owned by Forge Technology Solutions LLC or its licensors and is protected by intellectual property law.

Subject to these Terms and your plan, we grant you a limited, non-exclusive, non-transferable, revocable right to access and use the Service, and to use the documents you generate for your own organization's internal compliance purposes, including sharing them with your assessors, auditors, customers, and regulators as needed.

That right does not include reselling, republishing, or otherwise distributing our templates or course material as standalone content. All rights not expressly granted are reserved.

Third-party framework names and standards referenced in the Service belong to their respective owners. Their use is descriptive and does not imply endorsement or affiliation.

If you send us feedback or suggestions, you grant us a perpetual, royalty-free right to use them without obligation to you.

The Service depends on third-party providers, including Stripe for payments, our cloud hosting and database provider, and our email delivery provider. The Service may also link to third-party resources, including government publications and framework documentation.

We are not responsible for third-party services or content, and their availability, terms, and privacy practices are their own. A third-party outage may affect the Service.

Parts of the Service use artificial intelligence to generate or assist output, which may include readiness recommendations, control guidance, framework mappings, policy and documentation drafts, summaries, and suggested remediation steps.

You acknowledge that:

• AI output can be incomplete, outdated, or wrong, and can appear confident while being incorrect;
• output is generic until you adapt it, and it does not know facts about your environment that you have not provided;
• every AI-generated or AI-assisted item must be reviewed, verified, and edited by a qualified person in your organization before you rely on it, publish it, or provide it to an assessor or customer; and
• AI output is not legal advice, not a compliance determination, not an assessor finding, and not a certification.

We do not warrant the accuracy of AI output. You are responsible for what you adopt.

We work to keep content current, but frameworks, regulations, contract clauses, and government guidance change, sometimes with little notice.

Content in the Service may not reflect the most recent version of a standard or rule, may not address your industry or contract-specific requirements, and may not account for interpretations applied by a particular assessor, agency, or prime contractor.

Always verify requirements against the authoritative source and your own contractual obligations.

Use of the Service does not make your organization compliant, does not guarantee that you will pass an assessment or audit, does not guarantee eligibility for any contract or program, and does not guarantee any contract award.

Compliance depends on your actual practices, technical implementation, personnel, documentation quality, and the judgment of the body assessing you — none of which we control.

The Service is not a substitute for legal counsel, an accredited assessor, a registered practitioner, a qualified security professional, or your own due diligence.

You may stop using the Service and close your account at any time.

We may suspend or terminate your access, with or without notice depending on the circumstances, if:

• you materially breach these Terms or the Acceptable Use Policy;
• your payment fails and remains unresolved;
• your use threatens the security, integrity, or availability of the Service or another customer's data;
• we are required to do so by law; or
• we discontinue the Service, in which case we will give reasonable advance notice.

On termination, your right to use the Service ends. Sections that by their nature should survive — including intellectual property, disclaimers, limitation of liability, indemnification, and governing law — survive termination. We will make your data available for export for a reasonable period as described in our Privacy Policy, after which it may be deleted.

THE SERVICE AND ALL CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND.

To the fullest extent permitted by law, we disclaim all warranties, express, implied, and statutory, including implied warranties of merchantability, fitness for a particular purpose, title, accuracy, and non-infringement.

We do not warrant that the Service will be uninterrupted, timely, secure, or error-free; that content is accurate, complete, or current; that defects will be corrected; or that any particular compliance, assessment, certification, contracting, or business result will be achieved.

Some jurisdictions do not allow the exclusion of certain warranties, so parts of this section may not apply to you.

To the fullest extent permitted by law:

• neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, lost business, lost goodwill, lost contracts, lost data, or the cost of substitute services, even if advised of the possibility;
• our total aggregate liability arising out of or relating to the Service and these Terms will not exceed the greater of (a) the total amounts you paid us for the Service in the twelve months immediately before the event giving rise to the claim, or (b) one hundred United States dollars ($100); and
• these limits apply regardless of the theory of liability and even if a limited remedy fails of its essential purpose.

We are specifically not liable for a failed assessment or audit, a denied or lost certification, a lost or terminated contract, a regulatory penalty, or a security incident at your organization.

Nothing in this section limits liability that cannot be limited by law, including liability for fraud or willful misconduct. Some jurisdictions do not allow certain limitations, so parts of this section may not apply to you.

You agree to defend, indemnify, and hold harmless Forge Technology Solutions LLC and its officers, employees, and agents from and against third-party claims, damages, liabilities, and reasonable costs and attorneys' fees arising out of or relating to:

• Your Content, including material you upload or generate and any claim that it infringes or misuses a third party's rights;
• your use of the Service in violation of these Terms, the Acceptable Use Policy, or applicable law;
• your representation of ComplianceAnvil output as a certification, assessment result, or government approval; or
• a dispute between you and a member of your organization, an assessor, a customer, or a regulator.

We will notify you of the claim, allow you to control the defense with counsel of your choosing subject to our reasonable approval, and cooperate reasonably at your expense. You may not settle a claim in a way that imposes an obligation on us without our written consent.

These Terms are governed by the laws of the State of Florida and applicable United States federal law, without regard to conflict-of-law principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Informal resolution first. Before either party files a formal claim, the party with the concern must send written notice describing it to the other. We ask you to send that notice to support@complianceanvil.com. Both parties then work in good faith to resolve the matter for 30 days from the date of the notice. Most billing and access questions are resolved in far less time.

After the informal period. If the matter is not resolved within those 30 days, either party may pursue an appropriate claim. Unless applicable law requires otherwise, venue will be in the appropriate state or federal courts serving Polk County, Florida, and both parties consent to the personal jurisdiction of those courts.

No mandatory arbitration. There is no mandatory binding arbitration agreement. The parties may use mediation or arbitration only if both sides voluntarily agree in writing after a dispute has arisen.

No waiver of class actions or jury trial. These Terms do not contain a class-action waiver or a jury-trial waiver. Nothing here limits any right or remedy that applicable law does not permit you to waive, including your right to bring a matter before a small-claims court or a government agency.

We may update these Terms. When we do, we will change the "Last updated" date above and, for material changes that reduce your rights or increase your obligations, provide reasonable advance notice by email to the address on your account or by a notice in the Service.

Material changes take effect on the stated effective date. Continuing to use the Service after that date means you accept the updated Terms. If you do not accept them, cancel before the effective date.

We maintain prior versions and will provide a copy on request.

Entire agreement. These Terms, together with the Privacy Policy, Refunds & Cancellation Policy, Disclaimer, and Acceptable Use Policy, are the entire agreement between us regarding the Service.

Severability. If a provision is unenforceable, the rest remains in effect.

No waiver. Our failure to enforce a provision is not a waiver of it.

Assignment. You may not assign these Terms without our written consent. We may assign them in connection with a merger, acquisition, or sale of assets, on notice to you.

Force majeure. Neither party is liable for delays caused by events beyond its reasonable control.

Notices. We may send notices to the email address on your account. Send notices to us at support@complianceanvil.com.

Independent parties. Nothing here creates a partnership, joint venture, employment, agency, or fiduciary relationship.

Forge Technology Solutions LLC — a veteran owned and operated business in the United States, publisher of ComplianceAnvil™.

• Support and general inquiries: support@complianceanvil.com
• Website: https://www.complianceanvil.com

Please include your organization name and account email so we can respond accurately.