Terms & Conditions

1. Agreement to these Terms

Effective date: October 27, 2026  ·  These Terms are a template pending legal review.

These Terms & Conditions (the “Terms”) are a binding agreement between DefendFlow Security (“DefendFlow”, “we”, “us” or “our”), the provider of the GRCFlow software, and the individual or entity that purchases or uses a GRCFlow license (the “Customer”, “you” or “your”). By purchasing, installing, activating a license key for, or otherwise using GRCFlow, you agree to these Terms. If you are entering into these Terms on behalf of an organization, you represent that you have authority to bind that organization.

DefendFlow Security is a company organized under the laws of the Commonwealth of Massachusetts, United States. Its exact registered entity name and notice address will be completed before publication: [registered entity name and Massachusetts notice address to be completed].

2. Definitions

• GRCFlow or the “Software” means the GRCFlow self-hosted governance, risk and compliance platform, together with its container images, command-line tooling, documentation and any updates we make available.
• License Key means the Ed25519-signed key issued to the Customer that activates the Software and encodes the licensed organization name, the number of Seats and the subscription term.
• Seat means a single named user authorized to access the Customer's GRCFlow instance. Seats are measured by named users, not by concurrent sessions.
• Subscription Term means the period, by default one (1) year, for which a License Key is valid.
• Customer Infrastructure means the servers, containers, networks and storage that the Customer owns or controls and on which the Customer deploys GRCFlow.
• Customer Data means the evidence, policies, risk registers, assessments, audit records and other content the Customer creates in or uploads to its GRCFlow instance.

3. License grant and subscription

GRCFlow is commercial software licensed, not sold. Subject to your compliance with these Terms and payment of the applicable fees, DefendFlow grants you a non-exclusive, non-transferable, non-sublicensable license, for the Subscription Term, to install and run GRCFlow on your own Customer Infrastructure for your internal governance, risk and compliance operations.

3.1 Seat-based licensing

The license is granted by Seats (named users). The number of Seats you may provision is the number encoded in your License Key. The entry-level subscription authorizes up to twenty-five (25) named users; higher Seat counts are available under the applicable subscription you purchase.

3.2 License Key and term

Each License Key is cryptographically signed with an Ed25519 signature and encodes your licensed organization name, Seat count and term. Subscription Terms run for one (1) year unless a different term is stated on your order, and renew only upon purchase of a new or renewed License Key. The licensed organization name is signed into the key and appears on exported reports.

3.3 Self-hosted and air-gapped deployment

GRCFlow is deployed and operated entirely on Customer Infrastructure. License validation is performed locally and offline against the public verification key; the Software does not require a call back to DefendFlow or any license server to run. An air-gapped deployment, with no outbound network connectivity, is supported.

4. Acceptable use

You agree not to, and not to permit any third party to:

• copy, distribute, resell, rent, lease, or make the Software available to any third party except as expressly permitted by these Terms, or operate it as a service bureau for parties other than your own organization;
• reverse engineer, decompile or disassemble the Software, except to the extent that applicable law expressly permits despite this limitation;
• circumvent, disable, tamper with or forge the License Key verification, Seat enforcement, the audit hash chain or any other security or integrity mechanism of the Software;
• remove, alter or obscure any proprietary notices, the licensed organization name, or signatures embedded in the Software or its outputs;
• use the Software in violation of applicable law, or to fabricate, falsify or misrepresent a compliance posture, assessment result or audit record.

You are responsible for all use of the Software under your License Key and for the acts and omissions of your authorized users.

5. Intellectual property and ownership

GRCFlow, including all software, source and object code, documentation, designs, trademarks and all related intellectual property rights, is and remains the exclusive property of DefendFlow Security and its licensors. These Terms grant you a license to use the Software for the Subscription Term and transfer no ownership of the Software to you. All rights not expressly granted are reserved by DefendFlow. If you provide feedback or suggestions about the Software, you grant DefendFlow a perpetual, royalty-free license to use that feedback to improve the Software.

6. Customer Data, privacy and no telemetry

As between the parties, you own all Customer Data. Because GRCFlow is self-hosted, Customer Data is created and stored on your own Customer Infrastructure and is not transmitted to DefendFlow in the ordinary operation of the Software.

The Software does not phone home and emits no telemetry: it does not report usage, Customer Data or compliance posture back to DefendFlow. You are the controller of Customer Data and are solely responsible for its lawful collection and use, for configuring access controls, backups and retention, and for the security of your Customer Infrastructure. DefendFlow has no access to Customer Data except where you expressly and voluntarily share it with us, for example to receive support.

7. Confidentiality

Each party may receive information of the other that is marked confidential or that a reasonable person would understand to be confidential (“Confidential Information”), including the terms of your order, the License Key and non-public details of the Software. The receiving party will protect the other's Confidential Information with at least reasonable care, use it only to exercise its rights and perform its obligations under these Terms, and not disclose it except to personnel or advisors who need it and are bound by comparable obligations. These obligations do not apply to information that is or becomes public through no fault of the receiving party, was rightfully known without a duty of confidence, is independently developed, or must be disclosed by law.

8. Fees and payment

You agree to pay the fees for the subscription you purchase, in the currency and on the schedule stated on your order or invoice. Unless stated otherwise, fees are due in advance of the Subscription Term, are non-refundable except as required by law, and are exclusive of taxes, which are your responsibility other than taxes on DefendFlow's net income. Subscriptions do not auto-renew; a renewed License Key is issued on purchase of a renewal. Fees for a future term may change on notice before that term begins.

9. Seat and license compliance

The Software enforces your license locally. A valid, unexpired License Key is required for full operation. Without a valid License Key, write operations are blocked, so new and changed records cannot be saved, although your existing Customer Data remains on your infrastructure and is not deleted by the Software for lack of a key. You agree not to provision more named users than your Seat count, not to use the Software after the Subscription Term expires without a renewed key, and not to interfere with Seat or License Key enforcement. You will, on reasonable request, certify your Seat usage. If your usage exceeds your licensed Seats, you agree to purchase the additional Seats required to bring you into compliance.

10. Term and termination

These Terms begin when you first accept them or use the Software and continue for the Subscription Term and any renewal. Either party may terminate for the other's material breach that remains uncured thirty (30) days after written notice. Your license and right to use the Software end on expiry or termination; on termination for your breach you must stop using the Software and uninstall it. Because the Software is self-hosted, you remain in control of your Customer Data and are responsible for exporting or deleting it. Sections that by their nature should survive, including ownership, confidentiality, disclaimers, limitation of liability, indemnification and governing law, survive termination.

11. Disclaimer of warranties

To the maximum extent permitted by law, the Software is provided “as is” and “as available”, and DefendFlow disclaims all warranties, whether express, implied or statutory, including any implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. DefendFlow does not warrant that the Software will be uninterrupted or error-free. GRCFlow is a tool to help you manage governance, risk and compliance; it does not itself constitute legal, audit or compliance advice, and it does not guarantee certification under, or compliance with, any framework, regulation or standard. You are responsible for your own compliance determinations and for any decisions you make using the Software.

12. Limitation of liability

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, revenue, goodwill or data, arising out of or relating to these Terms, even if advised of the possibility of such damages. DefendFlow's total aggregate liability arising out of or relating to these Terms will not exceed the fees you paid for the subscription in the twelve (12) months immediately preceding the event giving rise to the claim. Nothing in these Terms limits liability that cannot be limited under applicable law.

13. Indemnification

You will defend, indemnify and hold harmless DefendFlow and its officers, employees and agents from and against third-party claims, and reasonable related costs and damages, arising out of your use of the Software in breach of these Terms, your violation of applicable law, or your Customer Data. Any indemnity DefendFlow offers against claims that the Software, as provided and used in accordance with these Terms, infringes a third party's intellectual property rights, together with its exclusions and remedies, will be as stated in your order or in a separate written agreement: [Mutual or vendor IP indemnity scope to be specified by counsel].

14. Changes to these Terms

DefendFlow may update these Terms from time to time. When we do, we will revise the effective date above and post the updated Terms at this URL. Changes apply to renewals and to use of the Software after the updated effective date; material changes affecting a current Subscription Term will take effect no earlier than the start of your next renewal unless you agree otherwise or the change is required by law. Your continued use of the Software after an update takes effect constitutes acceptance of the updated Terms.

15. Governing law and disputes

These Terms, and any dispute arising out of or relating to them or to the Software, are governed by the laws of the Commonwealth of Massachusetts, United States, without regard to its conflict-of-laws rules, and the parties submit to the exclusive jurisdiction and venue of the state and federal courts located in the Commonwealth of Massachusetts.

16. General

These Terms, together with your order, are the entire agreement between the parties on their subject matter and supersede prior discussions. If any provision is held unenforceable, the rest remains in effect. A failure to enforce a provision is not a waiver. You may not assign these Terms without DefendFlow's consent; DefendFlow may assign them in connection with a merger, acquisition or sale of assets. Neither party is liable for delay or failure caused by events beyond its reasonable control.

17. Contact

Questions about these Terms can be sent to support@defendflow.xyz, or to the legal entity and notice address to be specified in Section 1 above.