Terms of service

These terms govern the use of complies.ai and the Complies service. By creating an account or using the service you accept them.

1. The service

Complies provides compliance management software: an obligation tracker with a compliance calendar, controls cross-mapped across frameworks such as SOC 2, ISO 27001, GDPR, HIPAA, and PCI DSS, evidence collection with owners and due dates, AI-drafted policy starting points, a risk register, readiness scoring, and reporting. We may improve or change features, and where a change materially reduces what you pay for, we will tell you in advance.

2. Readiness, not certification

Complies assists with compliance workflows. Its scores, gap flags, drafts, and reports are preparation tools, not legal advice, not an audit, and not a certification. Complies does not certify compliance with SOC 2, ISO 27001, GDPR, or any other framework, and it does not guarantee audit outcomes. Only an accredited auditor can issue a SOC 2 report or an ISO 27001 certificate, and only a qualified lawyer can give legal advice. You remain responsible for your compliance decisions and for reviewing anything the product drafts before you adopt it.

3. Accounts

You must provide a real email address and keep your access credentials confidential. You are responsible for activity under your account. We may suspend accounts that breach these terms or put the service or other customers at risk.

4. Your data and your obligations

You confirm that your team is entitled to connect the systems it connects and upload the evidence it uploads, and that your use of the service complies with applicable law, including data protection law. You control who on your team can see what through roles and permissions on plans that include them.

5. Subscriptions and billing

Plans are billed monthly or yearly in USD at the prices published on the pricing page. Yearly billing is discounted. You can cancel at any time and the subscription runs until the end of the paid period; we do not refund partial periods except where the law requires. We may change prices with at least 30 days notice, taking effect at your next renewal.

6. Acceptable use

• No unlawful use, and no use of the service to misrepresent your compliance posture to auditors, customers, or regulators.
• No attempts to breach, probe, or overload the service.
• No reselling of the service without a written agreement with us.
• No scraping of the service or automated bulk export beyond the export features your plan includes.

7. Intellectual property

We own the platform, the control crosswalks, templates, and scoring models. You own your data: your obligations, controls, policies, evidence, and reports. On request or on termination you can export it.

8. Warranties and liability

The service is provided "as is" without warranties of fitness for a particular purpose. To the extent the law allows, our total liability for any claim is limited to the fees you paid in the 12 months before the event giving rise to the claim, and we are not liable for indirect or consequential damages, lost profits, audit findings, or regulatory outcomes (see section 2).

9. Termination

You may stop using the service and delete your account at any time. We may terminate with 30 days notice, or immediately for material breach. On termination you can export your data for 30 days, after which it is deleted per the privacy policy.

10. Governing law and changes

These terms are governed by the laws of the operator's registered jurisdiction, without prejudice to mandatory consumer protections. If we change these terms materially we will notify account holders at least 14 days before the change takes effect.

Questions about these terms: [email protected].