Terms of Service

1. Acceptance of Terms

These Terms of Service (“Terms”) constitute a legally binding agreement between you (the individual accessing or using the service, or the entity on whose behalf such individual is acting) and Sentrafort, Inc. (“Sentrafort,” “we,” “us,” or “our”), a Delaware corporation. By creating an account, accessing, or using the Sentrafort platform and related services (collectively, the “Service”), you agree to be bound by these Terms in their entirety.

If you are entering into these Terms on behalf of an organization, you represent and warrant that you have the authority to bind that organization to these Terms, and that the organization agrees to be bound. “You” and “your” refer to both the individual and the organization. If you do not have such authority, or if you do not agree to these Terms, you may not access or use the Service.

We may update these Terms from time to time. If we make material changes, we will provide at least 30 days' advance notice via email or in-app notification. Your continued use of the Service after the effective date of revised Terms constitutes acceptance of the revised Terms. If you disagree with any changes, your sole remedy is to terminate your account before the changes take effect.

2. Service Description

Sentrafort is a unified cloud security platform that provides organizations with comprehensive visibility, threat detection, and compliance automation across AWS cloud environments, with Azure and Google Cloud support in preview. The Service is delivered as a hosted software-as-a-service (SaaS) solution and is composed of the following core security pillars:

• Cloud Security Posture Management (CSPM): Continuous monitoring and assessment of cloud infrastructure configurations for AWS (Azure and Google Cloud in preview) against industry benchmarks and security best practices, including CIS Benchmarks, AWS Well-Architected Framework, and custom organizational policies.
• Identity & Access Intelligence (CIEM): Deep analysis of cloud identity configurations, permissions, access patterns, and privilege escalation paths. Includes service account monitoring, role-based access auditing, and automated least-privilege recommendations.
• Attack Path Analysis: Graph-based security modeling that identifies exploitable chains of misconfigurations, overly permissive access, and vulnerabilities across your cloud environment. Maps blast radius and provides prioritized remediation guidance based on actual exploitability.
• Runtime Protection (Vigil): Lightweight agent-based runtime security that monitors workloads, detects anomalous behavior, enforces security policies in real time, and provides drift detection for infrastructure-as-code deployments.
• SOC & Incident Management: Centralized security operations center capabilities, including alert triage, incident lifecycle management, investigation workflows, and integration with external SIEM and SOAR platforms. Available exclusively on the Enterprise tier.
• Compliance Automation: Automated mapping of cloud configurations to regulatory frameworks including SOC 2 Type II, ISO 27001, HIPAA, PCI-DSS v4.0, NIST CSF 2.0. Includes evidence collection, audit-ready report generation, and continuous compliance monitoring.

Feature availability varies by subscription tier as described in Section 4. Sentrafort reserves the right to modify, enhance, or discontinue features of the Service with reasonable notice. We will not remove material features during an active subscription term without providing comparable replacement functionality or offering a pro-rated refund at our discretion.

3. Account Registration & Security

To access the Service, you must create an account by providing accurate, current, and complete information, including your full name, business email address, company name, and a secure password. You agree to keep your registration information up to date at all times. Providing false, misleading, or outdated information constitutes a breach of these Terms and may result in immediate account termination.

You are solely responsible for maintaining the confidentiality of your account credentials, including your password, API keys, and any authentication tokens. You agree to implement commercially reasonable security measures for your account, including the use of strong, unique passwords and multi-factor authentication (MFA). MFA is required for all accounts on the Professional and Enterprise tiers and strongly recommended for all other tiers.

You are responsible for all activities that occur under your account, whether or not you have authorized them. You must immediately notify Sentrafort at security@sentrafort.com if you become aware of any unauthorized access to or use of your account. Sentrafort is not liable for any loss or damage arising from your failure to safeguard your account credentials. We reserve the right to suspend access to any account that we reasonably believe has been compromised, and to require a password reset or additional verification before restoring access.

Organization administrators are responsible for managing user access within their accounts, including inviting and revoking team members, assigning roles and permissions, and ensuring that only authorized personnel have access to sensitive security data and platform configurations.

4. Subscription Plans & Billing

The Service is offered across four subscription tiers, each providing progressively broader capabilities. Feature availability, usage limits, and support levels are defined by your selected tier:

Billing: Subscriptions are billed either monthly or annually, as selected during checkout. Annual subscriptions receive a discount as displayed on the pricing page at the time of purchase. All fees are quoted in United States Dollars (USD) and are exclusive of applicable taxes, which will be added to your invoice as required by law. Payment is processed through our payment provider, Stripe, and is due at the beginning of each billing cycle.

Upgrades and downgrades: You may upgrade your subscription tier at any time. Upgrades take effect immediately, and you will be charged a prorated amount for the remainder of the current billing cycle. Downgrades take effect at the start of the next billing cycle. When downgrading, you may lose access to features not included in the lower tier; it is your responsibility to export any data associated with those features before the downgrade takes effect.

Refund policy: All fees are non-refundable except as expressly stated in these Terms or as required by applicable law. If we materially fail to provide the Service in accordance with the applicable SLA and do not cure the failure within 30 days of written notice, you may terminate your subscription and receive a pro-rated refund for the unused portion of the then-current billing period. Annual customers who cancel within the first 30 days of their initial subscription term may request a full refund, less the value of any usage during that period.

Auto-renewal: Subscriptions automatically renew at the end of each billing cycle unless cancelled at least 30 days before the renewal date. We will send a renewal reminder at least 15 days before each renewal. Price increases for renewal terms will be communicated at least 60 days in advance.

5. Evaluation Access Terms

Sentrafort may provide free evaluation access to eligible new customers so they can assess the Service before purchasing a subscription. No payment information is required to start an evaluation. Sentrafort does not currently offer a fixed-duration free trial: evaluation access carries no committed duration and no committed subscription-tier entitlement, and Sentrafort may modify, limit, suspend, or end evaluation access at its discretion with reasonable notice.

During any evaluation period, you may use the Service subject to all terms and conditions in this agreement, including the Acceptable Use Policy. The Service is provided “as is” during evaluation, and the SLA commitments described in Section 10 do not apply to evaluation accounts. We may limit the number of cloud accounts, scans, features, or users available during an evaluation at our sole discretion.

To continue using the Service beyond your evaluation, you must select a paid subscription plan as described in Section 4. If you do not subscribe within 30 days after your evaluation access ends, your evaluation data, including scan results, findings, and configurations, may be permanently deleted. Sentrafort is not obligated to provide any notice before deleting evaluation data after this 30-day grace period. Each organization is eligible for one evaluation; creating multiple accounts to obtain additional evaluation access is a violation of these Terms.

6. Data Ownership & Processing

Your data:You retain all ownership rights, title, and interest in and to the data you submit to, store in, or generate through the Service (“Customer Data”), including cloud configuration data, security scan results, compliance reports, and any other information uploaded to or processed by the platform. Sentrafort acquires no ownership rights in Customer Data.

Limited license: You grant Sentrafort a non-exclusive, worldwide, royalty-free license to use, process, store, and display Customer Data solely as necessary to provide, maintain, and improve the Service in accordance with these Terms and any applicable Data Processing Agreement (DPA). This license terminates upon deletion of Customer Data or termination of your account, whichever occurs last.

Data processing: Where Customer Data includes personal data subject to data protection laws (including the GDPR, UK GDPR, or CCPA), Sentrafort processes such data as a data processor on your behalf. Our DPA, which is incorporated by reference into these Terms and available at sentrafort.com/legal/dpa (or upon request from legal@sentrafort.com), governs the processing of personal data and includes the Standard Contractual Clauses (SCCs) as required for international data transfers.

Data export and deletion: You may export your Customer Data at any time through the platform's built-in export functionality or via the API. Upon termination of your subscription, you have a 90-day period to export your data. After this period, Sentrafort will securely delete all Customer Data from production systems within 30 days. Deletion certificates are available for Enterprise customers upon request.

Aggregated data: Sentrafort may generate anonymized, aggregated, and de-identified statistical data derived from the use of the Service (“Aggregated Data”). Aggregated Data does not identify you or any individual and cannot be reverse-engineered to do so. Sentrafort may use Aggregated Data for any lawful business purpose, including product improvement, benchmarking, and industry research, without restriction. Aggregated Data is owned by Sentrafort.

7. Acceptable Use Policy

You agree to use the Service only for lawful purposes and in compliance with these Terms, all applicable laws and regulations, and any policies published by Sentrafort. The following activities are strictly prohibited:

• Using the Service to scan, monitor, or assess cloud environments or assets that you do not own or do not have explicit written authorization to assess.
• Attempting to reverse engineer, decompile, disassemble, or otherwise derive the source code, algorithms, or underlying architecture of the Service or any component thereof.
• Interfering with, disrupting, or degrading the performance of the Service or the servers, networks, or infrastructure used to deliver it, including through denial-of-service attacks, packet injection, or excessive automated requests.
• Reselling, sublicensing, redistributing, or providing access to the Service to any third party without a valid Sentrafort partner or reseller agreement.
• Using the Service to store, transmit, or process any content that is illegal, defamatory, obscene, or that infringes on the intellectual property or privacy rights of any third party.
• Circumventing, disabling, or interfering with any security, authentication, rate-limiting, or access control features of the Service.
• Using the Service to develop a competing product or service, or to perform competitive benchmarking or analysis for the benefit of a competitor.
• Accessing other customers' data, accounts, or environments through the Service, whether through exploitation of vulnerabilities, social engineering, or any other means.
• Using the Service to conduct vulnerability scanning, penetration testing, or exploitation of third-party systems, except through the authorized use of Sentrafort's built-in scanning features against your own authorized environments.
• Exceeding the usage limits, user counts, or cloud account quotas defined by your subscription tier, unless additional capacity has been purchased.

Sentrafort reserves the right to investigate suspected violations of this Acceptable Use Policy and to take appropriate action, including suspension or termination of access, without prior notice. If you become aware of any violation of this policy, please report it immediately to abuse@sentrafort.com.

8. Intellectual Property

The Service, including all software, APIs, documentation, user interfaces, designs, trademarks, logos, and content created by Sentrafort (collectively, “Sentrafort IP”), is and remains the exclusive property of Sentrafort and its licensors. These Terms do not grant you any ownership interest in the Sentrafort IP. All rights not expressly granted are reserved.

Subject to your compliance with these Terms, Sentrafort grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service during your active subscription term solely for your internal business purposes. This license does not include the right to modify, copy, distribute, sell, or create derivative works of any part of the Service or Sentrafort IP.

You may provide feedback, suggestions, ideas, or enhancement requests regarding the Service (“Feedback”). By providing Feedback, you grant Sentrafort a perpetual, irrevocable, worldwide, royalty-free license to use, modify, incorporate, and commercialize the Feedback for any purpose without obligation of compensation or attribution to you. You represent that any Feedback you provide does not infringe on any third-party intellectual property rights.

9. Confidentiality

“Confidential Information” means any non-public information disclosed by one party (“Disclosing Party”) to the other (“Receiving Party”) in connection with these Terms that is designated as confidential or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information includes, but is not limited to: Customer Data, security scan results, vulnerability findings, API keys, architectural details of either party's systems, pricing and business terms, product roadmaps, and any information marked as “Confidential” or “Proprietary.”

The Receiving Party agrees to: (a) use the Disclosing Party's Confidential Information solely for the purpose of exercising its rights or fulfilling its obligations under these Terms; (b) protect the Disclosing Party's Confidential Information using at least the same degree of care it uses to protect its own confidential information, and in no event less than reasonable care; and (c) not disclose the Disclosing Party's Confidential Information to any third party, except to employees, contractors, or agents who have a need to know and who are bound by confidentiality obligations no less protective than those in this section.

Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the Receiving Party; (b) was known to the Receiving Party prior to disclosure without restriction; (c) is independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information; or (d) is rightfully obtained from a third party without restriction. The Receiving Party may disclose Confidential Information if required by law, court order, or governmental regulation, provided that it gives the Disclosing Party prompt written notice (to the extent legally permitted) and cooperates with efforts to obtain protective treatment.

The obligations in this section survive termination of these Terms for a period of three (3) years, except with respect to trade secrets, which are protected for as long as they remain trade secrets under applicable law.

10. Service Level Agreement

Sentrafort targets high availability for the production Service. Enterprise customers may negotiate custom uptime commitments and service credit terms as part of their subscription agreement. Uptime is measured as the percentage of total minutes in a calendar month during which the Service is available and operational, excluding Scheduled Maintenance and force majeure events.

Scheduled Maintenance: Sentrafort performs scheduled maintenance during designated windows (Sundays 02:00–06:00 UTC) and will provide at least 72 hours' advance notice for planned maintenance that may affect availability. Emergency maintenance to address security vulnerabilities or critical system failures may be performed outside the scheduled window with as much advance notice as is practicable.

Service credits: Enterprise customers with negotiated SLA terms may request service credits if the Service fails to meet the agreed uptime commitment in a given calendar month.

Service credits must be requested in writing within 30 days of the end of the month in which the downtime occurred. Credits are applied to future invoices and do not constitute a cash refund. The maximum aggregate service credit for any calendar month shall not exceed 50% of the monthly fee for that month. Service credits are your sole and exclusive remedy for Sentrafort's failure to meet the Uptime Commitment.

Enterprise customers with custom SLA terms documented in a separate service agreement will be governed by those terms in the event of any conflict with this section. The SLA does not apply to evaluation accounts, beta features, or features designated as “Preview” or “Experimental.”

11. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL SENTRAFORT, ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF PROFITS, REVENUE, GOODWILL, DATA, BUSINESS INTERRUPTION, OR COST OF PROCUREMENT OF SUBSTITUTE SERVICES, ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR THE USE OR INABILITY TO USE THE SERVICE, REGARDLESS OF THE CAUSE OF ACTION OR THE THEORY OF LIABILITY (WHETHER IN CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE), AND EVEN IF SENTRAFORT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, SENTRAFORT'S TOTAL CUMULATIVE LIABILITY TO YOU FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE AGGREGATE FEES PAID BY YOU TO SENTRAFORT DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. FOR USERS ON FREE EVALUATION ACCESS, SENTRAFORT'S TOTAL LIABILITY SHALL NOT EXCEED ONE HUNDRED UNITED STATES DOLLARS (US $100).

The limitations in this section apply to the fullest extent permitted by law in the applicable jurisdiction. Some jurisdictions do not allow the exclusion or limitation of incidental or consequential damages, so the above limitations may not apply to you in their entirety. In such jurisdictions, Sentrafort's liability is limited to the greatest extent permitted by law. Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be excluded by law.

You acknowledge that the Service is a security monitoring and assessment tool and that Sentrafort does not guarantee that the Service will detect all security vulnerabilities, misconfigurations, or threats in your cloud environment. The Service is not a substitute for a comprehensive security program, and you remain solely responsible for the security of your cloud infrastructure and data.

12. Indemnification

Your indemnification: You agree to indemnify, defend, and hold harmless Sentrafort and its affiliates, officers, directors, employees, and agents from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) your use of the Service in violation of these Terms or applicable law; (b) your breach of the Acceptable Use Policy; (c) your violation of any third-party rights, including intellectual property or privacy rights; (d) Customer Data that you submit, store, or process through the Service; or (e) any unauthorized access to the Service resulting from your failure to safeguard your account credentials.

Sentrafort's indemnification: Sentrafort will indemnify, defend, and hold harmless you and your affiliates, officers, directors, employees, and agents from and against any third-party claim that the Service, as provided by Sentrafort and used in accordance with these Terms, infringes or misappropriates the claimant's intellectual property rights, and will pay any finally awarded damages or settlement amounts. This obligation does not apply to claims arising from: (a) modifications to the Service made by you or at your direction; (b) combination of the Service with products, services, or technologies not provided by Sentrafort; (c) your continued use of a version of the Service after being notified of an update that would have avoided the infringement; or (d) use of the Service in violation of these Terms.

If the Service becomes, or in Sentrafort's opinion is likely to become, the subject of an infringement claim, Sentrafort may at its option: (a) procure the right for you to continue using the Service; (b) modify the Service to make it non-infringing while maintaining substantially equivalent functionality; or (c) if neither of the foregoing is commercially reasonable, terminate your subscription and provide a pro-rated refund for the unused portion of the then-current billing period.

13. Termination & Suspension

Termination by you: You may terminate your subscription at any time by providing written notice to billing@sentrafort.com or through the account settings in the platform. Termination takes effect at the end of the current billing cycle. No refunds are provided for the remainder of the billing period in which termination is initiated, except as otherwise provided in these Terms.

Termination by Sentrafort: Sentrafort may terminate your subscription with 30 days' written notice for any reason or no reason. Sentrafort may also terminate immediately and without notice if: (a) you materially breach these Terms and fail to cure the breach within 15 days of written notice; (b) you fail to pay any amounts due within 30 days of the payment due date; (c) you become insolvent, file for bankruptcy, or become subject to insolvency proceedings; or (d) continued provision of the Service to you would cause Sentrafort to violate applicable law.

Suspension: Sentrafort may suspend your access to the Service immediately and without prior notice if: (a) we reasonably believe your account has been compromised; (b) your use of the Service poses a security risk to the Service or other customers; (c) your use of the Service may subject Sentrafort to legal liability; or (d) you violate the Acceptable Use Policy. We will use commercially reasonable efforts to notify you of the suspension and restore access promptly once the issue has been resolved.

Effect of termination: Upon termination, your right to access and use the Service ceases immediately (or at the end of the billing cycle, if applicable). Sentrafort will retain your Customer Data for 90 days following termination to allow for data export. After this period, Customer Data will be securely deleted in accordance with Section 6. The following sections survive termination: Sections 6 (Data Ownership), 8 (Intellectual Property), 9 (Confidentiality), 11 (Limitation of Liability), 12 (Indemnification), 14 (Governing Law), and 15 (General Provisions).

14. Governing Law & Dispute Resolution

These Terms are governed by and construed in accordance with the laws of the State of Delaware, United States of America, without regard to its conflict of laws principles. The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply to these Terms.

Mandatory arbitration: Any dispute, claim, or controversy arising out of or relating to these Terms or the Service, including the determination of the scope or applicability of this agreement to arbitrate, shall be resolved by binding arbitration administered by JAMS under its Comprehensive Arbitration Rules and Procedures. The arbitration shall be conducted by a single arbitrator and shall take place in Wilmington, Delaware. The language of the arbitration shall be English. The arbitrator's decision shall be final, binding, and enforceable in any court of competent jurisdiction.

Class action waiver: YOU AND SENTRAFORT AGREE THAT EACH PARTY MAY BRING CLAIMS AGAINST THE OTHER ONLY IN ITS INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION. Unless both parties agree otherwise, the arbitrator may not consolidate more than one person's claims and may not preside over any form of class or representative proceeding.

Exceptions: Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of a party's intellectual property rights, confidentiality obligations, or data protection obligations. Claims for amounts less than $10,000 USD may be brought in small claims court in lieu of arbitration.

Notice of dispute: Before initiating formal arbitration, you must first send a written notice of dispute to legal@sentrafort.com describing the claim and the specific relief sought. Both parties agree to negotiate in good faith for at least 60 days before commencing arbitration. If the dispute is not resolved through negotiation, either party may then initiate arbitration.

15. General Provisions

15.1 Entire Agreement

These Terms, together with the Privacy Policy, DPA, and any Order Forms or Statements of Work executed by the parties, constitute the entire agreement between you and Sentrafort regarding the subject matter hereof and supersede all prior or contemporaneous agreements, understandings, representations, and warranties, whether oral or written. In the event of a conflict between these Terms and an executed Order Form, the Order Form shall control to the extent of the conflict.

15.2 Severability

If any provision of these Terms is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, the invalidity of that provision shall not affect the validity of the remaining provisions, which shall continue in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it valid and enforceable while preserving the parties' original intent.

15.3 Waiver

The failure of either party to enforce any right or provision of these Terms shall not constitute a waiver of that right or provision. Any waiver of any provision of these Terms will be effective only if in writing and signed by the waiving party. A waiver of any right on one occasion shall not be construed as a bar to or waiver of any such right on any future occasion.

15.4 Assignment

You may not assign or transfer these Terms or any rights or obligations hereunder without the prior written consent of Sentrafort, and any attempted assignment without such consent shall be void. Sentrafort may assign these Terms in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets without your consent, provided the assignee agrees to be bound by these Terms. Subject to the foregoing, these Terms bind and inure to the benefit of the parties and their respective successors and assigns.

15.5 Force Majeure

Neither party shall be liable for any delay or failure to perform its obligations under these Terms (other than payment obligations) to the extent caused by events beyond its reasonable control, including natural disasters, war, terrorism, riots, embargoes, acts of governmental authorities, fire, flood, pandemic, power failures, internet or telecommunications failures, or third-party infrastructure outages. The affected party shall provide prompt written notice and use commercially reasonable efforts to mitigate the impact.

15.6 Notices

All legal notices under these Terms must be in writing and delivered to: (a) for notices to Sentrafort: legal@sentrafort.com or Sentrafort, Inc., 548 Market St, Suite 35000, San Francisco, CA 94104, USA; and (b) for notices to you: the email address associated with your account. Notices are deemed received upon delivery for email and three business days after mailing for postal mail.

15.7 Export Compliance

You agree to comply with all applicable export control laws and regulations, including the U.S. Export Administration Regulations (EAR) and sanctions programs administered by the U.S. Treasury Department's Office of Foreign Assets Control (OFAC). You represent and warrant that you are not located in, or a national or resident of, any country subject to comprehensive U.S. sanctions, and that you are not on any U.S. government denied party list. You agree not to export, re-export, or transfer the Service or any technical data received from Sentrafort in violation of applicable export laws.

15.8 Independent Contractors

The relationship between you and Sentrafort is that of independent contractors. Nothing in these Terms creates a partnership, joint venture, employment, agency, or franchise relationship between the parties. Neither party has the authority to bind the other or to incur obligations on the other's behalf.