Terms of Service

1. Agreement

These Terms of Service are an agreement between you and Backsplice LLC ("we", "us") covering your use of Backsplice. By creating an account or using the service, you agree to them. If you use the service for an organization, you confirm that you are authorized to accept these terms on its behalf, and "you" includes that organization.

Your acceptance is recorded against the version of these terms in effect when you sign up. Accounts created through self-service sign-up accept the terms when they register, and are asked to accept a materially changed version before continuing. [Counsel: accounts created by an admin, an invitation, single sign-on or SCIM do not accept the terms themselves today; decide whether the organization's acceptance covers them or they must be prompted.]

2. The Service

Backsplice is a platform for running an AI governance program. It provides tools to:

• Keep a registry of your AI systems, the models they use and their versions, and the AI vendors you rely on
• Run assessments against framework packs, for your organization's program and for each AI system
• Submit systems for review and record approval decisions, with approvers set by your risk-tier policy
• Write and publish model cards and system cards, and keep governance registers (risks, AI incidents, vendors, policies, training, changes and access reviews)
• Export records, share read-only access with auditors, let guests answer a question or complete a task through a link, and connect the service to other systems through an API, an MCP server, webhooks, SIEM forwarding, SAML single sign-on and SCIM

Backsplice supports your governance program. It does not establish that your organization, or any AI system, meets the requirements of a law, regulation or framework, and nothing in the service is legal advice.

We may change, add or remove features. [Counsel: notice commitment for removing a feature a paying customer relies on.]

3. Accounts, Roles and Security

Each person needs their own account. An organization's admins decide who has access and in which role (admin, contributor or auditor). You are responsible for:

• Keeping your credentials and second factors confidential
• Activity that happens under your account
• Making sure the people you invite follow these terms
• Telling us promptly at [email protected] about any unauthorized access you suspect

Do not share a login between people. We may suspend an account we reasonably believe is being used in breach of these terms. [Counsel: suspension process and notice for a breach of these terms.]

4. The Demo, the Lock, and Deletion

This section describes what the service does today. Every number in it is read from the same settings the service enforces.

The demo. A new organization starts with a demo that lasts 30 days. No payment card is needed. Most of the service works during the demo, with these exceptions: Watney, exports and scheduled report emails, auditor and guest links, the transparency page and public badge, the API and MCP server, webhooks and SIEM forwarding come with a plan.

When the demo ends. Your demo lasts 30 days. If you have not chosen a plan by then, the organization is locked; 90 days after the lock, it and everything in it is permanently deleted, unless you choose a plan first. Locking and deletion each happen on the first daily run after the date is reached.

Reminders. For a demo, we email your organization's admins 7 days and 1 day before the demo ends, again when the organization is locked, and again 14 days before it is deleted. Each reminder states the date it is about.

What a lock means. While an organization is locked, its members can sign in only to choose a plan, confirm their second factor, switch to another organization or sign out, and an admin can still download the organization's data (see below). Everything else refuses: the dashboard, the API and MCP server, SCIM, auditor and guest links, the public transparency page, webhook and SIEM delivery, and scheduled email. Choosing a plan lifts the lock and cancels the scheduled deletion.

When a paid subscription ends. If a paid subscription is canceled, or payment fails and our payment processor stops retrying it, the organization is locked on the next daily check and is permanently deleted 90 days after the lock unless you choose a plan first. While the processor is still retrying a failed payment, the organization keeps working. For a paid organization, we email its admins 7 days before a subscription that was canceled ends at the close of its billing period, when the organization is locked, and 14 days before it is deleted. When the lock follows a payment that finally failed, no reminder is sent before the lock itself. [Counsel: whether to commit to advance notice before a lock that follows a failed payment; the service sends none today.]

Closing your organization yourself. An organization admin can ask for the organization to be closed from its settings page. It is then permanently deleted 30 days after the request. An admin can cancel the request at any time before that date; choosing or paying for a plan does not cancel it. The deletion date is shown on the settings page; no reminder email is sent before a closure you requested.

Taking your data with you. Before deletion, an organization admin can download a copy of the organization's data: from the organization's settings page, or, while the organization is locked, from the page every member lands on. The download is available during the demo and while the organization is locked. After deletion the data is removed from the service and cannot be restored to it. Copies remain in our database and file backups until those backups expire. [Counsel: the backup retention period to state, and whether it should be shortened to fit the deletion commitment.]

What deletion removes. Deletion removes the organization and the records and files in it. Some records are kept after deletion, including the security audit log; the Privacy Policy lists what is kept.

5. Plans and Billing

After the demo, the service is sold on paid plans, described with their prices on the pricing page. Subscriptions are billed in advance, monthly or annually, through our payment processor, Stripe. By starting a subscription you authorize recurring charges to your payment method until it is canceled. Watney is included in paid plans, within fair-use limits. We may set limits on its use, for an organization or for work on a single assessment, and pause it when a limit is reached; the pause message says when Watney resumes, or how to turn it back on. [Counsel: this replaces the earlier metered-credit wording and the one-time credit purchase (owner decision D4, 2026-09-26); confirm the fair-use and pause language, and whether the limits must be disclosed.]

• You can manage or cancel a subscription from the billing page. When it ends, the organization is locked as described in section 4.
• [Counsel: refund policy for prepaid, unused periods.]
• [Counsel: notice period before a price change applies to an existing subscription.]
• Fees do not include taxes, which you are responsible for. [Counsel: confirm tax handling.]

6. Acceptable Use

Use the service only for lawful purposes and in line with these terms. You may not:

• Break any applicable law or regulation, or infringe anyone's rights
• Upload malware or other malicious code
• Try to gain unauthorized access to the service, another organization's data, or our systems
• Interfere with or disrupt the service, or load it in a way meant to degrade it for others
• Scrape or harvest data from the service by automated means, other than through the API and integrations we provide
• Impersonate anyone or misrepresent your affiliation with anyone

If you find a security vulnerability, we welcome a report at [email protected].

7. Your Data

You own the records and files you put into the service. You give us a limited, non-exclusive license to host, process and transmit them only to provide the service to you, as described in our Data Processing Agreement ("DPA") and Privacy Policy. An organization admin accepts the DPA before any governance records can be created or changed in the organization (organization setup, such as the profile, members, sign-in and integration settings, can be done first), and the DPA is part of these terms.

You are responsible for having the right to put your content into the service, including any personal information about other people.

8. Watney

Watney is the service's AI assistant. It proposes; it never decides. It does not approve a system, set a risk tier or publish a card. It drafts cards, suggests intake triage and answers questions from your organization's records.

• Watney is off until an organization admin opts in, and it is not part of the demo.
• When it runs, it sends the model provider only what the task needs: records you typed, documentation you pasted in, and the contents of uploaded evidence files (or its earlier summaries of them) when it reviews or drafts an answer or summarizes evidence.
• The model provider and the models are named on Watney's system card.
• Its output can be wrong or incomplete. Review it before you rely on it; the decision is always yours.

9. Intellectual Property

Backsplice, its software, documentation and content are owned by Backsplice LLC and protected by intellectual property laws. These terms give you a limited right to use the service during your demo or subscription, and no other right in it.

If you send us feedback, we may use it without obligation to you.

10. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.

We do not warrant that using the service satisfies any law, regulation, standard or contract. The service is a tool for your governance program, not a substitute for your own judgment or for qualified legal counsel. We do not warrant that the service will be uninterrupted or error-free. [Counsel: disclaimer scope.]

11. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, BACKSPLICE LLC WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS OR LOST DATA, ARISING FROM OR RELATED TO THE SERVICE.

Our total liability for all claims arising from or related to these terms or the service will not exceed the fees you paid us in the twelve months before the event giving rise to the claim. [Counsel: liability cap, carve-outs, and the cap for an organization that has only used the demo.]

12. Ending These Terms

You can stop using the service at any time, and an admin can close the organization as described in section 4. We may suspend or end access for a material breach of these terms. When an organization is deleted, its data is removed as section 4 describes. Sections 7, 9, 10, 11 and 13 continue after these terms end. [Counsel: termination for convenience by us, and notice.]

13. Governing Law

These terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-law rules, and disputes are heard in the state and federal courts located in Delaware. [Counsel: governing law, venue, dispute process and any claim-limitation period.]

14. Changes to These Terms

We may update these terms. The version and date at the top of this page change when we do. For a material change, users who accepted an earlier version are asked to accept the new version before continuing. [Counsel: advance notice period for material changes.]

15. Contact

For legal notices and questions about these terms, contact:

Backsplice LLC
[email protected]

[Counsel: postal address for formal notices.]