Terms of Service

Last updated: October 20, 2026 · Version 2026-10-20

1. Agreement

These Terms of Service are an agreement between you and Backsplice LLC ("we", "us") covering your use of Backsplice. By creating an account or using the service, you agree to them. If you use the service for an organization, you confirm that you are authorized to accept these terms on its behalf, and "you" includes that organization.

Your acceptance is recorded against the version of these terms in effect when you sign up. An account created through self-service sign-up accepts the terms when it registers, and is asked to accept a new version before continuing. An account that an organization's admins add, by invitation, by creating it, through single sign-on or through SCIM, uses the service under the organization's acceptance of these terms, and the organization is responsible for making sure the people it adds follow them.

2. The Service

Backsplice is a platform for running an AI governance program and a HIPAA compliance program. It provides tools to:

Keep a registry of your systems, the AI models they use and their versions, and the vendors you rely on
Run assessments against framework packs, for your organization's program and for each system, including HIPAA assessments for an organization that handles protected health information
Submit systems for review and record approval decisions, with approvers set by your risk-tier policy
Write and publish model cards and system cards, and keep governance and compliance registers (risks and the security risk analysis, incidents and breach notifications, requests from individuals, the disclosure log, vendors and their agreements, policies, training, workforce sanctions, devices, changes and access reviews)
Export records, share read-only access with auditors, let guests answer a question or complete a task through a link, and connect the service to other systems through an API, an MCP server, webhooks, SIEM forwarding, SAML single sign-on and SCIM

Backsplice supports your governance and compliance programs. It does not establish that your organization, or any system, meets the requirements of a law, regulation or framework, and nothing in the service is legal advice.

We may change, add or remove features. If we remove a feature that a paid plan includes, we tell the organization's admins by email at least 30 days before it is removed, unless security or the law requires us to remove it sooner. If the removal materially reduces what the plan includes, an admin may cancel the subscription, and we refund the prepaid fees for the unused part of the billing period.

3. Accounts, Roles and Security

Each person needs their own account. An organization's admins decide who has access and in which role (admin, contributor or auditor). You are responsible for:

Keeping your credentials and second factors confidential
Activity that happens under your account
Making sure the people you invite follow these terms
Telling us promptly at [email protected] about any unauthorized access you suspect

Do not share a login between people. We may suspend an account or an organization that we reasonably believe is being used in breach of these terms. Unless the breach puts the service, other customers or anyone's data at risk, or the law requires us to act at once, we first tell the organization's admins by email what the breach is and give them a reasonable chance to fix it. Suspension stops access and deletes nothing, and we lift it once the breach is fixed.

4. The Free Plan, Paid Plans, and Deletion

This section describes what the service does today. Every number in it is read from the same settings the service enforces.

The Free plan. A new organization starts on the Free plan, with no time limit. No payment card is needed. Most of the service works on it, with these exceptions: Watney, exports and scheduled report emails, auditor and guest links, the transparency page and public badge, the API and MCP server, webhooks and SIEM forwarding, and SAML single sign-on and SCIM provisioning come with a paid plan; the download of all your organization's data works on every plan. The Free plan includes 1 AI system and 1 system that handles ePHI, and a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only; the Privacy Rule questions and the optional HIPAA packs come with a paid plan, and answers already given are kept.

When a paid plan ends. A new organization starts on the Free plan, with no time limit. If a paid plan ends, the organization moves to the Free plan; nothing is deleted because a plan ended, and the organization itself is deleted only when an organization admin closes it. If a paid subscription is canceled, or payment fails and our payment processor stops retrying it, the organization moves to the Free plan on the next daily check and keeps the records and files in it. While the processor is still retrying a failed payment, the organization keeps working on its plan. We email the organization's admins 7 days before a subscription that was canceled ends at the close of its billing period.

A trial from before the Free plan. An organization that started a Premium trial before the Free plan existed keeps it until its end date and then moves to the Free plan. We email its admins 7 days and 1 day before the trial ends.

Closing your organization yourself. An organization admin can ask for the organization to be closed from its settings page. It is then permanently deleted 30 days after the request. An admin can cancel the request at any time before that date; choosing or paying for a plan does not cancel it. The deletion date is shown on the settings page; no reminder email is sent before a closure you requested.

Taking your data with you. Before deletion, an organization admin can download a copy of the organization's data from the organization's settings page, on every plan, the Free plan included. After deletion the data is removed from the service and cannot be restored to it. Copies remain in our database and file backups until those backups expire: we keep the most recent 30 daily backups and one backup from each month for 6 years, so a copy of deleted data can remain in a backup for up to 6 years. We keep backups only to recover the service, protect them as the DPA and any business associate agreement with us require, and use them for nothing else. If we ever restore the service from a backup, we delete again any organization that had been deleted before the restore.

What deletion removes. Deletion removes the organization and the records and files in it. Some records are kept after deletion, including the security audit log; the Privacy Policy lists what is kept.

5. Plans and Billing

Beyond the Free plan, the service is sold on paid plans, described with their prices on the pricing page. Subscriptions are billed in advance, monthly or annually, through our payment processor, Stripe. By starting a subscription you authorize recurring charges to your payment method until it is canceled. Watney is included in paid plans, within fair-use limits. We may set limits on its use, for an organization or for work on a single assessment, and pause it when a limit is reached; the pause message says when Watney resumes, or how to turn it back on. We set the limits so that ordinary use of the service stays within them; we do not publish them, and we may change them. A pause adds no charge.

You can manage or cancel a subscription from the billing page. When it ends, the organization moves to the Free plan as described in section 4.
A canceled subscription runs to the end of the period already paid. Fees are not refundable, except as sections 2 and 12 say or where the law requires a refund.
We tell the organization's admins by email at least 30 days before a price change applies to an existing subscription, and the new price applies from the first renewal after that notice.
Fees do not include taxes. Where we are required to collect a sales or similar tax, we add it to the invoice; you are responsible for any other tax due on your purchase.

6. Acceptable Use

Use the service only for lawful purposes and in line with these terms. You may not:

Break any applicable law or regulation, or infringe anyone's rights
Upload malware or other malicious code
Try to gain unauthorized access to the service, another organization's data, or our systems
Interfere with or disrupt the service, or load it in a way meant to degrade it for others
Scrape or harvest data from the service by automated means, other than through the API and integrations we provide
Impersonate anyone or misrepresent your affiliation with anyone

If you find a security vulnerability, we welcome a report at [email protected].

7. Your Data

You own the records and files you put into the service. You give us a limited, non-exclusive license to host, process and transmit them only to provide the service to you, as described in our Data Processing Agreement ("DPA") and Privacy Policy. An organization admin accepts the DPA before any governance records can be created or changed in the organization (organization setup, such as the profile, members, sign-in and integration settings, can be done first), and the DPA is part of these terms.

You are responsible for having the right to put your content into the service, including any personal information about other people.

Protected health information. If your organization is a covered entity or a business associate under HIPAA, we are its business associate, and it may put protected health information into the service only under a business associate agreement with us: our standard business associate agreement, signed by an organization admin in the dashboard, or your organization's own agreement once we countersign it. Our standard agreement, which you can read on our site, is signed by Backsplice in advance and takes effect when you sign it; or you can provide your own, which we review and countersign. The service asks during setup whether your organization handles protected health information, and while an organization that says it does has no executed agreement, the records that may hold it stay locked. If your organization has no executed business associate agreement with us, do not put protected health information into the service. For protected health information, the business associate agreement controls where it and these terms differ.

8. Watney

Watney is the service's AI assistant. It proposes; it never decides. It does not approve a system, set a risk tier or publish a card. It drafts cards, suggests intake triage and answers questions from your organization's records.

Watney is off until an organization admin opts in, and it is not part of the Free plan.
When it runs, it sends the model provider only what the task needs: records you typed, documentation you pasted in, and the contents of uploaded evidence files (or its earlier summaries of them) when it reviews or drafts an answer or summarizes evidence. We have a business associate agreement with the model provider, with zero data retention: the provider does not keep what Watney sends it once it has answered, except where the law requires it.
The model provider and the models are named on Watney's system card.
Its output can be wrong or incomplete. Review it before you rely on it; the decision is always yours.

9. Intellectual Property

Backsplice, its software, documentation and content are owned by Backsplice LLC and protected by intellectual property laws. These terms give you a limited right to use the service on whatever plan your organization holds, and no other right in it.

If you send us feedback, we may use it without obligation to you.

10. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.

We do not warrant that using the service satisfies any law, regulation, standard or contract. The service is a tool for your governance and compliance programs, not a substitute for your own judgment or for qualified legal counsel. We do not warrant that the service will be uninterrupted or error-free. Where the law does not allow a warranty to be excluded, it is limited to the shortest period the law allows. Nothing in this section limits what the DPA or a business associate agreement with us commits us to.

11. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, BACKSPLICE LLC WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS OR LOST DATA, ARISING FROM OR RELATED TO THE SERVICE.

Our total liability for all claims arising from or related to these terms or the service will not exceed the greater of the fees you paid us in the twelve months before the event giving rise to the claim and one hundred US dollars, which is the limit for an organization on the Free plan. These limits apply to claims under the DPA and a business associate agreement with us too, unless that agreement says otherwise, and they do not limit any liability that the law does not allow to be limited.

12. Ending These Terms

You can stop using the service at any time, and an admin can close the organization as described in section 4; an organization that simply stops using the service stays on the Free plan, and its data is kept until an admin closes it. We may suspend or end access for a material breach of these terms, as section 3 describes. We may also end the service for an organization for any other reason by telling its admins by email at least 30 days before; we then refund the prepaid fees for the unused part of the billing period, its admins can download its data until the notice ends, and we then close it, after which it is deleted as section 4 describes for a closure. When an organization is deleted, its data is removed as section 4 describes. Sections 7, 9, 10, 11 and 13 continue after these terms end.

13. Governing Law

These terms are governed by the laws of the State of Utah, United States, without regard to conflict-of-law rules, and disputes are heard in the state and federal courts located in Utah.

14. Changes to These Terms

We may update these terms. The version and date at the top of this page change when we do. For a material change, we email organization admins before it takes effect, and users who accepted an earlier version at sign-up are asked to accept the new version before continuing.

15. Contact

For legal notices and questions about these terms, contact:

Backsplice LLC
[email protected]

We accept legal notices by email at the address above, and a notice is received when it reaches that mailbox. We will give a postal address for formal service on request.