The terms RiskWoven is provided on.

1. Who you are contracting with

RiskWoven is operated by RiskWoven Inc., a corporation incorporated under the Canada Business Corporations Act, based in Aurora, Ontario, Canada. In these terms, "we" is that entity and "you" is the organisation whose people use the service.

RiskWoven is for organisations, not consumers. By creating an account or buying anything, you confirm that you are acting for a business, public body or other organisation, and that you have authority to accept these terms for it.

2. What RiskWoven produces, and what it is not

RiskWoven generates governance documents, assessments and readiness reports from the answers you give it, mapped to framework requirements held in a maintained control library.

• It is a draft, not a decision. Every generated document is advisory output to support your own judgement. You remain responsible for reviewing it, correcting it, and deciding whether to adopt it.
• It is not legal advice, and no lawyer-client relationship arises from using it.
• It is not a certification, an accreditation, or an audit, and no output should be presented to a customer, regulator or auditor as any of those.
• It is generated by a model, and models are wrong sometimes. Generated documents, assessments and reports pass an independent review stage before release, and that stage withholds work it cannot support. It reduces error; it does not remove it. Chat answers from the workspace assistant and the site's help assistant do not go through that review.
• Framework text is described, not reproduced. Requirements are stated in our own words and cited to identifiers. Where a standard's text is licensed, you need your own copy of the standard.

3. Your account

• Sign-in is through Google, LinkedIn, or a one-time code sent to your email. Keep control of the account or mailbox you sign in with; anyone who holds it can reach your workspace.
• Complete your profile before using the product. The service asks for it once and will not proceed until it is done.
• One account is one person. Do not share credentials.
• Tell us promptly at hello@riskwoven.com if you believe an account has been used without permission.

4. Acceptable use

Do not do any of the following.

• Attempt to reach another customer's workspace, or to probe, scan or overload the service.
• Submit content you have no right to submit, or personal information you have no lawful basis to share with a processor.
• Use the service to produce material that is unlawful, or to misrepresent generated output as certified, audited or professionally reviewed when it is not.
• Resell or white-label the output as your own advisory product, unless a partner agreement says you may.
• Use automated means to extract the control library in bulk.

Rate limits apply per account and per route. We may suspend an account that is being used in breach of this section, and will say why.

5. Payment and what it entitles you to

• One-time packs entitle you to what the product page for that pack describes, once.
• The partner tier is billed per seat and per client for the period paid, renewed by the next invoice. Cancelling stops the next renewal; access runs to the end of the period already paid for.
• Credits pay for repeat work. Credits you buy do not expire. They have no cash value and cannot be transferred or sold. The price in credits is shown before a run starts, and a run that fails or is withheld by our review is not charged.
• Payment is taken by Stripe on its own pages. Prices are in US dollars, as shown at the time of purchase, and exclude taxes unless stated.
• If a purchase does not unlock what it should, write to hello@riskwoven.com and it will be corrected. Purchases that fail to grant automatically are surfaced to the operator rather than silently ignored.

Refunds. Purchases are final once the entitlement is granted. If the output is not usable, write to hello@riskwoven.com and we will make it right: re-run the work, correct it, or restore the allowance so you can. A purchase that never granted an entitlement is a failed purchase, not a refund question, and is corrected as described above.

6. Who owns what

• Your content is yours. Your intake answers, uploaded evidence and generated documents belong to you. You may export or delete them.
• You grant us only the permission needed to run the service on your instructions: to store your content, send the relevant parts to the model provider to generate what you asked for, and show it back to you.
• The service is ours. The software, the control library, the assessment method and the site remain ours. Nothing here transfers any of it.
• We may report aggregate, non-identifying usage figures. Your content is not used to improve a model.

Confidentiality. We treat your content as confidential. We use it only to provide the service, and we disclose it only to the processors named in the privacy notice as needed to run the service, or where the law requires it. Access by RiskWoven personnel is limited to operating the service, support you ask for, investigating security or abuse, and meeting a legal obligation.

7. Availability

The service is provided as it stands, without a guaranteed level of availability. We do not promise it will be uninterrupted or error-free, and features may change. Where a change removes something you depend on, we will give account holders at least 30 days' notice by email.

No service level is offered on any plan, paid or free. We work to keep the service available and will announce planned maintenance in advance where we can.

8. Liability

Nothing in these terms limits liability for anything that cannot lawfully be limited, including fraud, or death or personal injury caused by negligence.

Subject to that: because RiskWoven produces drafts for your review rather than decisions, we are not liable for a decision you take on the basis of an output, for a finding by a regulator, auditor or customer of yours, or for lost profit, lost business or lost data.

Subject to the first paragraph, our total liability for all claims arising from or relating to the service is limited to the fees you paid us in the twelve months before the event giving rise to the claim.

9. Ending it

You may stop using the service and ask for your account to be deleted at any time. We may end an account for a breach of section 4, or with reasonable notice for any other reason, and will refund the unused part of anything prepaid, including unused purchased credits, unless the account was ended for a breach.

On deletion, your content is removed. Audit records of administrative actions and records we must keep for tax purposes are retained. What is kept and for how long is set out in the privacy notice.

10. Changes, and the law that applies

We may change these terms. The date at the top changes when we do, and a material change is notified to account holders by email at least 30 days before it takes effect. Continuing to use the service after that is acceptance.

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply there. The courts of Ontario sitting in Toronto have exclusive jurisdiction over any dispute arising from them, and both parties accept that jurisdiction.

Questions: hello@riskwoven.com.