Legal
Terms of Service
These Terms are between the customer organisation ("Customer", "you") and Andrejs Sevcenko, an individual established in Latvia [address ___] ("Cerynix", "we", "us"), for use of the Cerynix platform (the "Service"), in the edition and delivery model set out in your order or licence key.
1. Definitions
- Service — the Cerynix GRC platform (NIS2 / ISO/IEC 27001:2022 / GDPR readiness, evidence management and decision-support), in the applicable Edition.
- Managed (SaaS) — Cerynix-hosted use at app.cerynix.com.
- Self-hosted — Customer-operated deployment authorised by an offline licence key.
- Edition — Evaluation, Community, Professional or Enterprise, with the limits and features described on the pricing page.
- Documentation — the product docs we make available.
- Customer Content — data you load into the Service (controls, risks, evidence, assets, incidents, policies, connector data, personal data therein).
2. Licence granted
Subject to these Terms and payment of applicable fees, we grant you a non-exclusive, non-transferable, non-sublicensable, revocable licence, for the subscription term, to access and use the Service (managed) and/or to install and run one deployment per valid licence key (self-hosted), in the authorised Edition, solely for your internal business / compliance purposes. The software is licensed, not sold; all rights not expressly granted are reserved.
3. Restrictions
You will not, and will not permit any third party to: (a) copy, resell, rent, lease, sublicense, host as a service to third parties, or otherwise make the Service available to anyone beyond your authorised users, except as expressly permitted for MSP / Enterprise editions; (b) reverse engineer, decompile or disassemble the Service, or attempt to derive source code, except to the extent this restriction is prohibited by mandatory law (e.g. limited interoperability rights); (c) circumvent, tamper with or forge licence keys, usage limits or security controls; (d) remove proprietary notices; (e) use the Service to build a competing product.
4. Intellectual property
The Service, software, design, brand and all related IP are and remain owned by Andrejs Sevcenko (or his licensors). You retain all rights in Customer Content; you grant us only the limited rights needed to provide and support the Service. See also the Data Processing Agreement for personal data.
5. Subscription, term, renewal, termination
(a) The Service is provided on a subscription basis for the term in your order. (b) Terms renew for successive periods unless either party gives [30] days' notice before renewal. (c) Fees are [as per order / price list], [non-refundable except as required by law]. (d) Either party may terminate for material breach not cured within [30] days' notice. (e) On termination your right to use the Service ends; managed Customer Content is returned / deleted per the DPA; expired self-hosted licence keys revert the deployment to Evaluation limits without lockout.
6. Acceptable use
You will use the Service lawfully; you are responsible for your users, for the lawfulness of Customer Content, and for having the rights / permissions to load and process it (including personal data). Do not upload malware, infringing material, or data you are not entitled to process.
7. Disclaimer of warranties
The Service is provided "AS IS" and "AS AVAILABLE". To the maximum extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.
The Service is a readiness / decision-support / evidence-management tool. It does NOT: (i) guarantee that you will pass any audit or certification; (ii) guarantee compliance with NIS2, ISO/IEC 27001, GDPR or any law or standard; (iii) constitute legal advice, a legal opinion, an audit, a certification, or a substitute for a qualified auditor, lawyer or DPO. Readiness scores, mappings and generated documents (e.g. SoA drafts) are support outputs, not assurances. You remain solely responsible for your own compliance and for verifying any output before relying on it. AI-assisted features (AURA) may produce inaccurate output and must be human-reviewed.
8. Limitation of liability
To the maximum extent permitted by law:
- (a) No indirect / consequential loss. Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data, goodwill, or for regulatory fines incurred by the Customer, arising out of or relating to the Service.
- (b) Cap. Our total aggregate liability arising out of or relating to these Terms is limited to the fees you paid for the Service in the 12 months preceding the event giving rise to the claim. For free / Evaluation use, our aggregate liability is limited to EUR [100].
- (c) Carve-outs. The exclusions / cap do not apply to liability that cannot be limited by law (e.g. death / personal injury caused by negligence, fraud, wilful misconduct, and certain data-protection / consumer liabilities).
9. Confidentiality
Each party will protect the other's confidential information with reasonable care, use it only for the purposes of these Terms, and not disclose it except to those who need it and are bound by confidentiality. A standalone non-disclosure agreement applies where the parties execute one.
10. Data protection
Where we process personal data on your behalf (managed model), the Data Processing Agreement applies and is incorporated by reference. Our security measures are summarised in our security overview (no certifications are claimed beyond what is actually in place).
11. Support & service levels
Managed Service support and availability targets are set out in the applicable Service Level Agreement. Self-hosted deployments are operated by the Customer; we provide [the Documentation and the agreed support tier] only.
12. Governing law & disputes
These Terms are governed by the laws of the Republic of Latvia. Disputes are subject to the exclusive jurisdiction of the courts of Latvia, without prejudice to any mandatory consumer rights.
13. Changes
We may update these Terms; material changes to the managed Service will be posted with a new version / date and [notice]. Continued use after the effective date constitutes acceptance.