RiskBee Terms of Service

By registering for an account or using the RiskBee platform (the "Service"), you ("User", "you", or "your") agree to be bound by these Terms of Service. If you are entering into these Terms on behalf of a company, Managed Security Service Provider (MSSP), or other legal entity, you represent that you have the authority to bind such entity to these Terms.

1. MVP Status & AI Advisory Framework

MVP Provision: The Service is provided as a Minimum Viable Product. Features, integrations, and interfaces are under active development and may change. You use the platform acknowledging it may contain bugs or inaccuracies. RiskBee is not intended to be your sole system of record for critical compliance or legal data.

AI Outputs Are Not Advice: RiskBee utilizes Artificial Intelligence (AI) to provide document classification, clause extraction, and security posture summaries. AI-generated outputs, Health Scores, and Grades are for informational and operational prioritization purposes only. They do not constitute legal, compliance, or professional cybersecurity advice.

Human Verification: AI can misinterpret technical and legal documents. You are solely responsible for verifying the accuracy of any AI-extracted data before relying on it for audits or business decisions.

2. Service Tiers & Self-Service Subscription Terms

RiskBee offers multiple service tiers. The terms governing your use depend on your selected tier and data processing needs. All amounts are in Australian dollars (AUD) unless otherwise displayed at checkout.

Free Tier: Free workspaces are provided strictly "AS IS" without any Service Level Agreements (SLAs), support guarantees, or warranties. The free tier includes up to 5 internal vendors and a base monthly AI credit allowance, with no credit card required. To the maximum extent permitted by law, RiskBee bears no financial liability for use of the Free Tier.

Self-Serve Paid Subscriptions (Month-to-Month): Paid subscriptions are billed monthly in advance through our payment processor (Stripe) with no lock-in contracts. Plans are anchored in USD: $99 USD per managed client workspace per month and $299 USD per month for direct (non-MSP) workspaces. You may choose to pay in AUD, GBP, or EUR at checkout; the local amount is fixed at the time of subscription and may change with at least 30 days' notice.

Automatic Renewal: Subscriptions automatically renew each month until you cancel through the billing dashboard or Stripe Customer Portal. Cancellation takes effect at the end of the current billing cycle; you retain access until that date.

Failed Payments: If a payment fails, we may suspend access after a reasonable grace period. Access is restored once payment is successfully processed.

Refunds: Fees are non-refundable for partial months unless required by law. If you terminate for our uncured material breach under Section 8, you will receive a pro-rata refund of any prepaid fees.

Usage Limits: AI-powered features consume monthly credits from a pooled allowance. Free MSP workspaces receive $5 AUD per month; each active paying client workspace adds $3 AUD per month; direct workspaces receive $25 AUD per month. Unused credits do not roll over. If your allowance is exhausted, AI features will pause until the next billing cycle or until a bonus grant is arranged.

Enterprise / High-Risk Threshold: If you intend to process highly restricted data (e.g., unredacted Protected Health Information, PCI-DSS cardholder data, or classified government data), or if your Annual Recurring Revenue (ARR) with RiskBee exceeds $25,000 AUD per year, or if you manage more than 15 client workspaces under a single account, this standard Terms of Service is insufficient. You must negotiate a custom Master Services Agreement (MSA) with us. RiskBee reserves the right to suspend self-serve accounts that exceed this threshold until an MSA is executed.

3. Multi-Tenant Workspaces & Client Authority

If you operate as an MSSP, vCISO, or primary administrator managing "child" workspaces:

• You represent and warrant that you have obtained all necessary consents and legal rights from your clients to input their data into RiskBee and connect their third-party environments (e.g., Google Workspace, Microsoft Entra) for Shadow IT discovery.
• RiskBee holds no direct relationship with your clients. You are solely responsible for your clients' compliance with these Terms.

4. Data Privacy, Ownership & Processing

Data Ownership: You retain all ownership rights to the data, documents, and evidence (e.g., SOC 2 reports) you upload ("User Data").

Privacy & Subprocessors: RiskBee complies with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Our handling of personal data, including data discovered via Identity Provider (IdP) scans, is governed by our Privacy Policy and our standard Data Processing Agreement (DPA), which are incorporated by reference. The DPA outlines our security incident response commitments and our approved list of subprocessors.

5. Acceptable Use

You agree not to:

• Upload malicious code, malware, or viruses.
• Use the Service to store sensitive data not explicitly supported by your tier (as defined in Section 2).
• Attempt to reverse engineer, decompile, or bypass the multi-tenant architecture or AI scoring engine.

6. Mutual Indemnification

Your Indemnity: You agree to indemnify and hold harmless RiskBee against any third-party claims arising from your unauthorized use of third-party data (including unauthorized scanning of client IdPs), breaches of confidentiality regarding uploaded vendor documents, or your violation of applicable laws.

RiskBee's Indemnity: RiskBee agrees to indemnify and hold you harmless against any third-party claims alleging that the platform itself (excluding User Data) infringes upon a third party's intellectual property rights, or claims arising directly from our gross negligence or willful misconduct.

7. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND EXCEPT FOR CONSUMER GUARANTEES THAT CANNOT BE EXCLUDED UNDER THE AUSTRALIAN CONSUMER LAW, RISKBEE EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

LIABILITY CAP: EXCEPT FOR EXCLUDED CLAIMS (DEFINED BELOW), EACH PARTY'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF THIS AGREEMENT SHALL NOT EXCEED THE GREATER OF: (A) THE TOTAL AMOUNT YOU PAID TO RISKBEE IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE LIABILITY, OR (B) ONE THOUSAND AUSTRALIAN DOLLARS ($1,000 AUD).

EXCLUDED CLAIMS: The liability cap does not apply to obligations under Section 6 (Mutual Indemnification), breaches of confidentiality, gross negligence, or willful misconduct. Neither party shall be liable for indirect, incidental, special, or consequential damages, including lost profits or data loss.

8. Term, Termination & Suspension

Termination for Convenience: On a month-to-month plan, you may cancel at any time via the billing dashboard. Access remains until the end of the current billing cycle.

Data Export on Termination: After you cancel or downgrade, you may export your User Data from the platform for a reasonable period. Once that period expires, RiskBee may delete your data in accordance with the Privacy Policy and any legal retention obligations.

Termination for Cause: Either party may terminate this agreement immediately upon written notice if the other party commits a material breach and fails to cure it within thirty (30) days of receiving notice. If you terminate for our uncured material breach, you will receive a pro-rata refund of any prepaid fees.

Suspension: We reserve the right to suspend your access immediately if we detect a severe security threat, illegal activity, or a violation of the Acceptable Use policy.

9. Changes to Terms

RiskBee may modify these Terms periodically. For material changes, we will provide at least 30 days' advance notice via email or an in-app notification. If you do not agree to the revised Terms, your sole remedy is to cancel your subscription and stop using the Service before the changes take effect. Continued use of the Service constitutes acceptance of the new Terms.

10. Dispute Resolution & Governing Law

Governing Law: These Terms are governed by the laws of New South Wales, Australia.

Dispute Resolution: Before filing any litigation, the parties agree to attempt to resolve the dispute in good faith via mediation in Sydney, NSW, or via video conference. If the dispute is not resolved within 60 days of a written notice of dispute, either party may commence legal proceedings in the exclusive jurisdiction of the courts of New South Wales.

11. General Provisions

Severability: If any provision of these Terms is found to be unenforceable or invalid (including under the Unfair Contract Terms regime), that provision will be severed, and the remainder of the Terms will continue in full force and effect.

Entire Agreement: These Terms, alongside the Privacy Policy and DPA, constitute the entire agreement between you and RiskBee.