Skip to content
Legal

Terms of Service

Last updated: October 24, 2026

1. Acceptance of Terms

By accessing or using the AutoCISO platform (the "Service"), you agree to be bound by these Terms of Service ("Terms"). If you do not agree to these Terms, do not use the Service. These Terms apply to all visitors, users, and others who access or use the Service, including external reviewers, auditors, supplier respondents, and AI agent owners who access it via shared token links, and systems or AI clients that access it with your API tokens.

2. Description of Service

AutoCISO provides an AI-powered identity security and access intelligence platform. The Service includes:

  • Access & asset management: Employee directory, SaaS access inventory, asset tracking, dormant and orphaned account detection, access revocation tracking, and relationship graph visualisation.
  • Lifecycle management: Onboarding and offboarding workflows, provisioning checklists, and offboarding violation tracking.
  • AI Access: An inventory of AI agents, service principals, app registrations, and other non-human identities, with ownership assignment, agent access reviews, and exportable evidence packs. Data can come from Microsoft Entra ID (with your administrator's consent), uploaded exports, or screenshots.
  • AI security advisor: A conversational assistant that answers questions using live access to your organisation's data in the Service.
  • Risk management workspace: AI-guided risk intake, assisted and expert risk drafting, live risk registers, risk scoring, treatment strategy support, review workflows, and risk budget tracking.
  • Supplier risk management: Supplier register, security and privacy questionnaires, responses from supplier contacts through secure token links, risk scoring with manual adjustment, and supplier dossier exports.
  • ISO 27001 certification management: Scope definition, gap analysis against all 93 Annex A controls, risk register, Statement of Applicability, policy library, evidence vault, access review campaigns, internal audits, backup tests, management reviews, and auditor portal.
  • Privacy programme tools: Records of processing activities, data processor register, personal data dictionary, and data subject request readiness checks.
  • Evidence automation: Automated collection of compliance evidence from connected integrations, mapped to specific controls.
  • CISO dashboards & reporting: Access concentration analysis, security debt trending, department risk, privilege delta reporting, and export to CSV/PDF.
  • Public API, SDKs and MCP server: Programmatic access to the Service with scoped API tokens, client SDKs, and a Model Context Protocol (MCP) server that lets AI clients you choose read and act on your data.
  • Browser extension: The AutoCISO Audit Collector, which captures SaaS admin page content for AI-based access and asset detection.
  • Public-facing features: Certificate public verification, auditor portal, and access review, supplier questionnaire, and AI agent ownership and review forms accessible via secure token links.
  • CISO Partner Portal: A multi-org portfolio management workspace for fractional and virtual CISOs, including a portfolio risk board, cross-org action queue, client health timelines, AI board pack generation, and direct email delivery to client contacts.

3. User Responsibilities

As a user of the Service, you agree to:

  • Be at least 18 years old and have the authority to bind the organisation for which you use the Service.
  • Provide accurate and complete information when creating an account.
  • Maintain the security of your account credentials and API tokens and promptly notify us of any unauthorised access.
  • Ensure you have the legal right and all necessary permissions to upload, enter, or send through the API personal data about employees, contractors, supplier contacts, or other individuals, including the right to process that data for security, risk management, and compliance purposes.
  • Only use the browser extension to capture pages you are authorised to access within your organisation's SaaS environment, and only where such capture is permitted by the relevant SaaS provider's terms of service.
  • Use the Service in compliance with all applicable laws and regulations, including data protection laws (such as GDPR and CCPA) governing the personal data of individuals whose information is entered into or captured by the Service.
  • Manage access review links, supplier questionnaire links, AI agent ownership and review links, auditor portal links, and public certificate verification links responsibly, and revoke them when they are no longer required.
  • Do not submit risk narratives, interview responses, questionnaire answers, evidence references, or budget assumptions that you know are false, unlawfully obtained, or outside your authority to disclose.

4. Data Controller & Processor Relationship

When your organisation uploads or enters personal data about employees or other individuals, your organisation is the data controller and AutoCISO is a data processor acting on your instructions. As data controller, you are responsible for ensuring a lawful basis exists for processing that personal data and for responding to data subject rights requests relating to it. A Data Processing Agreement (DPA) is available on request at legal@autociso.io.

5. Browser Extension

The AutoCISO Audit Collector browser extension has no standing access to websites. It asks your browser for access to a site the first time you start a capture there. By installing the extension, you acknowledge and agree that:

  • The extension runs its capture script on a page only after you start a capture. It does not read, store, or transmit any page content before that.
  • When a capture is triggered, a simplified HTML representation of the current page (with password fields and hidden inputs stripped) and, optionally, a screenshot are transmitted to AutoCISO servers for analysis.
  • The page URL, title, and lightweight page signals (headings, navigation link text) are also transmitted to support automatic content-type detection.
  • Only Owners, Managers, and Contributors of your organisation can submit captures.
  • You are solely responsible for ensuring that capturing and uploading content from any given page is permitted under the terms of service of the relevant SaaS provider and applicable law.

6. API Access, API Tokens and MCP

The Service gives programmatic access through the public API, the SDKs, and the MCP server. Access uses API tokens that your organisation creates. When you use these interfaces, you agree that:

  • An API token is a credential. You are responsible for all actions taken with your organisation's tokens, by people, scripts, or AI agents.
  • You keep tokens secret, give each token only the scopes it needs, and revoke a token immediately if it is exposed or no longer needed.
  • Tokens that can read personal data can be created only by an Owner and expire after at most 90 days.
  • AI clients and AI agents that you connect through the MCP server act on your behalf. You are responsible for their actions, for reviewing their outputs, and for where they send or store the data they receive.
  • The API applies rate limits and daily data volume limits. Requests above a limit are rejected until the limit resets. Some API domains and features are available only on certain plans.
  • You will not use the API to disrupt the Service, to test its load or security without our written consent, to bypass limits or access controls, or to access data of another organisation.
  • We may suspend or revoke a token that threatens the security or stability of the Service. We will tell your organisation's Owner when we do so.

7. Third-Party Integrations & Credentials

The Service allows you to connect third-party applications. Examples are identity providers (GitHub, Google, Microsoft, and company identity providers such as Okta, Microsoft Entra ID, or any OpenID Connect or SAML 2.0 provider), directory data from Microsoft Entra ID, and productivity tools (Jira). When you do so:

  • You grant AutoCISO the right to use the provided credentials to interact with those services on your behalf, solely to deliver the features you have configured.
  • You are responsible for ensuring that connecting these services and granting AutoCISO access is permitted under those providers' terms of service and your organisation's security policies.
  • When your organisation uses company single sign-on, AutoCISO relies on your identity provider to verify users and their email addresses. You are responsible for the accounts and settings in your identity provider.
  • Reading directory data from Microsoft Entra ID needs consent from an administrator of your Microsoft tenant. Only your administrator can remove that consent, by removing the AutoCISO enterprise applications in Microsoft Entra.
  • Stored credentials are encrypted at rest. You are responsible for rotating or revoking credentials promptly if they are compromised.
  • AutoCISO is not responsible for actions taken by third-party services or for data returned from them.

8. AI-Generated Content

The AI security advisor and other AI-powered features generate responses based on the data in your account and AI model outputs. This includes AI-guided risk interview questions and summaries, extracted facts, inferred scoring, treatment strategy recommendations, derived risk-budget suggestions, gap analysis and roadmap suggestions, questionnaire translations, and AI Access findings. These outputs are informational only. They do not constitute professional security, legal, compliance, financial, or certification advice, and should not be relied upon as such. AutoCISO makes no warranty as to the accuracy, completeness, or fitness for purpose of AI-generated content. Use of the ISO 27001 certification management tools does not guarantee that your organisation will achieve or maintain certification; certification decisions are made solely by accredited certification bodies.

9. Data Privacy & AI Processing

AutoCISO uses third-party AI models that run on the serverless inference service of our cloud provider, DigitalOcean, in the United States. These models process captured HTML, screenshots, AI chat context, and risk-management inputs such as interview answers, free-text risk descriptions, extracted facts, draft summaries, and budget or loss assumptions you provide in the Service. We implement technical and procedural controls designed to reduce unnecessary sensitive data exposure before data reaches AI models, but these controls do not remove all personal data, and you remain responsible for the lawfulness and appropriateness of the data you submit. Your use of the Service is also governed by our Privacy Policy.

10. Intellectual Property

The Service and its original content, features, and functionality are and will remain the exclusive property of AutoCISO and its licensors. You may not reproduce, distribute, or create derivative works of any part of the Service without express written permission. The SDKs are licensed to you only for use with the Service, unless their own licence says otherwise.

11. Subscription & Payments

Certain parts of the Service are billed on a subscription basis (Free, Seed, Growth, and Scale tiers). Usage limits apply per tier, including limits on connected applications, monthly audit runs, monthly AI chat requests, and API access. Some features, including some API domains, are available only on certain tiers. You will be billed in advance on a recurring and periodic basis. Payments are processed by the payment provider named on your order or invoice. By subscribing, you also agree to that provider's terms and conditions.

11a. Partner Program

Overview. The AutoCISO Partner Program operates through two mutually exclusive billing tracks. Each managed organization is on exactly one track at any time. Partners may switch an organization between tracks; track changes take effect as described below. The full terms are in the Partner Program Agreement, which prevails for the Partner Program.

Agreement tiers. Each Partner is an Affiliate or a Strategic partner. Affiliate is the default tier, accepted online. Referral payouts to an Affiliate stop after a lifetime total of $2,000, and are earned for 12 months from a referred organization's first payment. Strategic partners sign a separate agreement that sets their payout period.

Track A — Referral Payout. When an organization signs up via a Partner's referral link within the 90-day attribution window, or is switched to the Referral track, the organization's subscription billing remains directly between the organization and AutoCISO. The Partner earns a cash payout equal to 20% of each successful monthly subscription payment made by the referred organization, within the limits of the Partner's agreement tier. Payouts are generated only while the organization has an active paid subscription; free-plan, trial, failed-payment, and cancelled organizations generate no payout. Payouts are disbursed according to AutoCISO's standard payout schedule and are not account credits.

Track B — Managed Discount (vCISO Portal). When a vCISO Partner enrolls an organization via the partner portal and selects the Managed billing track, the Partner pays AutoCISO directly for that organization's subscription at a discounted rate. The discount tier is determined by the Partner's count of eligible managed-track organizations (those on the Managed track with an active paid subscription) at the start of each billing cycle: Starter (2–5 eligible orgs): 20% discount; Pro (6–14 eligible orgs): 25% discount; Elite (15+ eligible orgs): 30% discount. A minimum of 2 eligible managed-track organizations is required to enter any discount tier. Tier changes take effect at the start of the next billing cycle. The discount applies to the Partner's payment to AutoCISO and does not affect the organization's own pricing or billing relationship with AutoCISO. Track B requires at least the Seed plan and an active partner registration.

Track Switching. (a) Referral to Managed: the switch takes effect immediately upon confirmation. The Partner assumes billing responsibility for the organization from that point; any referral payout accrued for the current billing period up to the switch date is forfeited. (b) Managed to Referral: the organization's billing reverts to AutoCISO direct at the start of the following calendar month. The Partner begins earning the 20% referral payout from the first successful payment received from the organization in that month onward.

Tax. Payouts require valid tax documents. AutoCISO pauses payouts until the required documents are on file and valid. VAT is added or self-assessed as the law of the Partner's country requires. AutoCISO withholds tax from payouts where the law requires it and pays the withheld amount to the tax authority.

Partner Obligations. The Partner is an independent contractor, not an employee or agent of AutoCISO. The Partner is responsible for obtaining appropriate authorization from each client organization before enrolling them. The Partner may not use the portal to access client data for purposes other than security advisory services. The Partner must not offer or accept bribes or kickbacks in connection with the Partner Program. The Partner is solely responsible for any separate commercial arrangements made with client organizations regarding pricing, invoicing, or service fees; these are outside the scope of this agreement.

Fraud and Abuse. AutoCISO reserves the right to terminate a Partner's account, forfeit pending referral payouts, and reverse discounts if fraudulent org enrollment, artificial inflation of the managed-org count, or misuse of the partner program is detected.

Account Closure. Upon voluntary account closure, pending referral payouts not yet disbursed are forfeited. Payouts accrued during the final billing cycle are not disbursed if the account is closed before the payout date.

12. Termination

We may terminate or suspend your account and bar access to the Service immediately, without prior notice or liability, under our sole discretion, for any reason whatsoever and without limitation, including but not limited to a breach of the Terms.

13. Limitation of Liability

In no event shall AutoCISO, nor its directors, employees, partners, agents, suppliers, or affiliates, be liable for any indirect, incidental, special, consequential or punitive damages, including without limitation, loss of profits, data, use, goodwill, or other intangible losses, resulting from your access to or use of or inability to access or use the Service.

14. Changes to Terms

We reserve the right, at our sole discretion, to modify or replace these Terms at any time. If a revision is material, we will provide at least 30 days' notice prior to any new terms taking effect. Material changes to the Partner Program terms will be communicated to active partners via email with at least 14 days' notice.

15. Contact Us

If you have any questions about these Terms, please contact us at legal@autociso.io.