These Terms of Service govern your use of AuditHat LLC's products and services, including Flow, Pulse, the Pulse agent, and audithat.com. Please read them carefully. They include an authorization for AuditHat to monitor and manage the systems you connect, your ownership of your data and your right to have it removed or to cancel at any time, billing and term-contract rules, and important disclaimers, limitations of liability, and a release that limit your remedies against AuditHat.
These Terms of Service (the "Terms") are a binding agreement between AuditHat LLC, which also does business as AuditHat and audithat.com ("AuditHat", "we", "us", or "our"), and the organization or person that creates an account or uses the Services ("Customer", "you", or "your").
You accept these Terms by ticking the acceptance box at signup, by clicking to accept an updated version, or by accessing or using any part of the Services. If you do not agree, do not use the Services.
We may update these Terms and the Privacy Policy from time to time. When we do, we will publish the new version with a new effective date, and you will be asked to accept it the next time you sign in. Continued use of the Services after a new version is published is acceptance of that version. The version you most recently accepted, and in every case the latest published version, governs your use of the Services. Each acceptance is recorded with the accepting user, the version, the date and time, and the network address it came from.
If you accept these Terms on behalf of a company or other organization, you represent that you have authority to bind that organization, and "you" refers to that organization.
The Services are offered to businesses and organizations, not to consumers. You must provide accurate, current, and complete registration and billing information and keep it up to date. Email verification is required to activate an account.
You are responsible for every action taken under your account and by your Users, for keeping passwords, registration codes, API credentials, and agent installations secure, and for telling us promptly at the address in Section 17 if you suspect unauthorized use. We are not responsible for loss that results from unauthorized use of your account.
This section is a condition of using the Services.
You certify that you own the Monitored Systems or that you have the full legal authority, and all consents and approvals required by law, contract, and your own policies, to manage and monitor them and to allow AuditHat to do so on your behalf.
You grant AuditHat LLC and audithat.com full authority, for as long as your account or any Monitored System is connected to the Services, to access, connect to, scan, collect from, monitor, and manage the Monitored Systems; to collect, receive, transmit, store, hold, process, analyze, and back up Customer Data; and to generate, retain, and deliver reports, alerts, findings, and other output derived from that data to you and to anyone you direct us to share it with. This includes reading Active Directory and Group Policy information, security event logs, Microsoft 365 tenant configuration and audit logs, firewall and network device configurations, and hardware and software inventories, and, where you enable it, making changes you request through the Services.
You are solely responsible for obtaining any notice to or consent from your employees, contractors, customers, and other data subjects that the law requires before their information is collected by or through the Services, and for complying with the terms of every third-party platform you connect (for example Microsoft's terms for Microsoft 365 and Graph API data).
If you connect a system you were not authorized to connect, you alone are responsible for the consequences, and you will defend and indemnify AuditHat under Section 13 for any claim that results.
Customer Data is yours. You keep all right, title, and interest in it. You grant AuditHat a non-exclusive, worldwide, royalty-free license to host, copy, transmit, process, analyze, display, and create derivative works of Customer Data solely to provide, secure, support, and improve the Services, to comply with law, and as otherwise permitted by the Privacy Policy.
You may request removal of your Customer Data, and you may cancel the Services, at any time by using the tools in the product or by contacting us at the address in Section 17. Following a removal request or cancellation we will delete or de-identify Customer Data within a commercially reasonable time, normally within 30 days, except for copies held in routine backups (which expire on their own schedule) and information we must keep to comply with law, resolve disputes, enforce these Terms, or complete billing. Deleted data cannot be recovered, so export anything you need before you ask us to remove it.
We may use data that has been aggregated or de-identified so that it does not identify you or any person for benchmarking, product improvement, and statistics.
Some parts of the Services are offered free of charge or under a trial. We may change, limit, suspend, or withdraw free and trial offerings at any time. Paid plans, term contracts, and prices are as stated in your order, quote, or the product's pricing page at the time of purchase.
You authorize AuditHat to charge all fees, taxes, and other amounts you owe to the payment card or other payment method you keep on file, on the billing schedule for your plan and, for amounts that become due under Section 7 or Section 8, when they become due. You must keep a valid payment method on file while you have a paid plan or an outstanding balance.
Payments not received when due are late. Late amounts accrue a late fee equal to the greater of $25 or 1.5% of the overdue balance per month (18% per year), or the maximum rate permitted by applicable law if lower, from the due date until paid in full. You will also reimburse our reasonable costs of collection, including collection agency fees, court costs, and attorney fees.
If any amount is past due, we may lock or suspend your account and your Users' access, disable agents and integrations, and withhold reports and support until the full balance, including late fees, is paid. Locking or suspending an account does not reduce, pause, or cancel anything you owe.
Fees are exclusive of taxes; you are responsible for all sales, use, value-added, withholding, and similar taxes other than taxes on our net income. Except where these Terms or the law expressly say otherwise, all fees are non-refundable.
If you have a term contract (for example an annual or multi-year agreement, or a monthly plan with a minimum commitment), you are committing to pay for the entire term.
Fees for the full term are owed whether or not you use the Services, connect any system, install any agent, or sign in, and whether or not your access is locked or suspended for non-payment or for breach of these Terms.
If you cancel a term contract before the end of its term, or if we terminate it because of your breach, the entire unpaid balance for the remainder of the term becomes due immediately on the date of cancellation or termination. You authorize us to automatically charge that balance, together with any other unpaid amounts and late fees, to the payment method on file to settle the account.
Term contracts renew for successive terms of the same length unless either party gives written notice of non-renewal before the renewal date, as stated in your order. Price changes for a renewal term will be communicated before the renewal date.
You may cancel the Services at any time from your account settings or by written notice to us. Cancellation takes effect at the end of the then-current billing period for month-to-month plans and immediately for free plans. For term contracts, Section 7 applies.
We may suspend or terminate your account or any part of the Services, with or without notice, if you breach these Terms, fail to pay when due, use the Services in a way that creates risk or legal exposure for us or others, or if we discontinue the Services. If we discontinue the Services for convenience, your only remedy is a pro-rata refund of prepaid fees for the unused portion of a paid term.
On termination or cancellation, your and your Users' right to use the Services ends, agents and integrations should be uninstalled and disconnected, and Customer Data is handled under Section 5. Sections that by their nature should survive (including Sections 4 through 7 and 10 through 16) survive termination.
You will not, and will not allow anyone to:
To the fullest extent permitted by law, the Services, the agent, all reports and findings, all support, and all other output are provided "as is" and "as available", with all faults, and without warranty of any kind, whether express, implied, statutory, or otherwise, including any implied warranty of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, or that the Services will be uninterrupted, timely, secure, or error-free.
We do our best to maintain your data, keep the Services operating, and support you, but we do not promise any particular level of availability, data durability, detection, or response time unless a signed order says so.
The Services help you observe and document your environment. They are tools, not a guarantee. We do not warrant that the Services will detect every change, misconfiguration, vulnerability, threat, or incident, that reports are complete or free of error, or that using the Services will make you compliant with FFIEC, GLBA, NCUA, HIPAA, PCI DSS, or any other law, regulation, standard, or examiner expectation. Nothing in the Services or in our communications is legal, regulatory, accounting, or security advice. You remain solely responsible for your own compliance, security, backups, and business decisions and for verifying any output before relying on it.
Third-party platforms and data (for example Microsoft 365 audit logs, firewall exports, and directory information) are outside our control, may be incomplete, delayed, or changed by the third party, and are provided without warranty.
You use the Services at your own risk. To the fullest extent permitted by law, AuditHat is not responsible or liable for Customer Data or for any loss, corruption, unavailability, disclosure, interception, alteration, or destruction of Customer Data or of any Monitored System, however caused, and you agree that you have no recourse against AuditHat for any such event. You are solely responsible for maintaining independent backups of anything you cannot afford to lose.
To the fullest extent permitted by law, in no event will AuditHat LLC, audithat.com, or any of their officers, managers, members, owners, employees, contractors, agents, licensors, or suppliers be liable to you or anyone else for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, business, goodwill, data, or use, or for the cost of substitute services, or for regulatory fines, penalties, or examiner findings, arising out of or related to these Terms or the Services, even if advised of the possibility of such damages and even if a remedy fails of its essential purpose.
To the fullest extent permitted by law, the total cumulative liability of AuditHat and the persons listed above for all claims arising out of or related to these Terms or the Services, under any theory (contract, tort, negligence, strict liability, statute, or otherwise), will not exceed the greater of the fees you actually paid to AuditHat for the Services in the twelve months before the event giving rise to the claim, or one hundred U.S. dollars ($100).
These limitations apply together and to every kind of claim, allocate the risk between the parties, and are an essential basis of the bargain. Some jurisdictions do not allow certain limitations; in those places our liability is limited to the smallest amount the law permits.
To the fullest extent permitted by law, you release, waive, and agree not to sue and not to hold AuditHat LLC, audithat.com, or any of their officers, managers, members, owners, employees, contractors, or agents liable for any claim, demand, loss, damage, or expense of any kind, known or unknown, arising out of or related to the Services, Customer Data, the Monitored Systems, any act or omission of AuditHat or its personnel in providing the Services, or any wrongdoing of any kind that the law allows to be released. If you are a California resident you waive California Civil Code Section 1542 with respect to this release.
You will defend, indemnify, and hold harmless AuditHat LLC, audithat.com, and their officers, managers, members, owners, employees, contractors, and agents from and against all claims, demands, suits, proceedings, losses, damages, liabilities, fines, penalties, costs, and expenses (including reasonable attorney fees) arising out of or related to: (a) Customer Data or the Monitored Systems; (b) your or your Users' use of the Services or breach of these Terms; (c) any claim that you lacked authority to connect, manage, or monitor a Monitored System, or lacked a required consent from a data subject; (d) your violation of law or of any third party's rights; or (e) any dispute between you and your Users, employees, customers, examiners, or regulators. We may take control of the defense of any matter subject to indemnification at your expense, and you will not settle any such matter without our written consent.
We treat Customer Data as confidential and use commercially reasonable administrative, technical, and physical safeguards designed to protect it, including encryption of stored credentials and of data in transit. No method of transmission or storage is completely secure, and we do not guarantee that Customer Data will never be accessed, disclosed, altered, or destroyed. You are responsible for the security of the credentials, keys, and registration codes you give the agent and the integrations, for the security of the systems the agent runs on, and for promptly rotating anything you believe is compromised.
On reasonable request we will cooperate with your vendor-management and examination processes to a commercially reasonable extent.
The Services, the agent, our report formats, and everything in them other than Customer Data are owned by AuditHat and its licensors and are protected by intellectual property laws. We grant you a limited, non-exclusive, non-transferable, revocable license to use them, and to install the agent on Monitored Systems you are authorized to manage, during the term and only as these Terms allow. If you send us suggestions or feedback, we may use them without restriction or compensation.
These Terms are governed by the laws of the state in which AuditHat LLC is organized and by applicable United States federal law, without regard to conflict-of-law rules. The state and federal courts located in that state have exclusive jurisdiction over any dispute arising out of or related to these Terms or the Services, and each party consents to personal jurisdiction and venue there.
To the fullest extent permitted by law, each party waives any right to a jury trial and agrees that disputes will be brought only on an individual basis and not as a plaintiff or class member in any purported class, collective, or representative proceeding. Any claim must be filed within one year after it arises or it is permanently barred.
Nothing in this section prevents either party from seeking injunctive relief in any court of competent jurisdiction, or prevents AuditHat from pursuing collection of unpaid amounts in any appropriate forum.
These Terms, the Privacy Policy, and any signed order form are the entire agreement between you and AuditHat about the Services and replace all prior agreements and understandings. If an order form conflicts with these Terms, the order form controls for that order. If any provision is found unenforceable, it will be enforced to the maximum extent permitted and the rest of the Terms will remain in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our written consent; we may assign them to an affiliate or a successor. Neither party is liable for delay or failure caused by events beyond its reasonable control. Notices to you may be sent to the email address on your account; notices to us must be sent to the address below. The parties are independent contractors.
Questions about these Terms: flow@audithat.com. AuditHat LLC, doing business as AuditHat and audithat.com.