Terms of service

1. Agreement

These Terms of Service ("Terms") are a contract between Cevro ("we", "us") and the business or organization that uses the Cevro platform ("you", "Customer"). They cover the Cevro website, the web application, our APIs, and any related services (together, the "Service").

By requesting a demo, activating an account, accepting an invitation, or using the Service, you agree to these Terms. If you act for an organization, you confirm you have authority to bind it. If you do not agree, do not use the Service.

2. Accounts and approved access

Cevro is a business service. Accounts are created for organizations after we approve a demo request or for people invited by an existing workspace administrator. You must be at least 18 and use the Service only for business purposes.

You must give accurate information and keep it current. You are responsible for every action taken through your workspace and for the people you invite, including their roles and permissions.

• Keep passwords and authenticator devices secret. Multi-factor authentication is required, and you must not share accounts or bypass it.
• Tell us promptly at the address below if you suspect unauthorized access.
• Remove access for people who leave your organization.

Sign-in links, invitations and verification links are personal to the recipient and expire. Do not forward them.

3. The Service

Cevro helps organizations manage compliance work, such as frameworks, policies, risks, vendors, evidence, data-protection records, AI governance, and a public trust center. We may add, change, or retire features. If we make a change that materially reduces the Service you pay for, we will give notice and, where we cannot offer a reasonable alternative, a pro-rated refund for the unused period.

We work to keep the Service available but do not promise uninterrupted or error-free operation. Planned maintenance and events outside our control may cause downtime.

4. Compliance content and AI features

Cevro supports audit readiness. It does not provide legal, regulatory, audit, or accounting advice, does not replace your auditor, lawyer, or data protection officer, and does not guarantee that you will pass an audit, obtain a certification, or satisfy any law.

Framework mappings, jurisdiction information, generated policy or addendum drafts, classifications, scores, and suggestions (including those produced with AI) are starting points. They can be incomplete, out of date, or wrong. You are responsible for reviewing them, tailoring them to your situation, and deciding what to adopt, publish, or submit.

Documents you publish or share from the Service, including trust center pages and attestations, are your statements. You are responsible for their accuracy.

5. Trials, subscriptions, and payment

New workspaces may start with a free trial of 7 days. Unless you subscribe before the trial ends, paid features may be limited or the workspace may be suspended.

Paid plans are billed monthly in advance in US dollars at the price shown on our pricing page or in your order. Payments are processed by Paystack; their terms apply to the payment itself. By subscribing you authorize recurring charges until you cancel.

• Subscriptions renew automatically each month. You can cancel at any time in the billing settings; cancellation takes effect at the end of the paid period and we do not provide refunds for partial months except where required by law or where the Service section above provides for a refund.
• We may change prices with at least 30 days' notice, effective from your next billing period.
• Fees exclude taxes, duties, and bank or payment charges, which you are responsible for. We will add taxes where we are required to.
• If a payment fails we may retry it, restrict features, or suspend the workspace after reasonable notice.

6. Acceptable use

You agree not to, and not to allow anyone else to:

• break the law, infringe others' rights, or upload content you have no right to use;
• upload malware, or probe, scan, or test the vulnerability of the Service or anyone else's systems without written permission (our scanning features may be used only against assets you own or are authorized to assess);
• bypass or disable security, access, rate-limit, or usage controls;
• access the Service by automated means other than our documented APIs, or overload it;
• reverse engineer the Service, or copy, resell, or offer it as a competing service;
• misrepresent your compliance status, or publish false or misleading attestations or trust center content;
• use the Service to store or process data that the Service is not designed for, such as payment card numbers or government identification numbers, unless we agree in writing.

7. Your data

You own the content you put into the Service, including documents, evidence, records, and the information in your registers ("Customer Data"). You give us a limited, non-exclusive license to host, process, transmit, and display Customer Data only to provide, secure, support, and improve the Service for you, and as these Terms and our privacy information describe.

We do not sell Customer Data, and we do not use it to train general-purpose AI models. Features that use AI process the content you submit to produce results for your workspace.

We protect Customer Data with technical and organizational measures that are appropriate to the risk, including access controls, multi-factor authentication, encryption in transit, and audit logging. No system is perfectly secure, so you are also responsible for configuring your workspace sensibly and for the data you choose to upload.

Where we process personal data on your behalf, we act as your processor and you act as the controller. You must have a lawful basis and any notices and consents needed to give us that data. On request we will enter into a data processing addendum, and we will tell you about the sub-processors we use.

You can export your data while your workspace is active. After termination we will make your data available for export for a reasonable period, then delete or anonymize it, unless the law requires us to keep it. Contact us at help@cevrogrc.com for deletion requests.

8. Third-party services and integrations

The Service can connect to third-party services you choose, such as cloud, code, ticketing, and identity providers. Connecting them lets us access the data and permissions you grant. Those services are governed by their own terms, we do not control them, and we are not responsible for them. Use the least access you can, and disconnect integrations you no longer need.

9. Intellectual property and feedback

Cevro and its licensors own the Service, including the software, design, templates, framework mappings, and documentation. We grant you a limited, non-exclusive, non-transferable right to use the Service during your subscription for your internal business purposes. No other rights are granted.

If you give us feedback or suggestions, we may use them without restriction or payment. Our trademarks may not be used without our written permission.

10. Confidentiality

Each party will protect the other's non-public information that is marked or reasonably understood to be confidential, use it only to perform or use the Service, and disclose it only to people who need it and are bound to keep it confidential, or where the law requires (with notice where lawful). This does not apply to information that is public through no fault of the recipient, already known to it, independently developed, or lawfully received from someone else. Customer Data is your confidential information.

11. Disclaimers

We provide the Service with reasonable care and skill. To the fullest extent the law allows, the Service is otherwise provided "as is" and "as available", and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Service will meet every requirement, be uninterrupted or error-free, or that any compliance result will be achieved.

12. Limitation of liability

To the fullest extent the law allows, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, goodwill, or data, even if told they were possible.

Each party's total liability arising out of or relating to these Terms is limited to the fees you paid us for the Service in the 12 months before the event that gave rise to the claim. If you have paid nothing, the limit is US$100.

These limits do not apply to liability that cannot be limited by law, to your payment obligations, or to your breach of the acceptable use rules, and they apply whatever the legal theory.

13. Indemnity

You will defend and indemnify us against third-party claims, and the resulting losses, damages, and reasonable costs, that arise from Customer Data, your use of the Service in breach of these Terms or the law, or content you publish through the Service. We will tell you promptly of a claim, let you control the defense, and reasonably cooperate at your expense.

14. Suspension and termination

You may stop using the Service and cancel your subscription at any time. We may suspend or terminate access if you materially breach these Terms and do not fix it within a reasonable period after notice, if you do not pay, if your use threatens the security or integrity of the Service or other customers, or if the law requires. Where we can reasonably do so, we will give notice first.

When these Terms end, your right to use the Service ends. Sections that by their nature should survive will survive, including those on data, intellectual property, confidentiality, disclaimers, liability, indemnity, and governing law.

15. Governing law and disputes

These Terms are governed by the laws of the Federal Republic of Nigeria, without regard to conflict-of-law rules. Before starting a formal claim, each party will try in good faith to resolve the dispute through discussion for at least 30 days after written notice. Subject to that, the courts of Lagos State, Nigeria have exclusive jurisdiction, except that either party may seek urgent relief from any competent court to protect its intellectual property or confidential information.

16. Changes to these Terms

We may update these Terms. For material changes we will give at least 30 days' notice by email to your administrators or in the Service before they take effect. If you keep using the Service after the effective date, you accept the updated Terms. If you do not agree, you may cancel before then.

17. General

• Entire agreement: these Terms, with any order form or data processing addendum, are the whole agreement and replace earlier discussions. If they conflict, the order form or addendum prevails for its subject.
• Changes and waiver: terms may be changed only in writing. A failure to enforce a right is not a waiver.
• Severability: if a provision is unenforceable, the rest remains in effect and the provision is applied as far as the law permits.
• Assignment: you may not assign these Terms without our consent. We may assign them in a merger, acquisition, or sale of assets.
• Force majeure: neither party is liable for delay or failure caused by events beyond its reasonable control, other than payment obligations.
• Notices: we may send notices to the email address on your account or in the Service. You may send notices to the address below.
• No third-party rights: these Terms do not give rights to anyone else.
• Language: the English version controls over any translation.

18. Contact

Questions about these Terms, notices, or requests about your data: help@cevrogrc.com.