Terms of Service — TrueNorth Exposure Scan

Effective date: [date]

These Terms are a contract between TrueNorth Data Shield LLC, a Hawaii limited liability company ("TrueNorth"), and the business that accepts them ("Customer"). By creating an account, connecting a tenant, or signing an order form, you agree to these Terms on behalf of that business and confirm that you have authority to do so.

1. The Service

TrueNorth Exposure Scan (the "Service") is a hosted, read-only assessment of Microsoft 365 sharing and access settings. It produces findings, scores and recommended fixes. The Service does not change your tenant. Related consulting, such as the Copilot Readiness Review, is governed by these Terms and the applicable order form.

2. Business use only

The Service is provided only to businesses and organizations, not to consumers.

3. Customer responsibilities and authorization

Customer represents and warrants that: (a) it owns the Microsoft 365 tenant it connects, or is expressly authorized by the tenant owner to connect it. MSPs warrant that they have written authorization from each client; (b) the person granting admin consent is authorized to do so; (c) it has provided any notices to its personnel that its policies or applicable law require; and (d) it will use the Service only for lawful security and governance purposes, not to surveil individuals or to access tenants without authorization.

Customer can revoke access at any time by deleting the TrueNorth Exposure Scan enterprise application in Microsoft Entra ID.

4. Fees, renewal and cancellation

• Fees are stated on the order form or pricing page. Subscriptions are billed monthly or annually in advance through Stripe.
• Subscriptions renew automatically for the same term unless cancelled. You can cancel at any time in the billing portal or by emailing billing@truenorthdatashield.com. Cancellation takes effect at the end of the current billing period. Except where required by law or stated in section 9, fees are non-refundable.
• We will email you at least 30 days before any price increase takes effect.
• Taxes: fees exclude taxes. Customer pays applicable sales, use, Hawaii general excise, and similar taxes, which we calculate based on your billing location. Tax-exempt customers must provide a valid certificate.
• Overdue amounts may lead to suspension after 15 days' notice.

5. Data

• Customer Data (tenant metadata processed by the Service) remains Customer's property. TrueNorth processes it only to provide the Service, as described in the Privacy Policy and the Data Processing Addendum (DPA), which is incorporated into these Terms.
• TrueNorth may use aggregated, de-identified data that does not identify Customer or any individual to improve the Service and publish industry statistics.
• TrueNorth does not access file contents and does not use Customer Data to train AI models.

6. Confidentiality

Each party will protect the other's non-public information with at least reasonable care, and will use it only for this agreement. Reports and findings are Customer's confidential information.

7. Intellectual property

TrueNorth owns the Service, its software, rules and report templates. Customer receives a non-exclusive, non-transferable right to use the Service and its reports for internal business purposes (and, for MSPs, to deliver them to their clients under the Reseller Agreement). Feedback may be used freely.

8. Acceptable use

Customer will not: reverse engineer the Service; resell it except under a signed Reseller Agreement; use it on a tenant without authorization; interfere with its security; or use it to build a competing product.

9. Warranties and disclaimers

TrueNorth warrants that the Service will perform materially as described, and that it will use commercially reasonable security measures. If the Service does not perform as warranted, Customer's remedy is re-performance or, if that fails, a refund of fees paid for the affected period.

EXCEPT AS STATED ABOVE, THE SERVICE AND REPORTS ARE PROVIDED "AS IS." TRUENORTH DOES NOT WARRANT THAT THE SERVICE WILL FIND EVERY EXPOSURE OR PREVENT EVERY INCIDENT. FINDINGS DEPEND ON DATA MICROSOFT MAKES AVAILABLE AT SCAN TIME. REPORTS ARE NOT LEGAL, COMPLIANCE, OR AUDIT CERTIFICATIONS. CUSTOMER DECIDES WHETHER AND HOW TO ACT ON THEM.

10. Limitation of liability

NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR LOST PROFITS. EACH PARTY'S TOTAL LIABILITY IS LIMITED TO THE FEES PAID OR PAYABLE BY CUSTOMER IN THE 12 MONTHS BEFORE THE CLAIM. These limits do not apply to Customer's payment obligations, either party's indemnity obligations, or liability for gross negligence or willful misconduct. [Attorney: consider a higher "super-cap," e.g. 2–3x fees, for data-protection breaches; enterprise buyers will ask for one.]

11. Indemnities

TrueNorth will defend Customer against third-party claims that the Service infringes U.S. intellectual property rights. Customer will defend TrueNorth against claims arising from Customer connecting a tenant without authorization or violating section 3 or 8.

12. Term and termination

Either party may terminate for material breach that remains uncured 30 days after notice. On termination, access ends and Customer Data is deleted within 30 days. Customer may export reports before the termination date.

13. General

• Governing law and venue: the laws of the State of Hawaii. Disputes go to the state or federal courts located in Honolulu, Hawaii. [Attorney: consider binding arbitration.]
• Independent contractors. Neither party may assign this agreement without consent, except to a successor in a merger or sale.
• Force majeure applies to events beyond a party's reasonable control.
• Notices go by email to the addresses on the account.
• Entire agreement: these Terms, the order form, the DPA and, if applicable, the Reseller Agreement. If they conflict, the order form controls, then the DPA (for data matters), then these Terms.
• We may update these Terms with 30 days' notice. Continued use after that means acceptance.
• Trademarks: Microsoft and related marks belong to Microsoft. TrueNorth is not affiliated with or endorsed by Microsoft.

Contact: legal@truenorthdatashield.com · TrueNorth Data Shield LLC · [address], Hawaii