Legal · Terms of Service

Terms of Service

Effective September 25, 2026 · Version 4.1 · Bonterms Standard Online Cloud Terms v1.0, with Provider-Specific Terms

Draft pending counsel sign-off. The operative body of this agreement is a published standard form, the Bonterms Standard Online Cloud Terms v1.0, which we incorporate by reference and do not edit. What is ours, and pending sign-off by counsel, is: the Provider-Specific Terms in Sections 2 to 5, including the Additional Terms in Sections 3.6 and 5 that replace Standard Terms Sections 6.2, 14, 15 and 19.2 (warranty, liability, indemnity, and Texas law with JAMS arbitration), and the Attachments we wrote (the Acceptable Use Policy, the Security Measures in Section 3.4, the Support Policy, the SLA Key Terms, the DPA Details and the Refund Policy). Questions: legal@elasticd3m.com.

1. What this agreement consists of

Your use of Enclave AI™ is governed by the Bonterms Standard Online Cloud Terms, v1.0 (the "Standard Terms"), published by Bonterms and incorporated here by reference, as modified and supplemented by the Provider-Specific Terms in Sections 2 to 5 below and the Attachments listed in Section 6. Together these form the agreement (the "Agreement") between you and ElasticD3M, LLC. Where the Provider-Specific Terms conflict with the Standard Terms, the Provider-Specific Terms control (Standard Terms Section 1.3).

In the Standard Terms, "Provider" means ElasticD3M, LLC, a Texas limited liability company with a registered address at 7700 Broadway St, Ste 104 PMB1083, San Antonio, TX 78209. "Customer" means the organization identified at Stripe checkout or intake; the individual who completes the Order represents that they may bind it. The "Website" is ai4cmmc.ai. By completing an Order or using the Cloud Service, Customer accepts this Agreement.

This Agreement covers every Order placed on ai4cmmc.ai: the CMMC Level 2 Readiness Snapshot™ (one-time), the CMMC Level 1 Readiness Snapshot (one-time), Enclave AI™ Level 1 Starter AaaS, and the Standing, Sentinel, Garrison, Standard, Fortress and Sovereign readiness subscriptions, together with every other Enclave AI™ subscription tier offered at ai4cmmc.ai/pricing, whether billed annually or monthly. Level 1 checkout is not open yet; the Level 1 terms below apply once it opens.

The Standard Terms are © 2024 Bonterms, Inc. and published under the Creative Commons Attribution-NoDerivatives 4.0 International licence (CC BY-ND 4.0). We link to them rather than reproduce them, so what binds is the unmodified text Bonterms publishes. Every change we make is stated in the Provider-Specific Terms below, not in a redline. ElasticD3M is not affiliated with or endorsed by Bonterms, Bonterms is not a party to this Agreement, and the Provider-Specific Terms are ours, not Bonterms'.

Read Sections 3.6 and 5 before you buy. They replace the Bonterms defaults on warranty, liability, indemnity and disputes, and they are deliberately protective of Provider. In short: the Cloud Service and every deliverable are provided as is, with no performance warranty and no warranty that any output is accurate or complete; Provider's total liability for everything, on any theory, is capped at the fees Customer actually paid in the preceding twelve months, or one hundred dollars, whichever is greater; Customer indemnifies Provider, and Provider does not indemnify Customer; and disputes are resolved by individual JAMS arbitration in San Antonio, Texas, with no class actions and no jury. If those terms do not work for your organization, do not purchase.

2. Provider-Specific Terms: the Cloud Service

2.1 What the Cloud Service is

The "Cloud Service" is Enclave AI™, delivered as Agent-as-a-Service (AaaS) for CMMC readiness: AI agents read configuration metadata from the systems Customer connects, record the evidence Customer supplies, and prepare the documents listed in Sections 2.2 and 2.3 for Customer's people to review, approve and use. Customer's people make every compliance determination, every affirmation and every submission. Provider does not perform CMMC assessments: self-assessments are Customer's own, and certification assessments are performed by independent Cyber AB-authorized C3PAOs (Level 2) or DCMA DIBCAC. Provider is not a C3PAO, and the Cloud Service does not substitute for an independent assessment. In Addendum A, "Services" means the Cloud Service.

2.2 Level 1 (FCI) offers

For CMMC Level 1 offers, the Cloud Service prepares: an FCI scope record (the FCI Scope Record); requirement state for the 15 FAR 52.204-21(b)(1) requirements (the 15-Requirement Compliance Record, and Drift Monitoring between cycles); an evidence record (the Evidence Register and the Automated Measurement Record); the Gap and Exception Report; a remediation-action report (the Remediation Action Report), which is not a POA&M, because 32 CFR 170.24(c)(1) permits no POA&M at Level 1; an annual self-assessment package (the Annual Self-Assessment Package and the SPRS Submission Worksheet); an affirmation-support package (the Annual Affirmation Package) prepared for Customer's Affirming Official; and the Historical Assurance Record. The CMMC Level 1 Readiness Snapshot is the FCI Scope Record and the records of one Level 1 measurement cycle. Customer's Affirming Official makes and submits every affirmation; ElasticD3M submits nothing to the Government.

2.3 Level 2 (CUI) offers

For CMMC Level 2 subscriptions, every tier receives, each delivery cycle: the CMMC Level 2 Readiness Snapshot™ report (an SPRS posture estimate and the top control gaps), a System Security Plan, a Plan of Action and Milestones (with 32 CFR 170.21 eligibility called out), a CUI Scoping Package, a Customer Responsibility Matrix and an Evidence Library Index. Fortress adds a Monitoring Runbook and an Audit-Defense Exhibit List. Sovereign adds a Board Readiness Narrative, a Multi-Entity Portfolio Roll-Up, a C3PAO Handoff Packet and a Subcontractor Flow-Down Matrix. The delivery cycle for each tier is stated in the Support Policy. The one-time CMMC Level 2 Readiness Snapshot™ delivers its report only.

2.4 Documentation

"Documentation" means Sections 2.1 to 2.5 of these Provider-Specific Terms, the Support Policy, and the usage instructions shown in the Customer workspace and onboarding pages. Marketing pages, blog posts, sample reports and sample dashboards are not Documentation.

2.5 Connectors, Customer Data and export

Customer connectors used to read configuration metadata (AWS read-only IAM roles, Azure Service Principals with the Reader and Security Reader roles, Microsoft 365 Service Principals with read-only Microsoft Graph application permissions, Google Workspace service accounts delegated a read-only directory scope, Okta read-only API tokens, CrowdStrike OAuth2 read-only API clients) are scoped to configuration metadata only and may be revoked by Customer at any time by removing the role, app registration, or token from the corresponding tenant, which ends the Cloud Service's access. Customer may also disconnect its connectors on its onboarding page, and Provider then deletes the credential it stores for each one (an AWS connector uses a role Customer grants, and Provider stores no credential for it). Customer's connected services are Third-Party Platforms under Standard Terms Section 8.

During the Subscription Term, including after Customer cancels and until the paid period ends, Customer may export its readiness record through the workspace export, and Customer keeps every document delivered to it by email. That is the export described for Standard Terms Section 12.4. After the Agreement ends, Standard Terms Section 12.4 applies: Provider deletes Customer Data within 60 days of Customer's request, subject to backup and record-retention policies and to law. Provider does not host records for Customer after the Agreement ends; any duty Customer has to retain its own records (for example, 32 CFR 170.15(c)(2) at Level 1) stays with Customer.

2.6 Usage Rules (added to Standard Terms Section 7.2)

Customer will not submit Controlled Unclassified Information (CUI), data controlled under the International Traffic in Arms Regulations (consistent with Standard Terms Section 19.13) or other regulated data contents to the Cloud Service. The Cloud Service is designed to read configuration metadata, not the contents of Customer's files, mail or records, and Customer is responsible for keeping CUI out of what it enters at intake or in evidence records. Customer's use is also subject to the Acceptable Use Policy, including its eligibility certification.

2.7 Seats (modifies Standard Terms Section 7.3)

A Customer holding an MSP, MSSP, ESP, C3PAO or prime-contractor seat may use the Cloud Service to view or act for another organization only to the extent that organization's consent is recorded in the Cloud Service; that use is not a breach of Standard Terms Section 7.3(a). Good-faith security research reported as described in /.well-known/security.txt, and within the rules stated there, is not a breach of Standard Terms Section 7.3(d).

3. Provider-Specific Terms: commercial terms

3.1 Orders and Subscription Term (modifies Standard Terms Section 12.1)

An "Order" is a purchase completed through Stripe checkout on ai4cmmc.ai. Each subscription's Subscription Term is the monthly or annual period selected at checkout, and it renews for the same period until cancelled. Cancelling stops renewal at the end of the then-current paid period, and access continues until then. A one-time Snapshot is an Order for a single delivery; its Subscription Term ends when its report is delivered.

3.2 Fees and payment (modifies Standard Terms Section 10.1)

Fees are the prices shown at checkout, in U.S. dollars, charged in advance through Stripe at checkout and at each renewal. Level 2 prices are published at ai4cmmc.ai/pricing. There is no free trial. Fees are non-refundable except as this Agreement, including the Refund Policy, expressly provides. The Refund Policy's Snapshot credits are level-specific: the CMMC Level 2 Readiness Snapshot™ credits only toward a Level 2 subscription, never toward Level 1 Starter, and the CMMC Level 1 Readiness Snapshot credits only toward Level 1 Starter. Provider may change the price of a renewal on at least thirty (30) days' notice; a change never applies to a period already paid.

3.3 Fair use and suspension (adds to Standard Terms Section 11)

Each subscription tier includes capacity (telemetry events processed per day, AI agent actions per month, and the number of covered entities) subject to fair-use thresholds set per tier at levels sufficient for the ordinary compliance operations of an organization of the size and scope the tier describes. The number of covered entities for each tier is stated on the applicable tier page; use for entities beyond that count requires the applicable higher tier or a custom agreement. Where Customer's usage sustainedly exceeds the fair-use thresholds for its tier, Provider will notify Customer in writing before any overage charge is applied. Sustained overage is billed at Provider's cost plus a thirty percent (30%) margin, or Customer may move to the appropriate higher tier. Use above ten (10) entities, FedRAMP High or IL5+ requirements, and custom contract structures are not offered self-serve at this time and are outside these Terms.

A Suspension Event under Standard Terms Section 11 also includes: (a) a subscription payment that is still unpaid after repeated failed collection attempts, or after Stripe stops retrying it; (b) a payment refunded in full, other than a refund that pays a credit under the Refund Policy or an approved refund of a first payment that ends the subscription under the Refund Policy; and (c) a chargeback, meaning a dispute of a payment that Customer files with its card issuer or bank, other than an inquiry. A good-faith invoice dispute under Standard Terms Section 10.3 is not a chargeback. While a subscription is suspended for one of these reasons, delivery pauses, and it resumes once the payment matter is settled.

3.4 Security Measures (identified for Standard Terms Section 3.2)

Provider maintains these Security Measures:

3.5 Notices (Standard Terms Section 19.3)

Provider's notice address is legal@elasticd3m.com, with a copy to 7700 Broadway St, Ste 104 PMB1083, San Antonio, TX 78209. Notices to Customer go to the email address on file.

3.6 Governing Law, Arbitration and Courts (Additional Term: supersedes Standard Terms Section 19.2)

Standard Terms Section 19.2 (Governing Law and Courts) is expressly superseded and does not apply; this Section 3.6 applies in its place. The Governing Law is the law of the State of Texas, without regard to its conflict-of-laws rules. This replaces the California default in Standard Terms Section 19.2.

Negotiation, then arbitration. The parties will first try to resolve any dispute arising out of or relating to this Agreement or the Cloud Service through good-faith negotiation between business leaders. A dispute that is not resolved within thirty (30) days after either party gives notice of it will be resolved by binding arbitration administered by JAMS under its Streamlined Arbitration Rules, conducted in English before a single arbitrator, and seated in San Antonio, Bexar County, Texas. Each party bears its own attorneys' fees, and the parties split the arbitration costs equally. Judgment on the award may be entered in any court of competent jurisdiction.

Courts. No dispute is heard in court except: (a) a claim for injunctive or other equitable relief, including for a breach of Standard Terms Section 16 (Confidentiality) or of either party's intellectual property rights; and (b) a proceeding to compel arbitration or to confirm, vacate or enforce an arbitration award. The Courts for those proceedings are the state and federal courts located in Bexar County, Texas, and each party consents to their jurisdiction and venue, except that judgment on an award may also be entered in any other court of competent jurisdiction.

Individual Claims Only. ALL CLAIMS MUST BE BROUGHT IN THE PARTY'S INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. THE ARBITRATOR MAY NOT CONSOLIDATE MORE THAN ONE PARTY'S CLAIMS AND MAY NOT PRESIDE OVER ANY CLASS OR REPRESENTATIVE PROCEEDING. IF THIS PARAGRAPH IS HELD UNENFORCEABLE AS TO A PARTICULAR CLAIM, THAT CLAIM ALONE IS SEVERED AND HEARD IN THE COURTS, AND THE REST OF THIS SECTION 3.6 CONTINUES TO APPLY.

Jury Waiver. TO THE EXTENT ANY DISPUTE PROCEEDS IN COURT RATHER THAN IN ARBITRATION, EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO TRIAL BY JURY.

3.7 Free surfaces are Trials and Betas

The free gap checks, sample reports, sample dashboards and any feature marked beta, preview or evaluation are Trials and Betas under Standard Terms Section 18. Nothing a free surface produces is a readiness determination.

3.8 Standard Terms sections these Provider-Specific Terms supersede

Under Standard Terms Section 1.3, these Provider-Specific Terms take precedence over the Standard Terms. As Additional Terms, they expressly supersede, and replace in full, these sections of the Standard Terms:

A reference anywhere in the Agreement to one of those sections is a reference to the section that replaces it. Section 4 below adds disclaimers to Standard Terms Section 6.3.

4. Provider-Specific Terms: additions to Standard Terms Section 6.3 (Disclaimers)

No Warranty of Output Accuracy. Provider makes no representation or warranty that any output of the Cloud Service is accurate, complete, current, or fit for any particular use. Output includes requirement and objective states, scoring figures, gap findings, draft System Security Plans, POA&M entries, the Evidence Library Index, the Level 1 records and every other deliverable. Output is derived from configuration metadata that Customer's connected systems report at a point in time, from information Customer supplies, and from automated systems that can produce incorrect or incomplete results. Customer is responsible for reviewing, verifying, correcting, and approving every output before relying on it or providing it to any third party.

No Professional Advice. The Cloud Service does not provide legal, accounting, audit, or professional advice, and no deliverable is a legal opinion, an audit, an attestation, a certification, or an assessment. Provider is not a C3PAO, not a Registered Provider Organization acting in an assessment capacity, and not Customer's counsel.

Customer Submissions to the Government. Customer alone determines what it enters into the Supplier Performance Risk System, what it affirms under 32 CFR 170.22, and what it represents to any contracting officer, prime contractor, higher-tier contractor, or C3PAO. Provider makes no submission, representation, certification, or affirmation to the United States Government on Customer's behalf and is not a party to any Customer submission.

Automated Processing and Third-Party Models. Portions of the Cloud Service use large language models operated by a third party, which is a Subprocessor under the DPA. Automated systems can produce output that is plausible and wrong. Provider does not warrant the output of any model.

Regulatory Change. CMMC requirements, 32 CFR part 170, 48 CFR part 204, NIST SP 800-171 and its revisions, DoD scoring methodology, and related guidance change over time and are subject to interpretation by the Government and by assessors. Provider does not warrant that the Cloud Service reflects the current state of any requirement at any given moment.

Assessment Outcomes. The Cloud Service supports Customer's CMMC readiness preparation. Provider does not guarantee that Customer will pass any CMMC Level 1, Level 2, or Level 3 assessment; outcomes depend on the assessor's judgment, on Customer's own remediation work, and on the accuracy of what Customer provides.

Customer Acknowledgments and Non-Reliance. Customer acknowledges that: (a) its obligations under DFARS 252.204-7012, 252.204-7019, 252.204-7020, and 252.204-7021, under 32 CFR part 170, and under its own contracts are Customer's alone and are not assumed, shared, or discharged by Provider or by any deliverable; (b) Customer will apply its own qualified judgment to every compliance determination; and (c) Customer is not relying, and will not rely, on any marketing material, sample report or demonstration of Provider in deciding what to represent to the Government or to any prime, higher-tier contractor, or C3PAO.

No Reliance by Non-Parties. Deliverables are prepared for Customer's internal use. Provider owes no duty of care to any person who receives a deliverable from Customer, including a prime or higher-tier contractor, C3PAO, assessor or insurer, and Customer will make that clear to anyone to whom it provides a deliverable. This supplements Standard Terms Section 19.11 (No Third-Party Beneficiaries).

5. Provider-Specific Terms: warranty, liability and indemnity (Additional Terms superseding Standard Terms Sections 6.2, 14 and 15)

5.1 No Performance Warranty (supersedes Standard Terms Section 6.2)

Standard Terms Section 6.2 (Performance Warranty), including its claim report, fix period and refund, is expressly superseded and does not apply; this Section 5.1 applies in its place. Provider makes no performance warranty. THE CLOUD SERVICE, THE DOCUMENTATION AND EVERY DELIVERABLE ARE PROVIDED "AS IS," "AS AVAILABLE," AND WITH ALL FAULTS AND DEFECTS. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, PROVIDER DISCLAIMS ALL WARRANTIES AND CONDITIONS NOT EXPRESSLY STATED IN THIS AGREEMENT, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, QUIET ENJOYMENT, NON-INFRINGEMENT, AND TITLE, AND ANY WARRANTY ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, USAGE, OR TRADE PRACTICE. PROVIDER DOES NOT WARRANT THAT THE CLOUD SERVICE WILL PERFORM AS DESCRIBED IN THE DOCUMENTATION, OR THAT IT WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, OR THAT ALL DEFECTS WILL BE CORRECTED.

There is no warranty claim, fix period or warranty refund. Fees are refundable only as the Refund Policy expressly provides. The Security Measures (Section 3.4), the SLA and the Support Policy are service commitments, not warranties, and every claim about them is subject to Section 5.2.

5.2 Limitations of Liability (supersedes Standard Terms Section 14)

Standard Terms Section 14 (Limitations of Liability), including its General Cap, Enhanced Cap, Enhanced Claims and Uncapped Claims, is expressly superseded and does not apply; this Section 5.2 applies in its place.

Excluded damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY OF THE FOLLOWING, WHETHER CHARACTERIZED AS DIRECT DAMAGES OR OTHERWISE: LOST PROFITS OR REVENUES; LOST, FORFEITED, TERMINATED, OR UNAWARDED CONTRACTS, TASK ORDERS, OR BID OPPORTUNITIES; SUSPENSION, DEBARMENT, OR LOSS OF ELIGIBILITY TO CONTRACT; FINES, PENALTIES, DAMAGES, OR ASSESSMENTS IMPOSED BY ANY GOVERNMENT OR REGULATOR; THE COST OF ANY RE-ASSESSMENT, RE-SCAN, OR REMEDIATION WORK; LOSS OR CORRUPTION OF DATA; BUSINESS INTERRUPTION; THE COST OF SUBSTITUTE GOODS OR SERVICES; OR LOSS OF GOODWILL OR REPUTATION. THIS EXCLUSION APPLIES EVEN IF THE PARTY WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

Liability cap. EACH PARTY'S TOTAL CUMULATIVE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE CLOUD SERVICE WILL NOT EXCEED THE GREATER OF: (A) THE FEES ACTUALLY PAID BY CUSTOMER TO PROVIDER IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED DOLLARS ($100 USD). THIS LIMIT IS CUMULATIVE ACROSS ALL CLAIMS AND IS NOT INCREASED BY THE NUMBER OF CLAIMS OR CLAIMANTS. THESE LIMITATIONS APPLY WHETHER THE CLAIM ARISES IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, STATUTE, INDEMNITY, OR OTHERWISE, AND EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

One Cap for Everything. The cap in this Section 5.2 is a single aggregate limit that applies to every claim of every kind against Provider, including claims for breach of Standard Terms Section 3.2 (Security) or the Security Measures, Section 3.3 (DPA) or the Data Processing Addendum, or Section 16 (Confidentiality); claims relating to intellectual property, including under Section 5.3; any Service Level Agreement credit or refund; claims relating to Trials and Betas, in place of the US$1,000 limit in Standard Terms Section 18; and any statutory claim. There is no separate, higher, or enhanced cap for any category of claim, and no super-cap.

Exclusions. The limitations in this Section 5.2 do not apply to: (i) Customer's payment obligations and Customer's indemnification obligations under Section 5.3; or (ii) any liability that applicable law does not permit to be limited or excluded. No other category of claim is uncapped. Nothing in this Agreement is intended to exclude a liability that cannot lawfully be excluded, and if a limitation here is held unenforceable it applies to the maximum extent the law allows rather than not at all.

Time Limit on Claims. Except for claims arising from Customer's payment obligations, no claim arising out of or relating to this Agreement or the Cloud Service may be brought more than twelve (12) months after the claiming party first knew or reasonably should have known of the facts giving rise to the claim.

Allocation of Risk. The parties agree that the disclaimers in Sections 4 and 5.1 and the limitations in this Section 5.2 are a fundamental basis of the bargain between them, that the fees for the Cloud Service reflect that allocation of risk, and that Provider would not make the Cloud Service available at these prices without them.

5.3 Indemnification (supersedes Standard Terms Section 15)

Standard Terms Section 15 (Indemnification), including Provider's indemnity for Provider-Covered Claims in Section 15.1, is expressly superseded and does not apply; this Section 5.3 applies in its place. The indemnity runs one way, from Customer to Provider.

Customer Indemnification. Customer will defend, indemnify, and hold harmless Provider and its members, officers, employees, and agents against any third-party claim, and any resulting loss, liability, penalty, fine, settlement, judgment, or reasonable attorneys' fee, arising from or relating to: (a) Customer Data or anything Customer submits to or through the Cloud Service; (b) Customer's use of the Cloud Service or of any deliverable, including any use in or in connection with an assessment; (c) any representation, certification, score, or affirmation Customer makes to the United States Government, to a prime or higher-tier contractor, or to a C3PAO, whether or not informed by the Cloud Service; (d) Customer's breach of this Agreement, including Standard Terms Section 7 (Usage Rules) and the Acceptable Use Policy, or of applicable law, including export control and sanctions law; or (e) Customer's gross negligence or willful misconduct. Provider will notify Customer of any covered claim, and Customer will have control of the defense and settlement, except that it may not settle in a way that admits fault by Provider or imposes any obligation on Provider without Provider's written consent.

No Indemnity from Provider. Provider does not defend, indemnify, or hold Customer harmless against any claim, including any claim that the Cloud Service infringes or misappropriates a third party's intellectual property rights.

Infringement Remedy. If Customer's use of the Cloud Service is enjoined or claimed to infringe a third party's intellectual property rights, Provider may, at its sole option and expense: (i) procure for Customer the right to continue using the Cloud Service; (ii) replace or modify the Cloud Service so it no longer infringes; or (iii) terminate the affected Order and refund any prepaid fees attributable to the unused portion of the then-current Subscription Term. THIS IS NOT AN INDEMNITY. IT STATES PROVIDER'S ENTIRE OBLIGATION AND CUSTOMER'S SOLE AND EXCLUSIVE REMEDY FOR ANY CLAIM OF INFRINGEMENT OR MISAPPROPRIATION, AND IT IS SUBJECT TO SECTION 5.2. Provider has no obligation under this paragraph for any claim arising from Customer Data, from Customer's combination of the Cloud Service with anything Provider did not supply, from Customer's modification of any deliverable, or from Customer's use after Provider has told it to stop.

6. Attachments

These Attachments form part of the Agreement:

Our Privacy Notice describes how we handle personal information and is not part of the Agreement.

7. U.S. Government end users

Standard Terms Section 19.14 (Government Rights) applies: the Cloud Service is commercial computer software or a commercial item under FAR 12.212 and DFARS 227.7202. United States Government customers are additionally governed by Addendum A, which controls over any conflicting provision of this Agreement.

8. Contact

Questions about these Terms: legal@elasticd3m.com
Links, order status, billing and refund requests: ai4cmmc.ai/help
Privacy questions: privacy@elasticd3m.com

Addendum A. United States Government Contracting Rider

This Addendum applies only where the Customer is the United States Government or a contractor acquiring on its behalf. It does not modify the rights or obligations of any commercial Customer.

Provider identifiers. ElasticD3M, LLC · SAM.gov Unique Entity ID (UEI): LXSZZXDYPN16 · CAGE Code: 23E31.

A1. Applicability. This Addendum applies when Customer is the United States Government, an agency or instrumentality thereof, or a prime or higher-tier contractor acquiring the Services for delivery to the United States Government under a federal prime contract, subcontract, or purchase order. Where it applies, this Addendum controls over any conflicting provision of these Terms.

A2. Commercial product and commercial service status. The Services are commercial products and commercial services within FAR 2.101. Any software component is commercial computer software and commercial computer software documentation under FAR 12.212 and DFARS 227.7202. The Government acquires only those rights customarily provided to the public, as set out in these Terms as modified by this Addendum.

A3. Order of precedence. The federal contract or order, including FAR 52.212-4 and any clause incorporated by operation of law, controls over these Terms. Consistent with GSAR 552.212-4, any provision of these Terms that conflicts with federal law or is unenforceable against the United States is deemed deleted for that engagement, and its deletion does not affect the remainder.

A4. Governing law and disputes. For Government engagements these Terms are governed by federal law, and Section 3.6 (Governing Law, Arbitration and Courts) is superseded. Disputes are resolved under the Contract Disputes Act, 41 U.S.C. §7101 et seq.: by written claim to the Contracting Officer, then appeal to the cognizant Board of Contract Appeals or the United States Court of Federal Claims. Provisions selecting state law, state venue, or consent to personal jurisdiction do not apply.

A5. No binding arbitration. No arbitration provision applies to Government engagements, and the arbitration, class-action waiver and jury waiver in Section 3.6 do not apply to them. The parties may use alternative dispute resolution only as authorized by the Contract Disputes Act and the acquiring agency's procedures.

A6. Indemnification. Any obligation for Customer to defend, indemnify, or hold Provider harmless, including under Section 5.3, does not apply to the United States Government, which cannot obligate funds in advance of an appropriation under 31 U.S.C. §1341. For Government engagements, Section 5.3's statement that Provider gives no indemnity does not apply to the intellectual-property indemnity contemplated by FAR 52.212-4(h), which Provider gives as the federal contract or order requires.

A7. Funding, renewal, and termination. No provision automatically renews a Government order or escalates price without a modification executed by a warranted Contracting Officer. Performance is subject to the availability of appropriated funds. Termination for convenience and for cause is governed by FAR 52.212-4(l) and (m).

A8. Limitation of liability. Limitations, exclusions, and disclaimers in these Terms apply only to the extent permitted by federal law, and do not limit any remedy available to the Government under the federal contract or order.

A9. Scope of Government engagements. Government engagements are advisory and deliverable-based. Provider does not ingest, process, store, or transmit Government data, Controlled Unclassified Information, or data from a Federal information system, and does not connect to, scan, or operate within a Federal information system or a contractor system processing CUI on the Government's behalf. Deliverables are produced from information the Government elects to furnish and are reviewed and approved by Customer's designated official before issuance. Accordingly the Services are not a cloud service offering requiring FedRAMP authorization. Any engagement requiring Provider to process Government data or connect to a Federal information system is outside the scope of these Terms and requires a separate written agreement.

A10. Accessibility. Provider will furnish an Accessibility Conformance Report for the Services and for deliverable formats on request, addressing the Revised Section 508 Standards at 36 C.F.R. Part 1194.

A11. Supply chain and place of performance. Provider does not provide covered telecommunications equipment or services as defined in Section 889 of the FY2019 NDAA. Provider's own personnel are United States persons and perform the Services in the United States. Customer data is stored in United States regions, and the Subprocessor List states where each Subprocessor processes it. Model inference is requested as U.S.-only on every call.

A12. Standard representations. Provider has not paid or agreed to pay any contingent fee for the award of a federal contract (FAR 52.203-5) and has not offered gratuities (FAR 52.203-3). Assignment is subject to the Anti-Assignment Act, 41 U.S.C. §6305.

Effective Date: September 25, 2026 · Version: 4.1 · Operative body: Bonterms Standard Online Cloud Terms v1.0, by reference
Replaces all prior versions of the Terms published at ai4cmmc.ai before this date.