Terms of Service

The agreement between you and Cyber Alliance governing your access to and use of Sally, our AI-assisted cybersecurity platform at www.ca-sally.ai.

01Agreement to these Terms

These Terms of Service (the "Terms") are a binding agreement between you ("you", "your", or the "Customer") and Cyber Alliance Consortium, LLC, a North Carolina limited liability company ("Cyber Alliance", "we", "us", or "our"), governing your access to and use of the Sally platform, websites, applications, APIs, and related services (together, the "Services").

By creating an account, clicking to accept, or otherwise accessing or using the Services, you agree to these Terms and to our Privacy Policy, which is incorporated by reference. If you do not agree, do not access or use the Services.

Eligibility

You must be at least 18 years old (or the age of majority in your jurisdiction) and able to form a binding contract. The Services are intended for business and professional use in securing systems you are authorized to secure; they are not directed to children. The Services are offered for business, professional, and governmental use. By accepting these Terms, you confirm that you are using the Services for those purposes.

Authority to bind an organization

If you use the Services on behalf of a company, organization, or other legal entity (an "Organization"), you represent that you are authorized to bind that Organization to these Terms, and "you" and "Customer" refer to that Organization. The person who creates an Organization workspace is responsible for its members' use of the Services.

Consumers

Where you use the Services as an individual consumer rather than for business purposes, you may have mandatory statutory rights under the consumer-protection laws of your country. Nothing in these Terms limits or excludes any right that cannot lawfully be limited or excluded; where a provision conflicts with your non-waivable consumer rights, those rights prevail to the extent of the conflict.

02Definitions

Services: The Sally platform and all features described in §3, including any successor or additional features.

Customer Content: Data, text, files, scan targets, code, credentials-scope, assessment answers, chat messages, and other material you or your users submit to or generate through the Services.

Target: A website, network, host, IP range, application, repository, or other system that you submit to be scanned, assessed, or analysed.

Scan: Any automated security test the Services perform against a Target, including website vulnerability, network, deep/active, and source-code scans, whether run on our infrastructure or via a third-party scanning engine.

Findings: The results, scores, risk ratings, and recommendations the Services produce, including AI-generated narrative and reports.

Trust Score / Assessment: The self-reported cybersecurity posture assessment aligned to the NIST Cybersecurity Framework and the resulting score, as described in §8.

Free / Paid tier: The subscription levels described in §6, which determine which features and usage limits apply to your account.

03The Sally services

Sally is an AI-assisted cybersecurity platform that helps organizations understand and improve their security posture. Depending on your tier and configuration, the Services may include:

• Sally chat: an AI assistant scoped to cybersecurity topics that answers questions, explains threats and findings, and suggests next steps.
• Risk assessment (Trust Score): a questionnaire-based assessment aligned to the NIST Cybersecurity Framework that produces a self-reported posture score, category breakdowns, and gaps.
• Website vulnerability scanning: automated scanning of web Targets, including a standard scan, a deep/active scan, and a professional web scan powered by a third-party scanning engine.
• Network scanning: automated scanning of network Targets.
• Source-code scanning: automated analysis of source-code repositories you connect or provide.
• Threat intelligence & monitoring: curated threat and vulnerability signals, including known-exploited-vulnerability and region-relevant feeds.
• Findings, remediation & reports: prioritized findings, remediation guidance, and exportable Executive, Technical, and Compliance-oriented reports.
• Collaboration: inviting colleagues (including by secure link) to complete parts of an assessment, and managing your Organization's workspace.

The Services are actively developed. Features, limits, and availability may change, and some capabilities may be offered in pilot, beta, or limited-availability form. We may add, modify, or discontinue features as described in §18.

04Accounts & registration

To use most features you must create an account. Authentication is handled through our identity provider, and you may be required to verify your email address before access is granted.

• You must provide accurate, current, and complete information and keep it up to date.
• You are responsible for safeguarding your credentials and for all activity under your account. Notify us promptly at legal@cyber-alliance.com of any unauthorized use or suspected compromise.
• You may not share accounts, or let anyone use the Services under your identity except authorized members of your Organization within your plan's seat limits.
• Organization administrators may invite, manage, and remove members and may set or change a member's access. Members' use is subject to these Terms and to the administrator's control.

05Authorization to scan & acceptable use

By submitting a Target or initiating a Scan, you represent and warrant that, for each Target, you either own it or have obtained all necessary authorizations and consents from its owner and operator to conduct the Scan, and that doing so will not violate any law or any third party's rights. You are solely responsible for identifying your Targets correctly and for the consequences of scanning them.

You will not

• Scan, probe, or test any Target you are not authorized to test, or use the Services to attempt to gain unauthorized access to any system;
• Use the Services or any Findings to attack, exploit, disrupt, or harm any system, or to develop or deploy malware;
• Use the Services in violation of any applicable law, regulation, or third-party right, or to process another person's personal data without a lawful basis;
• Interfere with, overload, or disrupt the Services or the infrastructure of third parties, or circumvent usage limits, rate limits, or access controls;
• Reverse engineer, decompile, or attempt to extract source code or models from the Services except to the extent this restriction is prohibited by law;
• Resell, sublicense, or provide the Services to third parties as a service bureau except under a written agreement with us;
• Upload content that is unlawful, infringing, or that you have no right to submit; or
• Use the Services to benchmark or build a competing product.

We may investigate suspected violations and may suspend or restrict access as described in §17. You will cooperate with reasonable requests to verify your authorization to scan a Target. You will keep a record of your authorization for each Target and provide it to us on request. We may require you to verify control of a Target (for example, through DNS or file-based verification) before running certain Scans, and we may decline, pause, or stop any Scan at our discretion.

06Plans, fees & billing

Free and paid tiers

The Services are offered on a Free tier and one or more Paid tiers. The Free tier provides limited access: for example, a capped number of chat questions, a single baseline assessment, a limited number of website scans, and a limited number of visible findings. Paid tiers unlock expanded usage and additional capabilities such as network, deep/active, and source-code scanning; full findings; professional web scans; and report exports. The specific features and limits of each tier are described on our pricing and in-product materials and may be updated from time to time.

Fees, subscriptions & renewal

• Paid subscriptions are billed in advance on a recurring basis (for example monthly or annually) through our third-party payment processor. By subscribing you authorize us and our processor to charge your payment method for the applicable fees.
• Unless stated otherwise, subscriptions renew automatically at the end of each billing period at the then-current price until cancelled.
• Fees are exclusive of taxes; you are responsible for applicable taxes, and we may collect them where required.
• We may change prices or introduce new charges; we will give reasonable prior notice, and changes take effect at your next renewal.

Cancellation & refunds

Free trials and plan conversions. If a free trial or introductory plan will convert to a paid subscription, we will show you the price, billing frequency, and conversion date before you start, and you can cancel before the conversion date to avoid being charged. Where the law requires, we will also send a reminder before the first charge or before renewal.

If you purchase as a consumer and your local law grants a mandatory cancellation or "cooling-off" right, that right applies notwithstanding the above; where you ask us to begin providing the Services during a cooling-off period, you may owe a proportionate amount for what was provided before you cancelled.

Enterprise & invoiced plans

Enterprise or contract customers may be provisioned on a Paid tier by invoice or order form rather than through self-service checkout. Where a signed order form or master agreement exists between you and us, its commercial terms govern billing and prevail over this §6 to the extent of any conflict.

Usage-metered and credit-based features

Some features consume third-party credits or have per-user caps (for example, professional web scans are limited to a set number of distinct domains per user). We may enforce these limits and may adjust them to manage cost and abuse. Exceeding a limit may block further use of that feature until the next period or an upgrade.

07AI output & automated analysis

The Services use artificial intelligence and large language models, including models operated by third parties, to generate chat responses, explanations, risk narratives, remediation guidance, and reports ("AI Output").

To provide AI features, we send the content needed to generate a response or report to our AI subprocessor (OpenAI), for example the chat messages you submit and, when you generate an AI-written report, the relevant scores and findings. Your Trust Score is calculated by our own scoring logic rather than by the AI provider, and we apply automated filtering designed to remove secrets and credentials before content is sent. We do not use Customer Content to train AI models, and our AI provider does not use it to train its models under its API terms. We do not use the Services to make legally or similarly significant decisions about individuals automatically, and you must not use AI Output to do so without appropriate human review.

08No security guarantee; assessments & scores

Security testing is inherently limited. Scans and analyses are point-in-time, best-effort, and depend on the Target's configuration and availability at the time of testing.

• We do not warrant that the Services will detect all vulnerabilities, misconfigurations, or threats, that Findings are free of false positives or false negatives, or that acting on Findings will make any system secure or compliant.
• The Trust Score and related assessments are self-reported indicators of posture aligned to the NIST Cybersecurity Framework. They are not an audit, penetration test of record, certification, or attestation, and they do not certify or guarantee compliance with any law, standard, or framework.
• The Services do not provide certification of compliance with any regulatory or industry framework. Any references to frameworks are for guidance only.

You remain responsible for your own security program, for validating Findings in your environment, and for engaging qualified professionals where appropriate.

09Your content, data & privacy

You retain ownership of your Customer Content. You grant us a worldwide, non-exclusive license to host, process, transmit, display, and otherwise use Customer Content as needed to provide, secure, support, and maintain the Services and to comply with law. We may also create and use aggregated or de-identified data that does not identify you, your Organization, or any individual to operate, analyze, and improve the Services, including for benchmarking. Our handling of personal data is described in our Privacy Policy.

Data we process

Depending on how you use the Services, this may include account and profile data, Organization and workspace information, Targets and scan results, assessment answers, chat content, threat-monitoring preferences, and billing information.

Your responsibilities for personal data

You are responsible for ensuring you have a lawful basis to submit any personal data you provide (including data of colleagues you invite), and for not submitting personal data of third parties without authorization. Do not submit special-category or highly sensitive data, including protected health information, payment card data, government identification numbers, or nonpublic personal information about your own customers or consumers (for example, information protected under the Gramm-Leach-Bliley Act). The Services are not designed to process that data.

Subprocessors & data location

We use reputable third-party subprocessors to operate the Services, currently including our cloud host (AWS), identity provider (Auth0), payment processor (Stripe), AI provider (OpenAI), transactional email provider (Resend), and third-party scanning engine (Pentest-Tools). The Services are hosted in the United States, and Customer Content may be processed in or transferred to the United States and other countries.

Where you or your data subjects are in South Africa, such transfers are made subject to appropriate safeguards under the Protection of Personal Information Act (POPIA), for example your consent, contractual protections, or another lawful transfer basis, as described in our Privacy Policy. Business customers who require a Data Processing Addendum may enter into one with us; where signed, the DPA governs our processing of personal data on your behalf.

10Assessment invitations & collaborators

The Services let you invite others, for example a colleague, your head of IT, or a managed service provider, to complete part of an assessment through a secure, time-limited link, without requiring them to create an account.

• You are responsible for choosing whom to invite and for the accuracy of the email addresses you provide, and for ensuring you may share the assessment context with them.
• Invitation links grant scoped, limited access to specific parts of an assessment and expire after a set period. Treat them as sensitive and share them only with intended recipients.
• Answers submitted by an invited collaborator become part of your Organization's assessment and are visible to your authorized users.

11Intellectual property

The Services, including all software, models, content, designs, and the "Sally" and "Cyber Alliance" names and logos, are owned by us or our licensors and are protected by intellectual-property laws. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, revocable right to access and use the Services and to use the Findings for your internal security purposes.

You retain all rights in your Customer Content. If you send us feedback, suggestions, or ideas, you grant us a perpetual, irrevocable, royalty-free license to use them without restriction or obligation to you. Except as expressly granted, no rights are transferred, and all rights we do not expressly grant are reserved.

12Third-party services

The Services rely on and integrate with third-party products and services, and may link to third-party sites. Your use of a third-party service is governed by that party's terms and privacy practices, not ours, and we are not responsible for third-party services.

Some features depend on the availability and behavior of third parties. For example, a professional web scan may be unable to reach a Target that blocks the scanning provider, and AI features depend on our AI provider. We are not liable for third-party outages, changes, rate limits, or errors, and their availability is not guaranteed.

13Confidentiality

Each party may access non-public information of the other ("Confidential Information"). Your Findings, scan results, and assessment data are your Confidential Information; the non-public aspects of the Services, including pricing, roadmaps, and security details, are ours. Each party will protect the other's Confidential Information using at least reasonable care, use it only to exercise rights and perform obligations under these Terms, and not disclose it except to personnel and contractors bound by confidentiality, or as required by law with reasonable notice where permitted.

14Disclaimers of warranties

Except as expressly stated in these Terms and to the fullest extent permitted by law, the Services and all Findings and AI Output are provided "as is" and "as available", without warranties of any kind, whether express, implied, or statutory, including implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, and any warranty that the Services will be uninterrupted, error-free, secure, or that vulnerabilities will be detected.

Some jurisdictions do not allow the exclusion of certain warranties, and consumers may have statutory guarantees that cannot be excluded. Where that is the case, the above exclusions apply only to the extent permitted, and nothing in these Terms excludes any liability that cannot lawfully be excluded.

15Limitation of liability

To the fullest extent permitted by law:

• Neither party will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, or goodwill, arising out of or relating to the Services or these Terms, even if advised of the possibility.
• Each party's total aggregate liability arising out of or relating to the Services or these Terms will not exceed the greater of (a) the fees paid and payable by you for the Services in the twelve (12) months before the event giving rise to the liability, or (b) one hundred US dollars (USD 100). If you use only the Free tier, our total aggregate liability is USD 100.
• The exclusions and limits in this §15 do not apply to: your obligation to pay fees; your obligations under §16 (Indemnification); your breach of §5 (Authorization to scan & acceptable use); either party's fraud or willful misconduct; or any liability that cannot be limited by law.

These limitations do not apply to liability that cannot be limited by law (for example, in some jurisdictions, liability for death or personal injury caused by negligence, fraud, or willful misconduct) and do not limit non-waivable consumer rights. Nothing here limits your obligations under §16.

16Indemnification

You will defend, indemnify, and hold harmless Cyber Alliance and its officers, employees, and agents from and against any claims, damages, liabilities, losses, and expenses (including reasonable legal fees) arising out of or related to: (a) your Customer Content or Targets; (b) your scanning or testing of any Target without proper authorization; (c) your violation of these Terms or of any law or third-party right; or (d) your use of the Services or Findings. We will give you reasonable notice of the claim and, at your expense, reasonable cooperation; you may not settle any claim in a way that imposes obligations on us without our consent.

17Suspension & termination

You may stop using the Services and close your account at any time. We may suspend or terminate your access, in whole or in part, if: you materially breach these Terms; you fail to pay fees when due; we reasonably believe your use is unlawful, unauthorized, or poses a security or legal risk; or we are required to by law. Where practicable and lawful, we will give notice and an opportunity to cure.

On termination, your right to use the Services ends. For thirty (30) days after termination, we will make your Customer Content available for export. We will then delete Customer Content within ninety (90) days after termination, except aggregated or de-identified data, data we are required by law to keep, and copies in routine backups, which are overwritten on their normal cycle. Provisions that by their nature should survive, including §§8, 11, 13–16, 19, and 21, survive termination.

18Changes to the Services and to these Terms

We may modify, add, or discontinue features of the Services at any time. We may also update these Terms; when we make material changes, we will provide reasonable notice, for example by posting the updated Terms with a new effective date or notifying you in-product or by email. Changes are not retroactive. Your continued use of the Services after changes take effect constitutes acceptance; if you do not agree, you must stop using the Services.

19Governing law & dispute resolution

The governing law and forum depend on where you are located. Before starting any court proceeding (other than for urgent injunctive relief or to collect unpaid fees), each party will first try in good faith to resolve the dispute through discussion for thirty (30) days after written notice of the dispute.

Customers in South Africa

If your billing address or place of establishment is in South Africa, these Terms are governed by the laws of the Republic of South Africa, without regard to conflict-of-laws rules, and you and we submit to the exclusive jurisdiction of the courts of South Africa, subject to any non-waivable right you have to bring proceedings in your local courts.

All other customers

For all other customers, these Terms are governed by the laws of the State of North Carolina and the applicable federal laws of the United States, without regard to conflict-of-laws rules, and you and we submit to the exclusive jurisdiction of the state courts located in Wake County, North Carolina, and the United States District Court for the Eastern District of North Carolina.

The United Nations Convention on Contracts for the International Sale of Goods does not apply. Nothing in this section deprives a consumer of the protection of mandatory provisions of the law of their country of residence.

20Export controls & sanctions

You must comply with all applicable export-control and economic-sanctions laws. You represent that you are not located in, and will not use the Services in or for the benefit of, any country or party subject to comprehensive sanctions or embargo, and that you are not a restricted or denied party. You will not use the Services for any purpose prohibited by such laws.

21General

• Entire agreement. These Terms, together with the Privacy Policy and any order form or DPA, are the entire agreement between you and us regarding the Services and supersede prior agreements on the subject.
• Order of precedence. If there is a conflict, a signed order form or master agreement prevails over these Terms, which prevail over other in-product materials, except where a mandatory law provides otherwise.
• Severability. If any provision is held unenforceable, the rest remain in effect and the provision is modified to the minimum extent necessary.
• No waiver. A failure to enforce a provision is not a waiver of it.
• Assignment. You may not assign these Terms without our consent; we may assign them to an affiliate or in connection with a merger, acquisition, or sale of assets.
• Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control.
• Notices. We may give notice by email or in-product; you give notice to us at the address in §22.
• Relationship. The parties are independent contractors; these Terms create no partnership, agency, or employment relationship.
• Public-sector customers. If you are a US federal, state, or local government entity: (a) any provision requiring you to indemnify us, to accept a governing law or forum other than your own, or to waive immunity applies only to the extent permitted by the law that governs you; (b) our confidentiality rights are subject to applicable public-records laws; (c) renewal of any paid subscription is subject to the availability of appropriated funds; and (d) where you purchase through a statewide, cooperative, or other public contract vehicle or a signed order, those terms prevail over these Terms to the extent of any conflict.

22Contact us

Questions about these Terms or the Services can be sent to us at:

Cyber Alliance Consortium, LLC
711 Six Forks Rd, Raleigh, NC 27609, USA
legal@cyber-alliance.com · www.ca-sally.ai