Terms of Service

1. The Service

Boundera is a platform for FedRAMP evidence collection, Key Security Indicator (KSI) validation, findings management, and certification package assembly. The Service includes the Boundera software, our documentation, and this website.

The Service helps you collect and organize evidence. It does not provide legal advice, compliance guarantees, or authorization decisions.

2. Deployment Models

Boundera is available in two deployment models. These Terms apply to both, except where a section says otherwise.

• Boundera Cloud. A hosted service operated by Boundera. We host the software and store your data to provide the Service.
• Boundera Self-Hosted. Software you install in your own cloud account, for example through AWS Marketplace. The software runs inside your environment. Boundera has no access to your environment, your production data, or the evidence the software processes. You are responsible for securing the environment where you run it.

Purchases made through AWS Marketplace are billed by AWS and are also subject to the AWS Marketplace terms that apply to your AWS account.

3. Signed Agreements Take Precedence

If your organization has a signed agreement with Boundera, such as a cover page, order form, or evaluation agreement, that agreement governs your use of the Service and takes precedence over these Terms wherever they conflict. These Terms apply to everyone else, including website visitors, trial users, and self-service customers.

4. Accounts and Users

You must provide accurate information when you create an account. You are responsible for the actions of the users you allow onto your account and for their compliance with these Terms.

Keep your login credentials confidential. Tell us promptly at security@boundera.io if you learn that an account or credential has been compromised.

5. License and Restrictions

We grant you a limited, non-exclusive, non-transferable right to use the Service for your own business purposes during your subscription. For self-hosted deployments, this includes the right to run the software we supply inside your own environment.

You will not:

• Sell, sublicense, rent, or distribute the Service, or use it to provide a hosted or managed service to others
• Reverse engineer or attempt to access the source code of the Service, except where the law permits it despite this restriction
• Copy, modify, or create derivative works of the Service, or remove proprietary notices
• Interfere with the Service, circumvent its access restrictions or license controls, or run security tests against Boundera Cloud without our written approval
• Use the Service to build a competing product

6. Customer Data

You own your data. Data you submit to the Service, including cloud configuration metadata, security findings, evidence artifacts, and documents, remains yours.

• In Boundera Cloud, we access and use your data only to provide, maintain, and support the Service. We do not disclose it to third parties except as described in these Terms or our Privacy Policy.
• In self-hosted deployments, your data stays inside your environment. Boundera does not receive it.
• We may collect technical usage data about how the Service operates and use it to run, secure, and improve the Service. We do not share usage data externally unless it is de-identified and aggregated.

You are responsible for the content and accuracy of the data you submit, and you confirm you have the rights needed to use it with the Service. Do not submit regulated health data, payment card data, or similar special categories of personal data unless we have agreed to it in writing.

7. Integrations and Third-Party Platforms

You may connect the Service to third-party platforms, such as cloud providers, identity providers, code hosting, ticketing systems, and security scanners, using credentials you configure.

• You authorize the Service to access those platforms with the credentials you provide, and you confirm you are permitted to grant that access.
• Use least-privilege, read-only credentials where our documentation supports them.
• Your use of a third-party platform is governed by your agreement with its provider, not by these Terms. Boundera is not responsible for third-party platforms or for how their providers use your data.

8. AI Features

Some optional features, such as remediation suggestions and policy drafting, use large language models. Core validation is rule-based and makes no AI calls. Where the prompts go depends on your deployment:

• In Boundera Cloud, prompts are processed by third-party AI model providers acting on our behalf.
• In self-hosted deployments, you configure the AI provider yourself, such as Amazon Bedrock in your own AWS account or model provider API keys you supply. Prompts go directly from your environment to the provider you chose, under your own agreement with that provider. Boundera never receives them.

In both models:

• You may disable the AI features at any time.
• Boundera will not use your data to train or improve any AI model.
• AI output is informational only. Review it before you rely on it.

9. No Compliance Guarantee

The Service evaluates what can be observed through automation and the evidence available to it. A passing result means a specific requirement is satisfied based on the evaluated evidence, not that your system is "FedRAMP compliant" or authorized.

Use of the Service does not guarantee:

• FedRAMP authorization
• Approval by a Third-Party Assessment Organization (3PAO)
• Acceptance by any federal agency

Authorization decisions remain the responsibility of the appropriate federal authorities. You are responsible for deciding whether the Service's outputs fit your authorization and risk decisions.

10. Acceptable Use

You agree not to:

• Use the Service to misrepresent your security posture
• Alter or selectively present results in a misleading manner
• Claim certification, authorization, or endorsement based solely on Service output
• Use the Service in violation of applicable law
• Use the Service for activities where failure could lead to death, personal injury, or environmental damage

11. Trials, Evaluations, and Betas

We may offer free trials, evaluations, and beta features. They are provided "as is", with no warranty, indemnity, service level, or support commitment, and either party may end them at any time. Beta features may be incomplete or may never be released. Our total liability for trials and betas will not exceed US$1,000.

12. Fees and Payment

Paid subscriptions are described in your order or in the AWS Marketplace listing through which you purchase. Marketplace purchases are billed by AWS. Fees are non-refundable except where your agreement or the law says otherwise, and they exclude taxes, which are your responsibility.

13. Intellectual Property and Feedback

Boundera and its licensors retain all rights in the Service, the software, and related technology. You retain all rights in your data. If you give us feedback, we may use it without restriction or obligation, and we will not publicly identify you as its source without your permission.

14. Term, Suspension, and Termination

These Terms apply while you use the Service. We may suspend access if your account is materially overdue, if you breach these Terms, or if your use risks material harm to the Service or others. Where practical, we will give you notice first so you can resolve the issue.

• You may export your data from Boundera Cloud during your subscription.
• After termination or expiration, we will delete your Boundera Cloud data within 60 days of your request, except for backups kept under our standard retention practices or as required by law.
• For self-hosted deployments, your data is already in your environment and stays there.

15. Indemnification

Boundera will defend you against third-party claims that the Service, used as authorized under these Terms, infringes their intellectual property rights, and will pay the damages or settlements that result. This does not apply to claims arising from modifications, unauthorized use, or combining the Service with items we did not provide. This section is your exclusive remedy for third-party intellectual property claims about the Service.

You will defend Boundera against third-party claims arising from your data or from your breach of Section 6 (Customer Data) or Section 10 (Acceptable Use), and will pay the damages or settlements that result. The party seeking protection must give the other prompt notice, control of the defense, and reasonable cooperation.

16. Disclaimer of Warranties

Except as expressly stated in a signed agreement, the Service is provided "as is" and Boundera disclaims all warranties, whether express, implied, statutory, or otherwise, including warranties of merchantability, fitness for a particular purpose, title, and noninfringement. These disclaimers apply to the full extent permitted by law.

17. Limitation of Liability

To the fullest extent permitted by law, neither party will be liable for indirect, special, incidental, or consequential damages, or for loss of use, lost profits, or interruption of business, even if informed such damages were possible.

Each party's total liability arising out of or related to these Terms will not exceed the amounts you paid to Boundera for the Service in the 12 months before the first incident giving rise to liability, or US$100 if you have paid nothing. These limits do not apply to liabilities that cannot be limited by law.

18. Export and Government Use

Each party will comply with applicable export and import laws. You represent that you are not on any U.S. government list of prohibited or restricted parties and not located in a country subject to a U.S. government embargo. Do not submit data controlled under the U.S. International Traffic in Arms Regulations to Boundera Cloud.

The Service is "commercial computer software" and a "commercial item" for purposes of FAR 12.212 and DFARS 227.7202. Government use, reproduction, and disclosure are governed solely by these Terms or your signed agreement with Boundera.

19. Governing Law

These Terms are governed by the laws of the State of Texas, without reference to conflict of law rules. The state and federal courts located in Texas have exclusive jurisdiction over any dispute arising out of these Terms, and both parties consent to venue there.

20. Changes to These Terms

We may update these Terms from time to time. Updates will be posted on this page with a revised "Last updated" date. Changes are not retroactive and will not materially reduce our obligations during a paid subscription term. Your continued use of the Service after an update means you accept the updated Terms.

21. Contact

Boundera Inc., a Delaware corporation, 160 W Camino Real, Suite #996, Boca Raton, FL 33432. Questions and legal notices: legal@boundera.io.