Terms of Service

CyberTwin produces architecture recommendations based on the inputs you provide and our curated catalog. The output is informational, not professional advice. We work hard to keep prices and configurations current, but you remain responsible for verifying products and prices with vendors, configuring controls in your environment, and performing the actual security work. Following a CyberTwin recommendation does not transfer liability for security outcomes from you to us.

• You are responsible for activity under your account and for keeping credentials safe.
• Every paid tier includes unlimited environments; abuse (e.g., one org operating multiple unrelated companies) is grounds for migration to a higher tier or Enterprise pricing.
• We reserve the right to suspend accounts engaged in clearly hostile activity (credential testing, harassing our support team, evading payment).

• Fees are listed at /pricing. Assess and Operate may be billed monthly or annually (annual saves $1,188 on Assess and $3,588 on Operate versus 12 months of monthly); Program is annual-only; Enterprise is contracted per order form.
• Enterprise tier is contracted on a custom basis with sales-assisted onboarding and a contracted SLA.
• Failed payments suspend access after 14 days. Reactivation restores data unless deletion has run (see Privacy).
• Cancellation: cancel anytime. Monthly plans end at the next billing cycle; annual plans end at term completion. No partial refunds and no proration. After cancellation, the account is read-only for 90 days so you can export data; data is retained for another 90 days for re-activation; deleted permanently after 180 days.

• Do not use the API to mirror, resell, or compete with the catalog itself.
• Do not attempt to extract our control libraries or playbook content for redistribution outside your organization.
• Do not introduce malicious payloads in document uploads. Parsing runs server-side under strict size limits, uploaded content is never executed, and configuration exports are secret-redacted by default before storage — but you remain responsible for what you upload.

• You confirm that you, your organization, and everyone who uses CyberTwin under your account are not named on a sanctions list kept by the United Nations, the United States (including the OFAC Specially Designated Nationals list), the European Union or the United Kingdom, and are not owned or controlled by anyone who is.
• You will not use CyberTwin, or let anyone use it, from a country or region under country-wide sanctions or an embargo, or for the benefit of a person or organization located there.
• CyberTwin, its outputs and its documentation may be subject to export-control laws. You will not export, re-export or transfer them in breach of those laws, or for an end use or to an end user those laws prohibit. We have not published an export classification for CyberTwin.
• Self-serve payments are taken by Polar, our merchant of record, which applies its own sanctions restrictions to payments. Polar publishes the countries it does not accept payments from at polar.sh/docs/merchant-of-record/supported-countries.
• If we learn that an account breaks this section, we may suspend or close it immediately.

The catalog, framework mappings, playbooks, and decision-engine logic are CyberTwin's. Your environment data is yours. Output documents you generate are yours to use internally and to share with auditors, regulators, insurers, and your board, including in PDF form.

Assess, Operate, and Program: best-effort, target 99.5% monthly uptime on the web app, as published at /sla. Service credits, a dedicated success manager, and a contractually-penalized SLA are Enterprise-only, per the order form.

We provide the service on an “as is” basis. We do not warrant that the service will be uninterrupted, that catalog prices are perfectly current at all times, or that following a recommendation will prevent any specific security incident. Configuration changes, commands and remediation steps CyberTwin suggests are yours to review, test and apply; CyberTwin does not apply them to your systems. To the maximum extent permitted by law, we disclaim implied warranties.

Our aggregate liability is capped at the fees you paid in the 12 months preceding the claim, except for fraud, willful misconduct, breach of confidentiality, or amounts owed under our infringement indemnity. Indirect, incidental, and consequential damages are excluded.

Either party may terminate with notice at the end of a billing period. We may suspend or terminate immediately for material breach (e.g., violations of acceptable use). On termination your environment data follows the same timeline as cancellation — read-only and exportable for 90 days, then deleted after 180 days total — except where we are legally required to retain it longer.

Governed by the laws of the State of Delaware, USA, without regard to conflicts principles. Disputes go to state or federal court in Delaware unless required otherwise by your local law.

We update these terms when our practices change. Material changes are emailed to org Owners with at least 30 days notice.

The legal name and registered address of the company that provides CyberTwin are not published yet. They will be added to the Terms of Service, the Data Processing Addendum and the Privacy Policy when they are. Until then, write to legal@cybertwin.io before you sign an order form or a DPA, and we will confirm the contracting party in writing.

legal@cybertwin.io