Hardenwell GRC

Terms of Service

Last updated: October 16, 2026

Hardenwell GRC is owned and operated by Hardenwell Cybersecurity Advisors LLC. These terms are an agreement between Hardenwell Cybersecurity Advisors LLC ("we", "us") and the organization that creates or uses a Hardenwell GRC workspace ("you"), covering the Hardenwell GRC website and application at https://app.hardenwell.com (the "Service"). By creating an account, joining a workspace or using the Service, you accept these terms. If you accept them for an organization, you confirm that you are authorized to do so. If you have a separate signed agreement with us, that agreement controls where it differs from these terms.

1. The Service

Hardenwell GRC helps IT and security consultants and the organizations they serve run security and compliance programs: assessments, evidence, policies and documents, risks, vendors, assets, connected-tool checks, plans and reports. We may improve, change or retire features over time; we will not materially reduce the core features of a paid plan during the period you have paid for.

The Service is for business use. You must be at least 18 years old to use it.

2. Accounts and sign-in

  • Keep your sign-in details secure and do not share accounts. Each person needs their own account.
  • Two-step sign-in may be required by your workspace or by us.
  • You are responsible for what happens under your account and your workspace, and you must tell us promptly at admin@hardenwell.com if you believe an account has been compromised.

3. Workspaces, clients and roles

A workspace belongs to the organization that created it. Its owners decide who can join, which roles they have, and which clients they can see. Consultants may invite people from their clients; those people see only their own organization's information. You are responsible for the people you invite and for the access you give them.

4. Your content

  • You own your content — everything you and your users put into the Service or collect into it through connected tools ("Your Content").
  • You give us permission to host, copy, process and display Your Content only as needed to provide, secure and support the Service, and as you direct (for example, when you publish a trust center page or share a link).
  • You confirm that you have the rights and permissions needed for Your Content — including, when you work for a client, the client's authorization to assess its systems, connect its tools and store its information.
  • We do not sell Your Content or use it for advertising.

5. Patient information and business associate agreements

Do not put protected health information (PHI) or other patient information into the Service unless your organization has signed a business associate agreement (BAA) with us. If you are a covered entity or business associate under HIPAA, you remain responsible for your own HIPAA compliance, including deciding what information you share with the Service.

6. Connected tools and third-party services

When you connect a tool, you authorize us to use the access you (or your client's administrator) grant to read the settings and summary information described in our Privacy Policy. Connected tools, Microsoft, Google, Stripe and other third-party services are governed by their own terms, and we are not responsible for them. You can disconnect a tool at any time.

7. AI features

Some features use artificial intelligence to suggest answers, maturity levels, document text, findings and summaries. AI output can be incomplete or wrong. Suggestions are not applied until a person accepts them, and you are responsible for reviewing anything before you rely on it or share it. Workspace administrators can turn AI features off.

8. No legal advice or certification

Hardenwell GRC provides tools, guidance and content to support security and compliance work. It does not provide legal advice, and using it does not certify or guarantee compliance with HIPAA, NIST, SOC 2, ISO 27001, CMMC or any other law, framework or standard. Framework mappings, scores and maturity ratings are aids to your professional judgment. Decisions about your security program — and statements you make to clients, auditors, insurers or regulators — are your responsibility. Framework names are trademarks of their owners and are used for identification only.

9. Acceptable use

You will not, and will not let others:

  • use the Service in violation of law or the rights of others;
  • scan, test or connect to systems you are not authorized to assess;
  • upload malware or content you have no right to share;
  • try to get around security, access other customers' data, or probe the Service for vulnerabilities without our written permission;
  • overload the Service, scrape it, or use it to build a competing product;
  • resell or provide the Service to third parties except as part of your own services to your clients.

We may suspend access that threatens the security or stability of the Service or violates these terms, and will tell you why unless we are not allowed to.

10. Plans, fees and payment

  • Paid plans are billed in advance, monthly or yearly, through Stripe, and renew automatically until cancelled. Prices do not include taxes, which you are responsible for.
  • We may change prices for future billing periods with at least 30 days' notice.
  • If a payment fails, we may limit the workspace to read-only or suspend it after notice.
  • Fees are not refundable for partial periods, except where the law requires otherwise.
  • Free or trial plans may have limits and may be changed or ended.

11. Cancellation, termination and your data

  • You can cancel at any time from Plan & billing; your plan stays active until the end of the period you have paid for.
  • We may end these terms or suspend a workspace if you materially breach them and do not fix the breach within 15 days of notice (or immediately for serious security or legal reasons).
  • Before cancelling, download the documents and reports you want to keep. A workspace owner can delete the workspace at any time, which permanently deletes its content; after that it cannot be recovered.

12. Security and confidentiality

We use reasonable administrative, technical and physical safeguards to protect Your Content, described in our Privacy Policy, and we will notify you of a security incident affecting Your Content as required by law. Each of us will keep the other's non-public information confidential and use it only for the purposes of this agreement.

13. Feedback

If you send us ideas or suggestions, we may use them without obligation to you.

14. Disclaimers

Except as expressly stated in these terms, the Service is provided "as is" and "as available". To the fullest extent the law allows, we disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement, and we do not promise that the Service will be uninterrupted or error-free, or that it will prevent every security incident.

15. Limitation of liability

To the fullest extent the law allows: neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data; and each party's total liability arising from these terms or the Service is limited to the amounts you paid us for the Service in the 12 months before the event giving rise to the claim. These limits do not apply to your payment obligations, to a party's breach of confidentiality, or to liability that cannot be limited by law.

16. Indemnity

You will defend and indemnify us against third-party claims arising from Your Content, your use of connected tools without proper authorization, or your violation of these terms or the law.

17. Changes to these terms

We may update these terms. If a change is material, we will tell workspace owners by email or in the Service at least 30 days before it takes effect. Continuing to use the Service after that means you accept the updated terms.

18. General

These terms are governed by the laws of the state in which Hardenwell Cybersecurity Advisors LLC has its principal place of business, without regard to conflict-of-law rules. If any part is found unenforceable, the rest stays in effect. You may not transfer these terms without our consent, except to a successor of your business. Neither party is responsible for delays caused by events beyond its reasonable control.

19. Contact

Questions about these terms: admin@hardenwell.com