Terms of Service

These Terms of Service (the “Terms”) govern your access to and use of the websites, mobile applications, and services (collectively, the “Service”) provided by Libero.io, Inc., a Delaware corporation, with offices in California, doing business as Libero (collectively referred to as “the Company”, “We”, “Us”, or “Our”). The Service includes our website at libero.io (the “Website”) and our governance, risk and compliance software platform (the “Platform”), which Part B covers.

If you use the Services on behalf of a company or other organization, “you” and “Customer” mean that organization, and you confirm that you have authority to bind it. The Services are built for business use. They are not offered to consumers or to anyone under 18.

By accessing the Website or using the Platform, you agree to these Terms. If you do not agree, do not use the Services.

Part A — Terms that apply to everyone

1. How these Terms fit with other agreements

Most customers sign a Master Services Agreement, Order Form or similar agreement with Libero (a “Customer Agreement”). If you have one, it controls the Platform and prevails over these Terms where they conflict. Part A still governs your use of the Website. Our Data Processing Addendum (“DPA”) governs our processing of personal data on a customer’s behalf and prevails over these Terms on that subject.

Our Privacy Policy, available at libero.io/privacy, explains how we handle personal data when we act for ourselves, such as when you browse the Website or contact us.

2. Changes to these Terms

We may update these Terms as the Services and the law change. We will post the updated Terms with a new “Last updated” date. For material changes that affect Platform customers, we will give at least 30 days’ notice by email or in the Platform before the change takes effect. Changes do not apply retroactively, and a change never overrides a signed Customer Agreement. If you continue using the Services after a change takes effect, you accept it.

3. Using the Website

You may view and use the Website for your internal business purposes, including evaluating Libero. Content on the Website, including blog posts, guides and framework summaries, is general information only. It is not legal, audit, accounting or regulatory advice, and it may not reflect the latest version of any law, regulation or standard.

If you send us information through the Website (for example, a demo request or contact form), you confirm that it is accurate and that you have the right to share it.

4. Acceptable use

You may not, and may not help anyone else to:

1. Access or use the Services in violation of any law, regulation or third-party right, including export control and sanctions laws.

2. Probe, scan or test the vulnerability of the Services, or breach or bypass any security or authentication measure, except under a written security testing agreement with Libero or our responsible disclosure policy.

3. Attempt to access another customer’s data or tenant, or interfere with the isolation between tenants.

4. Disrupt, overload or impair the Services, including through denial-of-service attacks or automated traffic that exceeds reasonable use.

5. Scrape, crawl or harvest the Services or their content by automated means, except as permitted by our robots.txt file or a documented API.

6. Reverse engineer, decompile or attempt to derive the source code, models, prompts or underlying structure of the Services, except where applicable law expressly permits it despite this restriction.

7. Use the Services or their outputs to build a competing product, or benchmark the Services for publication without our written consent.

8. Upload malware, or content that is unlawful, infringing, defamatory or that you do not have the right to upload.

9. Use AI features to generate content that is unlawful or deceptive, to attempt to extract other customers’ data or our system instructions, or to circumvent the safeguards placed on those features.

10. Upload sensitive personal data (such as health, biometric or genetic data), payment card data or government identification numbers, unless your Customer Agreement expressly allows it.

11. Resell, sublicense or provide the Services to third parties except as your Customer Agreement allows.

We may suspend access that violates this Section or that poses an immediate security risk to the Services or other customers. We will give notice where we lawfully can, limit the suspension to what is needed, and restore access once the issue is resolved.

5. Our intellectual property

Libero and its licensors own the Services, including the software, the Libero Control Library, AI features, documentation, Website content, and our names and logos. These Terms grant you no rights except those stated expressly. All other rights are reserved.

6. Feedback

If you give us suggestions or feedback about the Services, we may use them without restriction or obligation to you. Feedback does not include your Customer Data or Confidential Information, and we will not identify you as its source without your consent.

7. Third-party services and links

The Services may link to, or integrate with, products and websites that we do not control, such as identity providers or ticketing tools. Your use of them is governed by their own terms and privacy policies. We are not responsible for them, and enabling an integration authorizes us to exchange data with it as you configure.

8. Disclaimers

Libero is a tool that helps your team manage governance, risk and compliance work. Using Libero does not by itself make any organization compliant with any law, regulation, framework or standard, and it does not replace the judgment of your own legal, compliance, audit and security professionals. You remain responsible for your compliance decisions, your control environment and what you submit to auditors and regulators.

To the fullest extent permitted by law, and except as stated in a Customer Agreement, the Services are provided “as is” and “as available.” We disclaim all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the Services will be uninterrupted or error-free, or that framework mappings, control suggestions or AI-generated outputs will be complete, current or accurate.

9. Limitation of liability

To the fullest extent permitted by law, and unless a Customer Agreement states otherwise:

1. Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data, even if advised of their possibility.

2. Each party’s total liability arising out of or relating to these Terms is limited to the greater of (a) the fees you paid to Libero for the Platform in the 12 months before the event giving rise to the claim, and (b) US $100.

3. These limits do not apply to your payment obligations, your breach of Section 4 (Acceptable use), either party’s indemnity obligations, or liability for fraud, gross negligence or willful misconduct. They do not limit liability that cannot be limited under applicable law.

10. Indemnity

You will defend and indemnify Libero against third-party claims arising from your Customer Data, your breach of Section 4, or your violation of law. Where you are a Platform customer without a Customer Agreement, Libero will defend and indemnify you against third-party claims that the Platform, as provided by us, infringes that party’s intellectual property rights. Each obligation requires prompt notice of the claim, control of the defense by the indemnifying party, and reasonable cooperation. The indemnifying party may not settle a claim in a way that admits fault by the other party without its consent.

11. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply. The state and federal courts located in New Castle County, Delaware have exclusive jurisdiction, and each party consents to them. Each party waives any right to a jury trial to the extent permitted by law. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

Before filing a claim, each party agrees to try to resolve the dispute informally for 30 days after written notice to the other.

12. General

These Terms, together with any Customer Agreement, the DPA and documents they reference, are the entire agreement on their subject. If a provision is unenforceable, it will be modified to the minimum extent needed, and the rest remains in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our consent, except to a successor of your entire business; we may assign them to an affiliate or a successor of our business. Neither party is liable for delays caused by events beyond its reasonable control. Notices to Libero go to legal@libero.io; notices to you go to the email address associated with your account. Sections that by their nature should survive termination will survive.

Part B — Platform terms

Part B applies when you use the Platform. If you have a Customer Agreement, it controls over Part B wherever the two differ, and Part B fills only the gaps it leaves.

13. Accounts and administrators

Customer designates one or more administrators who control user access, roles and settings. You are responsible for keeping credentials confidential, for using the security features available to you, and for all activity under your accounts. Tell us promptly at security@libero.io if you suspect unauthorized access.

14. Customer Data

“Customer Data” means all data that you or your users submit to the Platform, including policies, controls, risks, evidence, audit findings, vendor records, personal data, and the configurations you create. Customer owns its Customer Data. Customer Data is never Libero’s intellectual property.

You grant Libero a limited, worldwide, non-exclusive license to host, copy, process and display Customer Data only as needed to provide, secure and support the Platform for you, to prevent abuse, and as required by law. You are responsible for the accuracy of Customer Data and for having all rights, notices and consents needed to submit it.

15. Personal data

When Customer Data includes personal data, Customer is the controller (or, under US state laws, the “business”) and Libero is its processor (or “service provider”). Where Customer itself processes the data for its own clients, Libero acts as Customer’s sub-processor. Libero’s Data Processing Addendum (“DPA”), which we provide to each customer before any personal data is processed, applies and forms part of these Terms.

Libero processes that personal data only on Customer’s documented instructions, which are these Terms, the DPA and your configuration of the Platform. We do not sell it, share it for cross-context behavioral advertising, or use it for any purpose outside our direct business relationship with Customer.

16. AI features

The Platform includes features that use artificial intelligence to assist with compliance work (“AI Features”). When you interact with an AI Feature, the Platform tells you so, and AI-generated content is labeled.

1. No training on your data. Neither Libero nor its AI model providers use your Customer Data, prompts or outputs to train or improve foundation models.

2. No cross-customer use. AI Features use your Customer Data only to serve your organization, never to generate outputs for another customer.

3. Human review. AI outputs can be inaccurate or incomplete. They are suggestions for qualified people to review, and you decide whether to rely on them. Administrators can turn AI Features off for their organization.

Customers under contract receive further detail on how AI Features are built and governed.

17. Usage Data

Libero collects technical and usage information about how the Platform performs and is used (“Usage Data”). Libero may also create aggregated, de-identified data from use of the Platform that does not identify you, your users or any individual (“Aggregated Data”). We use Usage Data and Aggregated Data to operate, secure, support and improve the Services. We will not disclose Usage Data that identifies you or your users to third parties, other than our service providers, without your consent.

18. Security

Libero maintains administrative, technical and physical safeguards designed to protect Customer Data, appropriate to its sensitivity. Customers under contract receive our security documentation, including details of these safeguards and any third-party audit reports, subject to confidentiality. We will notify affected customers of a confirmed security breach involving their Customer Data without undue delay, as described in the DPA.

19. Availability and support

Service levels, support hours and response times are set out in your Order Form. Without an Order Form, we provide the Platform on a commercially reasonable basis with no service level commitment. We schedule maintenance to minimize disruption and give advance notice of planned downtime where practical.

20. Fees and taxes

Fees, billing periods and payment terms are stated in your Order Form. Unless it says otherwise, invoices are due within 30 days, fees are non-refundable except as these Terms or the Order Form state, and fees exclude taxes, which you are responsible for (other than taxes on Libero’s income). We may suspend access for undisputed amounts more than 30 days overdue after 10 days’ written notice.

21. Trials and beta features

We may offer free trials, proofs of concept or features labeled beta or preview. They are provided “as is,” may change or end at any time, and are excluded from any service levels and indemnities. Section 9’s cap for these is US $100, to the extent permitted by law. Data from a trial is deleted 30 days after it ends unless you convert to a paid subscription.

22. Term and termination

Your subscription runs for the term in your Order Form. Either party may terminate for the other’s material breach if it is not cured within 30 days of written notice. On termination, your right to use the Platform ends, except for the data export period below.

23. Data export and deletion

You can export your Customer Data at any time during your subscription in a standard machine-readable format. Customer Data remains available for export for 90 days after your subscription ends, and we will provide reasonable assistance on request.

When that 90-day period ends, we delete Customer Data from the active Platform. Copies in backups are deleted on our standard backup cycle. We may keep records we must retain by law, such as invoices. Deletion includes the audit trail records that form part of your Customer Data. If you ask us in writing to delete your Customer Data before the 90-day period ends, we will do so.

24. Confidentiality

“Confidential Information” means non-public information that one party discloses to the other and that is marked confidential or should reasonably be understood to be confidential. Customer Data is Customer’s Confidential Information. The receiving party will use it only to perform under these Terms, protect it with at least reasonable care, and share it only with personnel and service providers who need it and are bound by similar obligations. These duties do not cover information that is public through no fault of the receiving party, already known to it, independently developed, or rightfully received from a third party. A party may disclose Confidential Information when legally required, after giving the other party prompt notice where lawful.

25. Export controls and government users

You will not use or permit access to the Services from a country or by a person subject to US sanctions, or in violation of export control laws. If you are a US government entity, the Platform is commercial computer software provided with only the rights granted to all other customers.

26. Contact

Questions about these Terms: legal@libero.io.