Terms of Service

These terms govern use of PostureIQ, operated by Gold Tree Group LLC ("we", "us"), 2044 Lovell Pl, Santa Clara, CA 95051.

By creating an account or using PostureIQ, you agree to these terms. If you are agreeing on behalf of an organisation, you confirm you have authority to bind it, and "you" means that organisation.

Where a signed subscription agreement exists between us, that agreement governs and these terms apply only where it is silent.

The service#

PostureIQ is a platform for security posture assessment, third-party risk management and external attack surface analysis. We provide it on a subscription basis according to the plan you select.

We may change, add or remove features. If a change materially reduces a core function of the service, we will give you 30 days' notice by email to your account administrators.

Your account#

You are responsible for your account credentials and for activity under your account. You must tell us promptly at support@postureiq.io if you believe an account has been compromised.

You are responsible for your users' use of the service and for ensuring they comply with these terms.

Your data#

You own the data you put into PostureIQ. We claim no rights to it beyond what is needed to provide the service.

We process your data as described in our Privacy Notice and, where applicable, our Data Processing Agreement.

Accuracy. You are responsible for the accuracy of the data you enter, including vendor contact details. You confirm you have a lawful basis to provide us with personal data about your staff and your vendors' staff.

Export and deletion. You may export your data from the platform at any time. On termination we delete your data 90 days after account closure, as described in the Privacy Notice.

Vendor questionnaires#

PostureIQ sends questionnaires to your vendors on your behalf, by email from a postureiq.io address. You are responsible for the vendors you invite and the content you send them. We are not a party to your relationship with your vendors.

Attack surface scanning#

PostureIQ's scanning features probe systems over the public internet. You may only scan systems you own or are authorised to scan. Scanning without authorisation may be unlawful.

You confirm you have authorisation for every target you add, and you indemnify us against claims arising from scans you initiate. We may suspend scanning if we believe a target is not authorised.

AI-generated content#

PostureIQ uses AI to analyse documents, draft reports and suggest answers. AI output can be wrong, incomplete, or influenced by the content it analyses, including content supplied by a vendor being assessed.

AI output is a starting point, not a professional judgment. You are responsible for reviewing it before relying on it or sharing it. Nothing PostureIQ produces is legal, compliance or professional advice, and we do not warrant that any assessment, score or report is accurate or complete.

Security data sources#

PostureIQ queries third-party sources including sanctions lists, breach databases and threat intelligence feeds. Those sources are maintained by others and may be incomplete, out of date, or temporarily unavailable.

A clear screening result is not a guarantee. Where a source cannot be reached, PostureIQ marks the result as unverified rather than clear. You should not treat any screening result as a substitute for your own due diligence.

Acceptable use#

You may not use PostureIQ to break the law, scan systems you are not authorised to scan, attempt to access another customer's data, interfere with the service, reverse engineer it, or resell access without our agreement.

We may suspend access if we reasonably believe this section is being breached. We will tell you why and, where practical, give you an opportunity to fix it first.

Fees#

Fees are as set out in your plan or signed agreement. Subscriptions renew automatically unless cancelled before the renewal date. Fees are non-refundable except where required by law.

We may change prices with 30 days' notice before a renewal.

Availability#

We aim to keep PostureIQ available but do not commit to a specific uptime unless a signed agreement says otherwise. We may take the service down for maintenance, and will give notice where we reasonably can.

Termination#

You may cancel at any time; your subscription runs to the end of the paid period.

We may terminate for material breach, if you do not pay, or on 30 days' notice. If we terminate without cause, we will refund the unused portion of any prepaid fees.

On termination you lose access to the platform. Export your data before the account closes.

Warranties#

PostureIQ is provided "as is". To the maximum extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.

We do not warrant that the service will be uninterrupted or error-free, that assessments or scores are accurate, or that screening results are complete.

Liability#

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special or consequential damages, or for lost profits or data, even if advised of the possibility.

Our total liability for any claim is limited to the fees you paid in the 12 months before the claim arose.

These limits do not apply to your obligation to pay fees, to either party's indemnities, or to liability that cannot be limited by law.

Indemnity#

You will defend and indemnify us against claims arising from your use of the service in breach of these terms, from data you put into the platform, and from scans you initiate.

Confidentiality#

Each party will protect the other's confidential information with at least reasonable care and use it only to perform under these terms. This does not apply to information that is public, already known, independently developed, or required to be disclosed by law.

Changes to these terms#

We may update these terms. For material changes we will give 30 days' notice by email to account administrators. Continuing to use the service after that constitutes acceptance.

General#

Governing law. California law, excluding its conflict of law rules.

Disputes. The state and federal courts in Santa Clara County, California have exclusive jurisdiction.

Assignment. You may not assign these terms without our consent. We may assign them in connection with a merger or sale of the business.

Entire agreement. These terms, the Privacy Notice, and any signed subscription agreement are the entire agreement between us.

Severability. If any provision is unenforceable, the rest remains in effect.

Contact#

Gold Tree Group LLC
2044 Lovell Pl, Santa Clara, CA 95051
support@postureiq.io