Terms of Service

1. Who these terms cover

These terms are an agreement between CPRCyber and the organization or managed service provider (MSP) that opens an account ("you"). The person who creates the account accepts these terms on your behalf and confirms they are authorized to do so. When an MSP adds a client organization, the MSP accepts these terms for that client and is responsible for having the client's authority to do so.

2. What CPRCyber is, and what it is not

CPRCyber is a tool for your team's own internal communication, planning and preparation, and for tracking your incident response and compliance readiness. It works separately from your own systems so your team can still communicate during an incident.

• CPRCyber does not provide incident response services. CPRCyber staff do not investigate, triage, contain or recover from incidents for you, and are not your incident responders.
• You are responsible for incident triage, containment and recovery, using your own backup and recovery systems and solutions and any incident response providers you choose.
• Any support we provide, free or paid, covers using CPRCyber itself. It is not incident response, forensic, legal or recovery assistance.

Reporting a problem with CPRCyber itself (a bug, an outage, a billing or account problem, or a security concern) is free:

• If CPRCyber has an outage or a problem affecting customers, we will tell affected customers when it happens, with an estimated time to resolution, and update them until it is resolved.
• If a bug or outage affects only your organization or MSP account, we will respond and begin working on it within 24 hours of your report.

3. Your account and your people

• Everyone who signs in must use multi-factor authentication.
• Your admins decide who has access and what role each person has, and are responsible for keeping that list current.
• Tell us promptly if you believe an account has been misused.

4. Your data

You own the data you put into CPRCyber. We use it only to provide the service to you. We keep it separate from every other customer's data and record sensitive actions in your organization's audit log.

CPRCyber is built to hold the plans, contacts, messages and tracking that coordinate your response, not your most sensitive records. Do not store the following in CPRCyber:

• Government data, including Controlled Unclassified Information (CUI) and other data you receive or create under a government contract, and sensitive company data such as trade secrets or financial account numbers.
• Medical records or other patient data, including protected health information (PHI) under HIPAA. CPRCyber does not sign HIPAA business associate agreements in its current edition.

Describe such data by reference instead (for example, "the CUI file share" or "the EHR system"). You are responsible for what your users upload. Editions built to hold this kind of data may be offered in the future as an upgrade.

5. CPRCyber staff access

• CPRCyber staff cannot open your organization's data (incidents, alerts, contacts, files, chats and the rest). They can see only account records: the organization's name, type, status and add-ons.
• If you need help troubleshooting, one of your admins may give a CPRCyber staff member an account in your organization for that specific purpose. You choose the role, everything they do is recorded in your audit log, and you can remove the account at any time.
• CPRCyber staff can archive and delete accounts as described in section 7.

6. Texts, calls and email

You confirm that the people you send alerts to have agreed to receive them, by text, voice call or email, and that you will honor requests to stop. Recipients can reply STOP to any text to opt out.

7. Billing, missed payments, archive and deletion

Billing. Plans are billed in advance, either monthly or annually, on the 1st of the month. Your first invoice covers the days from when you subscribe to the next 1st (prorated) together with the period that starts then. A monthly plan is then billed on the 1st of each month, and an annual plan for the whole year on the 1st of the month it renews. Payment is taken automatically from the card or bank account you add; where we agree it, you pay by invoice instead, due 30 days after it is issued. MSPs are billed for at least 5 client organizations. Onboarding and support packages are billed when you buy them.

Price changes. We may change our standard prices. We email your billing contacts at least 30 days before a change reaches you, and the new price applies from your first renewal after that date (for an annual plan, when it next renews). A price we agreed with you individually stays until we agree a change with you.

Refunds and corrections. Fees are not refunded for part of a month or part of a billing period. You can cancel an annual plan at any time; it keeps working until the end of the year you paid for, and the remaining months are not refunded. Support package hours you have not used can be refunded within 30 days of purchase. We may give a credit at our discretion. If we correct an invoice, we do it with a credit note or a revised invoice; invoice numbers are never changed, and the corrected invoice shows when and why it was edited.

Users and usage. Each plan includes 25 users, meaning people who sign in; contacts and groups for alerts are unlimited. Additional users we agree with you are billed with your plan as a separate line, at the price we agree. Each plan includes a monthly number of alert messages (500 for Respond, 1,000 for Respond + Prepare), where one phone call or text message to one person is one message. Messages beyond that are billed per message, after the month they are sent, on a separate invoice; calls and texts sent during onboarding and account setup don't count. For an MSP, the included messages of its client organizations are pooled.

Default. Your account is in default when a payment has not been received by its due date. From that date, the account goes through these stages:

• Grace period (30 days from the due date). Everything keeps working. We notify your admins at the start of the grace period and again before it ends. Paying in full ends the default. If an incident is open in your account when the grace period ends, we wait until it is closed before archiving.
• Archive period (90 days). The account is archived. Your admins can still sign in to export your data and to pay the overdue balance, which restores the account. Alerts, calls, meetings and other sending are turned off, and nothing new can be added. We notify your admins when the archive period starts, 30 days before deletion and 7 days before deletion.
• Deletion. At the end of the archive period, once a CPRCyber administrator confirms it, the organization and all of its data are permanently deleted. Deletion cannot be undone, and neither you nor CPRCyber can recover deleted data. Copies in our backups are deleted as those backups expire, within 30 days. A record that the account existed and was deleted (its name and the date) is kept for our own records.

Exporting any records you need to keep (see section 8) before deletion is your responsibility.

If you cancel your subscription, everything keeps working until the end of the period you have paid for. When the subscription ends, the account is archived that day, and the same 90-day archive period applies before deletion unless you ask us to delete sooner. Subscribing again during the archive period restores it. If you tell us that your data is under a legal hold, or the law requires us to keep it, we will keep it for as long as that applies.

An MSP that stops paying affects the client organizations it manages. When an MSP account enters the archive period, we also notify the admins of its client organizations. Before the MSP account is deleted, its clients may move to their own accounts or to another MSP. A client that has not moved by then is archived and deleted on the same schedule.

8. Your records obligations

Some laws and frameworks (for example NIST SP 800-171 (CMMC 2.0), HIPAA or state breach-notification laws) require you to keep incident and compliance records for a set time. You remain responsible for keeping those records, and you can export them from CPRCyber at any time.

CPRCyber is a self-service tool for tracking your own readiness. It does not certify or guarantee compliance with any framework; that requires an official audit or an assessment by a certified assessor. CMMC certification is currently on hold (since July 13, 2026), while NIST SP 800-171 and DFARS 252.204-7012 still apply. We review CMMC's status every quarter and will update this note if it changes.

9. Changes to these terms

We will tell your admins before material changes take effect. The version you accepted is recorded with your account.