Terms of Service

Trusvo is a product of Nimavera Inc. (in formation) — a business that is being formed and is not yet incorporated ("Trusvo", "we", "us", "our"). These Terms of Service ("Terms") form a binding agreement between you, or the organization you represent ("you", "Customer"), and Nimavera Inc. (in formation). By creating an account, clicking "I agree", accessing, or using the Service, you accept these Terms. If you are agreeing on behalf of an organization, you represent that you are authorized to bind it, and "you" refers to that organization. If you do not agree, do not use the Service.

These Terms incorporate by reference our Privacy Policy, Acceptable Use Policy, Cookie Policy, AI Disclosure, Subprocessors list, and — where we process personal data on your behalf — our Data Processing Addendum. The version and effective date of these Terms are shown at the top of this page.

1. Definitions

• Service — the Trusvo web application, APIs, agent/MCP endpoints, machine-readable surfaces (such as trust.json), and related tools we make available.
• Customer Content — the repositories, files, configurations, policies, questionnaires, connected sources, and other materials you upload to or connect with the Service.
• Evidence Graph — the structured set of evidence items the Service derives from your Customer Content.
• Generated Materials — evidence items, questionnaire answers, support statuses, confidence scores, gap registers, trust packs, attestations, and trust rooms the Service produces from Customer Content.
• Trust Room (or Trust Center) — a buyer-facing surface you choose to publish or share from your Generated Materials, in public, NDA-gated, or approval-gated mode.
• Support Status — the honesty label attached to an answer: SUPPORTED, PARTIAL, UNSUPPORTED, or UNKNOWN.
• Attestation — an Ed25519-signed trust.json payload the Service can emit so a third party can verify a snapshot is authentic and untampered.

2. The Service

Trusvo turns your real operational evidence into security-review materials you can share honestly. It ingests documents and configuration from your stack; builds an Evidence Graph; drafts answers to security questionnaires with citations, support statuses, and confidence scores; maintains a gap register; lets you publish gated Trust Rooms and respond to buyer requests; exposes agent/MCP endpoints for machine-readable review; re-verifies evidence over time; and can emit signed attestations. We may improve, change, add, or discontinue features. We will give reasonable advance notice of any material adverse change to a paid feature you rely on.

The Service is at a pre-launch stage and is developed and released gradually. Features may be added, changed, limited, labelled beta, preview, or experimental, or withdrawn as the product evolves. Beta or preview features may be less reliable, are provided for evaluation only, and carry no guarantee of continued availability. Except where the law provides otherwise, the Service is provided on a best-effort basis.

3. What Trusvo is not

Trusvo helps you describe your security posture accurately. It does not:

• provide legal, regulatory, or compliance advice;
• issue a certification, audit opinion, attestation of compliance, or any assurance report;
• guarantee any security, audit, procurement, or business outcome;
• replace an auditor, assessor, penetration tester, or your own security program.

Framework views (for example SOC 2, ISO 27001, CAIQ, or SIG mappings) are informational cross-references, not certifications or a statement that you meet a framework. Support statuses and confidence scores are computed aids, not warranties of fact. Generated Materials are drafts you must review. You are solely responsible for the accuracy, completeness, and appropriateness of anything you approve, export, send to a third party, or publish.

4. The honesty design and your obligation not to misrepresent

The Service is deliberately built not to over-claim: answers may cite only evidence you actually provided; answers lacking a valid citation have their confidence capped in code and are not marked as fully supported; externally observed signals are labeled as observations, never as proof of an internal control; and no machine-readable surface exposes more than the human-readable page shows. You agree not to defeat these safeguards or use the Service to state, imply, or publish a security posture your underlying evidence does not support. Misrepresenting your posture to a customer, auditor, or the public is a material breach of these Terms.

5. Accounts, eligibility, and security

You must provide accurate registration details and keep them current. You are responsible for all activity under your account and for your team members' and collaborators' use of the Service. You are responsible for safeguarding your credentials and for enabling appropriate access controls; we support and may require two-factor authentication, including for accounts with administrative or owner privileges. Notify us promptly at legal@trusvo.com of any suspected unauthorized access. The Service is for organizations and businesspeople; it is not directed to consumers or to children.

6. Plans, fees, billing, and cancellation

6.1 Plans

Trusvo offers a Free tier and paid Starter, Growth, and Scale plans, with the project, seat, questionnaire, re-verification, trust-document, and access-mode limits described in-product and on our pricing page. Limits bind to the project owner's plan: an invited editor consumes the owner's quota, not their own.

6.2 Billing

Paid plans are billed in advance on a recurring monthly basis through our payment processor, Stripe, Inc. By starting a paid plan you authorize us, acting through Stripe, to charge your payment method on file on each renewal until you cancel. We store only a customer identifier and subscription status — never your full card details. All fees are exclusive of taxes; you are responsible for any sales tax, VAT, or similar levy, which is added at checkout where required.

6.3 Price changes

We may change pricing prospectively. If you hold an active paid plan, we will give you at least thirty (30) days' notice by email or in-app before a price increase takes effect on your renewal. If you do not accept the new price, you may cancel before the next renewal.

6.4 Cancellation, plan changes, and refunds

You may cancel at any time from your billing settings or the Stripe customer portal. Cancellation takes effect at the end of the current billing period; you keep paid features until then, and your payment method is not charged again. Cancelling does not produce a refund or credit for the rest of that period.

Changing between paid plans takes effect immediately, on your existing subscription. Moving to a higher plan charges the prorated difference for the rest of the current period at once, and the higher plan applies only when that payment succeeds. Moving to a lower plan applies at once, and the unused time on your previous plan is credited to your next invoice — a credit against future charges, not a cash refund.

Except as set out in our Refund and Cancellation Policy or where mandatory law requires otherwise, fees already paid are non-refundable. Duplicate charges and charges caused by a processor or billing error will be refunded.

6.5 Best-effort service; rate limits

We operate the Service on a commercially reasonable best-effort basis and do not commit to any specific uptime or service-level guarantee except as separately agreed in writing with an enterprise customer. We apply rate limits and quotas to bound abuse and protect service quality; rate-limiting is not a defect and does not entitle you to a refund.

7. Customer Content and intellectual property

As between the parties, you retain all rights, title, and interest in your Customer Content and in the Generated Materials produced for you. You grant us a limited, worldwide, royalty-free license to host, store, process, transmit, and display that content solely to provide, secure, support, and improve the Service for you. We do not use your Customer Content or Generated Materials to train AI models — ours or a provider's. We retain all rights in the Service, including its software, models, prompts, mappings, and design. You may not copy, resell, sublicense, reverse-engineer (except to the extent that restriction is unenforceable by law), or build a competing product from the Service. Feedback you volunteer may be used by us without restriction or obligation.

8. Acceptable use

Your use of the Service is subject to our Acceptable Use Policy, which is incorporated into these Terms. In summary, you must not use the Service to misrepresent your security posture; upload content you lack the rights to or that is unlawful; access other tenants' data or probe, bypass, or disrupt the Service; upload malware or secrets belonging to others; or exceed documented rate limits or evade plan gating. We may investigate suspected violations and take action, including content removal, suspension, or termination.

9. AI-generated content

Parts of the Service use large language models; configuration is parsed by deterministic, non-AI parsers. AI output can contain errors, omissions, or mischaracterizations. Support statuses and confidence scores are computed aids, not guarantees. Every generated answer carries a review status and must be reviewed and approved by a person before it is exported, shared, or published. Our AI Disclosure describes where AI is used, the over-claim clamps, human-oversight requirement, and data handling.

10. Trust Rooms and published materials

You control what you publish and to whom. A Trust Room exposes only the Generated Materials and documents you explicitly add and the access mode you select (public, NDA-gated, or approval-gated) — never your raw uploaded sources. You are responsible for the content you publish, for any confidentiality or NDA terms you set, and for honoring access you grant or revoke. Visitor information captured through a Trust Room (names, work emails, questions, NDA acceptances) is Customer Content you control and must handle lawfully. Attestations you emit are signed snapshots as of their timestamp and do not represent a continuing warranty.

11. Third-party services and subprocessors

The Service relies on subprocessors for hosting, object storage, AI inference, email, payments, and monitoring — see the Subprocessors page for the current role-based list. Where you supply your own LLM API key, that provider's terms govern that processing and AI features are disabled without a configured key. We are not responsible for third-party services we do not control.

12. Confidentiality

Each party may receive confidential information of the other. The receiving party will protect it with at least reasonable care, use it only to perform under these Terms, and disclose it only to personnel and subprocessors who need it and are bound by confidentiality. This does not apply to information that is or becomes public without breach, was already known, is independently developed, or is lawfully received from a third party without a duty of confidentiality, or to disclosures required by law (with notice where permitted).

13. Warranties and disclaimers

Except as expressly stated in these Terms, the Service and all Generated Materials are provided "as is" and "as available" without warranties of any kind, whether express, implied, or statutory, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. We do not warrant that the Service will be uninterrupted, timely, secure, or error-free, or that any Generated Material, support status, confidence score, or framework mapping will be accurate, complete, or fit for your purpose.

14. Limitation of liability

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, goodwill, or business, arising out of or relating to the Service, even if advised of the possibility. Our total aggregate liability arising out of or relating to the Service will not exceed the greater of (a) the fees you paid us in the twelve (12) months before the event giving rise to the claim, or (b) US$100. These limits apply even if a limited remedy fails of its essential purpose. Nothing here limits liability that cannot be limited by law.

15. Indemnification

You will defend, indemnify, and hold us harmless against third-party claims, damages, and reasonable costs arising from your Customer Content, your published materials or attestations, your misrepresentation of your security posture, or your breach of these Terms or the Acceptable Use Policy, except to the extent caused by our own violation of law.

16. Term, suspension, and termination

These Terms apply for as long as you use the Service. You may stop at any time and delete your account and projects. We may suspend or terminate access for material breach, non-payment, legal requirement, or a genuine risk to the Service or others, with notice where practicable and — where reasonable — an opportunity to cure. On termination, your right to use the Service ends; we will make Customer Content available for export for a reasonable period and then delete it as described in the Privacy Policy. Provisions that by their nature survive (ownership, confidentiality, disclaimers, liability limits, indemnity, governing law) continue after termination.

17. Changes to these Terms

We may update these Terms. Material changes will be announced in-app or by email and take effect on the stated effective date; continued use after that date is acceptance. If you do not agree to a change, stop using the Service before it takes effect.

18. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws rules. The state and federal courts located in New Castle County, Delaware have exclusive jurisdiction, and both parties consent to venue there, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information. If you are a business in the EEA or UK, nothing here deprives you of the protection of any mandatory law of your place of establishment.

19. General

Severability — if any provision is held unenforceable, it is enforced to the maximum extent permissible and severed, and the rest remains in effect. Entire agreement — these Terms and the documents they incorporate are the entire agreement on their subject and supersede prior understandings. No waiver — failure to enforce a right is not a waiver. Assignment — you may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets. Force majeure — neither party is liable for delay or failure caused by events beyond its reasonable control, including provider or infrastructure outages.

20. Contact

Questions about these Terms: legal@trusvo.com. Nimavera Inc. (in formation), United States. A postal address for service of notice is available on request at legal@trusvo.com.

Pre-launch template texts describing how Trusvo actually works. Not legal advice — have counsel review before relying on them.