Terms of Service

PosturaIQ is a Microsoft 365 security posture assessment platform. It collects configuration evidence from a connected Microsoft tenant, evaluates that evidence against security controls, and presents findings by severity, workload progress, remediation guidance, remediation tracking, validation and reports, depending on the plan. PosturaIQ is an independent product and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Microsoft, Microsoft 365, Entra, Exchange, SharePoint, Teams, Defender and Purview are trademarks of Microsoft Corporation.

You must sign up with a valid work email address and keep your credentials confidential. You are responsible for all activity under your organization's accounts, including activity by users you invite. Organization administrators control membership and roles within their organization. Notify us promptly at support@posturaiq.com if you suspect unauthorized access.

To use the Service, an administrator of your Microsoft tenant must grant PosturaIQ application consent. By granting consent, you confirm that you are authorized to do so for that tenant.

• Assessment access is used to read configuration evidence. It does not modify your security configuration.
• Extended access is optional. It enables additional read access for certain workloads, such as Exchange Online, Microsoft Purview, Teams, Power BI and Power Platform, and requires a separate approval.
• Remediation (write) access is optional, always requires a separate and explicit consent, and is used only for remediation actions you approve. Assisted remediation is not available in the current release.

PosturaIQ never asks for, stores or uses a Microsoft user password. You may disconnect your tenant at any time from within the Service. Disconnecting removes PosturaIQ's service principals from your tenant. You may also revoke consent directly in Microsoft Entra ID.

The Service is offered under the plans described at posturaiq.com/plans: Foundation, Advanced, Premier, MSP and Enterprise. Plan limits are based on eligible licensed Microsoft 365 users.

• Foundation is free and has no time limit. We may change or discontinue free-plan features with reasonable notice.
• Paid plans are billed annually in advance, in U.S. dollars, unless otherwise agreed in writing. Fees exclude applicable taxes.
• Renewal. Paid subscriptions do not renew automatically; we will contact you before your term ends.
• Refunds. Fees are non-refundable except where required by law or expressly stated in an order form.
• Price changes take effect at your next renewal. We will give you at least 30 days' notice.
• Partner and bundled subscriptions. If you obtain the Service through an authorized partner, or as part of a professional services engagement, the pricing, billing and term in your agreement with that partner or engagement apply in place of this section. These Terms continue to govern your use of the Service.
• Plan limits. Plan limits are measured by eligible licensed Microsoft 365 users and assessment runs per connected tenant per month. If your tenant exceeds your plan's limit, we may ask you to move to an appropriate plan.
• Microsoft Marketplace purchases. If you purchase through Microsoft Marketplace, your purchase is governed by the Standard Contract for Microsoft Marketplace and the PosturaIQ amendment presented at purchase, which control over these Terms if they conflict. Microsoft bills you, and renewal and cancellation are managed in Microsoft Marketplace.

Expert Security Review is an optional add-on purchased separately; it is not part of any plan. It provides one hour per month of expert security review. Unused time does not roll over. Expert review is advisory only. Hands-on implementation, remediation and other professional services are not included in any plan. They are available only under a separate statement of work.

If you obtain the Service through an authorized partner, or invite a partner's personnel into your organization, you authorize that partner to access and act within your workspace according to the roles you assign. Partners are independent businesses, not our agents. Services a partner provides to you — including consulting, remediation and advice — are governed by your agreement with that partner, and the partner is responsible for them. You can remove partner users from your organization at any time.

You agree not to:

• (a) connect a tenant you are not authorized to administer;
• (b) use the Service to assess any environment without its owner's permission;
• (c) attempt to access another organization's data or bypass tenant isolation, authorization or plan limits;
• (d) reverse engineer, scrape or copy the Service, except where the law allows this;
• (e) interfere with or disrupt the Service, or probe it for vulnerabilities without our written permission;
• (f) resell or sublicense the Service except through an authorized partner arrangement; or
• (g) use the Service in violation of law.

To report a security vulnerability, contact security@posturaiq.com.

"Customer Data" means the data collected from your connected tenant and the content you and your users submit to the Service. You retain all rights in Customer Data. You grant us a limited right to host, process and display Customer Data only as needed to provide, secure and support the Service, and as described in our Privacy Policy. We may use aggregated, de-identified data that does not identify you, your users or your tenant to operate and improve the Service. We do not sell Customer Data.

The Service, including its software, control catalog, scoring methodology, remediation content, reports and branding, is owned by us and our licensors. Subject to these Terms, we grant you a non-exclusive, non-transferable right to use the Service, and to use reports generated for your organization, for your internal business purposes. If you send us feedback, we may use it without obligation to you.

The Service provides security findings and guidance based on configuration evidence available at the time of assessment. It does not guarantee that your environment is secure or compliant with any law, regulation or framework. Some controls cannot be evaluated automatically and are marked as not evaluated. Scores and compliance mappings are indicators, not certifications. You are responsible for evaluating recommendations and testing changes before applying them to your environment, and for any changes you make.

The Service relies on Microsoft APIs and services. Changes, outages or limitations in those services may affect assessment coverage or results, and we are not responsible for them.

Some features may use artificial intelligence to explain findings, remediation or validation. AI-generated content may be incomplete or inaccurate and is provided for guidance only; review it before acting on it. Features labeled preview, beta or "not yet operational" are provided as-is, may change or be withdrawn, and are excluded from any service commitments.

Each party will protect the other's non-public information with reasonable care and use it only to perform under these Terms. We maintain administrative, technical and physical safeguards appropriate to the nature of the Service, as described at posturaiq.com/security.

You may stop using the Service and close your organization at any time. We may suspend or terminate access for material breach of these Terms, non-payment, or activity that threatens the security or integrity of the Service. Where practical, we will give notice first. After termination, we will delete Customer Data as described in the Privacy Policy. Sections 8–10 and 14–17 survive termination. If a subscription is past due or suspended, your organization becomes read-only: you can view your overview, findings and existing reports, disconnect tenants and manage members, but cannot run assessments, generate reports or make changes. After a subscription is canceled or expires, or a trial ends, the account enters read-only mode: previously generated Assessment Reports remain available to view and download for 90 days, and other portal features are suspended. Reactivating the subscription restores full access. After 90 days, data is deleted as described in our Privacy Policy.

EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED. THIS INCLUDES WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE OR WILL DETECT EVERY SECURITY ISSUE.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE OR DATA. OUR TOTAL LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE WILL NOT EXCEED THE FEES YOU PAID US FOR THE SERVICE IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. FOR THE FREE FOUNDATION PLAN, THIS AMOUNT IS US $100.

You will defend and indemnify us against third-party claims arising from your connection of a tenant you were not authorized to connect, or from your violation of these Terms or applicable law.

These Terms are governed by the laws of the State of Florida, without regard to its conflict-of-law rules. The courts located in Miami-Dade County, Florida have exclusive jurisdiction. We may update these Terms. If we make material changes, we will notify account owners by email or in the Service at least 30 days before they take effect. You may not assign these Terms without our consent. We may assign them as part of a merger or sale of our business. If a signed order form or agreement conflicts with these Terms, that document controls.

Vicant Solutions LLC, d/b/a Nubrix Security
777 Brickell Ave, Ste 99722, Miami, FL 33131
support@posturaiq.com

PosturaIQ Amendment to the Standard Contract for Microsoft Marketplace

1. 1. Plan limits. Each plan includes the limits stated in its Marketplace plan description, including eligible licensed Microsoft 365 users, connected Microsoft tenants, and assessment runs per connected tenant per calendar month. If Customer exceeds its plan's limits, Publisher may require Customer to move to an appropriate plan. Plan changes that would place Customer over the target plan's limits may be declined.
2. 2. Free trial. Where a plan includes a free trial, trial access excludes remediation guidance, remediation tracking and certain reports, and is limited to one assessment run. Unless cancelled in Microsoft Marketplace before the trial ends, the trial converts to a paid subscription.
3. 3. Tenant authorization. Customer will connect only Microsoft tenants it is authorized to administer and will assess only environments it owns or is authorized to assess. Customer is responsible for administrator consent granted to the Service.
4. 4. Nature of findings. The Service reports on configuration evidence available at the time of assessment. It does not guarantee that Customer's environment is secure or compliant with any law, regulation or framework. Customer is responsible for evaluating and testing changes before applying them.
5. 5. Expert Security Review. Expert Security Review is an optional add-on purchased separately and is not part of any plan. It is advisory, limited to one hour per month, unused time does not roll over, and it excludes hands-on implementation or remediation, which are available only under a separate statement of work.
6. 6. AI-assisted and preview features. AI-generated content may be incomplete or inaccurate and is provided for guidance only. Preview features are provided as-is and may change or be withdrawn.
7. 7. Microsoft service dependency. The Service relies on Microsoft APIs and services. Changes, outages or limitations in those services may affect assessment coverage or results.
8. 8. Inactive subscriptions and data retention. If a subscription is suspended, Customer's organization becomes read-only. After a subscription is canceled or expires, or a trial ends, the account enters read-only mode: previously generated Assessment Reports remain available to view and download for 90 days, and other portal features are suspended. Reactivating the subscription restores full access. After 90 days, data is deleted as described in our Privacy Policy. Customer may request earlier deletion at privacy@posturaiq.com.
9. 9. Privacy. Publisher processes Customer Data as described in the PosturaIQ Privacy Policy at https://www.posturaiq.com/privacy.