1. Introduction & Acceptance
These Terms & Conditions (the "Terms") form a binding agreement between you, or the organisation you are authorised to represent ("you", "Customer"), and CISO Consulting ("we", "us", the "Company"), and govern your access to and use of the ciso.sa platform, our websites, applications, APIs, content and related services (together, the "Services").
By creating an account, subscribing, or otherwise accessing or using the Services, you confirm that you have read, understood and agree to be bound by these Terms, our Privacy Policy and our Billing & Subscription Terms, each incorporated by reference. If you do not agree, you must not access or use the Services. If you accept these Terms on behalf of an organisation, you represent that you have authority to bind that organisation.
2. Definitions
In these Terms: "Account" means your registered access to the Services; "Content" means text, data, reports, assessments, templates and other materials available through the Services; "User Content" means material you upload, submit or generate; "Subscription" means the paid plan under which you access the Services; and "Authorised Users" means individuals you permit to use the Services under your Account.
3. Eligibility & Registration
The Services are intended for professional and business use by individuals who are at least 18 years old and legally capable of entering into contracts. You agree to provide accurate, current and complete registration information and to keep it up to date. We may refuse, suspend or terminate registration at our discretion where information is inaccurate or use breaches these Terms or applicable law.
4. Accounts, Credentials & Security
You are responsible for safeguarding your credentials and for all activity under your Account and those of your Authorised Users. You must keep passwords confidential, enable available security features, and notify us promptly at once of any unauthorised access or security incident. We are not liable for loss arising from your failure to secure your Account. You are responsible for your Authorised Users' compliance with these Terms.
5. Subscriptions, Plans & Access
Access to certain features requires a paid Subscription. The features, seat counts and usage limits available to you depend on your plan, as described on our pricing page and governed by our Billing & Subscription Terms. We may introduce, modify or retire plans and features; where a change materially reduces a feature you rely on during a paid term, we will act reasonably and, where appropriate, provide a comparable alternative.
6. Licence & Restrictions
Subject to these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Services for your internal business purposes. You must not, and must not permit others to: (a) copy, resell, sublicense or commercially exploit the Services or Content except as expressly permitted; (b) reverse engineer, decompile or attempt to derive source code; (c) circumvent access controls, usage limits or security; (d) scrape or use automated means to extract data beyond documented APIs; (e) remove proprietary notices; or (f) use the Services to build a competing product.
7. Acceptable Use
You agree not to use the Services to: violate any law or third-party right; upload malware or malicious code; attempt to gain unauthorised access to systems or data; conduct unauthorised penetration testing against the platform or others; transmit unlawful, defamatory, infringing or harmful content; harass or impersonate others; or interfere with the integrity or performance of the Services. Security tooling within the Services is provided for lawful, authorised assessment of systems you own or are permitted to test only.
8. User Content
You retain ownership of your User Content. You grant us a limited licence to host, process and display it solely to provide and improve the Services and as directed by you. You are responsible for your User Content and confirm you have the rights to submit it and that it does not infringe any third-party right or violate law. We may remove User Content that breaches these Terms. Where we act as processor for enterprise data, our Privacy Policy and any applicable data processing terms govern that processing.
9. Intellectual Property
The Services and all Content we provide — including software, text, designs, frameworks, assessments, templates, trademarks and logos — are owned by CISO Consulting or its licensors and are protected by intellectual-property laws. Except for the limited licence granted to you, no rights are transferred. "CISO Consulting", the CISO logo and related marks are our trademarks and may not be used without our prior written consent.
10. AI Features & Output
Certain features (including the ARIA virtual-CISO assistant and AI-generated reports) use automated and AI systems. AI output may be incomplete, out of date or inaccurate and must be independently reviewed before you rely on it. You are responsible for verifying AI-generated content and for any decisions you make using it. You must not submit others' personal data or confidential information to AI features without a lawful basis and appropriate authorisation.
11. No Professional or Legal Advice
The Services provide information, tooling and templates to support governance, risk and compliance activities. They do not constitute legal, regulatory, audit, financial or other professional advice, and no client, advisory or fiduciary relationship is created by your use of them. Regulatory frameworks change and outcomes depend on your specific circumstances; you should obtain qualified professional advice before acting. We are not responsible for regulatory findings, penalties or decisions resulting from your use of the Services.
12. Third-Party Services & Links
The Services may integrate with or link to third-party products, data sources or websites we do not control. Your use of them is governed by their own terms and privacy policies, and we are not responsible for their content, availability or practices. Integrations may be changed or discontinued if a third party alters or withdraws access.
13. Availability, Changes & Support
We aim to provide reliable Services but do not guarantee uninterrupted or error-free operation. We may perform maintenance, and may modify, suspend or discontinue features. We will use reasonable efforts to give notice of material changes or planned downtime. Support is provided according to your plan and our support channels; response targets, where offered, are described separately.
14. Data Protection & Confidentiality
Our processing of personal data is described in our Privacy Policy, issued under the Saudi Personal Data Protection Law. Confidential information exchanged between us is protected under our Mutual Non-Disclosure Agreement. By using the Services you acknowledge those documents, which are incorporated into these Terms by reference.
15. Disclaimers of Warranties
To the maximum extent permitted by law, the Services and Content are provided "as is" and "as available" without warranties of any kind, whether express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, accuracy and non-infringement. We do not warrant that the Services will meet your requirements, be uninterrupted or secure, or that Content is accurate, complete or current.
16. Limitation of Liability
To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, data or goodwill, arising out of or relating to the Services, even if advised of the possibility. Our total aggregate liability arising out of or relating to the Services is limited to the amounts you paid to us for the Services in the twelve (12) months preceding the event giving rise to the claim. Nothing limits liability that cannot be excluded under applicable law.
17. Indemnification
You agree to indemnify and hold us harmless from claims, damages, liabilities and reasonable expenses arising from your User Content, your use of the Services in breach of these Terms or applicable law, or your infringement of a third party's rights. We will notify you of any such claim and may participate in its defence with counsel of our choice.
18. Suspension & Termination
You may stop using the Services at any time; cancellation of paid Subscriptions is governed by our Billing Terms. We may suspend or terminate access immediately where you materially breach these Terms, create security or legal risk, or fail to pay. On termination, your right to use the Services ends and we may delete your data after a short retention period in line with our Privacy Policy, except where retention is required by law. Provisions that by their nature should survive termination will survive.
19. Force Majeure
We are not liable for any delay or failure to perform caused by events beyond our reasonable control, including acts of God, natural disasters, outages of telecommunications or hosting providers, cyber-attacks, government actions, or other force-majeure events.
20. Governing Law & Dispute Resolution
These Terms are governed by the laws and regulations of the Kingdom of Saudi Arabia. The parties will seek to resolve disputes amicably; failing that, the competent courts of Riyadh have exclusive jurisdiction, without prejudice to any mandatory regulatory dispute mechanism that applies.
21. Changes to these Terms
We may update these Terms from time to time. We will post the updated Terms with a new effective date and, for material changes, provide reasonable notice. Your continued use of the Services after changes take effect constitutes acceptance of the updated Terms.
22. General Provisions
These Terms, together with the Privacy Policy, NDA and Billing Terms, constitute the entire agreement between the parties regarding the Services and supersede prior understandings. If any provision is held unenforceable, the remainder continues in effect. Our failure to enforce a right is not a waiver. You may not assign these Terms without our consent; we may assign them to an affiliate or successor. Notices to you may be given via the Services or your registered email.
23. Contact
Questions about these Terms may be sent to legal@ciso.sa. General support is available at support@ciso.sa. CISO Consulting, Riyadh, Kingdom of Saudi Arabia.