Terms of Service

Reports are not:

• Legal advice
• Professional auditing or attestation services
• A certification, validation, or guarantee of compliance with any framework including SOC 2, PCI DSS, HIPAA, ISO 27001, or any other standard
• A substitute for the professional judgment of a licensed auditor or attorney

3.1 Authorization to Access

Customer warrants that before initiating any connection or scan, they have obtained explicit written authorization from the owner of the AWS account being accessed. If Customer is an external auditor, consultant, or third party using this service on behalf of a client, Customer is solely responsible for ensuring appropriate authorization is in place.

3.2 IAM Role Management

Customer is solely responsible for the creation, configuration, and deletion of the AWS Cross-Account IAM Role used to grant access to the service. BlackBox Auditor does not store IAM Role ARNs, External IDs, or AWS Account IDs after a connection is established. Customer may revoke access at any time by deleting or modifying the trust policy of the IAM role in their own AWS account.

3.3 Accuracy and Verification

While BlackBox Auditor strives for technical accuracy, Customer is responsible for reviewing and verifying all findings and evidence before presenting them to clients, third parties, auditors, or regulatory bodies.

3.4 Acceptable Use

Customer agrees not to:

• Use the service to access any AWS account for which they do not have explicit written authorization
• Attempt to exceed the permissions granted by the configured IAM role
• Resell, sublicense, or provide access to the platform to third parties without a separate written reseller agreement with BlackBox Auditor
• Use the service for any unlawful purpose or in violation of any applicable law

5.1 Fees

Subscription fees are as communicated at the time of sign-up or as otherwise agreed in writing. Fees are due in advance of each billing period.

5.2 Non-Payment

If payment is not received within 10 days of the due date, BlackBox Auditor reserves the right to suspend access until payment is made.

5.3 No Refunds

Fees paid are non-refundable except as required by applicable law or as expressly agreed in writing.

6.1 Your Data

Customer retains ownership of all AWS environment metadata and Reports generated through the service.

6.2 License to Operate

Customer grants BlackBox Auditor a limited, non-exclusive license to process and store Customer data solely as necessary to provide the service.

6.3 Retention

Reports and AWS environment metadata are retained for 14 days from generation and then permanently deleted. Customer is responsible for downloading Reports before that window expires. Deleted Reports are not recoverable. Account information is retained for 90 days following account termination and then permanently deleted.

9.1 Exclusion of Consequential Damages

To the maximum extent permitted by applicable law, BlackBox Auditor shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, loss of data, business interruption, or regulatory fines, arising from Customer's use of or inability to use the service.

9.2 Liability Cap

BlackBox Auditor's total aggregate liability to Customer shall not exceed the total fees paid by Customer in the twelve (12) months immediately preceding the event giving rise to the claim.

9.3 AWS Environment Security

BlackBox Auditor shall not be liable for any security breaches, unauthorized access, or data loss in Customer's AWS environment. Customer is responsible for the security of their own AWS environment, including the IAM roles and policies they configure.

11.1 By Customer

Customer may terminate their subscription at any time by contacting BlackBox Auditor at info@blackboxauditor.com. Termination takes effect at the end of the current billing period.

11.2 By BlackBox Auditor

BlackBox Auditor may suspend or terminate Customer's access immediately upon a material violation of these Terms, or with 30 days' written notice for any other reason.

11.3 Effect of Termination

Upon termination, Customer's access will be revoked and data will be deleted in accordance with Section 6.3. Customer is responsible for exporting any needed Reports before the termination date.