Terms of Service

These terms govern your use of Posturit, operated by Anderbox Holdings LLC (“we”, “us”). By using the site or the application, you agree to them. If you're agreeing on behalf of a company, you confirm you have the authority to do so.

What Posturit is — and what it isn't

Posturit helps you describe, score, and present a security posture using the NIST Cybersecurity Framework 2.0 and the CIS Critical Security Controls. It is a documentation and communication tool.

Read this part carefully:

• Posturit scores what you enter. It does not connect to, scan, test, or verify any system. A control marked “in place” means somebody said so — not that we confirmed it.
• A Posturit score is not a security audit, a penetration test, a certification, or a compliance attestation. It does not prove compliance with the FTC Safeguards Rule, HIPAA, PCI-DSS, CMMC, or any other regime, and it isn't a substitute for professional assessment.
• Nothing in Posturit is legal, insurance, or regulatory advice. Insurer requirements referenced in the product are general industry patterns, not the terms of any specific policy. Only your carrier can tell you what your policy requires.
• A good score does not mean you or your clients are secure, and won't prevent a breach.

Early access

Posturit is pre-release. Access is currently by invitation. During this period:

• Features may change, break, or be removed without notice.
• We may need to reset or migrate data, though we'll avoid it and warn you where we can.
• There are no uptime commitments and no support guarantees.
• Free access during an early-access period doesn't create a right to free access afterwards. We'll tell you well before anything becomes chargeable, and you'll never be billed without agreeing first.

Your account

• Keep your sign-in method secure and let us know promptly if you think your account has been compromised.
• You're responsible for what happens under your account, including anything your team members do.
• Don't share access with people outside your organisation.

Your data, and your clients' data

You keep ownership of everything you put into Posturit. You grant us only the licence needed to host and operate the service for you.

If you enter information about your clients, you confirm you're entitled to do so and that doing so doesn't breach your agreements with them. Please don't upload credentials, secrets, or more sensitive detail than a posture record needs.

How we handle data is described in our Privacy Policy.

Acceptable use

Don't:

• Attempt to access another organisation's data, or probe or attack the service (responsible security reports are welcome — email us).
• Resell or white-label Posturit except where your plan expressly permits it.
• Copy the control library or product to build a competing service.
• Use Posturit unlawfully, or to mislead anyone about their security posture.

The NIST CSF and CIS Controls are the work of their respective organisations and are used here as published frameworks. We claim no ownership of them, and Posturit is not endorsed by, affiliated with, or certified by NIST, CIS, or any vendor, insurer, or analyst firm named in the product.

Availability and changes

We provide Posturit “as is” and may change, suspend, or discontinue any part of it. We may end early access, or your access to it, at any time — if we do, we'll give you a reasonable opportunity to export your data.

Disclaimers and liability

To the fullest extent the law allows, Posturit is provided without warranties of any kind, express or implied, including fitness for a particular purpose and non-infringement. We don't warrant that it will be uninterrupted, error-free, or that any score it produces is accurate or complete.

We are not liable for indirect, incidental, special, consequential, or punitive damages, nor for lost profits, lost data, or any security incident affecting you or your clients. Where liability can't be excluded, our total liability is limited to the greater of the amount you paid us in the previous twelve months or US $100. Nothing here limits liability that can't lawfully be limited.

Indemnity

You'll indemnify us against claims arising from your use of Posturit in breach of these terms, or from data you entered that you weren't entitled to enter.

Governing law

These terms are governed by the laws of the State of Minnesota, USA, and the courts located there have exclusive jurisdiction.

Changes to these terms

We may update these terms; we'll change the date above and notify account holders of material changes. Continuing to use Posturit means you accept them.