Effective date: 11 August 2026 · Last updated: 11 August 2026 Published at: https://cautera.com/legal/terms
These Terms of Service (“Terms”) are a binding agreement between Cautera Labs, Unipessoal Lda., a single-member private limited company (sociedade unipessoal por quotas, art. 270.º-A of the Portuguese Código das Sociedades Comerciais) incorporated under the laws of Portugal, with registration number / NIPC 519436539 and registered office at Rua Augusto Macedo, n.º 8, Fração L, 1600-794 Lisboa, Portugal (“Cautera”, “we”, “us”), and the customer that accesses or uses the Services (“Customer”, “you”).
The Cautera platform is a business-to-business governance, risk, and compliance (“GRC”) software-as-a-service application made available at https://app.cautera.com, together with its marketing site at https://cautera.com, the administrative interface at https://admin.cautera.com, and all related features, APIs, and documentation (collectively, the “Services”).
By signing an Order Form that references these Terms, by clicking “I agree”, or by accessing or using the Services, you agree to these Terms. If you are entering into these Terms on behalf of an organisation, you represent that you have authority to bind that organisation, and “you” refers to that organisation.
Relationship to other agreements. Where the parties have executed a Master Service Agreement (“MSA”) and/or one or more Order Forms, those documents govern and these Terms apply only to the extent not inconsistent with them. In all cases, the Cautera Data Processing Agreement (provided as part of the customer contract) governs the processing of personal data and is incorporated by reference. How Cautera handles personal data for which it is itself the controller is described in the Privacy Policy at https://cautera.com/legal/privacy.
1. Definitions
1.1 “Account” means the tenant workspace and associated user accounts provisioned for the Customer.
1.2 “Authorised User” means an individual (employee, contractor, or agent of the Customer) whom the Customer authorises to use the Services under its Account.
1.3 “Customer Data” means all data, content, and files that the Customer or its Authorised Users submit to, or generate within, the Services, including controls, risks, policies, evidence, vendor records, and questionnaire responses.
1.4 “Documentation” means Cautera’s then-current published user and technical documentation for the Services.
1.5 “Order Form” means an ordering document or online order specifying the subscribed Services, scope, fees, and term, executed by the parties or otherwise agreed.
1.6 “Subscription Term” means the period during which the Customer is entitled to access the Services, as set out in the applicable Order Form.
2. The Services and accounts
2.1 Provision. Subject to these Terms and payment of applicable fees, Cautera grants the Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the Services during the Subscription Term, solely for the Customer’s internal business purposes.
2.2 Account registration. The Customer must provide accurate and complete registration information and keep it current. The Customer is responsible for configuring the Account and for designating one or more Account administrators.
2.3 Authorised Users. The Customer is responsible for all activity under its Account and for ensuring that each Authorised User complies with these Terms. The Customer must promptly deactivate access for any Authorised User who should no longer have it. Authorised User credentials must not be shared.
2.4 Security of credentials. The Customer is responsible for maintaining the confidentiality of its credentials. The Services support multi-factor authentication, which Cautera strongly recommends enabling for all Authorised Users, and which Cautera may require for administrative roles. The Customer must notify us promptly at support@cautera.com of any suspected unauthorised access.
2.5 Changes to the Services. Cautera continuously develops the Services and may add, modify, or discontinue features. Cautera will not materially degrade the core functionality of a subscribed Service during a paid Subscription Term without providing a substantially equivalent alternative or a pro-rata refund for the affected portion.
3. Acceptable use
3.1 The Customer and its Authorised Users must not, and must not permit any third party to:
(a) use the Services in violation of any applicable law or regulation, or in breach of any third party’s rights;
(b) upload or transmit any malware, or any content that is unlawful, defamatory, infringing, or that the Customer does not have the right to submit;
(c) attempt to gain unauthorised access to the Services, other customers’ tenants, or the underlying systems, or to circumvent any access controls, tenant-isolation, rate-limiting, or usage restrictions;
(d) reverse engineer, decompile, or disassemble any part of the Services, or attempt to derive source code, except to the extent this restriction is prohibited by applicable law;
(e) resell, sublicense, or make the Services available to any third party other than Authorised Users, or use the Services to build a competing product;
(f) use the Services to send unsolicited communications (spam), or to store or process data in volumes or in a manner that exceeds the limits in the applicable Order Form or that imposes an unreasonable load on the infrastructure;
(g) misuse the AI-assisted features, including by attempting prompt injection, by submitting input designed to extract another tenant’s data, or by relying on AI output as a substitute for professional, legal, or audit advice (see Section 6).
3.2 Suspension. Cautera may suspend access (in whole or in part, and to the minimum extent necessary) where it reasonably believes there is a material risk to the security, integrity, or availability of the Services, a violation of this Section 3, or a legal requirement to do so. Cautera will use reasonable efforts to notify the Customer and to restore access promptly once the cause is resolved.
4. Fees and payment
4.1 Fees. Fees, billing frequency, and payment terms are as set out in the applicable Order Form or MSA. Unless stated otherwise, fees are exclusive of VAT and other applicable taxes, which the Customer is responsible for.
4.2 Invoicing and late payment. Invoices are payable within the period stated on the Order Form (or, absent a statement, within 30 days of invoice date). Overdue amounts may accrue interest at the statutory rate for commercial transactions under Portuguese law (Decreto-Lei n.º 62/2013), without prejudice to any other remedy.
4.3 No refunds except as stated. Except as expressly provided in these Terms or the Order Form/MSA, fees are non-refundable and subscriptions are non-cancellable for the committed Subscription Term.
4.4 Free, trial, or beta access. Where Cautera offers free, trial, or beta access, that access is provided “as is”, may be modified or withdrawn at any time, and is excluded from the warranties and service commitments that apply to paid subscriptions.
5. Intellectual property
5.1 Cautera IP. As between the parties, Cautera and its licensors own all right, title, and interest in and to the Services, the Documentation, and all underlying software, models, designs, and know-how, including all improvements and derivatives. No rights are granted other than as expressly set out in these Terms.
5.2 Customer Data. As between the parties, the Customer owns all right, title, and interest in and to its Customer Data. The Customer grants Cautera a worldwide, non-exclusive licence to host, copy, transmit, process, and display Customer Data solely as necessary to provide and support the Services, in accordance with the DPA.
5.3 Aggregated / de-identified data. Cautera may generate and use aggregated and de-identified data derived from use of the Services (data that does not identify the Customer, any Authorised User, or any individual) to operate, improve, and benchmark the Services. Cautera will not use Customer Data to train third-party foundation models, and the production AI vendor’s terms prohibit such training (see the sub-processor list at https://cautera.com/legal/subprocessors).
5.4 Feedback. If the Customer provides suggestions or feedback, Cautera may use it without restriction or obligation.
6. AI-assisted features
6.1 The Services include AI-assisted features (the “AI Copilot” and related suggestions) that generate output using a third-party large-language-model service (currently Google Vertex AI / Gemini, hosted in the EU — see the sub-processor list at https://cautera.com/legal/subprocessors).
6.2 No professional advice. AI output is provided for informational and productivity purposes only, may be inaccurate or incomplete, and does not constitute legal, regulatory, audit, or other professional advice. The Customer is solely responsible for reviewing and validating AI output before relying on it. Cautera does not warrant the accuracy, completeness, or fitness of AI output for any particular purpose.
6.3 Safeguards. Cautera applies safeguards to AI features, including server-side PII redaction before input is sent to the model, topic restriction to GRC subject matter, prompt-injection sanitisation, and per-tenant usage limits. These are reasonable-effort controls and do not guarantee that output will be free of error.
6.4 Scope limit of redaction — please read. PII redaction operates on text (prompts, queries, and extracted text). Where the Customer runs evidence analysis or audit-finding extraction on an uploaded document or image, the file itself is transmitted to the AI model in its original, unredacted form, so any personal data inside that file is disclosed to the AI provider. The same applies to the malware-scanning provider, which receives every uploaded file. The Customer should take this into account when deciding what to upload and on which files to run AI analysis. This limit is described in full in the DPA (Annex II §5).
7. Warranties and disclaimers
7.1 Mutual. Each party warrants that it has the authority to enter into these Terms and that doing so does not violate any other agreement to which it is bound.
7.2 Cautera limited warranty. During a paid Subscription Term, Cautera warrants that the Services will perform materially in accordance with the Documentation. The Customer’s exclusive remedy, and Cautera’s entire liability, for breach of this warranty is for Cautera to use commercially reasonable efforts to correct the non-conformity, or, if it cannot do so within a reasonable period, to terminate the affected Service and refund pre-paid, unused fees for that Service.
7.3 Disclaimer. EXCEPT AS EXPRESSLY SET OUT IN THESE TERMS, AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE”, AND CAUTERA DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. CAUTERA DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT THE SERVICES WILL ENSURE THE CUSTOMER’S COMPLIANCE WITH ANY LAW, STANDARD, OR FRAMEWORK. THE SERVICES ARE A TOOL TO ASSIST WITH GRC ACTIVITIES; RESPONSIBILITY FOR THE CUSTOMER’S COMPLIANCE OUTCOMES REMAINS WITH THE CUSTOMER.
7.4 Nothing in these Terms excludes or limits liability that cannot be excluded or limited under Portuguese law, including liability for death or personal injury caused by negligence, or for fraud.
8. Limitation of liability
8.1 Excluded damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, OR ANTICIPATED SAVINGS, OR FOR LOSS OR CORRUPTION OF DATA (BEYOND CAUTERA’S EXPRESS OBLIGATIONS UNDER THE DPA), ARISING OUT OF OR RELATING TO THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
8.2 Aggregate cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY THE CUSTOMER FOR THE SERVICES IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE LIABILITY. This cap is 100% of the fees for the trailing twelve (12) months; no separate or higher super-cap applies, save for the carve-outs in Section 8.3. The same cap applies under MSA §11.2.
8.3 Carve-outs. The cap in Section 8.2 and the exclusions in Section 8.1 do not apply to: (a) the Customer’s payment obligations; (b) either party’s indemnification obligations (if any in the MSA); (c) either party’s breach of Section 10 (Confidentiality); (d) the Customer’s breach of Section 3 (Acceptable Use) or Section 5 (IP); or (e) liability that cannot be limited under applicable law. (Same carve-outs as MSA §11.3.)
8.4 These limitations apply regardless of the form of action (contract, tort, or otherwise) and reflect the agreed allocation of risk between the parties.
9. Term and termination
9.1 Term. These Terms apply for as long as the Customer has an active Subscription Term, and otherwise for as long as the Customer accesses the Services.
9.2 Termination for cause. Either party may terminate these Terms (or the affected Order Form) on written notice if the other party materially breaches these Terms and fails to cure the breach within thirty (30) days of written notice, or immediately where the breach is incapable of cure.
9.3 Termination for insolvency. Either party may terminate immediately if the other becomes insolvent, enters liquidation, or has an administrator, receiver, or equivalent appointed.
9.4 Effect of termination. On termination or expiry: (a) the Customer’s right to access the Services ceases; (b) the Customer must pay all fees accrued up to the effective date of termination; and (c) Cautera will make Customer Data available for export and will delete or return it in accordance with the DPA.
9.5 Survival. Sections 4 (accrued fees), 5, 6.2 (no professional advice), 6.4 (scope limit of redaction), 7.3, 8, 9.4, 9.5, 10, and 11, and any term that by its nature should survive, survive termination.
10. Confidentiality
10.1 Each party may receive confidential information of the other. Each party will use the other’s confidential information only to perform under these Terms and will protect it with at least the same care it uses for its own confidential information (and no less than reasonable care). This Section does not apply to information that is public, independently developed, or rightfully received from a third party without restriction, and does not prevent disclosure required by law (with notice where lawful).
11. General
11.1 Governing law. These Terms are governed by, and construed in accordance with, the laws of Portugal, excluding its conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods.
11.2 Venue. Subject to any mandatory consumer-protection venue rules, the parties submit to the exclusive jurisdiction of the courts of the Comarca de Lisboa (Lisbon), Portugal, for any dispute arising out of or relating to these Terms.
11.3 Changes to these Terms. Cautera may update these Terms from time to time. For material changes affecting paid subscriptions, Cautera will provide reasonable prior notice (e.g. by email to the Account administrator or in-app notice). Changes take effect at the start of the next renewal term, or, for non-material or legally required changes, on the stated effective date. Continued use after the effective date constitutes acceptance.
11.4 Assignment. Neither party may assign these Terms without the other’s prior written consent, except that either party may assign to a successor in connection with a merger, acquisition, or sale of substantially all assets, on notice.
11.5 Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control.
11.6 Notices. Notices to Cautera must be sent to support@cautera.com (with a copy to privacy@cautera.com for data-protection matters). Notices to the Customer may be sent to the Account administrator’s email.
11.7 Entire agreement; order of precedence. These Terms, together with any MSA, Order Form, and the DPA, constitute the entire agreement and supersede all prior agreements on their subject matter. In the event of conflict, the order of precedence is: (1) the DPA (for data-protection matters), (2) the Order Form, (3) the MSA, (4) these Terms.
11.8 Severability and waiver. If any provision is held unenforceable, the remainder continues in effect. A party’s failure to enforce a provision is not a waiver.
Contact: support@cautera.com · Data protection: privacy@cautera.com · Cautera Labs, Unipessoal Lda., Rua Augusto Macedo, n.º 8, Fração L, 1600-794 Lisboa, Portugal, NIPC 519436539. · Published at https://cautera.com/legal/terms
Cautera Labs, Unipessoal Lda., NIPC 519436539, Rua Augusto Macedo, n.º 8, Fração L, 1600-794 Lisboa, Portugal. Supervisory authority: CNPD (Portugal).