Terms of Service, EULA & Acceptable Use Policy

Governing hosted commercial cloud access (unclassified, non-CUI) to RMF Sprint™, a product of Trident Defense Tech, LLC.

1. Scope of License & Authorized Operator Use

Subject to timely payment of applicable license fees and compliance with this Agreement, Trident Defense Tech, LLC grants Customer a non-exclusive, non-transferable, non-sublicensable, revocable license during the active subscription term to use RMF Sprint™ for internal cybersecurity engineering, Risk Management Framework (RMF) package generation, and compliance auditing across Department of Defense (DoD), Federal agency, and Defense Industrial Base (DIB) environments. Seat entitlements (Single, 1 user; Team, up to 10 users; and Enterprise, up to 25 users; each with unlimited systems and packages) are strictly limited to the number of authorized named users (seats) encoded in Customer’s cryptographic license certificate. On a Team or Enterprise license the purchaser is the license owner and assigns the seats.

2. Data Handling, Hosted Cloud Boundary & CUI Prohibition

(a) Hosted Cloud Tier (Unclassified, Non-CUI Only): The hosted version of RMF Sprint™ runs in a commercial cloud environment for unclassified, non-CUI information only. It is not authorized for Controlled Unclassified Information (CUI), is not a DoD Impact Level 2, 4, 5 or 6 authorized service and holds no DoD provisional authorization.
(b) Files Processed on Your Device: STIG checklists (.ckl, .cklb), SCAP / XCCDF results, Nessus and ACAS scans, eMASS export workbooks, POA&M workbooks and Master BOE workbooks that you select in the eMASS Reconciler, POA&M Triage, Compliance Metrics, eMASS Package Linter, ConMon Planner and OSCAL export are read and processed by software that runs in your web browser. Their content is not sent to or stored by the Service, and the files made from them are created in your browser. The Service receives only what you type into its forms, your profile and System settings, the control identifiers read from an eMASS export (ConMon Planner), and, for Audit History, the name and SHA-256 hash of each file you make. Separation of Duties acceptance documents are hashed in your browser; only the file name and hash are sent. The Package Builder and the POA&M Tracker do not accept scan files on the hosted Service.
(c) What the Service Stores: Everything you type into forms (for example System records, POA&M Tracker items, ConMon check results and Package Builder selections), customer overlay workbooks you import, and the documents the Package Builder generates from those values are stored by the Service. Customer is strictly prohibited from entering, importing or storing Classified National Security Information, CUI (including CUI//ISVI) or ITAR/EAR export-controlled technical data in the Service. Processing a file in your browser does not make the Service authorized for CUI; whether you may open a given file on your device is governed by your organization's CUI and device policies. No self-hosted, on-premises or air-gapped edition is available yet; one is planned for a future release.
(d) Operator Responsibility: Operators remain solely responsible for verifying that all artifacts they process, enter or export conform to applicable Security Classification Guides (SCG), the DCSA Assessment and Authorization Guide (DAAG; formerly the DAAPM) for DCSA NISP systems, NISPOM (32 CFR Part 117), and organizational CUI handling policies.

3. Intellectual Property & License Restrictions

RMF Sprint™ and all associated reconciliation algorithms, CCI-to-NIST mapping heuristics, narrative generation templates, source code, container images, and user interface designs are and remain the exclusive proprietary intellectual property of Trident Defense Tech, LLC. Customer retains all ownership rights to its underlying system data and generated compliance deliverables (.xlsx and .docx outputs). Customer shall not (a) reverse engineer, decompile, disassemble, or extract the underlying source code or control-mapping heuristics; (b) forge, tamper with, share, or resell cryptographic HMAC license keys; or (c) use the Software to build a competing commercial RMF or compliance product.

4. Billing, Subscriptions, Payment Processing & Renewals

RMF Sprint™ is sold by Trident Defense Tech, LLC. Online card payments are processed by Stripe, Inc., our payment processor; card details are entered on Stripe’s pages and are not received or stored by the Service. Orders may also be placed by purchase order against a direct invoice. Subscriptions are billed in advance on an annual or monthly cycle as selected at checkout (the Team and Enterprise plans are annual only) and automatically renew unless canceled prior to the renewal date; a cancellation takes effect at the end of the paid period. Because cryptographic license keys (RMF-...) are self-validating once issued, all sales are final once a signed license key has been provisioned, except as expressly required by applicable law.

(a) Failed card payments: If a renewal payment by card fails, access to the Software is suspended immediately for every user on the license until the payment succeeds. The payment processor may retry the charge; the license owner can update the payment method at any time, and access is restored when the payment is received.
(b) Purchase orders (Net-30): An order placed by purchase order is invoiced with payment due thirty (30) days after the invoice date, by ACH, wire transfer or card. The license key is active from the date the invoice is sent, for a term of one (1) year. If the invoice remains unpaid fourteen (14) days after its due date, access is suspended until the invoice is paid, and access is restored when payment is received.

5. No Guarantee of ATO & Disclaimer of Warranties (“AS-IS”)

RMF SPRINT™ IS AN ENGINEERING PRODUCTIVITY AND AUTOMATION TOOL, NOT A SUBSTITUTE FOR AN INDEPENDENT SECURITY CONTROL ASSESSOR (SCA) OR AUTHORIZING OFFICIAL (AO). Trident Defense Tech, LLC does not warrant or guarantee that use of the Software or its generated System Security Plans (SSP), Security Control Traceability Matrices (SCTM), Plans of Action and Milestones (POA&M), or Continuous Monitoring (ConMon) artifacts will result in an Authorization to Operate (ATO), Authority to Connect (ATC), DCSA accreditation, or CMMC certification. THE SOFTWARE AND ALL GENERATED ARTIFACTS ARE PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR REGULATORY COMPLIANCE.

6. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL TRIDENT DEFENSE TECH, LLC, ITS FOUNDERS, OFFICERS, MEMBERS, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING WITHOUT LIMITATION LOSS OF PROFITS, LOSS OF GOVERNMENT CONTRACTS, DELAY OF ATO ACCREDITATION, DATA LOSS, OR BUSINESS INTERRUPTION, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE USE OF THE SOFTWARE. TRIDENT DEFENSE TECH, LLC’S TOTAL CUMULATIVE LIABILITY FOR ALL CLAIMS ARISING UNDER OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL LICENSE FEES ACTUALLY PAID BY CUSTOMER TO TRIDENT DEFENSE TECH, LLC IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO LIABILITY (OR $100.00 USD IF NO FEES WERE PAID).

7. Customer Indemnification

Customer agrees to defend, indemnify, and hold harmless Trident Defense Tech, LLC and its officers, members, and affiliates from and against any third-party or regulatory claims, investigations, fines, liabilities, and expenses (including reasonable attorneys’ fees) arising out of: (a) Customer’s violation of Section 2 (including any unauthorized upload of CUI, classified data, or export-controlled data to the hosted cloud tier); (b) inaccuracies or omissions in compliance packages submitted by Customer to eMASS, DCSA, or any government agency; or (c) Customer’s breach of this Agreement.

8. Export Control & U.S. Persons Compliance

Customer represents and warrants that it is not located in, under the control of, or a national or resident of any country subject to U.S. Department of the Treasury OFAC sanctions, nor listed on any U.S. Government denied-party list (including SAM.gov exclusions or the BIS Entity List). Customer shall comply with all applicable U.S. export control laws, including the Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR).

9. Account Security, Audit Logging & Suspension

In accordance with NIST SP 800-53 controls (AC-7, AC-8, AC-12, AU-2, AU-3), access to the Service is continuously monitored and logged. Accounts are automatically locked for 15 minutes after 5 consecutive failed authentication attempts. Trident Defense Tech, LLC reserves the right to immediately suspend or terminate access or revoke license keys without refund if an Operator engages in unauthorized penetration testing against the hosted cloud infrastructure, attempts to bypass rate limits, or violates the Section 2 data-handling boundary.

10. Governing Law, Venue & Dispute Resolution

This Agreement shall be governed by and construed in accordance with the laws of the State of California, without regard to its conflict of law principles. Any dispute, claim, or controversy arising out of or relating to this Agreement that cannot be resolved informally within thirty (30) days shall be resolved by binding individual arbitration in San Diego County, California in accordance with the Commercial Arbitration Rules of the American Arbitration Association (AAA), or in the state or federal courts located in San Diego County, California for injunctive relief protecting intellectual property. CLASS ACTION WAIVER: Each party agrees that any dispute resolution proceedings will be conducted only on an individual basis and not in a class, consolidated, or representative action.