These terms govern your access to and use of the Polestead platform, the Critical Incident Intelligence Center (CIIC), and the Trust Center. Please read them carefully.
This is a template agreement prepared for Polestead's launch. Bracketed items marked [ ] must be completed by Polestead and reviewed by qualified counsel before publication.
These Terms of Service ("Terms") are a binding agreement between you and [Polestead legal entity name], a company incorporated in [jurisdiction] ("Polestead", "we", "us"). By creating an account, deploying the software, or otherwise using the service, you agree to these Terms. If you are entering into these Terms on behalf of an organization, you represent that you have authority to bind that organization.
Polestead is a third-party risk management platform. It ingests your vendor register, classifies each vendor by your exposure across six access vectors (Internal Risk Classification), scopes assessment depth by tier, and supports continuous monitoring, incident response through CIIC, and a published Trust Center.
The service is available in several deployment models — on-premises, air-gapped, single-tenant EU cloud, and managed single-tenant SaaS. The obligations in these Terms that concern hosting, availability, and security apply to whichever model you have licensed; for self-hosted and air-gapped deployments, operational responsibility for the environment rests with you.
You must provide accurate account information and keep your credentials secure. You are responsible for activity under your accounts and for your authorized users' compliance with these Terms. The service is intended for organizational, professional use and not for consumers.
Publishing a Trust Center — including documents, subprocessor lists, access controls, and a visitor log — is provided free of charge. Paid capabilities begin where the Trust Center actively works on your behalf: responding to inbound questionnaires with human-in-the-loop workflows, pushing regulatory data to counterparties, and unlimited visitor-log history. You are responsible for the accuracy of the content you publish.
Ownership. As between you and Polestead, you own your register, assessments, evidence, incident records, and Trust Center content ("Customer Data"). You grant us the limited rights necessary to host and operate the service for you.
AI. Where AI features are enabled, inference runs on your own provider keys (bring-your-own-key) under your spend caps and model choice. Polestead does not operate that inference and does not use Customer Data to train models. A zero-AI configuration is available, in which vendor-name resolution falls back to deterministic matching at lower accuracy.
Your use of the service is subject to our Acceptable Use Policy, which is incorporated into these Terms. You may not use the service to assess or scan parties you have no lawful basis to assess, nor to circumvent the platform's controls.
Fees are described on our pricing page and any order form you sign. Polestead does not ration coverage by vendor count: vendor records are unlimited, and price varies by assessment depth, deployment model, and modules. Fees are exclusive of taxes. Unless stated otherwise, fees are billed annually in advance and are non-refundable except as required by law.
Polestead and its licensors own the platform, its software, models of classification, documentation, and brand. These Terms grant you a non-exclusive, non-transferable right to use the service during your subscription. You retain all rights in Customer Data.
We provide the service with reasonable skill and care. Except as expressly stated, the service is provided "as is" without further warranties. CIIC and the platform's regulatory content are operational tools, not legal advice; the regulatory dataset is verified against primary sources and carries last-verified dates, but national transposition and applicability to your circumstances should be confirmed with your own counsel.
To the maximum extent permitted by law, neither party is liable for indirect, incidental, or consequential damages, and each party's aggregate liability is limited to the fees paid or payable for the service in the [twelve] months preceding the event giving rise to the claim. Nothing limits liability that cannot be limited by law.
These Terms apply for your subscription term and any renewals. Either party may terminate for material breach not cured within [30] days of notice. On termination you may export your Customer Data in a machine-readable format during a [30]-day export window; self-hosted and air-gapped deployments retain their data in place. We may suspend access for serious or ongoing violations of the Acceptable Use Policy.
These Terms are governed by the laws of [governing jurisdiction], and the courts of [venue] have exclusive jurisdiction, without prejudice to mandatory consumer or data-protection rights. The parties will attempt to resolve disputes in good faith before commencing proceedings.
We may update these Terms from time to time. Material changes will be notified in advance through the platform or by email, and the "last updated" date above will change. Continued use after the effective date constitutes acceptance.
Questions about these Terms: legal@polestead.com.
You do. Your register, assessments, evidence, and incident records remain your property. We process them to run the service and never use them to train AI models.
No. AI runs on your own provider keys under your spend caps, or not at all. We don't operate the inference, so there's nothing for us to train on.
Yes — a machine-readable export during the termination window. Self-hosted and air-gapped deployments keep their data in place regardless.
No. CIIC is an operational tool; its regulatory dataset is informational and carries last-verified dates. Confirm national transposition with your own counsel.