Terms of Service

Effective Date: Phase-0 (pre-launch); commercial activity has not commenced.

These Terms of Service ("Terms") form a binding agreement between Ellis Intelligence LLC, a Colorado limited liability company doing business as DefenseScore ("DefenseScore", "we", "us"), and the customer subscribing to or using the Service ("Customer", "you").

The Service is for use by businesses — including small businesses and Defense Industrial Base contractors. The Service is not for use by consumers.

1. The Service

1.1 DefenseScore is a software-as-a-service application that helps small Defense Industrial Base contractors compute and track their self-assessment score for the Supplier Performance Risk System ("SPRS") under National Institute of Standards and Technology ("NIST") Special Publication ("SP") 800-171 Rev 2 (Defense Federal Acquisition Regulation Supplement ("DFARS") 252.204-7019/-7020), and manage their Plan of Action & Milestones ("POA&M") under 32 CFR 170.21 and annual Cybersecurity Maturity Model Certification ("CMMC") affirmation obligations under 32 CFR 170.4/170.22 and DFARS 252.204-7021. The Service computes a score from information the Customer provides, tracks POA&M items with a 180-day closeout clock, manages the annual-affirmation cadence, and generates a SPRS Submission Sheet.

1.2 Tier-specific features and limits (including any request-volume or usage bands) are described at defensescore.com/pricing. Tier names, and the figures behind them, live on that page and are never restated in these Terms. Tier names: Free Calculator, Tracker, Team. Figures live at defensescore.com/pricing and are never restated here.

1.3 Business Use Only. The Service is intended for use by businesses for business purposes.

1.4 DefenseScore Is Software, Not a C3PAO or Assessment. DefenseScore is a software vendor providing a self-assessment computation and tracking tool. DefenseScore is not a C3PAO (a CMMC Third-Party Assessment Organization), not an assessment, not a third-party assessor, and does not certify CMMC compliance. DefenseScore does not: - Certify, attest to, or guarantee the accuracy or sufficiency of any self-assessment score - Act as your representative or agent before the U.S. Department of Defense ("DoD"), the Defense Counterintelligence and Security Agency ("DCSA"), or any U.S. Government agency - Submit your SPRS self-assessment to SPRS on your behalf - Provide legal advice, compliance advice, or legal opinions - Perform, supervise, or review security control implementations on your behalf

You compute, review, and submit your own SPRS self-assessment score using the official SPRS system. DefenseScore produces a Submission Sheet that you enter into SPRS; DefenseScore does not submit to SPRS for you. See the standalone Disclaimers at defensescore.com/disclaimers for the full framing.

1.5 Score Is Computed From Customer-Provided Information. The SPRS score and POA&M the Service generates are computed entirely from the control-status information you enter. You are solely responsible for the accuracy of the information you provide and for what you submit to SPRS. A score that reflects incorrect control statuses is the Customer's responsibility; DefenseScore computes the methodology math, not the underlying truth of your control implementation.

1.6 No Affiliation, Endorsement, or Government Action. DefenseScore is not affiliated with, endorsed by, sponsored by, or officially recognized or supported by the U.S. Department of Defense ("DoD"), the Defense Counterintelligence and Security Agency ("DCSA"), the CMMC Accreditation Body, the Supplier Performance Risk System ("SPRS"), or any other U.S. federal or state government agency, or the U.S. Government in any way. DefenseScore does not predict, forecast, or represent how DoD, DCSA, a contracting officer, or any other government agency will assess, review, or act on any Customer's self-assessment score, POA&M, or Submission Sheet, and DefenseScore does not act, and is not authorized to act, on behalf of DoD, DCSA, or any other government agency or the U.S. Government in any capacity. Using DefenseScore does not create a CMMC certification, a C3PAO assessment, or any government-recognized status. DefenseScore's Submission Sheet, marketing pages, and app UI render as plain text/typography only — no seal, badge, ribbon, watermark, or certificate-style graphic, or other supportive-looking insignia — so no surface visually or verbally suggests such affiliation, endorsement, sponsorship, official recognition, predictive authority, or action on any government agency's behalf.

2. Account

2.1 Account creation requires an authorized representative of the Customer entity.

2.2 Each seat is for a single named individual. Seat-sharing is prohibited. Team members (Team tier only) are managed through the Settings → Team flow under flat single-tenant membership.

3. Subscriptions, Pricing, Billing

3.1 Tracker and Team are monthly subscriptions, billed via Stripe; annual pricing is shown at defensescore.com/pricing.

3.2 Pricing at defensescore.com/pricing. 30-day notice for material changes.

3.3 Billing via Stripe.

3.4 Free Calculator. The Free Calculator is available without a subscription. Sessions are ephemeral; no data is persisted between sessions. Email capture may be offered in exchange for a session link. The Free Calculator includes the full 110-control score computation (not crippled math) and a single-session POA&M draft.

3.5 Refunds. Monthly fees are non-refundable for the current period except pro rata on our material breach or on discontinuation under §10.

3.6 No Service-Level Credits or Refunds. The Service carries no uptime or response-time commitment. No service credit, fee credit, refund, or other remedy arises from any delay, outage, missed response target, or unmet support expectation. The §12.1 limited-warranty remedy and the §10.2 pro-rata refund on our own discontinuation remain the only remedies.

4. Customer Data; Flat Multi-Tenancy

4.1 Ownership. As between us, you own all Customer Data you submit ("Customer Data"), including your organization name, Commercial and Government Entity ("CAGE") code, scope, System Security Plan ("SSP") information, control-status entries, and the records the Service generates for you.

4.2 License to Us. You grant us a limited license to host, store, transmit, display, and process Customer Data solely to provide the Service (including computing scores, tracking POA&M items, managing the affirmation cadence, and generating the Submission Sheet).

4.3 No Training / No Selling. We do not sell or share Customer Data, and we do not use it to train any model or to improve a Service used by other customers. See our Privacy Policy.

4.4 Flat Per-Tenant Isolation. Each business is one tenant. Single-level isolation is enforced: every tenant-scoped read and write routes through tenant-scoping helpers that raise if the scope is missing, so no tenant can access another tenant's data. There is no nested tenancy and no white-label resale in v1.

5. Acceptable Use

5.1 No reverse engineering, no scraping, no building a competing product from the Service, no resale.

5.2 SPRS Submission Is Yours. Any self-assessment score you submit to SPRS is submitted by you, through the official SPRS system, based on information you have provided and verified. DefenseScore does not submit anything to SPRS on your behalf.

5.3 No Misrepresentation of Certification. You will not represent to any party that DefenseScore has certified, assessed, or otherwise validated your CMMC compliance, SPRS score, or security posture.

6. Service Outputs, Score Accuracy, and Compliance Disclaimers

6.1 Self-Assessment Computation, Not Certification. The SPRS score and POA&M the Service generates are a computation of the DoD Assessment Methodology v1.2.1 applied to the control statuses you enter. They are not a C3PAO assessment, not a certification, not a legal opinion, and not a compliance guarantee. You are solely responsible for the accuracy of the information you provide and for what you submit to SPRS.

6.2 Show-Your-Work Auditability. The Service shows the weight (5/3/1) and point effect of each control in the score derivation. This is provided so you can audit the computation; it is not a representation that the derivation is the final or official DoD assessment of your score.

6.3 Methodology Currency. The Service is computed to NIST SP 800-171 Rev 2 per the DoD Assessment Methodology v1.2.1 as of its implementation date. Verify against current DoD guidance for your contract. A Rev 3 migration path is architecturally planned but not built in v1. It is your responsibility to ensure you are using the correct revision for your DFARS clause.

6.4 No Guarantee of DoD Acceptance. We do not warrant that any score, POA&M, or Submission Sheet the Service generates will be accepted by DoD, DCSA, a contracting officer, or any U.S. Government component, or will satisfy any DFARS clause or CMMC requirement. Regulatory acceptance depends on your underlying security implementation and is your responsibility.

6.5 FCA Posture. DefenseScore is a tool to help you compute and track your self-assessment score with show-your-work accuracy. It is not a representation that a score generated by the Service is truthful or accurate as to your actual security posture — only you know whether your marked control statuses accurately reflect your implementation. Submitting a false SPRS self-assessment is your responsibility under the False Claims Act ("FCA"). DefenseScore is not liable for any FCA exposure arising from your submission of a score to SPRS.

6.6 No Autonomous Submission. DefenseScore does not submit, transmit, or upload any score, POA&M, or Submission Sheet to SPRS, DoD, DCSA, or any other U.S. Government system on your behalf. You review the computed output and submit it yourself, through your own SPRS account. Because a submission reaches a government system outside your control once made, this sits in the stricter tier of our consequence-scaled no-autonomous-action approach — see also §7, whose POA&M and affirmation handling is likewise never auto-submitted.

7. POA&M and Affirmation Management

7.1 The Service tracks POA&M items and affirmation cadences as a software tool. The customer is responsible for: - Taking timely remediation action on POA&M items within the 180-day closeout period - Completing and submitting the annual affirmation to SPRS by the required deadline - Ensuring the Affirming Official is properly identified and authorized

DefenseScore helps you not miss a deadline; it cannot and does not meet compliance obligations for you.

7.2 POA&M Eligibility Enforcement. The Service enforces the DoD POA&M eligibility rules (5-pt controls and hard-blocked 1-pt controls cannot be placed on a POA&M). This enforcement is provided as a correctness safeguard. The Customer remains responsible for ensuring their POA&M is compliant with the applicable DFARS clause and DoD guidance.

8. Intellectual Property

8.1 Service IP. We own the Service, including the scoring engine, POA&M lifecycle logic, affirmation manager, and Submission Sheet generator. No rights are granted except as expressly set forth.

8.2 Feedback. Standard perpetual-license grant on feedback.

8.3 Customer References. We may identify you as a customer (name, logo) on the customers page unless you opt out.

8.4 IP & Assignment Rider. An IP & Assignment Rider addressing ownership and assignment of intellectual property is incorporated by reference into these Terms and controls over this §8 and over §15.4 on the subjects within its scope.

8.5 Present assignment of Derivative IP. To the extent any Derivative IP would otherwise vest in Customer — by operation of law, under any work-made-for-hire or commissioned-work doctrine, because Customer's use, Inputs, or Feedback contributed to it, or on any other basis — Customer hereby irrevocably and presently assigns to Company all right, title, and interest in and to that Derivative IP, effective automatically upon its creation and without further action or consideration.

9. Privacy and Data Processing

9.1 Privacy Policy at defensescore.com/privacy. We are the controller for marketing-site visitors and Customer account/billing contacts, and the processor for the compliance data you place under your tenant. Where the Data Processing Addendum and these Terms conflict as to the processing of Customer Data, the DPA controls; this Privacy Policy is a notice, not a contracting instrument.

10. Suspension and Termination

10.1 By You. Cancel anytime; effective at the end of the paid monthly period. 10.2 By Us. Material breach, violation of §5 (Acceptable Use), or non-payment. 30 days' notice with pro rata refund for any discontinuation we initiate, paid within 30 days after the effective date of termination. 10.3 Effect. Customer Data deleted within 30 days of termination unless retention is required by law or export is requested. 10.4 Survival. Sections 4 (data), 6 (outputs/disclaimers), 8 (IP), 11 (Confidentiality), 12 (Warranties), 13 (Liability), 14 (Indemnification), 15 (General) survive.

11. Confidentiality

Treat all Customer Data as confidential information; standard confidentiality commitments; 5-year survival; trade-secret indefinite.

12. Warranties and Disclaimers

12.1 Limited Warranty. The Service performs substantially per documentation. Exclusive remedy: repair or pro rata refund.

12.2 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN §12.1, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS, NON-INFRINGEMENT, AND ANY WARRANTY ABOUT SCORE ACCURACY, CONTROL-METHODOLOGY CURRENCY, POA&M COMPLETENESS, REMINDER DELIVERY, OR REGULATORY ACCEPTANCE OF ANY SELF-ASSESSMENT SUBMISSION.

12.3 No Warranty Re Compliance Outcome. We do not warrant that use of the Service will result in CMMC certification, a compliant SPRS self-assessment, DoD contract award, or satisfaction of any regulatory requirement. Compliance depends on your underlying security implementation and the accuracy of the information you provide.

13. Limitation of Liability

13.1 TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, LOST REVENUE, LOST DATA, OR ANY DAMAGES ARISING FROM A FAILED CONTRACT, DISQUALIFIED BID, REGULATORY ACTION, OR FCA PROCEEDING, EVEN IF ADVISED.

13.2 OUR TOTAL CUMULATIVE LIABILITY ARISING FROM OR RELATED TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE FEES YOU PAID US IN THE TWELVE MONTHS PRECEDING THE CLAIM. The Free Calculator's liability is separately limited to USD $100, unaffected by this correction.

13.3 No Liability for Regulatory Outcomes. We are not liable for: any finding, inquiry, investigation, determination, or enforcement action by any regulatory, administrative, or enforcement body of any kind — including without limitation the U.S. Government, DoD, DCSA, the Department of Justice (including any qui tam relator or other False Claims Act ("FCA") proceeding), any contracting officer or agency, or any other federal, state, or other regulator — regarding your SPRS score, CMMC certification status, contract eligibility, or your submission of a score to SPRS; any reliance you place on a score, POA&M, or Submission Sheet the Service generates; any disqualification, debarment, or contract action arising from your SPRS self-assessment; or any allegation arising from your representation to any party about our role or our relationship to the U.S. Government or any other regulatory or enforcement body. This carve-out is stated as broadly as possible and applies uniformly regardless of the specific statute, regulation, or regulatory or enforcement body involved; a party asserting that this carve-out does not apply to a particular claim, statute, or regulatory or enforcement body bears the burden of establishing that, rather than us bearing the burden of having disclaimed each one individually.

14. Indemnification

14.1 Stated in the contract you execute. Both indemnities — ours for IP infringement and yours — are stated in full on the face of §7 of the DefenseScore Engagement & Tiers SOW ("7. Indemnification — the executed-instrument provision"). That §7 is the indemnification block carried on the face of the click-signed Order Form you accept, rendered above the agree control. Those provisions govern; this §14 is a cross-reference and does not restate them.

14.2 No separate indemnity. These Terms state no indemnification obligation separate from, additional to, or narrower than SOW §7, and nothing in these Terms enlarges or limits it. Where these Terms refer to the §14 indemnity (§10.4 survival), the reference is to SOW §7.

15. General Provisions

15.1 Governing Law. Colorado. The United Nations Convention on Contracts for the International Sale of Goods ("CISG") does not apply. 15.2 Disputes. Binding arbitration via JAMS in Boulder County, CO. Each party waives any right to a jury trial and to participation in any class, collective, or representative proceeding. Either party may seek injunctive relief in court for §5, §6, §8, or §11 breaches. 15.3 Notices, Force Majeure, Entire Agreement, Modifications (30-day), Severability, No Waiver, Independent Contractors. Standard. Written notice under these Terms (email to the billing contact or in-product notice) is deemed given when sent or first displayed; any notice period runs from that date, and failure to read a notice does not extend it. 15.4 Assignment; Change of Control. You may not assign, delegate, or transfer these Terms, in whole or in part, whether by operation of law, merger, or change of control, without our prior written consent; any attempted assignment in violation of this sentence is void. We may, without your consent and without notice except as any applicable data-protection law requires, assign or transfer these Terms and all of our rights and obligations under them, in whole or in part, (a) to a successor or acquirer in connection with a merger, acquisition, or sale of substantially all of our business or assets, or (b) to an affiliate, subsidiary, or newly formed entity in connection with a corporate conversion, reorganization, or contribution or drop-down of assets undertaken to effect a sale, reorganization, or transfer of the specific business line or product to which these Terms relate. Upon such an assignment, all of our rights under these Terms pass to the assignee, the assignee assumes our obligations arising after the assignment, and your continued use of the Service constitutes acknowledgment of the assignee as "DefenseScore" going forward. A change in our ownership, control, equity holders, or entity form is not a breach of, default under, or ground to terminate, suspend, renegotiate, or re-price these Terms, and does not trigger any right of termination, consent, first refusal, most-favored-nation, audit, or refund on your part. This §15.4 controls over any contrary term in a Customer purchase order or procurement addendum.

15.5 Regional and Supplemental Terms. No jurisdiction-specific supplemental term applies today. Where a supplemental jurisdiction-specific term applies, it controls over a conflicting general term of these Terms for that jurisdiction only.

Contact

DefenseScore — Ellis Intelligence LLC Email: [email protected] Address: 1500 N Grant St, Ste N, Denver, CO 80203, USA