Terms of Service
Effective date: 16 October 2026 · Operator: Danger Close Security Co, a for-profit business organized in New Jersey ("the Company", "we") · Contact: support@certif.ly
These Terms of Service ("Terms") govern your access to and use of Certifly (certif.ly), a platform that imports third-party system configuration, versions it over time, and evaluates audit rules against it (the "Services"). The Privacy Policy and the Cookie & Local Storage Policy are part of these Terms.
1. Who may use the Services
The Services are for business use only. They are offered to organizations, and to people acting on an organization's behalf, for auditing that organization's own systems. They are not offered for personal, family or household use.
By creating an account, accepting an invitation, or using the Services, you confirm that you are at least 18 years old and that you have authority to accept these Terms for the organization you use them for. "You" means both you and that organization.
2. The service is provided best-effort, "AS IS"
Certifly is operated on a best-effort basis. We work to keep it available, fast and correct, but we make no promises.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, SECURE, ERROR-FREE, OR FREE OF DATA LOSS, OR THAT DEFECTS WILL BE CORRECTED. NO ADVICE OR INFORMATION OBTAINED FROM US CREATES ANY WARRANTY NOT EXPRESSLY STATED HERE.
You acknowledge that transmitting configuration and credentials over the internet involves inherent security, privacy and technical risks, and that no digital environment or transmission is entirely secure. We implement administrative, physical and technical safeguards, but we do not guarantee them.
3. Your data stays yours
3.1 Ownership
You retain all rights to the configuration imported on your behalf, the rules you write, the exceptions you record, the policies you publish, and everything else you put here ("Customer Data"). The Company claims no ownership over any of it.
3.2 Limited license
The Company is granted a strictly limited, non-public, non-transferable license to host, store, process and render Customer Data for the sole purpose of operating the Services for you and the people you authorize.
We will not sell, publish, monetize or disclose Customer Data to third parties, and will not use it to train machine-learning models. We do not aggregate it across customers.
3.3 What you choose to publish
If you publish a policy through a share link, or give an auditor a link to an audit period, the people holding that link can read what it shows. You decide what to publish and who receives the link, and you can revoke it at any time.
4. Connecting a system
This is the section specific to what Certifly does, and it has real consequences.
4.1 Credentials
Connecting a provider means giving us a credential that can read it. You are responsible for scoping that credential to the minimum the audit needs (every integration lists the exact permissions it requires) and for rotating or revoking it when you disconnect.
4.2 Data about other people
Importing configuration means importing information describing your users: their names, addresses, group memberships, administrative roles and authentication posture. For that data you are the controller and we are your processor. You are responsible for having a lawful basis to bring it here and for any notice your law requires you to give the people it describes. See the Privacy Policy, section 6.
4.3 Authority
You represent that you are authorized to connect each system you connect, and to grant us access to read its configuration.
5. Your responsibilities
- Keep your account credentials secure, and manage who you invite and what role you give them.
- Do not use the Services to access systems you are not authorized to access, or to probe infrastructure that is not yours.
- Do not attempt to circumvent the tenancy boundary, the authorization model, or the rate limits.
- Do not use the Services in violation of applicable law.
5.1 Indemnification
You agree to defend, indemnify and hold harmless the Company and its officers, directors, employees and agents from and against any third-party claims, damages, liabilities, costs and expenses (including reasonable attorneys' fees) arising out of: (a) your Customer Data; (b) your use of the Services in breach of these Terms; (c) your connecting a system you were not authorized to connect; or (d) your violation of any law or third-party right. The Company may, at your expense, assume the exclusive defense of any matter subject to indemnification, and you agree to cooperate with that defense. This obligation survives termination of these Terms.
6. Fees and billing
6.1 Plans
The plans, their prices and what each includes are published at certif.ly/pricing and form part of these Terms. A free plan is offered and may be changed or withdrawn at any time; paid plans are billed in US dollars.
Payment is processed by Stripe. Card details are entered on Stripe's pages and are never received, transmitted or stored by the Company.
6.2 What is counted on a usage-priced plan
Some plans charge by usage. Two things are counted, and it matters that you read what they are before choosing one:
- People. A "person" is a distinct human identity the Services resolve from the systems you have connected, not the number of people who sign in to Certifly. One person holding several accounts across several connected systems is counted once. Conversely, an identity that exists in a system you connect is counted whether or not that person has ever used Certifly, and whether or not they still work for you. Disconnecting a system, or removing an identity from it, reduces the count at the next import.
- Connected systems. Each third-party system you have connected, counted once.
Counts are measured by the Company from its own records, and those measurements are the billing record. If you believe a count is wrong, tell us within 30 days of the invoice and we will investigate; we will credit any error we find.
6.3 When you are charged
Fixed fees are charged in advance for each billing period. Usage is charged in arrears for the period in which it occurred, so the amount of a usage-priced invoice is not known until the period ends and is not capped. The calculator at certif.ly/pricing uses the same rates as the invoice.
6.4 Taxes
Prices are exclusive of taxes. You are responsible for any sales, use, VAT, GST or similar taxes arising from your purchase, except taxes on the Company's income.
6.5 Late or failed payment
If a payment fails we may retry it and will keep your plan in place for a short grace period. If it remains unpaid we may move the organization to the free plan or suspend access under section 11. Nothing is deleted when that happens.
6.6 Cancellation and refunds
You may cancel at any time through the billing portal. Cancellation takes effect at the end of the current period and you keep the paid plan until then. Fees already paid are not refunded, and usage already incurred remains payable.
6.7 Changing plans
Moving to a smaller plan is not applied retroactively. If you have connected more systems or written more policies than the smaller plan includes, they keep working; nothing is switched off or hidden. What the limit prevents is adding another one beyond it.
6.8 Price changes
We may change prices. For an organization with an active paid subscription, a change takes effect no earlier than 30 days after we notify the billing contact, and never within a period already paid for. Continuing to use a paid plan after that date is acceptance of the new price; if you do not accept it, cancel before it takes effect.
7. Availability and your own records
You are responsible for your own records. Certifly versions configuration over time and that history is valuable, but the Services are a hosting product, not an archival or escrow service. Export anything you need to keep independently.
8. Limitation of liability
8.1 No indirect damages
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL THE COMPANY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL OR ANTICIPATED SAVINGS, OR THE COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES, UNDER ANY LEGAL THEORY (CONTRACT, TORT INCLUDING NEGLIGENCE, STRICT LIABILITY OR OTHERWISE), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
8.2 Liability cap
THE COMPANY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES, FROM ALL CAUSES OF ACTION AND UNDER ALL THEORIES OF LIABILITY, WILL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID US IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED US DOLLARS. MORE THAN ONE CLAIM DOES NOT ENLARGE THIS LIMIT.
8.3 Allocation of risk
These limits are an essential basis of the bargain and apply even if a limited remedy fails of its essential purpose. They do not limit liability that the law of New Jersey does not allow to be limited.
9. The audit is evidence, not assurance
Certifly reports what the systems you connect told it, evaluated against the rules you enable. It is a tool for finding things, and it is not:
- a certification, attestation or audit opinion, and not a substitute for one;
- a guarantee that your estate is secure, or that anything it does not flag is therefore correct;
- complete: a rule can only see what the provider's API exposes, and a field the credential cannot read is reported as unknown rather than as compliant.
A finding is a prompt to look, and a clean result is not a promise. Decisions about your security posture remain yours.
10. AI features
10.1 Optional, and off until you turn them on
AI features (drafting audit rules, answering questions about your organization, and extracting policy text from documents) are off by default. An administrator of your organization turns them on, and can turn them off at any time. While they are on, the Customer Data a feature needs to answer a request is processed by a language model for that request, as described in the Privacy Policy, sections 6 and 7. Section 3.2 applies to it unchanged: it is not used to train or fine-tune any model. Conversations are not kept unless your organization turns on chat history (section 10.6).
10.2 Output is a draft
AI output can be wrong, incomplete, or exactly backwards. The Services never apply it on their own: a drafted rule is not saved, and extracted text is not published, until a person in your organization accepts it. You are responsible for reviewing AI output before you save it, publish it, or rely on it. Section 9 applies to it in full.
10.3 Your own AI provider key
If your organization saves its own AI provider key, its requests go directly to that provider under your agreement with them. You are responsible for that agreement, its charges and its data-handling terms, and the Company is not responsible for how that provider processes what it receives.
10.4 What you send
Do not submit content you are not entitled to have processed, and do not use AI features to attempt to reach data outside your organization or to get around the authorization model. Section 5 applies to AI features as to everything else.
10.5 Usage and price
AI requests are recorded per organization and shown to its administrators. AI usage is currently included in every plan. If it becomes separately priced or limited, section 6.8 applies, including its notice period.
10.6 Chat history
Chat history is off by default. If an administrator of your organization turns it on, the Services store the questions each member asks the Assistant and the Help chat and the answers they receive, so that member can return to them. Stored conversations are Customer Data: section 3 applies to them in full. Each is readable only by the member who had it, not by administrators or anyone else in your organization, and is deleted 90 days after its last message, when that member deletes it, or when an administrator turns chat history off, which deletes every stored conversation in your organization at once. The Privacy Policy, sections 1 and 11, describes what is stored and for how long.
11. Suspension and termination
You may stop using the Services and delete your organization at any time. We may suspend or terminate access for breach of these Terms, for non-payment under section 6.5, for conduct that endangers the Services or other customers, or where required by law. We will give reasonable notice where we can. Sections 3, 5.1, 8, 9, 12 and 13 survive termination.
12. Disputes
Informal first. Before starting any proceeding, send a written description of the dispute to support@certif.ly. Both parties will try in good faith to resolve it for at least thirty (30) days. Most things are resolved that way.
Courts, not arbitration. There is no arbitration clause and no class-action waiver. Any dispute that is not resolved informally will be heard exclusively in the Superior Court of New Jersey, Camden County, or the United States District Court for the District of New Jersey sitting in Camden, and both parties consent to the personal jurisdiction of those courts. Either party may still seek urgent injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.
13. Governing law
These Terms are governed by the laws of the State of New Jersey, United States, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
14. General
- Entire agreement. These Terms, with the Privacy Policy and the Cookie & Local Storage Policy, are the entire agreement between you and the Company about the Services. A separate written agreement signed by both parties takes precedence where it conflicts.
- Severability. If a court holds any provision unenforceable, that provision is enforced to the maximum extent permitted and the rest of these Terms remain in effect.
- No waiver. Not enforcing a provision is not a waiver of it.
- Assignment. You may not assign these Terms without our written consent. We may assign them to a successor in a merger, acquisition or sale of the business that operates the Services, with notice to you.
- Notices. We send notices to the email address of your organization's administrators or billing contact. You send notices to support@certif.ly.
15. Changes
We may revise these Terms. Material changes will be announced in the product with reasonable notice before they take effect, and the effective date above will change. Continuing to use the Services after that date is acceptance of the revised Terms.