The agreement, written to be read.

Index8 is a security readiness platform: it helps your business check common security gaps, organize evidence, prepare practical policies, and produce a review-ready summary. Index8 is not a law firm, an insurance advisor, a certification body, a managed security provider, or a breach prevention service. Nothing in the product is legal, insurance, or professional security advice, and important decisions should be reviewed with qualified professionals.

You need an account to use the workspace, and you are responsible for keeping your credentials safe and for the people you invite. The workspace owner controls billing, integrations, member roles, and sharing. You must be authorized to act for the business you register.

Paid plans are billed through Stripe on the schedule you choose at checkout. You can cancel anytime from the billing portal; paid time runs to the end of the current period. Prices for new subscriptions can change; an active subscription keeps its rate while it remains active, and Founding rates remain in place for as long as the subscription stays active. Index8 never sees or stores your card details.

Your workspace content belongs to you. You give Index8 permission to store and process it solely to operate the product for you. You are responsible for having the right to upload what you upload, and for not storing material we ask you to keep out (regulated identifiers, card numbers, credentials). Our handling of personal information is described in the privacy policy.

Scores, levels, checks, and generated documents are educational readiness information built from the inputs available to the product. Labels such as "checked" and "verified" describe how a specific item was supported at a point in time; they are not certifications of your business, guarantees of insurance outcomes, or assurances that no security incident will occur. Drafted documents are starting points that require your review and approval.

Do not use Index8 to break the law, probe systems you do not control, misrepresent readiness information to others, resell access without an agreement, or interfere with the service. Public checks may only be run against domains you control or have permission to assess. We may suspend accounts that abuse the platform, and we will tell you why.

Optional integrations connect with read-only scopes you approve in your provider's consent screen. You can disconnect at any time, which stops future access. Third-party services have their own terms.

Index8 is provided as-is, without warranties of any kind to the extent the law allows. To the same extent, Index8's total liability for any claim is limited to the amount you paid us in the twelve months before the claim arose, and neither side is liable for indirect or consequential damages. Nothing here limits liability that cannot be limited by law.

You can stop using Index8 and delete your data at any time (see the privacy policy for how). We can end or suspend service for material breach of these terms, with notice where practical. Sections that by their nature should survive (your content rights, disclaimers, limits) survive termination.

If these terms change in a way that matters, we will update the date above and note the change on this page before it takes effect. These terms are governed by the laws of the United States and the state where Index8 is organized. Questions go to support@index8.app.