Terms of service

• Cyber Ambush is a cloud-hosted tabletop exercise platform operated by Sterling Readiness Group, LLC.
• The platform runs discussion-based cyber tabletop exercises on a shared clock, releases time-phased injects, records decisions and produces an after-action review and improvement plan.
• Exercises are conducted against synthetic scenario content. The platform does not connect to, test or interact with your production systems.
• We may change, improve or discontinue features. We will not materially reduce the functionality of a paid subscription during its term without notice to you.

• You decide who holds the Executive Sponsor, Operator, Participant and Evaluator roles in your organization, and you may change those assignments at any time. Each account holds one role at a time. An observer — an auditor, insurer or board member who only watches — is invited into the read-only Evaluator seat and is not a separate role.
• You are responsible for the accounts created under your organization, for keeping credentials confidential, and for all activity that occurs under them.
• You are responsible for confirming that each person you invite is entitled to see the exercise content shared with them.
• You will notify us promptly if you believe an account has been compromised or is being used without authorization.

• You must not enter regulated personal data, live case material or production secrets into an exercise, an inject, a response or a contact form. This matches the content rules published on our security and compliance page.
• Exercise content must be synthetic. Do not use real credentials, real customer records, real health or payment data, or material from an active investigation or legal matter.
• You must not attempt to break, probe or circumvent the platform's access controls, or use the platform to attack any system.
• You must not resell, sublicense or provide the platform to a third party except as agreed in a written partner or reseller arrangement.
• We may remove content that violates these rules and, where the violation is serious or repeated, suspend the account.

• Cyber Ambush produces exercise evidence: the objectives, the inject timeline, the decisions your team recorded, the timestamps and the resulting after-action review and improvement plan.
• We do not issue an attestation, and we do not certify, accredit or audit your program, your controls or your compliance posture.
• Framework mappings shown in the platform are informational aids to help you locate the exercise within a framework. They are not a determination that you satisfy any control or legal obligation.
• The same limits are stated on our security and compliance page.

• The platform uses artificial intelligence to help draft scenario material, assess responses and prepare after-action content.
• Every AI-generated assessment, score, rating or narrative is advisory. It is a draft for a human to review.
• A human Executive Sponsor or Operator reviews and owns every final rating and every after-action review before it is circulated.
• AI output can be incomplete or wrong. You should not rely on it as the sole basis for a regulatory, legal, financial or operational decision.

• You own your exercise content: your objectives, your planning guidance, your Participants' responses and decisions, and the after-action reports your exercises produce.
• You grant us a limited license to host, process and display that content solely to operate the platform and deliver the service to you.
• We own the platform itself, including the software, the inject library, the scenario library, templates, framework mappings and all related documentation.
• Nothing in these terms transfers ownership of our library or platform to you. Your subscription is a right to use them for your own exercises.
• We may use aggregated, de-identified operational statistics to improve the service. We do not train models on your exercise content.

• Fees, tiers, seat counts and the term, renewal and cancellation terms are set out on the pricing page and in your signed order form. If they conflict, the order form controls.
• Subscription terms run for 12 months and renew automatically unless either party cancels at least 30 days before the end of the term.
• Prices are stated in United States dollars and exclude applicable sales tax, VAT or GST.
• Fees are payable in advance for the term. Fees already paid are not refundable except where required by law or expressly agreed in the order form.
• A single exercise purchase must be scheduled and run within 6 months of the signed order form.

• You may terminate by canceling in line with the term above. We may terminate or suspend access for non-payment, or for a material breach of these terms that is not cured within 30 days of notice.
• We may suspend access immediately, with notice as soon as practicable, where continued access presents a security risk to the platform or to other customers.
• You may export your after-action reports and exercise records at any time while the account is active. Export before termination takes effect.
• On written request, whether during the subscription or after termination, we will permanently delete your organization's exercise data and personal data within 30 days and confirm when the deletion is complete, consistent with the retention commitment on our security and compliance page. We will retain data beyond that period only where applicable law requires it, and only for as long as that requirement lasts.

The service is provided "as is" and "as available". To the fullest extent permitted by law, we disclaim all warranties, whether express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, non-infringement, and any warranty arising from course of dealing or usage of trade. We do not warrant that the service will be uninterrupted or error-free, that AI-generated content will be accurate or complete, or that use of the platform will prevent, detect or mitigate any actual security incident.

• To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost revenue, lost data or business interruption, even if advised of the possibility.
• Each party's total aggregate liability arising out of or relating to these terms is limited to the fees you paid or owed for the 12 months immediately before the event giving rise to the claim.
• These limits do not apply to your obligation to pay fees, to either party's liability for fraud or willful misconduct, or to any liability that cannot be limited under applicable law.

• You will defend and indemnify us against third-party claims arising from your exercise content, from your breach of the acceptable use rules above, or from your use of the service in violation of law.
• We will defend and indemnify you against third-party claims alleging that the platform, as provided by us and used in line with these terms, infringes that party's intellectual property rights.
• The indemnified party must give prompt notice of the claim, allow the indemnifying party to control the defense, and provide reasonable cooperation.

• This agreement is governed by the laws of the State of Tennessee, without regard to its conflict of laws rules.
• The parties submit to the exclusive jurisdiction of the state and federal courts located in Davidson County, Tennessee.
• Jurisdiction reflects Sterling Readiness Group, LLC's state of organization. Like the rest of this document, this clause is pending legal review.

• Our Data Processing Addendum sets out the controller and processor roles, the categories of data subjects and personal data, and the security, breach-notification, deletion and audit obligations that apply to personal data processed through the platform.
• The DPA is incorporated into these terms by reference and takes effect when you enter a paid subscription or otherwise execute it.

• We may update these terms. The effective date at the top of the page shows when they were last revised. Material changes take effect at your next renewal.
• Questions about this contract, including these terms, should be sent through the contact page, or in writing to Sterling Readiness Group, LLC, 41 Peabody St, Nashville, TN 37210, United States. Formal legal notices should go to that postal address.