Terms of Service

These Terms of Service (the "Terms") govern your access to and use of the corporate website axeliacybersecurity.com, the ISMShed multi-tenant GRC SaaS platform accessible at grc.ismshed.ai (the "Platform"), and the professional cybersecurity and compliance services provided by Axelia Digital SL ("Axelia", "we", "us"). Please read them carefully. By accessing our website, creating an account, subscribing to the Platform, or engaging our services, you agree to be bound by these Terms. If you do not agree, do not use our website, Platform, or services.

1. Who we are and acceptance of these Terms

The provider of the website, the Platform and the services is:

• Legal entity: Axelia Digital SL

• Tax ID (CIF/NIF): B-72889611

• Registered address: Rambla Poblenou 164, 08018 Barcelona, Spain

• Contact email: compliance@axeliacybersecurity.com

These Terms constitute a binding agreement between you (or the organisation you represent) and Axelia. Where you accept these Terms on behalf of an organisation, you represent that you have authority to bind that organisation. For the Platform and for professional services, these Terms are complemented by the specific subscription order, quotation, statement of work, or service contract you sign; in the event of conflict, that specific signed document prevails over these Terms for the matters it covers.

2. Definitions

In these Terms:

• "Platform" means the ISMShed GRC SaaS application and its features, hosted at grc.ismshed.ai.

• "Services" means the professional services Axelia provides, including Red Team & Offensive security testing, GRC & Compliance consulting, and Managed Security.

• "Customer" means the individual or organisation that subscribes to the Platform or contracts the Services.

• "User" means an individual authorised by the Customer to access the Platform under the Customer's subscription.

• "Customer Data" means the data the Customer or its Users upload to, or generate within, the Platform.

• "Engagement" means a defined package of Services delivered under a statement of work, quotation, or service contract (the "SOW").

3. Scope of these Terms

These Terms apply to three distinct relationships: (a) general visitors who browse our website; (b) Customers and Users of the Platform; and (c) Customers who contract our professional Services. Some sections apply only to one of these — for example, the licence terms in section 5 apply to Platform use, and the authorisation warranty in section 7 applies to security-testing Services. Where a section is specific, it says so. Our Privacy Policy, available on our website, forms part of these Terms and describes how we process personal data.

4. Eligibility and accounts

To use the Platform or contract Services you must be of legal age and have capacity to enter into a binding contract; the Platform is intended for organisations and their professional users and is not directed at minors. You are responsible for the accuracy of the registration information you provide, for keeping your credentials confidential, and for all activity that occurs under your account. You must notify us promptly of any unauthorised use of your account or credentials. You are responsible for ensuring your Users comply with these Terms.

5. The ISMShed Platform and licence

Subject to your subscription and to these Terms, Axelia grants the Customer a non-exclusive, non-transferable, revocable right to access and use the Platform during the subscription term, for the Customer's own internal compliance and security management. The subscription tier you select determines the features, user seats, organisations and storage available to you. In using the Platform you agree that you will not:

• copy, modify, reverse-engineer, decompile, or attempt to derive the source code of the Platform, except to the extent this restriction is prohibited by applicable law;

• resell, sublicense, rent, or make the Platform available to any third party except your authorised Users;

• circumvent or disable any security, tenant-isolation, or access-control feature of the Platform;

• upload malicious code or use the Platform to store or transmit unlawful, infringing, or harmful content;

• use the Platform to build a competing product or service, or to benchmark it for a competitor.

We may update, improve, or modify the Platform's features over time. We aim to provide continuity of service, but the specific features available are those of your current subscription tier. Where the Customer enters Customer Data about its own employees, suppliers, or third parties, the Customer is the data controller and Axelia acts as data processor under the data processing agreement referenced in our Privacy Policy.

6. Professional services (Red Team, GRC, Managed Security)

Axelia provides professional Services that are contracted separately from the Platform, each governed by a specific SOW that defines its scope, deliverables, timeline, fees, and rules of engagement. Our Services include:

• Red Team & Offensive security: authorised penetration testing and adversary-simulation engagements, delivered strictly within an agreed scope and authorisation (see section 7).

• GRC & Compliance consulting: advisory and implementation support for frameworks such as ISO 27001, ENS, NIS2, DORA, SOC 2, and GDPR.

• Managed Security: ongoing security monitoring and response services, which may be delivered together with third-party technology partners.

Unless the SOW states otherwise, Services are provided on a professional best-efforts basis using reasonable skill and care consistent with industry standards. Nothing in our Services constitutes legal advice; where a compliance outcome depends on legal interpretation, you should obtain independent legal counsel. Certification and attestation decisions are made by the relevant accredited bodies or auditors, not by Axelia.

7. Authorisation for security testing

This section is essential and applies to all Red Team, offensive-security, and penetration-testing Services. You may only instruct Axelia to test systems, applications, networks, or assets that you own or for which you hold documented, lawful authorisation to authorise testing. Before any testing begins, you must provide written authorisation identifying the in-scope targets and confirming your right to authorise the work; testing is performed only within that agreed scope and rules of engagement. You warrant that the authorisation you provide is valid and that testing the in-scope targets will not breach any third-party rights or contracts (for example, a cloud provider's terms). Security testing carries inherent risk; where an engagement is conducted within the agreed scope and rules of engagement, Axelia is not liable for effects that are an unavoidable consequence of authorised testing. Axelia will conduct engagements professionally and will not knowingly exceed the authorised scope.

8. Acceptable use

When using our website, the Platform, or the Services, you agree not to:

• use them for any unlawful purpose or in breach of any applicable law or regulation;

• infringe the intellectual property, privacy, or other rights of Axelia or any third party;

• attempt to gain unauthorised access to our systems, other tenants' data, or any system you are not authorised to access;

• interfere with or disrupt the integrity or performance of the website, Platform, or Services;

• misuse security findings or deliverables to harm third parties or to conduct unauthorised activity.

9. Fees, billing, and taxes

Fees for the Platform and Services are set out in the applicable subscription order, quotation, or SOW. Unless stated otherwise, fees are exclusive of applicable taxes (including VAT/IVA), which are added where required by law. Platform subscriptions are billed in advance for the subscription period and, unless the order states otherwise, renew for successive periods; you may prevent renewal by giving notice before the renewal date. Service fees are invoiced as set out in the SOW. Invoices are payable within the period stated on the invoice; late payment may result in suspension of access in accordance with section 17. Fees already paid are non-refundable except where required by law or expressly agreed in writing.

10. Intellectual property

Ownership is allocated as follows:

• Axelia IP: the Platform, its software, design, documentation, methodologies, and all related intellectual property remain the exclusive property of Axelia and its licensors.

• Customer Data: the Customer retains all ownership of its Customer Data. The Customer grants Axelia the limited right to process it as necessary to provide the Platform and Services.

• Deliverables: on full payment, the Customer receives a licence to use the reports and deliverables produced under an Engagement for its own internal security and compliance purposes.

Axelia retains ownership of its pre-existing know-how, tools, and methodologies used to produce deliverables, and may use anonymised, aggregated information that does not identify the Customer to improve its Services. You may not use Axelia's name, logos, or trademarks without our prior written consent, except to factually state that you are a customer where permitted.

11. Customer data and data protection

Our processing of personal data is described in our Privacy Policy, which forms part of these Terms and is drafted in accordance with the GDPR and Spanish LOPDGDD. Where Axelia processes personal data on the Customer's behalf (for example, personal data the Customer enters into the Platform), the parties' respective roles as controller and processor, and the security and confidentiality obligations, are governed by the data processing agreement (Art. 28 GDPR) referenced in the Privacy Policy. Axelia applies technical and organisational security measures consistent with ISO/IEC 27001 and the Spanish National Security Framework (ENS), MEDIUM category (RD 311/2022), and hosts Platform data within the European Union.

12. Confidentiality

Each party may receive confidential information of the other — including, for Services, security findings, vulnerabilities, and system details. Each party agrees to keep the other's confidential information secret, to use it only to perform or receive the Platform and Services, and to protect it with at least reasonable care. This obligation does not apply to information that is or becomes public without breach, was already lawfully known, is independently developed, or must be disclosed by law or competent authority. Security findings and reports produced during an Engagement are treated as the Customer's confidential information and are handled by Axelia with particular care.

13. Third-party services and sub-processors

We rely on reputable third-party providers to deliver the website, Platform, and Services, including:

• Google Cloud Platform (GKE) — Platform hosting, within the European Union.

• Twilio SendGrid — delivery of transactional and contact-form emails.

• Cloudflare — content delivery and perimeter security for our public websites.

• Technology partners used to deliver Managed Security services, as identified in the applicable SOW.

14. Warranties and disclaimers

Axelia provides the Platform and Services with reasonable skill and care. Except as expressly stated in these Terms or an applicable SOW, and to the maximum extent permitted by law, the website, Platform, and Services are provided "as is" and "as available", and Axelia disclaims all other warranties, whether express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement. No security assessment, tool, or platform can guarantee that a system is free of all vulnerabilities or that a certification will be granted; Axelia does not warrant that the Platform will be uninterrupted or error-free, or that use of the Services will detect every vulnerability or guarantee any particular compliance or audit outcome.

15. Limitation of liability

To the maximum extent permitted by applicable law, neither party will be liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profits, revenue, data, or goodwill, arising out of or relating to these Terms, even if advised of the possibility. To the maximum extent permitted by law, Axelia's total aggregate liability arising out of or relating to the Platform or an Engagement will not exceed the total fees paid by the Customer to Axelia for the Platform subscription or the specific Engagement giving rise to the claim during the twelve (12) months preceding the event. Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence, fraud, or wilful misconduct.

16. Indemnification

The Customer agrees to indemnify and hold Axelia harmless from third-party claims, losses, and reasonable expenses arising from the Customer's breach of these Terms, the Customer's unlawful use of the Platform or Services, or — for security-testing Services — the Customer's failure to hold valid authorisation over the targets it instructed Axelia to test, as required by section 7. Each party's indemnity obligations are subject to the indemnified party promptly notifying the other of the claim and cooperating in its defence.

17. Term, suspension, and termination

These Terms remain in force while you use the website, hold a Platform subscription, or receive Services. In addition:

• Either party may terminate a subscription or Engagement as set out in the applicable order or SOW, or for the other party's material breach that remains uncured after a reasonable cure period.

• We may suspend access to the Platform for non-payment, for a security risk, or for a serious breach of these Terms, giving notice where practicable.

• On termination, your right to access the Platform ends; we will make Customer Data available for export for a limited period as described in the applicable order, after which it may be deleted subject to legal retention obligations.

• Provisions that by their nature should survive termination — including intellectual property, confidentiality, limitation of liability, and governing law — will survive.

18. Changes to these Terms and the Services

We may update these Terms to reflect changes in law, regulation, our Services, or our business. The version in force is the one published on our website with its version number and last-updated date. For material changes affecting an active subscription or Engagement, we will provide reasonable notice. Your continued use of the website, Platform, or Services after the changes take effect constitutes acceptance of the updated Terms; if you do not accept them, you should stop using the affected service.

19. Governing law and jurisdiction

These Terms are governed by Spanish law. To the extent permitted by applicable law — and without prejudice to any mandatory consumer-protection rights — the parties submit any dispute arising out of or relating to these Terms to the exclusive jurisdiction of the courts of the city of Barcelona, Spain. Where a specific SOW or subscription order contains its own governing-law or jurisdiction clause, that clause prevails for the matters it covers.

20. Miscellaneous

If any provision of these Terms is held invalid or unenforceable, the remaining provisions remain in full force. Our failure to enforce a right is not a waiver of it. You may not assign these Terms without our prior written consent; we may assign them in connection with a merger, acquisition, or reorganisation, ensuring the continuity of these Terms. Neither party is liable for delay or failure caused by events beyond its reasonable control (force majeure). These Terms, together with the applicable order or SOW and our Privacy Policy, constitute the entire agreement between the parties regarding their subject matter.

21. Contact

If you have any questions about these Terms, please contact us at compliance@axeliacybersecurity.com. We will be happy to help.