Last updated: September 28, 2026
These Terms and Conditions ("Terms") govern your access to and use of the Pistos website at pistos.io, the Pistos vendor risk and compliance management platform, and any related applications, APIs, Trust Center pages, and services (together, the "Services"). The Services are provided by ITG Security LLC dba Pistos Trust Labs, a Wyoming, USA, limited liability company ("Pistos", "we", "us", or "our").
By creating an account, accepting an order, clicking to accept these Terms, or using the Services, you agree to be bound by these Terms. If you are using the Services on behalf of a company or other organization, you represent that you have authority to bind that organization, and "you" or "Customer" refers to that organization. If you do not agree, do not use the Services.
If you and Pistos have signed a separate written agreement (such as a Master Subscription Agreement) covering the Services, that agreement controls to the extent it conflicts with these Terms.
1. Definitions
- "Account" means the workspace or tenant created for a Customer to use the Services.
- "Authorized User" means an employee, contractor, or agent of Customer whom Customer permits to use the Services under Customer's Account, and who occupies a team seat.
- "Customer Data" means all data, content, documents, questionnaire responses, evidence, and other materials submitted to the Services by or on behalf of Customer, its Authorized Users, or its Respondents.
- "Respondent" means a third party (such as a vendor or supplier) that Customer invites to complete an assessment or questionnaire through the Services.
- "Trust Center" means a public or access-controlled page hosted through the Services on which Customer publishes security documentation, certifications, and related materials, and manages access and NDA requests.
- "Order" means an online sign-up, order form, or quote accepted by Customer that specifies the plan, fees, subscription term, and usage limits.
- "Client" means, for a Partner, a third-party organization for which the Partner uses the Services to manage vendor risk or compliance.
- "Partner" means a managed service provider (MSP), consultancy, or other reseller or service provider that uses the Services to serve its Clients, including through multi-tenant features.
2. Eligibility and Business Use
The Services are intended for business and professional use only. You must be at least 18 years old and able to form a binding contract to use the Services. The Services are not directed to consumers, and you agree not to use them for personal, family, or household purposes.
3. Accounts and Access
3.1 Registration. You must provide accurate, complete, and current information when creating an Account and keep it up to date.
3.2 Credentials. You are responsible for safeguarding all login credentials and for all activity that occurs under your Account. Notify us promptly at support@pistos.io if you become aware of any unauthorized access.
3.3 Authorized Users and seats. Customer may permit Authorized Users up to the number of seats in its plan. Seats are assigned to named individuals and may not be shared, although they may be reassigned when a person no longer needs access. Customer is responsible for its Authorized Users' compliance with these Terms.
3.4 Single sign-on. Where Customer enables SSO/SAML, Customer is responsible for configuring and maintaining its identity provider and for access granted through it.
4. Subscriptions, Fees, and Payment
4.1 Plans. The Services are offered on subscription plans with usage limits (for example, number of vendors under management and team seats) described on our pricing page or in the applicable Order. Features vary by plan.
4.2 Fees. Customer agrees to pay all fees stated in the Order or on our pricing page at the time of purchase. Unless otherwise stated, fees are quoted in U.S. dollars, are billed in advance for each billing period, and are non-refundable except as expressly provided in these Terms or required by law.
4.3 Automatic renewal. Subscriptions automatically renew for successive periods equal to the initial billing period unless either party gives notice of non-renewal before the end of the current period (for monthly plans, before the next billing date; for annual or multi-year plans, at least 30 days before the end of the term).
4.4 Overages and upgrades. If Customer exceeds its plan limits, we may require Customer to upgrade to an appropriate plan or pay additional fees. Upgrades take effect immediately and may be prorated. Downgrades take effect at the start of the next billing period and may result in loss of features or capacity.
4.5 Price changes. We may change our prices by giving at least 30 days' notice. Price changes take effect at the next renewal.
4.6 Late payment. If any amount is overdue, we may, after giving notice, suspend access to the Services until payment is received. Overdue amounts may accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law.
4.7 Taxes. Fees exclude taxes. Customer is responsible for all sales, use, VAT, GST, and similar taxes associated with its purchase, other than taxes based on Pistos's net income.
4.8 Trials and demos. We may offer free trials, pilots, or demonstration access at our discretion. Such access is provided "as is", may be ended at any time, and is not subject to any service commitments. Data in a trial Account may be deleted when the trial ends unless Customer purchases a subscription.
5. Customer Data
5.1 Ownership. As between the parties, Customer owns all Customer Data. Pistos does not claim ownership of Customer Data.
5.2 License to Pistos. Customer grants Pistos a worldwide, non-exclusive, royalty-free license to host, store, process, transmit, and display Customer Data solely to provide, secure, maintain, and support the Services, to prevent or address technical or security issues, and as required by law.
5.3 Customer responsibilities. Customer is responsible for the accuracy, quality, and legality of Customer Data and for having all rights, consents, and notices needed to submit it to the Services and to invite Respondents. Customer will not submit to the Services any data that is subject to heightened regulatory requirements (for example, protected health information, payment card data, or government identification numbers) unless we have agreed in writing that the Services support that data.
5.4 Personal data. Our handling of personal data is described in our Privacy Policy at pistos.io/privacy. Where Pistos processes personal data on Customer's behalf, the Pistos Data Processing Addendum at pistos.io/dpa applies and forms part of these Terms.
5.5 Aggregated data. Pistos may collect and use usage metrics and data derived from the operation of the Services that is aggregated and de-identified so that it does not identify Customer, any Respondent, or any individual, to operate, analyze, and improve the Services.
5.6 Export and deletion. During the subscription term, Customer may export its Customer Data using the features available in the Services. For 30 days after termination or expiration, we will, on request, make Customer Data available for export. After that period, we may delete Customer Data in accordance with our data retention practices, except as required by law. Backups will be overwritten in the ordinary course.
6. Security
Pistos maintains administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Customer Data, including logical separation of data between Customers and, for Partners, between Clients. We will notify Customer without undue delay after becoming aware of a security incident that results in unauthorized access to Customer Data. No system is completely secure, and Pistos does not guarantee that unauthorized access will never occur.
7. Respondents (Vendors Being Assessed)
7.1 Invitations. Customers can invite Respondents to complete questionnaires and provide evidence through the Services. Customer is responsible for its relationship with its Respondents, for the content of its questionnaires, and for how it uses Respondent responses.
7.2 Respondent terms. If you are a Respondent, you may use the Services only to respond to assessments you have been invited to complete. By submitting information, you represent that you are authorized to share it with the inviting Customer, and you acknowledge that your responses and uploaded materials become available to that Customer and are handled as Customer Data under that Customer's control. Any confidentiality obligations governing your responses are between you and the inviting Customer.
7.3 No relationship with Pistos. Pistos is not a party to the relationship between a Customer and its Respondents and is not responsible for any decision a Customer makes based on an assessment.
8. Trust Center
8.1 Published content. Customer is solely responsible for the content it publishes on its Trust Center, including ensuring that certifications, reports, and statements are accurate, current, and not misleading, and that it has the right to publish them.
8.2 Access requests and NDAs. The Services may allow Customer to require visitors to accept a non-disclosure agreement or request access before viewing certain materials. Any such NDA is an agreement between Customer and the visitor. Pistos is not a party to it, does not enforce it, and makes no representation about its terms or enforceability.
8.3 Visitors. If you visit a Customer's Trust Center, you agree to use the materials only for the purpose for which they were provided and in accordance with any terms the Customer presents to you.
9. Partners, MSPs, and Consultancies
9.1 Multi-tenant use. Partners may use multi-tenant features to manage Accounts or workspaces for their Clients, subject to their plan.
9.2 Partner responsibilities. A Partner is responsible for (a) obtaining all authority and consents required from each Client to submit Client data to the Services, (b) its own services and advice to Clients, and (c) its Clients' use of the Services through the Partner's Account. The Partner remains responsible for all fees for its Account unless we agree otherwise in writing.
9.3 Partner program. Participation in the Pistos partner program may be subject to additional terms, which will control over these Terms for matters they address.
10. Acceptable Use
You will not, and will not permit anyone else to:
- Use the Services in violation of any applicable law or regulation, including export control and sanctions laws;
- Upload or transmit malware or other harmful code, or content that is unlawful, defamatory, infringing, or that violates anyone's privacy;
- Attempt to gain unauthorized access to the Services, other Accounts, or related systems, or to probe, scan, or test their vulnerability without our prior written permission;
- Interfere with or disrupt the integrity or performance of the Services, or impose an unreasonable load on our infrastructure;
- Reverse engineer, decompile, or attempt to derive the source code of the Services, except where this restriction is prohibited by law;
- Copy, modify, or create derivative works of the Services, or access the Services to build a competing product;
- Sell, resell, sublicense, or provide the Services to third parties except as expressly permitted for Partners;
- Scrape, crawl, or use automated means to access the Services other than through our published APIs;
- Circumvent plan limits, seat restrictions, or access controls; or
- Use a Trust Center or questionnaire to impersonate another person or organization or to misrepresent any certification or security posture.
We may suspend access to the Services if we reasonably believe you have breached this Section or that your use poses a security risk to the Services or other users. Where practicable, we will give notice and an opportunity to cure before suspending.
11. API Access
Where your plan includes API access, you may use our APIs in accordance with our documentation and any rate limits we set. We may issue, revoke, or rotate API keys, and you must keep them confidential. We may modify or deprecate API endpoints and will use reasonable efforts to give advance notice of material, breaking changes.
12. Intellectual Property
12.1 Pistos IP. Pistos and its licensors own all rights, title, and interest in and to the Services, including all software, designs, questionnaire templates, control framework mappings, risk scoring logic, documentation, and trademarks, and all improvements to them. Except for the limited rights expressly granted in these Terms, no rights are granted to you.
12.2 Right to use. Subject to these Terms and payment of applicable fees, Pistos grants Customer a non-exclusive, non-transferable, non-sublicensable right during the subscription term to access and use the Services for Customer's internal business purposes (and, for Partners, to serve their Clients).
12.3 Third-party frameworks. The Services may reference or include third-party standards and control frameworks (for example, ISO/IEC 27001, SOC 2, NIST, or CIS). Those frameworks remain the property of their respective owners, and your use of them may be subject to their own license terms.
12.4 Feedback. If you provide suggestions or feedback about the Services, Pistos may use it without restriction or obligation to you.
13. Confidentiality
Each party (the "Recipient") may receive non-public information from the other (the "Discloser") that is marked confidential or would reasonably be understood to be confidential ("Confidential Information"). Customer Data is Customer's Confidential Information. The Recipient will use the Discloser's Confidential Information only to perform under these Terms, will protect it with at least reasonable care, and will disclose it only to its employees, contractors, and advisers who need to know it and are bound by confidentiality obligations at least as protective. These obligations do not apply to information that is or becomes public through no fault of the Recipient, was known to the Recipient without restriction before receipt, is independently developed, or is rightfully received from a third party without restriction. The Recipient may disclose Confidential Information when legally required, after giving the Discloser reasonable notice where lawful.
14. Third-Party Services
The Services may interoperate with third-party products or services, such as identity providers, cloud storage, or ticketing tools. Your use of those services is governed by your agreements with their providers. Pistos is not responsible for third-party services and does not warrant them, and by enabling an integration you authorize Pistos to exchange Customer Data with that service as needed for the integration to work.
15. No Professional Advice; Risk Scores
The Services are tools to help Customers organize and manage their vendor risk and compliance programs. Risk scores, ratings, framework mappings, business impact analyses, templates, and any other outputs are generated from the rules, weightings, and data configured or supplied by Customer and its Respondents. They are informational only and do not constitute legal, audit, regulatory, security, or other professional advice, certification, or attestation. Pistos does not verify the accuracy of Respondent answers or evidence. Customer is solely responsible for its risk decisions, its compliance with applicable laws and standards, and any reliance on outputs of the Services. Use of the Services does not by itself make any organization compliant with any law, regulation, or framework.
16. Warranties and Disclaimers
16.1 Mutual. Each party represents that it has the legal power and authority to enter into these Terms.
16.2 Pistos. Pistos warrants that, during a paid subscription term, the Services will perform materially in accordance with their documentation. If they do not, and Customer notifies us in writing, our sole obligation and Customer's exclusive remedy is for us to use commercially reasonable efforts to correct the non-conformity, and, if we cannot do so within a reasonable time, either party may terminate the affected subscription and Customer will receive a refund of any prepaid fees for the remaining term.
16.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, PISTOS DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. PISTOS DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT ANY OUTPUT WILL BE ACCURATE, COMPLETE, OR SUFFICIENT TO IDENTIFY ALL RISKS.
17. Limitation of Liability
17.1 Exclusion of damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, OR DATA, OR COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
17.2 Cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICES WILL NOT EXCEED THE FEES PAID AND PAYABLE BY CUSTOMER TO PISTOS FOR THE SERVICES IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE LIABILITY. FOR FREE OR TRIAL USE, PISTOS'S TOTAL LIABILITY WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US$100).
17.3 Exceptions. The limitations in Sections 17.1 and 17.2 do not apply to Customer's payment obligations, either party's indemnification obligations, or a party's liability for its gross negligence, fraud, or willful misconduct, or for its breach of Section 10 (Acceptable Use).
18. Indemnification
18.1 By Pistos. Pistos will defend Customer against any third-party claim alleging that the Services, as provided by Pistos and used in accordance with these Terms, infringe that third party's intellectual property rights, and will pay any damages finally awarded or agreed in settlement. This obligation does not apply to claims arising from Customer Data, third-party services, modifications not made by Pistos, or combinations with items not provided by Pistos. If the Services are, or in our opinion are likely to be, subject to such a claim, we may procure the right for Customer to continue using them, modify them to be non-infringing, or terminate the subscription and refund prepaid fees for the remaining term. This Section states Pistos's entire liability for infringement claims.
18.2 By Customer. Customer will defend Pistos and its affiliates, officers, and employees against any third-party claim arising from Customer Data, Customer's Trust Center content, Customer's relationship with its Respondents or Clients, or Customer's use of the Services in breach of these Terms or applicable law, and will pay any damages finally awarded or agreed in settlement.
18.3 Procedure. The indemnified party must promptly notify the indemnifying party of the claim, give it sole control of the defense and settlement (provided that no settlement may impose an obligation on the indemnified party without its consent), and provide reasonable cooperation at the indemnifying party's expense.
19. Term and Termination
19.1 Term. These Terms apply from the date you first accept them or use the Services until all subscriptions have expired or been terminated.
19.2 Termination for convenience. Customer may cancel a subscription at any time through the Services or by contacting us, effective at the end of the current billing period. No refunds are provided for partial billing periods except as stated in these Terms.
19.3 Termination for cause. Either party may terminate these Terms by written notice if the other party materially breaches them and does not cure the breach within thirty (30) days after receiving notice, or if the other party becomes the subject of bankruptcy, insolvency, or similar proceedings.
19.4 Effect of termination. On termination or expiration, Customer's right to use the Services ends, Customer must pay all fees accrued through the effective date, and Section 5.6 (Export and deletion) applies. If Customer terminates for Pistos's uncured material breach, Pistos will refund any prepaid fees for the remaining term. Sections that by their nature should survive termination (including Sections 5.5, 10, 12, 13, 15 through 18, 20, and 21) will survive.
20. Governing Law and Disputes
These Terms are governed by the laws of Wyoming, USA, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply. The parties will first try in good faith to resolve any dispute informally for at least thirty (30) days after written notice. Any dispute not resolved informally will be brought exclusively in the state or federal courts located in Sheridan County, Wyoming, and each party consents to the personal jurisdiction of those courts. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.
21. General
21.1 Changes to these Terms. We may update these Terms from time to time. If we make material changes, we will notify Customers by email or through the Services at least 30 days before the changes take effect, except where changes are required by law or address security, in which case they may take effect sooner. Continued use of the Services after changes take effect constitutes acceptance. If Customer objects to a material change, Customer may terminate its subscription before the change takes effect and receive a refund of prepaid fees for the remaining term.
21.2 Changes to the Services. We may modify the Services from time to time, but we will not materially reduce the core functionality of a paid plan during a Customer's current subscription term.
21.3 Publicity. Pistos may identify Customer by name and logo as a customer of the Services unless Customer opts out by emailing support@pistos.io. Any other publicity requires the other party's consent.
21.4 Assignment. Neither party may assign these Terms without the other party's prior written consent, except that either party may assign them without consent to a successor in a merger, acquisition, or sale of all or substantially all of its assets or business to which these Terms relate. Any other attempted assignment is void.
21.5 Force majeure. Neither party is liable for any delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, war, terrorism, labor disputes, government action, or failures of internet, hosting, or utility providers.
21.6 Notices. Notices to Pistos must be sent to legal@pistos.io and 30 N Gould St Ste R, Sheridan, WY 82801 USA. We may send notices to Customer at the email address associated with its Account or through the Services.
21.7 Independent contractors. The parties are independent contractors. These Terms do not create a partnership, joint venture, agency, or employment relationship.
21.8 Export and sanctions. Each party will comply with applicable export control and economic sanctions laws. Customer represents that it is not located in, and will not allow access to the Services from, any embargoed country or by any sanctioned person.
21.9 Entire agreement. These Terms, together with any Orders, the Privacy Policy, and the Data Processing Addendum, are the entire agreement between the parties about the Services and supersede all prior agreements and understandings on that subject. Terms in any purchase order or other Customer document are void.
21.10 Severability; waiver. If any provision of these Terms is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will remain in effect. A party's failure to enforce any provision is not a waiver of its right to do so later.
21.11 Order of precedence. In case of conflict, the following order applies: (1) a signed written agreement between the parties, (2) the applicable Order, (3) the Data Processing Addendum (for matters relating to personal data), (4) these Terms, and (5) the Privacy Policy.
22. Contact Us
If you have questions about these Terms, please contact us:
ITG Security LLC
30 N Gould St Ste R
Sheridan, WY 82801
USA
Email: support@pistos.io