Terms of Service

1. Who these terms cover

These terms are an agreement between CPRCyber and the organization or managed service provider (MSP) that opens an account ("you"). The person who creates the account accepts these terms on your behalf and confirms they are authorized to do so. When an MSP adds a client organization, the MSP accepts these terms for that client and is responsible for having the client's authority to do so.

2. Your account and your people

• Everyone who signs in must use multi-factor authentication.
• Your admins decide who has access and what role each person has, and are responsible for keeping that list current.
• Tell us promptly if you believe an account has been misused.

3. Your data

You own the data you put into CPRCyber. We use it only to provide the service to you. We keep it separate from every other customer's data and record sensitive actions in your organization's audit log.

4. CPRCyber staff access

• CPRCyber staff cannot open your organization's data (incidents, alerts, contacts, files, chats and the rest). They can see only account records: the organization's name, type, status and add-ons.
• If you need help troubleshooting, one of your admins may give a CPRCyber staff member an account in your organization for that specific purpose. You choose the role, everything they do is recorded in your audit log, and you can remove the account at any time.
• CPRCyber staff can archive and delete accounts as described in section 6.

5. Texts, calls and email

You confirm that the people you send alerts to have agreed to receive them, by text, voice call or email, and that you will honor requests to stop. Recipients can reply STOP to any text to opt out.

6. Payment, missed payments and deletion

If a payment is missed, the account goes through these stages:

• Grace period (30 days). Everything keeps working. We notify your admins at the start of the grace period and again before it ends.
• Archive period (90 days). The account is archived. Your admins can still sign in to export your data and to bring the account up to date, which restores it. Alerts, calls and other sending are turned off. We notify your admins when the archive period starts, 30 days before deletion and 7 days before deletion.
• Deletion. At the end of the archive period, the organization and all of its data are permanently deleted. Copies in our backups are deleted as those backups expire, within 30 days. A record that the account existed and was deleted (its name and the date) is kept for our own records.

If you close your account yourself, the same 90-day archive period applies before deletion unless you ask us to delete sooner. If you tell us that your data is under a legal hold, or the law requires us to keep it, we will keep it for as long as that applies.

An MSP that stops paying affects the client organizations it manages. Before an MSP account is deleted, its clients may move to their own accounts or to another MSP.

7. Your records obligations

Some laws and frameworks (for example CMMC, HIPAA or state breach-notification laws) require you to keep incident and compliance records for a set time. You remain responsible for keeping those records, and you can export them from CPRCyber at any time.

8. Changes to these terms

We will tell your admins before material changes take effect. The version you accepted is recorded with your account.