Terms & Conditions

Effective Date: June 1, 2025  |  Last Updated: August 4, 2026

Acceptance of Terms

These Terms & Conditions ("Terms") govern your access to and use of the ControlSage, Inc. ("ControlSage," "we," "us," or "our") website and our compliance and security services, including SOC 2, PCI DSS, CMMC, HIPAA, ISO 27001, ISO 42001, and SOX compliance management, audit readiness, and related governance services (collectively, the "Services"). By accessing our website, submitting a form, or engaging us for Services, you agree to be bound by these Terms. If you do not agree, please do not use our website or Services.

Description of Services

ControlSage provides compliance consulting, audit readiness, gap assessments, control implementation support, and continuous governance services across multiple regulatory and industry frameworks. Our Services may include recommendations, documentation, and coordination with third-party auditors, assessors, and certification bodies (such as C3PAOs, QSAs, and ISO certification bodies). ControlSage does not issue certifications itself; certification and audit opinions are issued solely by the independent third parties engaged for that purpose.

Use of Service

You agree to use our website and Services only for lawful and appropriate purposes. You may not attempt to gain unauthorized access to our systems, interfere with the operation of our website, misrepresent your identity or authority, or use our Services to violate any applicable law or regulation. We reserve the right to suspend or restrict access if we reasonably believe these Terms have been violated.

Account Responsibility

If we provide you with access to any portal, dashboard, or shared workspace, you are responsible for maintaining the confidentiality of your login credentials and for all activity that occurs under your account. Notify us immediately if you suspect unauthorized access to your account.

Engagement, Fees, and Payment

Specific scope, deliverables, timelines, and fees for our Services are set out in a separate statement of work, order form, or services agreement between ControlSage and the client. Where these Terms and a signed services agreement conflict, the signed services agreement controls. Fees are due as specified in the applicable agreement, and late payments may result in suspension of Services.

Intellectual Property

All content on our website, including text, graphics, logos, and software, is owned by ControlSage or our licensors and is protected by intellectual property laws. Client-specific deliverables (such as policies, risk assessments, and System Security Plans) are licensed for the client's internal use as described in the applicable services agreement, unless otherwise agreed in writing.

Confidentiality

In the course of providing Services, ControlSage may receive confidential business, technical, and security information from clients. We agree to protect such information using industry-standard safeguards and to use it solely to deliver the contracted Services, except as otherwise required by law or authorized by the client.

Service Changes

We may update, modify, or discontinue features of our website or service offerings at any time to improve our platform and Services. Material changes affecting an active client engagement will be communicated through the applicable services agreement rather than through this general notice.

Disclaimers

Our Services are designed to help clients prepare for and maintain compliance with applicable frameworks, but ControlSage cannot guarantee that any audit, assessment, or certification will result in a passing outcome, as final determinations are made by independent third-party auditors and certification bodies. Our website and general content are provided "as available" and for informational purposes, and do not constitute legal advice.

Limitation of Liability

To the maximum extent permitted by law, ControlSage is not liable for indirect, incidental, special, or consequential damages arising from your use of our website or Services. Our total liability for any claim arising from a services engagement is limited as set out in the applicable services agreement.

Indemnification

You agree to indemnify and hold ControlSage harmless from claims, damages, or expenses arising from your misuse of our website or Services, or your violation of these Terms or applicable law.

Termination

We may suspend or terminate your access to our website or Services if we reasonably believe you have violated these Terms. Termination of an active client engagement is governed by the applicable services agreement.

Governing Law

These Terms are governed by the laws of the United States and the state in which ControlSage is registered, without regard to conflict of law principles.

Changes to These Terms

We may update these Terms periodically to reflect changes in our Services or applicable law. Continued use of our website after updates means you accept the revised Terms. We encourage reviewing this page periodically.

Contact Us

If you have questions about these Terms, please contact us at legal@controlsage.com