Free trial
Legal

Terms of Service

Last updated: October 23, 2026

1. Acceptance of Terms

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Customer," "you," or "your") and episki, llc, a Pennsylvania limited liability company ("episki," "we," "us," or "our"). By accessing or using the episki platform at app.episki.com or any related services (collectively, the "Service"), you agree to be bound by these Terms.

If you are accepting these Terms on behalf of an organization, you represent and warrant that you have the authority to bind that organization. If you do not agree to these Terms, do not use the Service.

1.1 Signed agreements

If you and episki have signed a master subscription agreement or similar written agreement (a "Signed Agreement"), the Signed Agreement governs your use of the Service, and these Terms apply only to the extent the Signed Agreement incorporates them. Accepting these Terms in the Service (for example, when a user signs in or creates an account) does not amend or replace a Signed Agreement.

1.2 Service Policies

The following parts of these Terms, together with the published documents listed below, are the "Service Policies." A Signed Agreement may incorporate them by reference, and they change only as described in §17.

  • Pricing. List prices, modules, and add-ons at episki.com/pricing, and the billing rules in §4.
  • AI and token terms. §5, including token allowances, overage, and prepaid packs.
  • Integration terms. §6 and the integration catalog in the Service documentation.
  • Acceptable Use Policy. §10.
  • Privacy Policy. episki.com/privacy.
  • Security and sub-processors. §20, our security documentation, and sub-processor list at trust.episki.com.
  • Data Processing Agreement. Our Data Processing Agreement at episki.com/dpa, which applies automatically whenever we process personal data in Customer Data on your behalf.
  • Service-Specific Terms. Terms for individual offerings, as described in §2.1.

2. Service Description

episki is a cloud-based, AI-first governance, risk, and compliance (GRC) platform. The Service includes a required Compliance Platform together with optional modules (such as Risk Management, Third-Party Risk Management, Trust, and AI Governance) and add-ons. The platform provides:

  • Programs, assessments, controls, policies, evidence, and audit-log workflows for one or more compliance frameworks.
  • An AI orchestration runtime: agents, skills, plans, step-runs, approvals, and safety floors.
  • Integrations with third-party systems and support for Model Context Protocol ("MCP") servers configured by you.
  • A Trust portal where you may publish security posture information to your customers and prospects.
  • The Operator Partner Program for partners managing the Service on behalf of multiple end customers.

The Service is provided on a software-as-a-service basis. These Terms grant you a limited, non-exclusive, non-transferable, revocable license to access and use the Service during your subscription term. No software is sold or transferred under these Terms.

2.1 New offerings

The Service includes any modules, add-ons, and features we make available after you subscribe, as well as those listed above. A new offering may come with its own terms, published in the Service documentation or where you order it ("Service-Specific Terms"). When you order or enable that offering, its Service-Specific Terms apply to it and are part of the Service Policies. No amendment to these Terms or to a Signed Agreement is needed.

2.2 Changes to the Service

We continually improve the Service and may add, change, or remove features. During a subscription term you have paid for, we will not materially reduce the core functionality of a module or add-on you subscribe to. If we discontinue a module or add-on you have paid for, we will give you at least ninety (90) days' notice and either provide equivalent functionality or refund the prepaid fees for it for the unused remainder of the term. Integrations are governed by §6.1, and preview features by §2.4.

2.3 Renaming and repackaging

We may rename, split, combine, or repackage modules, add-ons, and plans. If we do, you keep equivalent functionality at the same price for the rest of your subscription term. At renewal, your subscription moves to the current offerings that most closely match what you had. A reference in an order form or Signed Agreement to an offering by an earlier name means its successor.

2.4 Preview features

We may offer features labeled beta, preview, early access, or similar ("Preview Features"). Preview Features are optional, may be changed or withdrawn at any time, and are not covered by any warranty in §12 or by any SLA. They are free unless we say otherwise when you enable them, but AI work they perform uses tokens as described in §5. Our obligations for Customer Data, including confidentiality (§19), security (§20), and the no-training commitment (§5.6), apply to Preview Features in full.

3. User Accounts and Security

To use the Service, you must create an account with accurate and complete information. You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

You agree to notify us immediately at hello@episki.com if you become aware of any unauthorized use of your account. episki is not liable for losses arising from unauthorized access to your account where you have failed to safeguard your credentials.

4. Subscriptions, Billing, and Renewals

4.1 Subscription model

Use of the Service requires a paid subscription to the Compliance Platform and any modules or add-ons you select. Subscriptions are sold on a per-workspace basis. Users, frameworks, and (where applicable) vendors are not separately metered.

4.2 Billing cadence

You may select monthly or annual prepay billing for each priced item where both options are offered; certain add-ons may be offered on annual billing only. Fees are billed in advance for the upcoming billing period. Monthly subscriptions renew automatically each month. Annual subscriptions renew automatically each year unless cancelled at least 30 days before the renewal date.

4.3 Mid-cycle changes

You may add modules or add-ons at any time; charges are prorated to the end of the current billing period. Removal of modules or add-ons takes effect at the end of the then-current billing period. We will not refund prepaid amounts for the removed item except as required by law.

4.4 Failed payments

If a payment fails, the Service stays fully available for a fifteen (15) day grace period while you update your payment method. If payment is still outstanding after the grace period, we may restrict the workspace to read-only access until payment is received. Read-only access lets you view and request an export of your Customer Data but not create or change it. Subscriptions with balances overdue by more than thirty (30) days may be terminated, after which §15 applies.

4.5 Taxes

Fees are exclusive of any applicable taxes. You are responsible for any sales, use, value-added, withholding, or similar taxes other than taxes on our net income.

4.6 Refunds

Fees are non-refundable except as expressly stated in these Terms or required by applicable law.

4.7 Price changes

We may change list prices from time to time. A price change never applies during a subscription term you have already paid for. It takes effect at your first renewal that falls at least sixty (60) days after we notify you, so you have time to cancel before you are charged the new price. Price changes for a Signed Agreement follow §17.3.

4.8 Additional orders

You may add modules, add-ons, token packs, or other offerings by signing an order form or by purchasing in the Service. A purchase in the Service by a workspace owner or administrator is a binding order under these Terms and any Signed Agreement. Unless an order form says otherwise, an addition is priced at our then-current list price, prorated, and ends with your current subscription term. A customer with a Signed Agreement may ask us in writing to require an order form for all purchases, and we will then disable purchasing in the Service for its workspaces.

5. AI Features and Tokens

5.1 What AI features do

The Service uses AI to draft policies, answer questionnaires, summarize evidence, propose risk language, plan agent work, and similar tasks. AI features are bounded by the safety floors and approvals you configure in your workspace. Agents propose work that requires human approval before sensitive actions are taken; you remain responsible for reviewing and approving agent output before relying on it.

5.2 Tokens

AI work is metered in tokens, a unit of computational consumption. Your workspace receives a monthly token allowance equal to the base allocation included with the Compliance Platform plus an additional allocation for each module you subscribe to. Unused tokens roll forward by twenty percent (20%) to the immediately following month. New customer workspaces receive a multiplier on their monthly allowance during the first twelve (12) months as an onboarding boost.

5.3 Overage and prepaid packs

All AI usage is metered, including usage beyond your allowance. If your workspace exhausts its allowance, we may bill additional AI work at the then-current overage rate (currently $0.50 per 1,000 tokens). Overage that we do not invoice in the billing period in which it accrues may be invoiced in a subsequent period; our election not to invoice overage in any period is a courtesy and does not waive our right to invoice previously accrued, metered overage on notice. You may also purchase prepaid token packs at the then-current rate; prepaid packs are valid for twelve (12) months from purchase and lock in the per-token rate of the pack at the time of purchase. AI features ordinarily continue to function during overage; we will not block legitimate use of the Service due to token consumption alone.

5.4 Fair use

AI features are subject to fair use. We may apply reasonable rate limits to protect the stability and integrity of the Service. If your workspace's consumption substantially and repeatedly exceeds its allowance, or reflects misuse — including automated bulk generation unrelated to your compliance program, sharing or reselling AI capacity outside your workspace, or attempts to circumvent metering, rate limits, or safety floors — we may throttle AI features, condition continued AI use on the purchase of prepaid token packs or payment of accrued overage, or suspend AI features for the affected workspace after notice. We will not throttle ordinary use within your allowance.

5.5 Right to adjust token economics

We may adjust token allocations and consumption rates on at least thirty (30) days' written notice. Adjustments take effect at your next billing cycle. Changes to the overage rate and to prepaid pack pricing are price changes and take effect only as described in §4.7 (or §17.3 for a Signed Agreement). Token economics are tied to the cost of underlying AI providers, which is outside our reasonable control. We will not reduce the monthly token allowance included in a subscription term you have already prepaid, and prepaid packs keep the rate at which you bought them.

5.6 AI sub-processors and training

We use third-party AI model providers as sub-processors to deliver AI features. Our current sub-processor list (including AI providers) is published on our trust center at trust.episki.com, or available on request at hello@episki.com. We will not use Customer Data to train any AI model, and our AI sub-processors are contractually bound to the same restriction.

5.7 AI output and accuracy

AI-generated content may be inaccurate, incomplete, or out of date. You are responsible for reviewing AI output before relying on it for any compliance, regulatory, security, or business decision. You retain ownership of AI output created from your Customer Data and prompts on the same terms as the rest of your Customer Data (see §9).

6. Integrations and Third-Party Services

6.1 Native integrations

The Service may connect to third-party services you authorize. The catalog of available integrations is described on our website and in the Service documentation and will change over time; we may add, modify, or discontinue individual integrations without amending these Terms. You are responsible for ensuring you have authority to connect the services you choose and to grant the access scopes each integration requires. We will only use those credentials and the data they provide to deliver the Service.

6.2 Third-party terms

Third-party services are governed by their own terms and privacy policies. We are not responsible for the availability, accuracy, or behavior of any third-party service.

6.3 MCP servers

You may configure Model Context Protocol ("MCP") servers that agents in your workspace can call. You are solely responsible for the MCP servers you configure, the data sent to them, and the data they return. We do not endorse, certify, or vet third-party MCP servers. The AI Governance module (when subscribed) provides allowlisting, logging, and other controls; you remain responsible for using those controls appropriately.

6.4 Revocation

You may revoke any integration or MCP server connection at any time from the workspace settings. Following revocation, we will cease using the associated credentials and will delete or revoke any stored secrets within a reasonable time, except where retention is required for legal, billing, or audit-log integrity purposes.

7. Trust Portal and Customer-Published Content

The Service includes (with the Compliance Platform) a basic public trust page, and (with the Trust module) a fully branded trust center on a domain you specify. Content you publish through these surfaces — including control claims, certifications, subprocessor lists, policies, security whitepapers, and questionnaire responses — is Customer-published content.

  • You are solely responsible for the accuracy, currency, completeness, and lawfulness of Customer-published content.
  • You are responsible for ensuring Customer-published content does not violate any confidentiality, contractual, or privacy obligation you owe to a third party.
  • You are responsible for any NDA gating, watermarking, or access-control settings you configure for documents shared through the trust center.
  • We provide the publishing infrastructure but do not review, approve, or certify Customer-published content.

8. Operator Partner Program

The Operator Partner Program is available to firms (such as vCISO, vGRC, and MSP firms) that manage workspaces on behalf of end customers. A separate Operator Partner Agreement, executed between us and the partner, governs the program. The following applies to partners and their end customers:

8.1 General

  • Each end-customer workspace is a separate subscription subject to these Terms.
  • The partner is responsible for ensuring it has the authority to administer each end-customer workspace and to enter into these Terms (or pass through equivalent obligations) with each end customer.
  • Partner discounts apply to the partner's entire book of business as defined in the Operator Partner Agreement and may be adjusted prospectively in line with that agreement.
  • Tokens, integrations, and other workspace-scoped resources are not shared across workspaces.
  • We may treat the partner as the customer's authorized representative for routine workspace administration but reserve the right to communicate directly with the end customer on legal, billing, or security matters.

8.2 Sponsored workspaces

A "Sponsored Workspace" is an end-customer workspace whose fees are paid by a partner. The end customer, not the partner, owns the Customer Data in a Sponsored Workspace (see §9), whoever pays for it. The partner administers the workspace on the end customer's behalf. Each Sponsored Workspace must keep at least one administrator who is designated by the end customer, and the partner may not remove that administrator.

Content that a partner creates in a Sponsored Workspace for the end customer, such as policies, risk registers, assessments, and evidence, is Customer Data of the end customer. A partner's own pre-existing templates and methods remain the partner's property. To the extent they are part of that Customer Data, the end customer may keep using them for its internal business purposes.

8.3 When sponsorship ends

Sponsorship ends when the partner stops paying for a Sponsored Workspace, removes it from its book of business, or its Operator Partner Agreement ends. When that happens, we will notify the end customer's designated administrator directly, and the following applies (the "Transition Period"), unless we terminate the workspace for Serious Misuse (§15.5):

  • Grace period. The workspace stays fully available for fifteen (15) days after sponsorship ends, at no charge to the end customer.
  • Read-only period. For the following sixty (60) days, the workspace is available read-only, and the end customer may request an export of its Customer Data at no charge.
  • The end customer decides. At any time during the Transition Period, the end customer may (a) subscribe directly with episki, (b) move the workspace to another partner, or (c) export its Customer Data and close the workspace. If it subscribes directly, it pays our then-current list price for the plan it chooses, with no setup, conversion, or migration fee, and the workspace continues with its Customer Data, configuration, and history intact.
  • Deletion. If the end customer takes none of these steps, the workspace is closed at the end of the Transition Period and §15.3 applies.

8.4 Partner limits

A partner may not use an end customer's Customer Data as leverage. In particular, a partner may not:

  • delete, or instruct us to delete, Customer Data in a Sponsored Workspace, or remove the end customer's administrators, when it has given notice of ending sponsorship or during the Transition Period;
  • condition the end customer's access to, or export of, its Customer Data on renewing or continuing services with the partner; or
  • restrict the end customer's right to subscribe directly with episki or through another partner.

We will not act on a partner's instruction to delete a Sponsored Workspace, or to delete Customer Data in it in bulk, without written confirmation from the end customer's designated administrator. This does not limit routine edits that a partner makes in the ordinary course of administering the workspace.

9. Data Ownership and Intellectual Property

Your Data. You retain all rights, title, and interest in the data you submit to or generate through the Service, including compliance programs, assessments, controls, policies, evidence, risks, vendors, agent plans and conversations, MCP server configurations, and AI output created from your prompts and Customer Data ("Customer Data"). This is true whoever pays for your workspace, including a Sponsored Workspace paid for by a partner (see §8). episki does not claim ownership of Customer Data, and we will never hold it back as leverage for a renewal or purchase.

Our Platform. episki and its licensors retain all rights, title, and interest in the Service, including all software, technology, designs, trademarks, model orchestration logic, and documentation. Nothing in these Terms transfers any intellectual property rights in the Service to you.

episki Content. The content we supply through the Service is "episki Content." It includes our framework catalog and mappings, control libraries, policy and questionnaire templates, agent skills, and prompts. It is part of our platform, not Customer Data, even when it is copied into your workspace. During your subscription, you may use episki Content within the Service and in documents you produce for your own compliance program. Your responses, edits, evidence, and the documents you produce are your Customer Data.

Feedback. If you provide us with feedback, suggestions, or ideas about the Service, you grant us a perpetual, royalty-free, worldwide license to use that feedback to improve the Service, without obligation to you.

Aggregated and de-identified data. We may produce aggregated, de-identified, or anonymized data that does not identify you or any individual. We may use such data to operate, improve, benchmark, and market the Service.

10. Acceptable Use

You agree not to:

  • Use the Service for any unlawful purpose or in violation of any applicable law or regulation.
  • Attempt to gain unauthorized access to the Service, other customer accounts, or related systems.
  • Interfere with, disrupt, or degrade the performance of the Service.
  • Reverse-engineer, decompile, or disassemble any part of the Service, except to the extent expressly permitted by law.
  • Resell, sublicense, or make the Service available to third parties except as permitted by your subscription or the Operator Partner Program.
  • Upload content that is malicious, infringing, or violates the rights of others.
  • Use the Service or AI features to generate, distribute, or facilitate illegal, defamatory, or harmful content.
  • Use the Service to circumvent or evade legal, regulatory, or contractual obligations you owe to third parties.
  • Configure MCP servers or integrations to exfiltrate data from the Service in violation of these Terms or applicable law.
  • Access or use the Service to build, train, or benchmark a competing product or service, or to copy its features, workflows, design, or episki Content.
  • Scrape, crawl, or use automated means to extract episki Content or other data from the Service, other than through the integrations and interfaces we provide for that purpose.
  • Impersonate any person or organization, misrepresent your identity or affiliation, or use the Service (including invitations, questionnaires, and the trust portal) to obtain information from anyone under false pretenses.
  • Create an account or workspace to get around a suspension or termination, or on behalf of someone whose access we have suspended or terminated.

"Serious Misuse" means any of the following breaches of this section, and no others: (a) unlawful use of the Service; (b) unauthorized access to the Service, other customer accounts, or related systems; (c) competitive use; (d) scraping or automated extraction; (e) impersonation or obtaining information under false pretenses; and (f) creating an account or workspace to get around a suspension or termination.

11. No Compliance Guarantee

episki provides tools, workflows, and AI assistance to help you manage compliance programs, but the Service does not guarantee that you will achieve or maintain compliance with any specific framework, regulation, or standard, including (without limitation) SOC 2, ISO 27001, ISO 27701, ISO 42001, HIPAA, PCI DSS, NIST CSF, NIST AI RMF, CMMC, the EU AI Act, GDPR, CCPA/CPRA, or any other regulatory regime.

Compliance is ultimately your responsibility. The Service assists with organizing, drafting, tracking, and documenting your compliance activities, but the accuracy and completeness of your programs, controls, evidence, and AI-assisted output depend on the information you provide, the configuration you choose, and the actions you and your reviewers take.

12. Warranties and Disclaimers

episki warrants that the Service will perform materially in accordance with its documentation during your subscription term. If the Service does not meet this warranty, your sole remedy is for us to use commercially reasonable efforts to correct the non-conformity.

EXCEPT AS EXPRESSLY PROVIDED ABOVE, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, EPISKI DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT AI OUTPUT WILL BE ACCURATE, COMPLETE, OR FIT FOR YOUR PURPOSE.

13. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, EPISKI'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE AMOUNTS PAID BY YOU TO EPISKI IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

IN NO EVENT WILL EPISKI BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, OR BUSINESS OPPORTUNITIES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

14. Indemnification

You agree to indemnify, defend, and hold harmless episki and its officers, directors, employees, and agents from any claims, damages, losses, or expenses (including reasonable attorneys' fees) arising from: (a) your use of the Service; (b) Customer Data and Customer-published content; (c) MCP servers or integrations you configure; (d) your violation of these Terms; or (e) your violation of any applicable law or the rights of a third party.

15. Termination and Data Export

15.1 Cancellation

Either party may terminate these Terms by providing written notice in accordance with §4.2. Upon cancellation, your access to the Service will continue until the end of your current billing period.

15.2 Read-only period and export

When a paid subscription ends for any reason, including non-renewal and non-payment but not termination for Serious Misuse (§15.5), your workspace stays available read-only for sixty (60) days (the "Read-Only Period"). During the Read-Only Period you may resubscribe and keep your Customer Data, configuration, and history intact, or request an export of your Customer Data. We provide the export at no charge, in a commonly used, machine-readable format, together with the evidence files you uploaded. We will not condition your access to, or export of, Customer Data during the Read-Only Period on renewing, upgrading, or purchasing anything. You remain responsible for any fees already owed. A Sponsored Workspace follows the Transition Period in §8.3 instead.

A free trial has no Read-Only Period. When a trial ends without a paid subscription, we may keep the workspace for a short time so you can subscribe, and then delete it.

15.3 Deletion

After the Read-Only Period, we will delete Customer Data from our active systems within thirty (30) days, except where retention is required by law. Backup copies expire on the schedule described in our Privacy Policy. On request, we will confirm the deletion in writing.

15.4 Suspension and termination for cause

episki may suspend or terminate your access immediately if you materially breach these Terms or if continued provision of the Service would violate applicable law. Non-payment is handled under §4.4, not this section. If we terminate for a breach other than Serious Misuse, §15.2 still applies. The exception is where providing read-only access would violate law or put the Service or other customers at risk; in that case we will provide the export directly to you on request.

15.5 Serious Misuse

If we suspend or terminate for Serious Misuse (§10), access ends immediately, and there is no Read-Only Period or Transition Period. Accounts and workspaces created to get around the suspension or termination may be closed without notice. Within thirty (30) days after your request, we will deliver an export of your Customer Data directly to you. The export excludes episki Content and any data obtained by impersonation or false pretenses.

We may preserve data obtained by impersonation or false pretenses and disclose it to law enforcement. We may also return it to, or delete it at the request of, the person or organization it was obtained from. These protections for ordinary endings are not affected: non-renewal, non-payment, and the end of a partner's sponsorship.

16. Governing Law and Dispute Resolution

These Terms are governed by and construed in accordance with the laws of the Commonwealth of Pennsylvania, without regard to conflict-of-law principles. Any dispute arising under these Terms will be resolved exclusively in the state or federal courts located in Pennsylvania, and each party consents to the personal jurisdiction of such courts.

17. Modifications

17.1 Updates

We may update these Terms and the Service Policies from time to time. For material changes — including changes to billing structure, the AI/tokens framework, data processing, dispute resolution, or limitations of liability — we will provide at least thirty (30) days' written notice by email or by posting a prominent notice in the Service before the changes take effect. For non-material changes (clarifications, typos, formatting), we may update these Terms without advance notice and indicate the change by revising the "Last updated" date.

Your continued use of the Service after the effective date of revised Terms constitutes acceptance of those changes.

17.2 Right to cancel

If a material change adversely affects you, you may cancel the affected subscription by written notice within thirty (30) days after we notify you of the change. We will then refund any prepaid fees for the unused remainder of that subscription's term. Changes we must make to comply with law or to address a security risk may take effect sooner than thirty (30) days, but you keep this right to cancel.

17.3 Signed Agreements

For a customer with a Signed Agreement:

  • Fees, quantities, and token allowances stated on an order form are fixed for that order form's subscription term. A price change takes effect only at a renewal that falls at least sixty (60) days after we notify you.
  • Updates to the Service Policies apply on the terms of §17.1 and §17.2, unless the Signed Agreement says otherwise.
  • Updates to our Data Processing Agreement and security commitments will not materially reduce the overall protection of Customer Data during your subscription term.
  • A change to these Terms that the Signed Agreement does not incorporate does not apply to you.

18. General Provisions

These Terms, together with the Privacy Policy, the Data Processing Agreement, any Business Associate Agreement, any Operator Partner Agreement, and any order forms or Service-Specific Terms, constitute the entire agreement between you and episki. If these documents conflict, the following order applies, highest first: (a) an order form, for the items it covers; (b) a Signed Agreement; (c) a Business Associate Agreement, for PHI; (d) the Data Processing Agreement, for the processing of personal data; (e) an Operator Partner Agreement, for matters between episki and the partner, except that §8.2 through §8.4 prevail over it; (f) Service-Specific Terms, for the offering they cover; (g) these Terms; and (h) the other Service Policies. If any provision is found to be unenforceable, the remaining provisions will remain in full force. Our failure to enforce any right or provision is not a waiver of that right. You may not assign these Terms without our prior written consent. episki may assign these Terms in connection with a merger, acquisition, or sale of assets.

We do not currently offer a contractual uptime service-level agreement (SLA) as part of these Terms. Any SLA must be separately agreed in writing on an order form or master agreement.

The following survive the end of these Terms: payment obligations for fees already owed (§4), §8.3 and §8.4, §9, §11 through §16, §19, §22, and any other provision that by its nature should survive.

19. Confidentiality

19.1 What is confidential

"Confidential Information" means non-public information that one party (the "Discloser") shares with the other (the "Recipient") in connection with the Service, if it is marked confidential or a reasonable person would understand it to be confidential. Your Customer Data is your Confidential Information. Non-public parts of the Service, our pricing terms offered only to you, and our security documentation are ours.

Confidential Information does not include information that the Recipient can show (a) is or becomes public through no fault of the Recipient, (b) it already knew without a duty of confidentiality, (c) it lawfully received from a third party without a duty of confidentiality, or (d) it developed independently without using the Discloser's Confidential Information.

19.2 Obligations

The Recipient will use the Discloser's Confidential Information only to perform its obligations or exercise its rights under these Terms, and will protect it with at least the care it uses for its own similar information, and no less than reasonable care. The Recipient may share it only with its employees, contractors, advisors, and (for episki) sub-processors who need it for those purposes and are bound by confidentiality obligations at least as protective as these. The Recipient is responsible for their compliance.

19.3 Required disclosure

The Recipient may disclose Confidential Information when required by law, subpoena, or court order. Where legally permitted, it will give the Discloser prompt notice and reasonable help to seek a protective order, and will disclose only what is required.

19.4 Duration

These obligations continue for three (3) years after these Terms end, and for trade secrets and Customer Data, for as long as they remain confidential. Return and deletion of Customer Data follow §15.

20. Security

20.1 Safeguards

We maintain administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Customer Data, as described in our security documentation at trust.episki.com. We may update these safeguards, but we will not materially reduce the overall protection of Customer Data during your subscription term.

20.2 Security incidents

A "Security Incident" is a confirmed unauthorized access to, or acquisition, disclosure, alteration, or loss of, Customer Data in systems we or our sub-processors control. If we become aware of a Security Incident, we will notify you without undue delay, and in any case within seventy-two (72) hours after confirming it. We will tell you what we know about the incident, keep you updated as we learn more, take reasonable steps to contain and remediate it, and reasonably cooperate with your own response and notification obligations. Notifying you of a Security Incident is not an admission of fault.

20.3 Your responsibilities

You are responsible for the security settings you control in your workspace, including user access, single sign-on and multi-factor settings, integrations and MCP servers you configure (§6), and Customer-published content (§7).

20.4 Protected health information

If you are a covered entity or business associate under HIPAA, you may submit protected health information ("PHI") to the Service only while a Business Associate Agreement ("BAA") between you and episki is in effect. We offer a standard BAA to paid subscriptions; request it at hello@episki.com. A BAA covers only the parts of the Service that our documentation lists as HIPAA-eligible, and you must keep PHI out of the rest. While a BAA is in effect, it governs PHI and prevails over these Terms for PHI. Without a BAA, episki has no obligations as your business associate, and you are responsible for any PHI you submit.

21. Publicity

We may identify you as an episki customer, using your name and logo, on our website and in marketing materials. We will follow any reasonable trademark or brand guidelines you give us. You may opt out at any time by emailing hello@episki.com; we will then remove your name and logo from our website within ten (10) business days and leave them out of new materials.

We will not publish a case study, testimonial, or quote attributed to you, or issue a press release about you, without your prior written approval. In a Sponsored Workspace, the end customer, not the partner, decides whether its name and logo may be used.

22. Notices

Notices to you. We may give notices under these Terms by email to the owner or administrators of your workspace, or by a prominent notice in the Service. For a Sponsored Workspace, notices about data, sponsorship, and termination also go to the end customer's designated administrator (§8.2). You are responsible for keeping your contact details current.

Notices to us. Send notices to hello@episki.com with "Legal Notice" in the subject line. Notices of breach, termination, or a legal claim must also be sent to the address set out in your order form or Signed Agreement, if any.

When notice is given. An email notice is given when sent, unless the sender receives a delivery failure. A notice in the Service is given when posted. "Written notice" in these Terms includes notice given under this section.

23. Contact

If you have questions about these Terms, contact us at hello@episki.com. Our sub-processor list is published at trust.episki.com; and our Data Processing Agreement is at episki.com/dpa.

episki, llc · Pennsylvania, USA