WardstepTerms of Service
These terms are between Wardstep (operated by Brandyn Schadel; Wardstep LLC is being formed and will take over this agreement) and the business that creates a Wardstep account ("Customer," "you"). They work together with our Privacy Policy.
1. Agreement and the service
By creating an account or using Wardstep you agree to these terms on behalf of the business you represent, and you confirm you're at least 18 and authorized to bind that business.
Wardstep is software that helps a business build, document and maintain its written information security program: a guided checklist, a generated security plan, staff training, an evidence folder, a breach response checklist and related tools (the "Service").
The Service is in beta and free during the beta. Features may change, and the Service may be interrupted or discontinued. We'll give at least 30 days' notice by email before ending the beta, introducing fees or discontinuing the Service, so you can save or print your plan.
2. Accounts and acceptable use
Each person uses their own login with multi-factor authentication; logins may not be shared. You're responsible for the people you invite as co-admins or add to your staff list, and for keeping credentials and authenticator devices secure. Tell us promptly at hello@wardstep.com if you suspect unauthorized access.
Prohibition on taxpayer information. Wardstep is built to document security policies and controls, not to process taxpayer returns. You agree not to upload, transmit or enter client tax returns, taxpayer identification numbers, bank account numbers or other nonpublic personal information protected by the Gramm-Leach-Bliley Act or Internal Revenue Code section 7216. You'll delete anything uploaded by mistake as soon as you discover it, and Wardstep may remove files that violate this restriction without liability.
You also agree not to use the Service for anything unlawful; send training links or invites without authority; try to access another customer's data, bypass security controls or overload the Service; probe or test the Service's security without our written permission (good-faith reports to hello@wardstep.com are welcome); or resell the Service or copy it to build a competing product.
3. Customer data and security commitments
This section is Wardstep's written commitment to safeguard your information, to support the service-provider oversight requirement of the FTC Safeguards Rule (16 CFR 314.4(f)).
Ownership and roles. You own the information you and your staff put into Wardstep ("Customer Data"). You're the controller of Customer Data and Wardstep is your processor and service provider. We host and process Customer Data only to provide, secure and support the Service and as the law requires. We don't sell Customer Data or use it for advertising.
Safeguards. Wardstep maintains administrative, technical and physical safeguards appropriate to the Service, including multi-factor authentication for every customer login; least-privilege access for Wardstep personnel; separation of each customer's data enforced in the database and tested before every release; encryption in transit and at rest; private file storage with short-lived download links; an audit log of changes that customers can't alter; and security training for anyone at Wardstep with access to Customer Data.
Breach notice. If Wardstep confirms unauthorized access to Customer Data, we'll notify your firm's administrators without unreasonable delay and no later than 72 hours after confirming it, describe what we know and the steps we're taking, and cooperate with your own notification duties.
Vendor review. On request we'll answer reasonable security questionnaires and describe our controls, as summarized on our security page.
Return and deletion. You can print or save your plan at any time and delete your firm in Settings, which removes its Customer Data from our systems.
4. Not legal advice, fees and termination
Not legal advice; no compliance guarantee. Wardstep provides automated organizational templates and compliance workflow tracking tools. Wardstep does not provide legal, accounting, tax or regulatory certification advice. Using the Service does not guarantee compliance with the FTC Safeguards Rule, IRS Publication 4557 or state regulations, which remain the sole responsibility of your firm and its designated Qualified Individual.
Fees. The Service is free during the beta. If we introduce paid plans, we'll tell you the price and terms in advance, and you'll only be charged if you choose a paid plan.
Ending the agreement. You can stop using Wardstep and delete your firm at any time. We may suspend or end access if you materially breach these terms, if required by law, or to protect the Service; where practical we'll give notice and a chance to fix the problem first.
5. Legal terms
Warranty disclaimer. Except as stated in section 3, the Service is provided "as is" and "as available," without warranties of any kind, to the extent the law allows.
Limitation of liability. To the extent the law allows, neither party is liable for indirect, incidental, special, consequential or punitive damages, or lost profits, and Wardstep's total liability for all claims relating to the Service is limited to the greater of the fees you paid in the 12 months before the claim or $100. These limits don't apply to a party's fraud or willful misconduct.
Indemnity. You'll defend and hold Wardstep harmless from third-party claims arising from information you upload in violation of section 2, or from your misuse of the Service.
Governing law. These terms are governed by the laws of the State of Kansas.
Changes. We'll email firm owners at least 30 days before material changes take effect; continuing to use the Service after that means you accept them.
General. These terms and the Privacy Policy are the entire agreement about the Service. If a provision is unenforceable, the rest stays in effect. You may not assign these terms without our consent; we may assign them to a successor, including Wardstep LLC.
Contact: hello@wardstep.com