Legal
Terms of Service
The agreement between Shieldra and customers using the AI governance and compliance automation platform. Version 2026-08-16, effective August 16, 2026.
By the Shieldra Compliance Team · Last updated August 16, 2026
Key takeaways
- Using Shieldra means accepting these terms; if you sign up on behalf of an organization you confirm you can bind it.
- Free trials are for evaluation and convert to a paid plan only if you affirmatively select one; fees are non-refundable except where required by law.
- You retain all right, title, and interest in your data; Shieldra owns the platform and grants a licence to use it during your subscription.
- The standard service is not for PHI unless Shieldra expressly authorizes it in writing, in which case a BAA governs.
- Shieldra automates compliance work but does not guarantee regulatory compliance or audit outcomes — that responsibility stays with your organization.
Your account and subscription
By creating an account, clicking "I accept", or otherwise using the service you agree to these terms, together with the Privacy Policy, DPA, Acceptable Use Policy, Cookie Policy, and Customer Responsibility Acknowledgment. If you use Shieldra on behalf of an organization, you represent that you have authority to bind that organization.
You must provide accurate registration information, keep your credentials confidential, and tell us immediately about any unauthorized access. Free trials are for evaluation and convert to a paid plan only if you affirmatively select one. Paid subscriptions auto-renew unless cancelled before the renewal date, and fees are non-refundable except where required by law.
What the service does
Shieldra provides a compliance automation and AI-governance platform. Supported frameworks currently include HIPAA, SOC 2, HITRUST CSF, NIST CSF, ISO/IEC 42001, and the NIST AI Risk Management Framework, with regulatory intelligence for the EU AI Act and certain US state and local AI laws. Features include automated control monitoring, evidence collection, document analysis, AI system inventories and regulatory classification, compliance integrity records, shareable evidence artifacts and trust-center pages, vendor risk management, incident workflows, training tracking, and audit reporting.
AI-assisted and deterministic outputs alike are advisory: they may contain errors, must be independently reviewed by qualified personnel, and are not legal advice or a conformity assessment.
Permitted use and restrictions
- Use the service only for lawful purposes and in line with these terms
- Do not reverse engineer, decompile, or attempt to extract the source code
- Do not use the service to build a competing product
- Do not share account credentials with unauthorized users
- Do not transmit malicious code or attempt to compromise platform security
- Do not falsify, backdate, or manipulate compliance evidence or Compliance Records, or misrepresent generated artifacts as certifications or independent audit outcomes
Data, PHI, and confidentiality
You retain all right, title, and interest in the data you upload. You grant Shieldra a licence to host and process it solely to provide, secure, and support the service; the platform and its intellectual property remain ours.
The standard service is designed for compliance documentation rather than protected health information. You must not upload PHI unless Shieldra expressly authorizes that processing in writing, in which case the applicable No-PHI acknowledgment or Business Associate Agreement governs and prevails for PHI. Each party keeps the other’s non-public information confidential.
Availability, liability, termination, and disputes
Shieldra uses commercially reasonable efforts to make the service available and communicates scheduled maintenance in advance where practicable; the service is provided without a guaranteed service level unless a service level agreement is expressly included in your order form. It is provided "as is" — while Shieldra automates compliance processes, it does not guarantee regulatory compliance or any audit outcome, and it is not legal, medical, or professional advice.
Each party’s total liability is capped at the fees paid in the twelve months before the event giving rise to liability, excluding indirect, incidental, special, consequential, and punitive damages. Either party may terminate for material breach not cured within 30 days of written notice. After termination you have 30 days to export your data, and Shieldra deletes or anonymizes Customer Data within 90 days of a deletion request, except records it must retain (certain compliance and incident records for up to six years). These terms are governed by Delaware law, with disputes resolved exclusively in the state or federal courts in Wilmington, Delaware, and each party waives participation in class actions to the extent permitted by law.
Frequently asked questions
Is there a free trial, and do I need a credit card?
Free trials are provided for evaluation purposes and convert to a paid plan only if you affirmatively select one. Paid subscriptions then auto-renew unless cancelled before the renewal date, and fees are non-refundable except where required by law.
Who owns the data I upload to Shieldra?
You do. You retain all right, title, and interest in your data, and Shieldra processes it only to provide, secure, and support the service. On termination you have 30 days to export your data, including Compliance Records.
Does using Shieldra guarantee HIPAA compliance?
No. Shieldra automates and documents compliance work, but it does not guarantee that your organization is compliant with any law or framework, or any audit or regulatory outcome. You remain responsible for your own compliance obligations, and the service does not constitute legal, medical, or professional advice.
How is the agreement terminated and what happens to my data?
Either party may terminate for material breach if it is not cured within 30 days of written notice; Shieldra may suspend access where required by law, to prevent harm, or for non-payment. You may export your data for 30 days after termination, and Shieldra deletes or anonymizes it within 90 days of a deletion request, except records retained as required — including certain compliance and incident records kept for up to six years.
How are disputes resolved?
These terms are governed by Delaware law, and disputes are resolved exclusively in the state or federal courts located in Wilmington, Delaware. Each party waives participation in class, collective, or representative actions to the extent permitted by law.
