Terms and Conditions

1. Acceptance and scope

These Terms and Conditions (“Terms”) govern access to and use of tenarie.com and related Tenarie public websites (the “Website”), the Tenarie hosted platform, documentation, support, application programming interfaces where enabled, and related services made available by Tenarie Limited (together, the “Services”).

These Terms apply when you visit or use the Website, create or access an Account, click to accept these Terms, start a Personal plan or trial, use early-access, preview, pilot, or evaluation functionality, purchase a self-service subscription, accept an Order, or otherwise use Services that refer to these Terms.

If you access or use the Services for an organization, you represent that you have authority to bind it. In that case, “Customer”, “you”, and “your” refer to that organization, and you must ensure its Authorized Users comply with these Terms. If you do not agree, or do not have the required authority, do not use the Services.

A signed Customer Engagement Agreement, Order Form, Data Processing Addendum, or other written agreement may replace or modify these Terms. Business and Enterprise subscriptions are generally contract-led. These Terms apply only to the extent the applicable signed agreement incorporates them or does not replace them.

2. About Tenarie

Tenarie is operated by Tenarie Limited, a company incorporated in New Zealand (company number 9425769). Tenarie provides a cybersecurity workspace for assurance, governance, risk, compliance, control testing, evidence, reporting, integrations, frameworks, test packages, and related work.

The Services are intended for business, professional, organizational, and internal operational use, including use by individual cybersecurity professionals. They are not designed for personal, domestic, or household use.

If both parties are in trade and the requirements of New Zealand law are met, the parties agree that the Consumer Guarantees Act 1993 does not apply and that they contract out of sections 9, 12A, 13, and 14(1) of the Fair Trading Act 1986. This applies only where it is fair and reasonable and legally permitted. Nothing in these Terms excludes or limits a right, guarantee, remedy, or liability that cannot lawfully be excluded or limited.

3. Definitions

Account

The Tenarie account, organization container, workspace, or other access environment created or enabled for Customer.

Authorized User

An individual Customer authorizes to access or use the Services.

Customer Data

Data, records, content, configurations, evidence, documents, files, logs, reports, and other materials submitted to, imported into, created in, or generated from Customer’s use of the Services, excluding de-identified Usage Data and Tenarie Materials.

Documentation

Tenarie’s user, technical, implementation, support, and product documentation.

Order

An online checkout, accepted quote, marketplace order, Order Form, or other Tenarie-approved ordering record.

Subscription Term

The period for which Customer is entitled to use paid Services under an Order.

Tenarie Materials

The Services, Documentation, software, templates, methodologies, workflows, mappings, connectors, scripts, know-how, and other materials owned or developed by Tenarie independently of Customer Data.

Third-Party Services

Services, software, systems, content, platforms, or applications not owned or controlled by Tenarie that are used by, linked to, or integrated with the Services.

Usage Data

Technical, diagnostic, telemetry, analytics, and performance data concerning operation and use of the Services. Where Usage Data is aggregated or de-identified so that it does not identify Customer, an Authorized User, or an individual, it is not Customer Data.

4. Plans and order of precedence

4.1 Plans

Tenarie may offer Personal, Team, Business, and Enterprise plans, as well as trials, pilots, early-access, preview, and evaluation services. Plan names, included capacity, features, availability, and commercial terms are those shown in the applicable Order, checkout, Website, or in-product notice at the time of purchase or activation.

• Personal: a no-fee plan for one person, subject to published limits and availability. No credit card is required unless the customer later purchases paid Services.
• Team: a paid plan that may be offered on monthly or annual terms and may include self-service purchase.
• Business: a paid plan that may be purchased through self-service or an assisted commercial process. An Order or signed agreement may add or replace terms.
• Enterprise: a contract-led annual plan governed by signed commercial terms.

Trials, pilots, early-access, preview, and evaluation services may be changed or withdrawn at any time, may be subject to additional terms and limits, and must not be used for business-critical production reliance unless Tenarie agrees otherwise in writing. No service level, service credit, warranty, indemnity, or support commitment applies to unpaid or evaluation access unless expressly stated in writing.

4.2 Product and entitlement boundaries

Access may depend on plan, account type, commercial approval, enabled features, product availability, rollout state, workspace configuration, user permissions, and API token scope. A capability being visible, described, technically possible, or included on a roadmap does not mean it is included in your plan.

4.3 Order of precedence

If documents conflict, the following order applies unless a signed agreement says otherwise:

1. a signed master agreement, Customer Engagement Agreement, or amendment;
2. an accepted Order Form, Order, Statement of Work, or accepted quote;
3. an applicable Data Processing Addendum, Security Addendum, Service Level Agreement, or other incorporated schedule;
4. these Terms; then
5. the Documentation and other incorporated published policies.

Customer purchase orders, procurement portals, invoice notes, and similar Customer documents do not amend the agreement unless Tenarie expressly signs them as an amendment.

5. Access and account administration

Subject to these Terms, the applicable plan limits, and payment of applicable fees, Tenarie grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, and revocable right during the applicable term to access and use the Services and Documentation for Customer’s internal business purposes.

Authorized Users must be at least 18 years old or the age of legal majority in their jurisdiction, whichever is higher. Customer is responsible for:

• providing accurate account, contact, and billing information and keeping it current;
• all activity under its Account and the acts and omissions of Authorized Users;
• ensuring each Authorized User has unique credentials and does not share them;
• configuring roles, permissions, workspaces, multifactor authentication, single sign-on, connectors, and other customer-controlled settings appropriately;
• protecting credentials, API tokens, connector secrets, devices, networks, and source systems; and
• promptly notifying Tenarie of suspected unauthorized access or credential compromise.

Customer may allow an affiliate or third party to use the Services only where its plan or a written agreement permits it. Customer remains responsible for that use. Personal and Team plans must not be used to provide a managed service, service bureau, multi-customer portal, resale service, or external audit service unless Tenarie approves that use in writing.

6. Acceptable use

Customer must use the Services lawfully and must not, and must not permit another person to:

• use the Services for unlawful, fraudulent, deceptive, abusive, harassing, defamatory, discriminatory, or infringing purposes;
• upload malware or harmful code, send spam or phishing, or use the Services to harm another person or system;
• gain or attempt unauthorized access to the Services, another customer environment, Tenarie systems, or third-party systems;
• interfere with, overload, disrupt, or circumvent the Services, security controls, rate limits, usage limits, entitlements, or billing controls;
• perform penetration testing, vulnerability scanning, load testing, denial-of-service testing, red-team testing, or similar activity against Tenarie without prior written authorization;
• reverse engineer, decompile, disassemble, or attempt to derive source code, non-public APIs, algorithms, or underlying structures, except where law prohibits this restriction;
• scrape, crawl, spider, harvest, frame, mirror, or systematically extract the Services or Website except through approved APIs, supported exports, ordinary search indexing permitted by our crawler instructions, or as otherwise permitted by law;
• resell, rent, lease, sublicense, distribute, timeshare, or make the Services available to third parties except as expressly permitted in writing;
• use the Services or Tenarie Materials to build, train, enhance, benchmark, or provide a competing product or service without prior written approval;
• misrepresent identity, share accounts, or violate applicable sanctions, export controls, privacy laws, confidentiality obligations, or third-party rights; or
• upload or process prohibited sensitive data described below without Tenarie’s express written approval.

To request authorization for good-faith security research, use our Contact Us form before testing.

7. Customer Data

7.1 Ownership and license

As between the parties, Customer owns Customer Data. Customer grants Tenarie a non-exclusive, worldwide, royalty-free right to host, copy, transmit, display, modify, and otherwise process Customer Data only as necessary to provide, secure, support, maintain, improve, and operate the Services, perform agreed services, comply with law, and exercise Tenarie’s rights under the agreement.

7.2 Customer responsibilities

Customer is responsible for the accuracy, quality, legality, and suitability of Customer Data and for all rights, permissions, notices, consents, and lawful bases needed for Tenarie and its service providers to process it. Where Customer provides personal information about another person, Customer must be authorized to do so and provide any notice required by law.

7.3 Sensitive and restricted data

The Services are designed for cybersecurity assurance and compliance operations, not unrestricted storage of highly sensitive or sector-regulated personal information. Unless Tenarie expressly approves it in writing, Customer must not upload or process:

• special-category or sensitive personal information, including health, biometric, racial or ethnic, political, religious, union-membership, sex-life, or sexual-orientation data;
• protected health information, patient records, or payment-card data;
• government-issued identifiers, bank-account details, or full financial credentials;
• personal information about children;
• criminal-record information or other highly regulated personal information; or
• private keys, production passwords, unrestricted API tokens, or secrets that should not be stored in a compliance workspace.

Tenarie may remove, quarantine, disable, or require removal of material it reasonably believes breaches these Terms, applicable law, third-party rights, or platform security requirements.

8. Privacy, data processing, and security

Our Privacy Policy explains how Tenarie handles personal information for its own purposes. When Tenarie processes personal information in Customer Data on Customer’s instructions, Customer generally acts as controller or equivalent organization and Tenarie acts as processor or service provider. Any applicable signed Data Processing Addendum takes precedence.

Customer instructs Tenarie to process Customer Data to provide, secure, support, maintain, and improve the Services, follow Customer configurations and lawful instructions, perform agreed services, and comply with law. Customer authorizes Tenarie to use service providers and subprocessors for these purposes, subject to appropriate contractual protections.

Tenarie uses technical and organizational measures designed to protect Customer Data against accidental or unlawful loss, destruction, alteration, unauthorized disclosure, or unauthorized access. These measures may include encryption in transit and at rest, access controls, tenant separation, logging, monitoring, backup and recovery procedures, personnel controls, vendor diligence, and incident response processes.

Tenarie will notify Customer without undue delay after confirming a security incident affecting Customer Data in Tenarie systems, in accordance with applicable law and any more specific written agreement. No service can be guaranteed completely secure. Customer remains responsible for customer-controlled security settings, systems, credentials, source services, and appropriate exports or backups of business-critical data.

9. Third-Party Services and integrations

The Services may link to, integrate with, import from, export to, depend on, or be used with Third-Party Services. Customer’s use of a Third-Party Service is governed by that provider’s terms, policies, permissions, and account settings.

When Customer enables an integration, Customer instructs Tenarie to access, transmit, store, disclose, and process Customer Data as necessary to provide it. Customer is responsible for configuring least privilege and for having the credentials, rights, permissions, notices, consents, and lawful bases required for the connection.

Tenarie is not responsible for third-party products, content, outages, API changes, data errors, security events, pricing changes, or terms changes outside Tenarie’s control. Tenarie may suspend, modify, or discontinue an integration where reasonably necessary for security, legal, third-party dependency, product integrity, operational, or commercial reasons.

10. Product boundaries

10.1 Frameworks and reference materials

Framework content is provided for operational reference and is not an official publication of a standards owner unless expressly stated. It may be summarized, reformatted, mapped, adapted, or supplemented and may differ from official source material. Customer is responsible for consulting official publications and obtaining any licenses or permissions required for its use. Third-party rights remain with their owners.

10.2 Connectors, Test Packages, and API

Connectors, Test Packages, and API access are subject to the applicable plan, enabled features, capacity, permissions, rate limits, third-party availability, product rollout, and Documentation. Test Packages are operational support materials, not legal, audit, assurance, certification, or regulatory advice. Customer is responsible for validating their suitability.

10.3 Automated and AI-enabled features

If Tenarie makes automation, recommendation, assisted drafting, classification, mapping, summarization, or artificial-intelligence features available, their outputs may be incomplete, inaccurate, non-unique, or unsuitable for Customer’s purpose. Customer must review and approve outputs before relying on them and must not use them for unlawful or harmful content or solely automated decisions about individuals that have legal or similarly significant effects.

10.4 No professional advice or guaranteed outcome

Tenarie supports cybersecurity and compliance work but does not provide legal, regulatory, tax, financial, audit, certification, or professional advice through the Services. Customer remains responsible for legal interpretation, control design, evidence sufficiency, remediation, audit strategy, regulatory communication, and any certification, assurance, or compliance outcome.

11. Fees, billing, taxes, and renewals

This section applies when Customer purchases paid Services. Customer must pay the fees shown in the applicable Order, checkout, accepted quote, invoice, marketplace order, or plan page. Unless stated otherwise, fees are in New Zealand dollars and exclude GST, VAT, sales tax, withholding tax, duties, and similar charges.

Paid subscriptions may be billed monthly or annually. Unless the Order says otherwise, fees are charged in advance and are non-refundable except as expressly stated in these Terms or required by law. Customer authorizes Tenarie and its payment processor to charge the supplied payment method for recurring fees, taxes, approved add-ons, overages, and renewals.

Unless Customer cancels before renewal, a paid subscription automatically renews for successive periods of the same length as the expiring period, or as stated in the Order. Cancellation takes effect at the end of the current paid period unless Tenarie confirms an earlier date.

If payment fails or an undisputed amount is overdue, Tenarie may retry payment, restrict paid features, suspend or downgrade the Account, recover reasonable collection costs, or terminate the affected subscription after notice where practicable. Customer must notify Tenarie promptly of a good-faith billing dispute, provide reasonable details, and pay undisputed amounts on time.

If Customer exceeds a plan limit, Tenarie may require additional capacity, charge an agreed overage, conduct a true-up, or restrict the affected excess use after notice where practicable. Over-capacity use does not by itself authorize deletion of Customer Data. Price or packaging changes for an existing paid subscription take effect from its next renewal unless required sooner by law, tax, security, or a third-party marketplace charge, or Customer agrees earlier.

12. Availability, maintenance, and support

Tenarie will use commercially reasonable efforts to provide paid production Services, excluding planned or emergency maintenance, Customer systems, Third-Party Services, misuse, internet failures, and events outside Tenarie’s reasonable control. Planned maintenance expected to materially affect paid production use will be notified in advance where practical.

Support channels, hours, response targets, onboarding, service levels, and service credits depend on the applicable plan or signed agreement. Unless an Order or signed agreement states otherwise, no service credits apply. Personal, trial, early-access, preview, pilot, and evaluation access has no committed availability or support target.

Tenarie may update, patch, enhance, replace, or retire features. For a paid subscription, Tenarie will not materially reduce the overall core functionality during the then-current Subscription Term unless reasonably required for security, law, third-party dependency, product integrity, or operations.

13. Intellectual property and feedback

Tenarie and its licensors own all rights, title, and interest in the Services, Documentation, Tenarie Materials, de-identified Usage Data, branding, and related intellectual property. Customer receives only the limited access rights expressly granted by the agreement.

Customer owns Customer Data and customer-specific content it authors. Feedback is not confidential. Customer grants Tenarie a perpetual, irrevocable, worldwide, royalty-free license to use suggestions, ideas, enhancement requests, corrections, and other feedback for any lawful purpose without compensation or attribution.

Tenarie may use aggregated or de-identified Usage Data to operate, secure, analyze, support, and improve the Services, develop services, and report aggregate metrics, provided it does not identify Customer, an Authorized User, or an individual.

14. Confidentiality

“Confidential Information” means non-public information disclosed by or for a party that is marked confidential or should reasonably be understood as confidential, including Customer Data, non-public product or security information, business information, and non-public pricing.

The receiving party will use Confidential Information only to perform or exercise rights under the agreement, protect it with at least reasonable care, and disclose it only to personnel, affiliates, professional advisers, service providers, and contractors who need to know it and are bound by suitable confidentiality obligations.

Confidential Information excludes information the receiving party can show was lawfully known without restriction, becomes public without breach, is lawfully received from a third party without a duty of confidence, or is independently developed without the information. A party may disclose information when legally required, provided it gives notice where permitted and reasonably cooperates with efforts to limit disclosure.

15. Warranties and disclaimers

Each party represents that it has authority to enter the agreement and will comply with laws applicable to its own performance.

For paid production Services, Tenarie warrants that the core Services will perform materially in accordance with the applicable Documentation during the Subscription Term. Customer’s exclusive remedies for breach are re-performance, repair, workaround, or, if Tenarie does not cure a material breach within a reasonable period, termination of the affected Services and a pro rata refund of prepaid unused fees for the terminated period.

Except for an express warranty in these Terms or a signed agreement, the Services, Website, Personal plan, trials, early-access and preview features, reference content, Test Packages, automated outputs, and Documentation are provided “as is” and “as available”. To the maximum extent permitted by law, Tenarie excludes implied warranties, guarantees, conditions, and representations, including fitness for a particular purpose, merchantability, non-infringement, accuracy, uninterrupted availability, and error-free operation.

Tenarie does not warrant that the Services will prevent security incidents, satisfy a law, contract, auditor, regulator, standard, or framework, or produce a certification, accreditation, assurance, or compliance outcome.

16. Indemnities

For paid Team or Business production Services governed by these Terms, Tenarie will defend Customer against a third-party claim that the unmodified Services, used as authorized, infringe that third party’s intellectual property rights, and will pay damages and reasonable external legal costs finally awarded or agreed in settlement. This does not apply to claims arising from Customer Data or instructions, third-party combinations, unauthorized modifications or use, Personal or evaluation access, or continued use after Tenarie offers a non-infringing alternative.

Customer will defend Tenarie against third-party claims arising from Customer Data or materials infringing third-party rights, Customer’s unlawful or unauthorized use, or Customer’s material breach of the acceptable-use, sanctions, export-control, privacy, or data-rights obligations in these Terms, and will pay damages and reasonable external legal costs finally awarded or agreed in settlement.

The indemnified party must promptly notify the indemnifying party, give it control of the defense and settlement, and provide reasonable cooperation at the indemnifying party’s cost. A settlement may not admit fault by or impose an unindemnified obligation on the indemnified party without its prior consent, not to be unreasonably withheld.

17. Limitation of liability

To the maximum extent permitted by law, neither party is liable to the other for loss of profit, revenue, goodwill, anticipated savings, or business opportunity; loss or corruption of data; business interruption; or indirect, consequential, special, exemplary, or punitive loss or damages.

Subject to the exclusions below, Tenarie’s total aggregate liability arising from the Website, Services, these Terms, an Order, or related claims will not exceed:

• NZD 100 for Personal, trial, early-access, preview, pilot, evaluation, Website, and other unpaid use;
• for a monthly paid subscription, fees paid for the affected Services during the three months before the first event giving rise to liability, or the shorter active period;
• for an annual paid subscription, fees paid or payable for the affected Services during the twelve months before the first event giving rise to liability, or the shorter active period; or
• the cap in the applicable signed agreement for contract-led Services.

The cap applies in aggregate across all legal theories. It does not limit Customer’s payment obligations, Customer’s liability for unauthorized use or breach of the acceptable-use or sanctions obligations, either party’s fraud or willful misconduct, or liability that cannot lawfully be excluded or limited.

18. Suspension

Tenarie may suspend or restrict access, to the minimum extent reasonably considered necessary, where:

• continued access creates a material security, legal, operational, or platform-integrity risk;
• Customer or an Authorized User materially breaches these Terms or uses the Services unlawfully;
• an undisputed payment is overdue;
• use materially exceeds agreed limits and threatens performance, security, or commercial integrity;
• a required Third-Party Service prevents continued operation; or
• law, a regulator, court, or government authority requires suspension.

Tenarie will give prior notice where reasonably practicable and restore access promptly after the reason is resolved. A Customer-caused suspension does not relieve Customer of payment obligations.

19. Term, cancellation, and termination

These Terms start when Customer first accepts them or uses Services governed by them and continue until all relevant Accounts and subscriptions end. Personal access continues until Customer closes the Account, Tenarie closes it, or Tenarie discontinues the plan. A paid subscription continues for the Subscription Term and any renewal.

Customer may cancel a paid subscription through available account or billing controls or by contacting Tenarie. Cancellation stops the next renewal and ordinarily takes effect at the end of the current paid period.

Either party may terminate for material breach if the other party does not cure the breach within 30 days after written notice. Tenarie may terminate or restrict access immediately when reasonably necessary for security, law, platform integrity, repeated breach, non-payment, unauthorized third-party access, or unlawful use.

When the agreement ends, Customer’s right to use the affected Services ends. Accrued rights and clauses that by their nature should survive remain effective, including confidentiality, intellectual property, payment, data return and deletion, indemnities, liability limits, and dispute terms.

20. Data export, deletion, and transition

During an active subscription, Customer may export Customer Data using available tools, subject to plan functionality, authorization, technical limits, and Documentation.

For paid self-service subscriptions, Customer may request or perform an available export for up to 30 days after termination or expiry, unless access was terminated or restricted for unlawful use, security risk, material breach, non-payment, or legal requirement. Personal, trial, early-access, preview, pilot, and evaluation access may have a shorter or no post-termination retrieval period, so Customer should export data before closure.

After the applicable retrieval period, Tenarie may delete Customer Data from active systems. Protected backup copies may remain until overwritten or deleted through the ordinary backup lifecycle or may be retained where required by law. Contract-led transition assistance, retrieval periods, deletion commitments, or deletion certificates are governed by the signed agreement.

21. Website use and external links

Website content is for general information and may change without notice. It is not legal, security, audit, certification, financial, tax, or other professional advice. Tenarie does not warrant that Website content is complete, uninterrupted, secure, or error-free.

The Website may link to third-party websites or resources. Tenarie does not control and is not responsible for their content, availability, privacy, security, products, or services. Use of the Website is also subject to our Privacy Policy.

Neither party may issue a press release naming the other without written consent. Tenarie may use a Customer’s name or logo publicly only with written approval, an affirmative opt-in, or permission in an applicable Order.

22. Changes to these Terms

Tenarie may update these Terms to reflect changes in the Services, business, law, security, technology, or operations. We will post the revised Terms with an updated date and provide additional notice of material changes where required by law or where reasonably appropriate.

For an existing paid self-service subscription, a material change that adversely affects Customer’s rights or obligations will ordinarily apply from the next renewal unless required sooner for law, regulation, security, third-party dependency, product integrity, or operations, or Customer agrees earlier. For unpaid, trial, early-access, preview, evaluation, and Website use, updated Terms apply when posted or otherwise notified, to the extent permitted by law. Signed agreements change only through their amendment process.

23. Governing law and disputes

These Terms are governed by New Zealand law. The New Zealand courts have non-exclusive jurisdiction, although either party may seek urgent interim, injunctive, or equitable relief in a court with jurisdiction.

Before starting court proceedings, each party will refer the dispute to senior representatives for good-faith resolution for at least 30 days. This does not apply to urgent interim relief, undisputed debt recovery, or where delay would prejudice a legal right. The parties will continue performing undisputed obligations during a dispute.

24. General terms

These Terms and the applicable Orders and incorporated policies form the entire agreement about their subject matter and supersede earlier discussions on that subject. A waiver must be in writing. If a provision is invalid or unenforceable, it will be limited or interpreted to the minimum extent necessary, and the remaining provisions continue.

Neither party may assign the agreement without the other party’s prior written consent, except in connection with a merger, reorganization, corporate restructure, financing, change of control, or sale of substantially all relevant assets, if the assignee assumes the agreement. The parties are independent contractors and do not create a partnership, joint venture, agency, fiduciary, or employment relationship.

Except for payment obligations, neither party is liable for delay or failure caused by events outside its reasonable control, including natural disaster, war, terrorism, labor disruption, utility or internet failure, third-party infrastructure failure, government action, epidemic, civil unrest, or a cyberattack not caused by that party’s failure to comply with the agreement.

Each party will comply with applicable export-control, sanctions, anti-corruption, and anti-bribery laws. Customer must not permit access that would violate those laws.

25. Contact and notices

Questions or notices about these Terms may be submitted using our Contact Us form.

• Company: Tenarie Limited
• New Zealand company number: 9425769
• Website: tenarie.com

Tenarie may send operational, billing, security, legal, and administrative notices through the Services, by email to an Account owner or administrator, or by posting a notice on the Website. Customer is responsible for keeping its notice contacts current.