Terms of Service

Agreement

These terms govern your use of Varman, a compliance automation service operated by CloudDrove Inc., an Ontario, Canada company ("Varman", "we", "us"). By creating an account or using the service you agree to them. If you use Varman for an organization, you accept these terms on its behalf and confirm you have the authority to do so. If you have a signed agreement with us, that agreement controls where it conflicts with these terms.

The service

Varman helps you run a security and compliance program: it connects to your systems, collects evidence, tracks controls against frameworks, and helps you prepare for audits.

Varman is a tool, not an auditor or a law firm. Using it does not by itself make you compliant with any framework or law, and we do not issue certifications or audit opinions. Those come from your independent auditor. You remain responsible for your own compliance decisions.

Accounts

You are responsible for the people you invite, for keeping credentials confidential, and for activity under your accounts. Tell us promptly at support@varman.io if you suspect unauthorized access.

Your data

You keep all rights to the data you connect or upload ("customer data"). You give us permission to host and process it only as needed to provide, secure and support the service. You confirm you have the right to connect the systems and share the data you bring to Varman, including personal data about your staff.

Our Privacy Policy explains how we handle personal data. If you need a data processing agreement, ask us.

Integrations and credentials

When you connect a third-party system, you authorize Varman to read from it using the access you grant. Grant the least access that works, and revoke it in the third-party system when you no longer need the connection. Third-party systems are governed by their own terms, and we are not responsible for them.

AI features

Some features generate text or analysis using large language models. Output can be wrong or incomplete. Review it before you rely on it, publish it as policy, or give it to an auditor. We do not use customer data to train AI models.

Security testing features

If you use scanning or penetration testing features, you may only target systems you own or are authorized in writing to test. You are responsible for any testing you start.

Acceptable use

Do not use Varman to break the law, to access systems or data you are not authorized to access, to upload malicious code, to disrupt or probe the service beyond what a published security policy allows, to resell the service without our agreement, or to get around usage limits.

Fees

Paid plans are billed as described in your order or on the pricing page at the time you subscribe. Subscriptions renew for the same term unless cancelled before renewal. Fees are non-refundable except where the law or your order says otherwise. Early access use may be free or discounted and can change with notice.

Our property and open source

We and our licensors own the service, its software and its content, apart from your customer data. Parts of the service are built on open source software, which remains under its own licenses. Feedback you send can be used by us without obligation to you.

Confidentiality

Each of us will protect the other's non-public information with reasonable care and use it only for the purposes of this agreement.

Term and termination

You may stop using the service and close your account at any time. We may suspend or end access if you materially breach these terms, if required by law, or if your use puts the service or others at risk. After termination you can request an export of your customer data for a reasonable period, after which we delete it as described in the Privacy Policy.

Disclaimers

The service is provided "as is" and "as available". To the extent the law allows, we disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement. We do not promise that the service will be uninterrupted or error free, or that it will detect every gap in your controls.

Limitation of liability

To the extent the law allows, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data. Our total liability arising from the service is limited to the fees you paid us for the service in the 12 months before the claim arose. Nothing in these terms limits liability that cannot be limited by law.

Governing law

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply there, without regard to conflict of law rules. The courts of Ontario have exclusive jurisdiction over any dispute, unless the law where you are located requires otherwise.

Changes

We may update these terms. We will change the date above and, for material changes, notify account owners before the change takes effect. Continued use after that means you accept the updated terms.

Contact

Questions about these terms: support@varman.io.