Bonterms-derivative. These Terms of Service incorporate standard B2B protections substantially modeled on the Bonterms Cloud Terms framework (CC-licensed, peer-reviewed by technology counsel). Customer-protective clauses (security warranties, data portability, indemnification, audit rights) are included. ElasticD3M, LLC has adapted this to its product set; this document does not constitute legal advice and Customer should consult its own counsel for material decisions.
1. Acceptance and Scope
These Terms of Service (the "Terms") constitute a binding agreement between ElasticD3M, LLC, a Texas limited liability company with a registered address at 7700 Broadway St, Ste 104 PMB1083, San Antonio, TX 78209 ("Provider", "we", "us"), and the entity or person identified in a signed engagement agreement or in Provider's records for a prior purchase ("Customer", "you"). By entering into an AIR AI™ engagement, or by using this site, Customer accepts these Terms. AIR AI™ is not sold self-serve: there is no checkout, no account creation and no intake form on this domain.
If Customer is using the Services on behalf of an organization, Customer represents that it has authority to bind that organization, and references to "Customer" mean that organization. These Terms apply to the Services described at ai4air.ai. Commercial terms for an AIR AI™ engagement (scope, fees, term, acceptance and any service levels) are set out in the individual written engagement agreement for that engagement, which controls over these Terms to the extent of any conflict. Sections 5 and 6 govern purchases of the relocated preparedness product that were made while it was sold on this domain.
2. Definitions
- "Services" means AIR AI™, Provider's Agent-as-a-Service automated incident response capability: software that correlates security signals into an incident, determines the containment warranted, and proposes that containment for execution only within a scope a Customer incident commander authorized in advance. AIR AI™ holds no credential on Customer systems and executes nothing itself; execution and rollback are performed by REL AI™, a separate component deployed under Customer's control. The incident response readiness assessment, plan, playbooks, notification matrix, tabletop kit and remediation roadmap are a different product, sold at ai4ciso.ai/incident-response under that site's terms, and are not the Services.
- "Customer Data" means data, content or information processed by the Services on Customer's behalf. AIR AI™ is deployed inside Customer's own accreditation boundary, so operational data (security signals, asset and posture information, incident records, authorization grants and the ledger) is processed within that boundary and under Customer's control. Provider does not receive Customer operational data by virtue of Customer running the Services. Any data Customer separately transmits to Provider is governed by the DPA.
- "Documentation" means the user-facing documentation Provider makes available at ai4air.ai.
- "Engagement" means an AIR AI™ deployment scoped in a written engagement agreement between the parties, beginning and concluding as that agreement provides.
- "Confidential Information" means non-public information disclosed by one party to the other in connection with these Terms, including Customer Data and Provider technology and pricing.
3. Services Description
Provider offers AIR AI™ (Automated Incident Response), an Agent-as-a-Service automated incident response capability for defense industrial base and government programs. AIR AI™ correlates security signals into a single incident with a confidence level and a written rationale, determines the containment warranted, and proposes it. It holds no credential on any Customer system and cannot execute its own conclusion. Execution, confirmation and rollback are performed by REL AI™, which verifies each proposed action against the authorizing scope at the moment it would run. Every decision, authorization, action and reversal is written to an append-only hash-chained ledger before the action takes effect. Actions outside the authorized scope, irreversible actions, and actions against protected assets or assets whose protection status cannot be established are routed to a human. There is no auto-approve mode, and no configuration creates one. Provider is not a law firm and does not provide legal advice, and is not a forensic investigator, insurance broker or regulator.
Development status. AIR AI™ is in development and is deployed in no customer environment. The authority gate, the hash-chained ledger, the correlation engine and the REL AI™ command contract are built and unit-tested in memory. Binding an authorization to a commander's PIV/CAC signature is designed and is not implemented, so the shipped verifier covers no grant and every proposed action routes to a human. There is no persistence, no network transport into REL AI™, and no detection connectors. Provider makes no representation that AIR AI™ is available for production use, and offers no Engagement on any other basis.
4. Account Terms
Customer is responsible for maintaining the security of any credentials it uses to access the Services and for all activity that occurs under its account. Customer must notify Provider promptly (at support@ai4ciso.ai) of any unauthorized access. Customer must provide accurate and current information at intake and during account use.
5. Fees and Payment
The Incident Response Readiness Assessment & Plan is sold in five one-time tiers priced by organization size: Starter $1,495, Essential $4,950, Professional $12,500, Enterprise $24,500, and Multi-Entity $34,500 (USD). As of 2026-08-17 that product is sold at ai4ciso.ai/incident-response and not on this domain; the terms in this section govern purchases made under them. AIR AI™, the automated incident response capability on ai4air.ai, is not sold self-serve and is scoped per engagement. The applicable fee is displayed at checkout before payment. The fee is a one-time charge processed at the time of order through Stripe. There are no subscriptions and no recurring charges on this site. All fees are non-refundable except as set forth in Provider's Cancellation Policy.
No Free Trial. There is no free trial. The one-time fee for the tier purchased is charged immediately at checkout. No card is stored by Provider; Stripe processes the payment.
Subscription Credit. If Customer purchases an Aegis AI™ subscription (a separate ElasticD3M, LLC product sold at ai4ciso.ai, under its own terms) within 30 days of the AIR AI™ purchase, Provider will credit the full AIR AI™ fee paid against the first subscription month. The credit is applied once, is not transferable, and has no cash value.
Provider may adjust pricing prospectively at any time. Price adjustments do not apply to an Engagement already purchased.
6. Cancellation and Refunds
AIR AI™ is a one-time engagement. The fee is refundable in full if Customer requests cancellation in writing, by email to support@ai4ciso.ai, before the deliverable PDF has been emailed to Customer. Once the deliverable has been delivered to Customer's inbox, the Engagement is complete and the fee is non-refundable. The Cancellation Policy governs.
7. Acceptable Use
Customer's use of the Services is governed by the Acceptable Use Policy. Without limiting the AUP, Customer agrees not to: (a) reverse engineer, decompile, or disassemble any part of the Services; (b) use the Services to develop a competing product; (c) interfere with the integrity or performance of the Services; (d) use the Services in violation of applicable law, including export control laws; or (e) submit regulated payload contents (PHI, cardholder data, GDPR Article 9 special categories) to the Services; the intake form is designed to collect business and security-program information, not regulated data contents.
8. Customer Data and Confidentiality
Customer retains all rights, title, and interest in Customer Data. Customer grants Provider a non-exclusive, worldwide, royalty-free license to use, store, process, and display Customer Data solely to provide the Services and as otherwise permitted by these Terms and the Privacy Notice. Provider's processing of Personal Data (as defined in the Data Processing Addendum) is governed by the DPA, which is incorporated into these Terms by reference.
Each party will hold the other's Confidential Information in confidence and will not disclose it except to its employees, contractors, and advisors who have a need to know and who are bound by confidentiality obligations no less protective than those in these Terms.
9. Security Warranties
Provider warrants that it will: (a) maintain industry-standard administrative, physical, and technical safeguards designed to protect Customer Data, including encryption at rest (AES-GCM or stronger) and in transit (TLS 1.2 or stronger); (b) restrict access to Customer Data to personnel with a need to know; (c) implement least-privilege access controls for production systems; (d) notify Customer of any confirmed Personal Data Breach affecting Customer's data within seventy-two (72) hours of confirmation, as required by the DPA; and (e) maintain a documented incident response plan.
Architecture of the Services. AIR AI™ runs inside Customer's own accreditation boundary and holds no credential on any Customer system; it cannot execute an action. Execution credentials and rollback are held by REL AI™, deployed under Customer's control within the same boundary, which verifies every proposed action against the authorizing scope before performing it. Provider operates no cloud service that reaches into Customer systems as part of the Services, and the Services do not phone home, emit telemetry to Provider, or check a license at run time. Where an Engagement requires Provider to receive any Customer data, that transfer and its safeguards are specified in the engagement agreement and governed by the DPA.
10. Intellectual Property
Provider retains all rights, title, and interest in the Services, including all related intellectual property rights. Customer's use of the Services does not transfer any ownership rights. Customer may use the deliverable of the relocated preparedness product now sold at ai4ciso.ai/incident-response (readiness assessment, incident response plan, scenario playbooks, notification matrix, tabletop exercise kit, remediation roadmap), where Customer purchased it while it was sold on this domain, for its own internal purposes, including providing it to counsel, insurers, regulators, customers, auditors, and partners in connection with due diligence and contract performance. The deliverable may not be resold or distributed to third parties for compensation without Provider's written consent.
11. Disclaimers
EXCEPT FOR THE EXPRESS WARRANTIES IN SECTION 9, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE. PROVIDER DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT ALL DEFECTS WILL BE CORRECTED.
Automated Response Disclaimer. ElasticD3M, LLC provides automated incident response software. It is not a law firm and does not provide legal advice, and it is not a forensic investigator, insurance broker, or regulator. Provider does not guarantee that Customer will detect, prevent, or recover from any incident, or achieve any particular regulatory outcome. Detection depends on the signals Customer's own instrumentation produces, and containment depends on Customer's environment and on the execution layer Customer operates. AIR AI™ proposes containment; it does not decide unilaterally and it cannot execute. Every action is bounded by the scope Customer's incident commander authorized in advance, and anything outside that scope, anything irreversible, and anything touching a protected asset or an asset whose protection status cannot be established is routed to a human. Authorizing a scope is Customer's act, and the final accountability for incident response, including the decision to permit any automated action at all, remains with Customer.
12. Indemnification
Mutual Indemnification. Each party will defend the other against any third-party claim arising from the defending party's: (a) gross negligence or willful misconduct; (b) infringement of a third party's intellectual property rights through that party's own materials (Provider's Services or Customer Data, respectively); or (c) breach of these Terms. The indemnified party will: (i) promptly notify the indemnifying party of any covered claim; (ii) give the indemnifying party reasonable control of the defense and settlement; and (iii) provide reasonable cooperation at the indemnifying party's expense.
Provider IP Infringement Remedy. If Customer's use of the Services is enjoined or claimed to infringe a third party's intellectual property rights, Provider may, at its option and expense: (i) procure for Customer the right to continue using the Services; (ii) replace or modify the Services so they no longer infringe; or (iii) terminate the affected portion of the Services and refund any prepaid fees attributable to the affected period.
13. Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUES, DATA, OR BUSINESS OPPORTUNITIES, ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
EACH PARTY'S TOTAL CUMULATIVE LIABILITY UNDER THESE TERMS WILL NOT EXCEED THE GREATER OF: (A) THE FEES PAID OR PAYABLE BY CUSTOMER TO PROVIDER IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED THOUSAND DOLLARS ($100,000 USD).
Exclusions. The limitations in this Section 13 do not apply to: (i) either party's indemnification obligations under Section 12; (ii) Customer's payment obligations; (iii) either party's gross negligence or willful misconduct; or (iv) breaches of confidentiality obligations.
14. Term and Termination
These Terms remain in effect for so long as Customer has an active account or any unpaid balance. Either party may terminate these Terms for material breach by the other if the breach is not cured within thirty (30) days after written notice. Either party may terminate immediately upon the other party's bankruptcy or insolvency.
Upon termination: (a) any in-progress Engagement concludes as provided in the Cancellation Policy; (b) Provider will, at Customer's written request made within thirty (30) days after termination, return or delete Customer Data in accordance with the DPA; and (c) provisions that by their nature should survive termination (including Sections 8, 10, 11, 12, 13, 15, 15A, 16, 17, 18, and 19) will survive.
15. Modifications
Provider may modify these Terms or the Services from time to time. For material modifications adverse to Customer's rights, Provider will provide at least thirty (30) days' prior notice via email or in-platform notice. Customer's continued use of the Services after a modification effective date constitutes acceptance of the modification. Modifications do not retroactively change the terms applicable to an Engagement already purchased.
15A. Trade Compliance (OFAC, Export Controls, Sanctions)
Customer represents and warrants that (a) Customer and its principals are not listed on the OFAC SDN, SSI, or any other U.S. government denied-party list; (b) Customer is not located in or organized under the laws of a country or region subject to a comprehensive U.S. embargo (currently Cuba, Iran, North Korea, Syria, Crimea, Donetsk, and Luhansk); (c) Customer will not use the Services in violation of U.S. export-control laws (Export Administration Regulations / International Traffic in Arms Regulations) or sanctions regulations administered by the U.S. Treasury Office of Foreign Assets Control. Breach of this Section 15A permits ElasticD3M, LLC to suspend or terminate the Services immediately, without refund of fees previously paid. Customer agrees to notify Provider at legal@elasticd3m.com promptly if Customer's eligibility status changes during the term.
16. Governing Law and Venue
These Terms are governed by the laws of the State of Texas, United States, without regard to conflict-of-laws principles. The exclusive venue for any dispute arising under these Terms is the state or federal courts located in Bexar County, Texas, and each party consents to personal jurisdiction in those courts.
17. Dispute Resolution and Arbitration
The parties will first attempt to resolve any dispute through good-faith negotiations between business leaders. If unresolved after thirty (30) days, either party may refer the dispute to binding arbitration administered by JAMS under its Streamlined Arbitration Rules, conducted in San Antonio, Texas, in English, before a single arbitrator. Each party bears its own attorneys' fees; arbitration costs are split equally. Judgment on the arbitration award may be entered in any court of competent jurisdiction.
Class-Action Waiver. Each party waives any right to participate in a class, collective, or representative action against the other arising out of these Terms or the Services. Disputes must be brought on an individual basis only.
Notwithstanding the foregoing, either party may seek injunctive or equitable relief in court for breach of intellectual property rights or confidentiality obligations.
18. Force Majeure
Neither party will be liable for any delay or failure to perform (except for payment obligations) due to causes beyond its reasonable control, including acts of God, war, terrorism, civil unrest, government action, internet or utility outages, cyberattacks affecting upstream infrastructure, pandemics, or natural disasters. The affected party will notify the other party promptly and use reasonable efforts to resume performance.
19. General Provisions
Notices. Notices to Provider must be sent to legal@elasticd3m.com with a copy to Provider's registered address. Notices to Customer will be sent to the email address on file. Notices are effective on receipt by email.
Assignment. Neither party may assign these Terms without the other's prior written consent, except that either party may assign these Terms in connection with a merger, acquisition, or sale of substantially all of its assets, provided the assignee assumes all obligations.
Entire Agreement. These Terms, together with the Privacy Notice, DPA, AUP, SLA, Cancellation Policy, and the Subprocessors List, constitute the entire agreement between the parties and supersede all prior agreements and understandings.
Severability. If any provision of these Terms is held unenforceable, the remaining provisions remain in effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.
No Waiver. Failure to enforce any provision is not a waiver of future enforcement.
Independent Contractors. The parties are independent contractors; no agency, partnership, joint venture, or employment relationship is created.
U.S. Government End Users. The Services are commercial computer software under FAR 12.212 and DFARS 227.7202; U.S. government end users acquire only the rights set forth herein.
20. Contact
Questions about these Terms: legal@elasticd3m.com
Service questions: support@ai4ciso.ai
Privacy questions: privacy@elasticd3m.com
Effective Date: June 12, 2026 · Version: 2.0 (Bonterms-derivative) · Customer: Standard B2B
Replaces all prior versions of the Terms of Service published at ai4air.ai before this date.