Terms of Service

These Terms of Service (“Terms”) govern access to and use of the Skadi platform, websites, software, AI-assisted analysis, integrations, and related services (collectively, the “Services”) provided by Skadi, Inc. (“Skadi,” “we,” “us,” or “our”).

By accessing or using the Services, or accepting an order form that incorporates these Terms, the customer identified in the applicable account or order form (“Customer”) agrees to these Terms.

1. Accounts and Authorized Users

1.1 Business Use. The Services are intended for business use. Customer represents that it has authority to enter into these Terms.

1.2 Authorized Users. Customer may permit employees, contractors, advisors, and invited CPA or audit professionals (“Authorized Users”) to access the Services according to Customer’s account permissions. Customer is responsible for its Authorized Users’ compliance with these Terms, except where an independent CPA firm has a separate agreement with Skadi.

1.3 Account Security. Customer and Authorized Users must safeguard their credentials, use reasonable security practices, and promptly notify Skadi of suspected unauthorized access.

2. The Skadi Service

2.1 What Skadi Does. Skadi provides technology for SOC 2 readiness and audit workflows, including evidence organization, control mapping, testing support, exception identification, remediation workflows, engagement management, and AI-assisted analysis.

2.2 Customer and CPA Workflows. Customer and authorized CPA or auditor users may access separate or logically segregated workspaces and functionality according to their assigned permissions.

2.3 No Guaranteed Outcome. Skadi helps customers and their auditors perform readiness and audit-related work more efficiently. Use of the Services does not guarantee SOC 2 readiness, successful completion of an examination, issuance of a SOC report, or any particular audit conclusion.

2.4 Roles and Responsibilities. Skadi provides the technology and is responsible for providing and protecting the Services in accordance with the Agreement.

Customer is responsible for the accuracy, completeness, legality, and authorization of information it provides and for its own business and remediation decisions.

Where a CPA firm performs an examination or other professional engagement, the CPA firm remains independently responsible for its professional judgment, procedures, workpapers, conclusions, and any report it issues.

3. Customer Data and Evidence

3.1 Evidence Submission. Authorized Users may provide evidence through direct upload, authorized connections to designated repositories, or supported integrations.

Evidence may include policies, documents, screenshots, system records, reports, configurations, access records, responses, explanations, and other information relevant to an assessment or engagement.

3.2 Authority to Provide Data. Customer represents that it has the rights and permissions necessary for Skadi to receive and process information submitted to the Services.

3.3 Third-Party Services. Customer’s use of third-party integrations remains subject to the terms and practices of those providers. Skadi is not responsible for third-party services or for changes, outages, or restrictions imposed by them.

4. AI-Assisted Functionality

4.1 AI Processing. Skadi uses artificial intelligence and machine-learning functionality to assist with document analysis, evidence classification, control mapping, testing support, exception detection, summaries, and suggested findings.

4.2 Human Review. AI-generated outputs may be incomplete or inaccurate and should be reviewed before reliance. Skadi outputs are decision-support materials and do not constitute a CPA opinion or final audit conclusion.

4.3 No Training on Customer Content. Skadi will not use Customer Data, Customer Evidence, identifiable engagement content, or CPA workpapers to train third-party foundation models. Skadi will not intentionally permit a third-party foundation-model provider to use such content to train its general-purpose models.

4.4 De-Identified Information. Skadi may use aggregated, statistical, or de-identified information to operate, secure, analyze, benchmark, and improve the Services, provided that such information does not identify Customer, an Authorized User, an audit client, or an individual and cannot reasonably be used by Skadi to reconstruct Customer Data.

Skadi will not attempt to re-identify such information.

4.5 Infrastructure. Skadi may use third-party cloud, infrastructure, and AI providers to deliver the Services and may change those providers from time to time, provided that Skadi maintains protections materially consistent with its contractual data-protection obligations.

5. CPA and Auditor Use

5.1 Independent CPA Relationship. Skadi may enable Customer to work with an independent CPA firm through the Services or may support a CPA firm that brings its own client to Skadi.

The CPA firm contracts separately with its audit or assurance client and remains solely responsible for its professional services and any report it issues.

5.2 Billing. For convenience, Skadi may invoice platform fees and CPA firm fees together and may collect CPA firm fees on behalf of the CPA firm. Applicable fees will be separately identified.

Skadi’s collection of CPA fees does not give Skadi control over the CPA firm’s professional judgment, scope, conclusions, or issuance of a report.

Skadi may reasonably assist with billing administration or communication regarding a CPA engagement, but the CPA firm remains responsible for its professional services, scope, deliverables, and related professional fees.

5.3 CPA Workpapers. Customer readiness materials and Skadi analyses do not automatically become CPA workpapers. The CPA firm determines what information it accepts or incorporates into its professional documentation.

Where supported by the Services, CPA firms may export available workpapers and engagement materials. CPA firms remain responsible for maintaining copies required by their professional, legal, regulatory, or firm requirements.

6. Test and Pre-Audit Environments

6.1 Test Environments. Skadi may provide pilot, sandbox, demonstration, beta, preview, or test environments. Unless expressly designated as a production engagement, these environments are intended for evaluation and testing.

6.2 Test Data. Users should use synthetic, anonymized, de-identified, or otherwise appropriate data in test environments whenever reasonably practicable.

If real Customer Data is submitted to a non-production environment, Skadi will apply applicable security safeguards, but such environments may have functionality, availability, or retention characteristics different from production environments.

6.3 Pre-Audits. A Skadi readiness assessment or pre-audit is designed to identify potential gaps, exceptions, or remediation opportunities. It is not an independent CPA examination and does not itself result in a SOC 2 report or attestation opinion.

7. Ownership

7.1 Your Data Is Yours. As between Customer and Skadi, Customer retains all right, title, and interest in data, evidence, documents, and engagement-specific information submitted by or on behalf of Customer (“Customer Data”).

7.2 Permission to Process Customer Data. Customer grants Skadi a limited, non-exclusive license to host, copy, transmit, process, and display Customer Data only as reasonably necessary to provide, secure, and support the Services and as otherwise permitted under Sections 4.3 and 4.4.

7.3 Your Results. As between Customer and Skadi, Customer owns its engagement-specific readiness reports, findings, and results, excluding the underlying Skadi Technology.

7.4 Skadi Technology. Skadi and its licensors retain all rights in the Services and related software, models, methodologies, templates, workflows, taxonomies, testing frameworks, designs, documentation, and other technology (“Skadi Technology”).

Nothing in these Terms transfers ownership of Skadi Technology to Customer.

7.5 Feedback. Skadi may use suggestions or feedback regarding the Services without restriction or compensation, provided it does not disclose Customer Confidential Information.

8. Data Retention and Deletion

8.1 Retention. Skadi's basic data retention period is 30 days. Skadi does not retain Customer Data beyond that period unless a written agreement between Customer and Skadi specifies a different retention period.

Where a written agreement specifies a different period, that agreed period applies.

8.2 Your Right to Request Deletion. Customer may request deletion of Customer Data at any time.

Skadi will honor valid deletion requests within a commercially reasonable period, except where retention is reasonably necessary to comply with applicable law, contractual obligations, security requirements, legal holds, dispute resolution, or applicable professional record-retention requirements.

Skadi may require confirmation from an authorized account administrator before processing a deletion request.

8.3 CPA Engagement Records. Evidence, workpapers, engagement documentation, and related records associated with a CPA production engagement may be retained as reasonably necessary to support applicable professional, contractual, legal, or regulatory requirements.

CPA firms remain responsible for determining and satisfying their own professional record-retention requirements.

8.4 Backups and Residual Copies. Customer Data deleted from active systems may remain for a limited period in backups, logs, or archives maintained for security, disaster recovery, business continuity, or legal purposes.

Such information remains protected under these Terms and will be deleted, overwritten, or rendered inaccessible in accordance with Skadi’s standard retention and backup practices unless longer retention is required.

8.5 De-Identified Information. Skadi may retain de-identified or aggregated information as permitted under Section 4.4.

9. Confidentiality and Security

9.1 Confidentiality. Each party may receive non-public information that a reasonable person would understand to be confidential (“Confidential Information”).

Customer Data is Customer Confidential Information. Skadi Technology, non-public product information, security information, and pricing are Skadi Confidential Information.

Each party will use reasonable safeguards to protect the other party’s Confidential Information and use it only as necessary to perform or receive the Services, exercise rights under the Agreement, or comply with law.

The receiving party may disclose Confidential Information to personnel and service providers with a need to know and appropriate confidentiality obligations.

9.2 Security. Skadi will maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect Customer Data against unauthorized access, use, alteration, loss, or disclosure.

Customer remains responsible for appropriately configuring its account, integrations, permissions, and Authorized Users.

9.3 Required Disclosure. A party may disclose Confidential Information where legally required and, where legally permitted, will provide reasonable notice to the other party.

10. Privacy

Skadi’s Privacy Policy describes its processing of personal information in connection with the Services.

If Skadi processes personal data on Customer’s behalf in circumstances requiring a data processing agreement, the parties may enter into Skadi’s then-current Data Processing Addendum.

Customer should avoid submitting highly sensitive personal information unless reasonably necessary for the applicable engagement and authorized by applicable law and contract.

11. Acceptable Use

Customer and Authorized Users may not use the Services unlawfully; access information they are not authorized to access; upload malicious code; interfere with or circumvent security controls; reverse engineer the Services except where permitted by law; systematically extract Skadi Technology to develop a competing product; misrepresent AI-generated output as an independent CPA opinion; or submit information in violation of privacy, confidentiality, intellectual-property, or contractual rights.

12. Fees and Payment

12.1 Orders. Paid Services may be purchased through an order form, online checkout, or other written ordering document.

12.2 Fees. Customer will pay applicable fees when due. Except as required by law or expressly stated in an order form, fees are non-cancelable and non-refundable.

12.3 Taxes. Customer is responsible for applicable sales, use, value-added, and similar taxes, excluding taxes based on Skadi’s net income.

12.4 Suspension. Skadi may suspend access for material nonpayment, unlawful use, material security risk, or material breach, using reasonable efforts to provide notice where practicable.

13. Termination and Data Export

13.1 Term. These Terms apply while Customer accesses or uses the Services.

13.2 Termination for Cause. Either party may terminate an applicable agreement for material breach if the breach is not cured within 30 days after written notice, unless the breach cannot reasonably be cured.

Skadi may immediately suspend or terminate access where reasonably necessary to address unlawful activity, material security threats, or abuse of the Services.

13.3 Effect of Termination. Upon termination, Customer’s right to use the Services ends except for any agreed export or transition period. Accrued payment obligations survive.

13.4 Data Export. During the subscription and for a reasonable period following termination where technically available, Customer may export available Customer Data and engagement reports using available functionality or request reasonable assistance from Skadi.

Skadi may thereafter retain or delete Customer Data in accordance with Section 8.

14. Warranties and Disclaimers

14.1 Service Warranty. Skadi will provide paid Services in a professional and workmanlike manner consistent with generally accepted SaaS practices.

If Skadi materially breaches this warranty, Skadi will use commercially reasonable efforts to correct the issue or, if unable to do so, terminate the affected Services and refund prepaid fees allocable to the unused terminated period.

14.2 Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN THESE TERMS, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.”

TO THE MAXIMUM EXTENT PERMITTED BY LAW, SKADI DISCLAIMS IMPLIED WARRANTIES INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

14.3 Compliance and Professional Results. Skadi does not guarantee that Customer will satisfy SOC 2 or other compliance requirements, that particular evidence will be accepted by an auditor, or that a CPA firm will issue a report or reach any particular conclusion.

15. Indemnification

15.1 By Customer. Customer will defend and indemnify Skadi and its affiliates, officers, directors, and personnel against third-party claims arising from Customer Data or Customer’s or its Authorized Users’ unlawful use of the Services, including claims that Customer lacked authority to provide information or connect a data source, except to the extent caused by Skadi’s breach of these Terms.

15.2 By Skadi. For paid Services, Skadi will defend Customer against a third-party claim alleging that Customer’s authorized use of the unmodified Services infringes a U.S. patent, copyright, or trademark and will pay damages finally awarded or settlements approved by Skadi.

This obligation does not apply to claims arising from Customer Data, third-party services, combinations not supplied by Skadi, modifications not made by Skadi, or continued use after notice of an infringement claim.

15.3 Procedure. The indemnified party must provide prompt notice and reasonable cooperation and allow the indemnifying party to control the defense. No settlement may admit fault or impose non-monetary obligations on the indemnified party without its consent.

16. Limitation of Liability

16.1 Excluded Damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR LOST PROFITS, REVENUE, BUSINESS OPPORTUNITIES, GOODWILL, OR ANTICIPATED SAVINGS ARISING FROM THE SERVICES.

16.2 Liability Cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EXCEPT FOR THE EXCLUSIONS BELOW, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT WILL NOT EXCEED THE TOTAL FEES CUSTOMER PAID TO SKADI DURING THE 12 MONTHS BEFORE THE FIRST EVENT GIVING RISE TO LIABILITY.

Customer’s payment obligations are not limited by this Section.

16.3 Exclusions. The liability cap does not apply to fraud or willful misconduct, liability that cannot lawfully be limited, Customer’s payment obligations, or Customer’s infringement or misappropriation of Skadi Technology.

Any different treatment for confidentiality, security, or indemnification obligations must be expressly stated in an applicable order form or other written agreement.

17. Changes to the Services and Terms

Skadi may improve, modify, or update the Services over time.

Skadi may also update these Terms. For material changes affecting an active paid subscription, Skadi will provide reasonable notice by email, in-product notice, or another reasonable method.

Unless required sooner by law, material changes will generally take effect at renewal or on the date stated in the notice.

18. Publicity

Skadi will not use Customer’s name, trademarks, or logo in public marketing without Customer’s permission, except where expressly authorized in an order form or other written agreement.

19. Compliance with Laws

Each party will comply with laws applicable to its performance under the Agreement.

Customer will not use or export the Services in violation of applicable U.S. export-control or sanctions laws.

20. Governing Law and Disputes

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-law rules.

Unless an applicable order form provides otherwise, state and federal courts located in Delaware will have exclusive jurisdiction over disputes arising from these Terms.

Nothing prevents either party from seeking injunctive or equitable relief for actual or threatened misuse of intellectual property, Confidential Information, or unauthorized access to data.

21. General

These Terms, together with applicable order forms, data-processing terms, and incorporated policies, constitute the agreement regarding the Services.

If an order form conflicts with these Terms, the order form controls for that order.

Customer may not assign the Agreement without Skadi’s consent, except in connection with a merger, reorganization, or sale of substantially all relevant assets, provided the assignee assumes Customer’s obligations.

Skadi may use affiliates and subcontractors to provide the Services and remains responsible for their performance to the extent required by the Agreement.

Neither party is liable for delays caused by events beyond its reasonable control.

Failure to enforce a provision is not a waiver. If any provision is unenforceable, it will be modified to the minimum extent necessary and the remainder will continue in effect.

22. Contact

Skadi, Inc.
A Delaware corporation

1 Belvedere Pl
Mill Valley, CA 94941

Legal and privacy inquiries: security@skadi.ai
Website: skadi.ai