Terms of Service

These Terms of Service (the "Terms") are a binding agreement between Substantively Software LLC, a Georgia limited liability company ("Substantively," "we," "us"), and the organization you represent ("Customer," "you"). They govern access to and use of the Substantively application, website, and related services (the "Service").

By creating an account, signing in, or using the Service, you accept these Terms. If you are accepting on behalf of an organization, you represent that you have authority to bind that organization; if you do not, you may not use the Service. The Service is offered for business use only and is not intended for consumers acting outside a trade or profession.

Substantively is project-management software for internal audit teams. Its defining architectural principle is a strict data boundary between two categories of information:

"Workspace Metadata" means the information the Service stores and processes for you: projects, tasks, control descriptions and test conclusions, issues, risks, evidence-request records, time entries, comments, activity logs, user and organization records, and references to files (such as file names, SharePoint URLs, and file identifiers).

"Customer Files" means the documents themselves — audit evidence, workpapers, spreadsheets, reports, and any other file content. Customer Files remain in your own Microsoft 365 / SharePoint tenant at all times. The Service links to them by reference, and uploads made through the Service travel directly from the user's browser to your tenant. Customer Files are never uploaded to, stored on, processed by, or in the custody of Substantively's servers, and we have no ability to access them except transiently as a signed-in user's delegated agent during actions that user initiates.

Because we never have custody of Customer Files, you acknowledge that Substantively has no responsibility for their storage, integrity, availability, backup, security, retention, or legal preservation — those remain governed by your own Microsoft 365 environment, your agreement with Microsoft, and your own policies.

You must be at least 18 years old to use the Service. Authentication is provided through our identity provider using Microsoft single sign-on or email links; you are responsible for safeguarding access to your accounts and email, and for all activity that occurs under your users' credentials. Notify us promptly at hello@substantively.ai if you suspect unauthorized access.

The Service is organized around workspaces ("organizations"). The Customer controls its organization: its owners and managers decide who is invited, what role each member holds (including read-only viewers and external evidence providers), and what those people can see and do. You are responsible for the acts and omissions of every user you invite or permit to access your organization, including external evidence providers, as if they were your own.

Where the Service performs actions in your Microsoft 365 tenant — creating folders, copying templates, accepting uploads — it does so using delegated permissions, acting as the signed-in user and bounded by that user's own Microsoft permissions. Granting and revoking those permissions, and any tenant-wide admin consent, is your administrators' decision and responsibility.

New organizations receive a free trial (currently 14 days). At the end of the trial, continued use requires a paid subscription; unpaid organizations become read-only.

Paid subscriptions are sold through our merchant of record, Paddle.com Inc. and its affiliates ("Paddle"). Your purchase is a transaction with Paddle: Paddle processes payment, calculates and remits applicable sales tax or VAT, and issues invoices and receipts, under Paddle's own terms and privacy policy presented at checkout. We never receive or store your payment card details.

Subscriptions are billed in advance and renew automatically until cancelled. You can cancel at any time, effective at the end of the current billing period. We may change prices with at least 30 days' notice; changes apply from your next renewal. Refunds are governed by our Refund Policy.

As between you and us, you own all Workspace Metadata. You grant Substantively a limited, non-exclusive license to host, copy, process, transmit, and display Workspace Metadata solely as necessary to provide and secure the Service, to comply with law, and to produce aggregated or de-identified statistics that do not identify you or any person. We do not sell Workspace Metadata, use it for advertising, or use it to train machine-learning models.

You are responsible for the accuracy and lawfulness of the Workspace Metadata you and your users put into the Service, including ensuring you have the right to reference any file you link and to share any information you enter.

The Service — including its software, design, documentation, and branding — is owned by Substantively and protected by intellectual-property law. We grant you a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Service during your subscription, for your internal business purposes, in accordance with these Terms. No other rights are granted. If you send us feedback or suggestions, you grant us a perpetual, irrevocable, royalty-free license to use them without obligation to you.

You agree not to, and not to permit anyone to:

• use the Service in violation of law, or to store or transmit unlawful, infringing, or malicious material;
• probe, scan, or test the vulnerability of the Service, or breach or circumvent its authentication or security, without our prior written consent;
• interfere with the Service's operation, impose an unreasonable load on it, or access it through scraping, crawling, or other automated means outside its documented interfaces;
• copy, modify, create derivative works of, reverse engineer, or attempt to extract the source code of the Service, except to the extent a law expressly permits it despite this restriction;
• resell, sublicense, rent, or provide the Service to third parties as a service bureau, or use it to build a competing product;
• misrepresent your identity or affiliation, or share user credentials between individuals.

We may suspend access immediately where we reasonably believe a violation threatens the Service or other customers.

Substantively is a software tool. It is not an accounting firm, audit firm, or law firm, and nothing in the Service — including templates, status indicators, workflow gates, sample content, or documentation — constitutes auditing, accounting, legal, compliance, or other professional advice.

You are solely responsible for the planning, performance, supervision, documentation, conclusions, and reporting of your audits and other work performed using the Service, and for compliance with all standards and laws applicable to that work (including, for example, IIA standards, SOX requirements, and regulatory obligations). Substantively has no liability arising from audit outcomes, regulatory findings, professional-standards matters, or business decisions made in reliance on information organized or displayed by the Service.

The Service interoperates with services we do not control, including Microsoft 365 / SharePoint (under your own Microsoft agreement), our identity provider, and Paddle. Your use of those services is governed by their terms, and we are not responsible for their acts, omissions, outages, or changes — including Microsoft API changes that affect linking, folder automation, or uploads. Substantively is an independent company and is not affiliated with or endorsed by Microsoft.

Each party may receive non-public information from the other that is marked confidential or that reasonably should be understood as confidential ("Confidential Information"). Each party will protect the other's Confidential Information with at least reasonable care, use it only to perform under these Terms, and not disclose it except to employees, advisors, and subcontractors bound by comparable obligations, or where required by law (with notice where lawful). Workspace Metadata is your Confidential Information.

Our Privacy Policy describes what we collect and how we handle it. For personal data contained in Workspace Metadata, you are the controller and Substantively processes it on your behalf; a data processing addendum is available on request at hello@substantively.ai.

We may improve or modify the Service, provided we do not materially reduce its core functionality during a paid term without notice. Features identified as beta, preview, or early access are provided as-is, may change or be withdrawn at any time, and are excluded from any commitments in these Terms. Standard support is provided by email on a commercially reasonable basis; no specific uptime or response time is guaranteed unless agreed in a separate signed agreement.

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, SUBSTANTIVELY DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, THAT DEFECTS WILL BE CORRECTED, OR THAT WORKSPACE METADATA WILL NOT BE LOST — MAINTAIN YOUR OWN EXPORTS OF INFORMATION YOU CANNOT AFFORD TO LOSE.

TO THE MAXIMUM EXTENT PERMITTED BY LAW: (A) NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, BUSINESS INTERRUPTION, OR REPUTATIONAL HARM, EVEN IF ADVISED OF THE POSSIBILITY; AND (B) SUBSTANTIVELY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE OR THESE TERMS WILL NOT EXCEED THE AMOUNTS YOU PAID FOR THE SERVICE IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM (OR ONE HUNDRED U.S. DOLLARS IF YOU HAVE PAID NOTHING).

WITHOUT LIMITING THE FOREGOING, SUBSTANTIVELY HAS NO LIABILITY OF ANY KIND FOR CUSTOMER FILES — INCLUDING THEIR LOSS, CORRUPTION, UNAVAILABILITY, DISCLOSURE, OR DELETION — BECAUSE THEY RESIDE EXCLUSIVELY IN YOUR OWN MICROSOFT 365 TENANT AND NEVER IN OUR CUSTODY.

These limits apply regardless of the theory of liability (contract, tort, negligence, strict liability, or otherwise) and even if a remedy fails of its essential purpose. They do not limit liability that cannot be limited by law, a party's indemnification obligations, your payment obligations, or liability arising from a party's willful misconduct.

You will defend, indemnify, and hold harmless Substantively and its members, officers, employees, and agents from and against any third-party claim, and resulting damages, costs, and reasonable attorneys' fees, arising out of (a) Workspace Metadata or Customer Files, (b) your or your users' use of the Service in violation of these Terms or applicable law, (c) your audits, professional work, or business decisions, or (d) any dispute between you and a person you invited to your organization. We will promptly notify you of any such claim and reasonably cooperate at your expense; you may not settle a claim imposing obligations on us without our consent.

These Terms apply from your first use of the Service and continue until your organization is deleted and any paid term ends. You may stop using the Service and cancel at any time. We may suspend or terminate access (i) for material breach not cured within 14 days of notice, (ii) immediately for violations of Section 8 or risks to the Service or others, or (iii) for non-payment.

For 30 days after termination or expiration, owners can export Workspace Metadata using the Service's export functions (or request an export by email). After that window we may delete Workspace Metadata from production systems, with residual copies removed from backups in the ordinary course. Customer Files are unaffected by termination — they are, and always were, only in your tenant. Sections that by their nature should survive (including 6, 7, 9, 11, 14, 15, 16, 18, and 19) survive termination.

We may update these Terms from time to time. For material changes, we will give at least 30 days' notice by email or in-product notice before the changes take effect; continued use of the Service after the effective date constitutes acceptance. For changes required by law or that are non-material, the updated Terms apply when posted with a revised "Last updated" date.

These Terms are governed by the laws of the State of Georgia, USA, without regard to conflict-of-laws rules, and the parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Georgia for any dispute not subject to informal resolution. Before filing any claim, the parties will attempt in good faith to resolve the dispute by written notice and discussion for 30 days. EACH PARTY WAIVES TRIAL BY JURY AND AGREES THAT DISPUTES WILL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT AS A CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION. Except where prohibited by law, any claim must be brought within one (1) year after it accrues.

Neither party is liable for delay or failure caused by events beyond its reasonable control (including outages of third-party providers, internet failures, acts of government, or force majeure). You may not assign these Terms without our consent, except to a successor in a merger or sale of substantially all assets with notice to us; we may assign to an affiliate or successor. You will comply with applicable export-control and sanctions laws and represent you are not located in an embargoed country or on a restricted-party list. If any provision is unenforceable, it will be modified to the minimum extent necessary and the rest remains in effect. No waiver is implied from any failure to enforce. The parties are independent contractors. These Terms, together with the Privacy Policy, Refund Policy, and any signed order or agreement between us, are the entire agreement and supersede prior discussions; if a signed agreement conflicts with these Terms, the signed agreement controls.

Notices to us: hello@substantively.ai. Notices to you: the email addresses of your organization's owners.