Terms of Service — Cybertis Platform

1. General

1.1. These Terms of Service (the "Terms") govern access to and use of the Cybertis compliance, information-security and privacy management platform available at platform.cybertis.co.il, including the client portal, the Trust Center, public forms, APIs and the applications used to connect third-party systems — among them the "Cybertis Connectors" application for Microsoft 365 / Entra ID, Google Workspace, GitHub and monday.com (together, the "Platform").

1.2. The Platform is operated by Cybertis Ltd., company no. 36741742, 58 HaBanim Street, Herzliya, Israel ("Cybertis", "we").

1.3. The Platform is intended for business use only, by organisations that receive services from Cybertis (the "Client") and by users authorised by the Client or by Cybertis ("Authorised Users"). It is not intended for consumers or minors.

1.4. By signing in, creating an account, or approving the connection of a third-party system (including granting admin consent, installing the GitHub App or approving an OAuth permission screen), you confirm that you have read and agree to these Terms and to the Platform Privacy Policy. If you do not agree, do not use the Platform and do not approve the connection.

2. Relationship to other agreements

2.1. Use of the Platform is provided as part of a commercial engagement between the Client and Cybertis (a services agreement, an approved proposal, a data processing agreement and the like — the "Services Agreement"). If these Terms conflict with the Services Agreement, the Services Agreement prevails.

2.2. The terms of use of the marketing website www.cybertis.co.il apply to that website only. These Terms apply to the Platform.

3. Accounts and permissions

3.1. Access is personal, through an account assigned to an Authorised User. Do not share credentials or use another person's account.

3.2. The Platform enforces role-based access (Cybertis staff, client administrator, client viewer). The Client is responsible for deciding who receives access on its behalf, for removing users who no longer need it (or notifying us), and for the accuracy of user details.

3.3. We may require two-factor authentication, password rules and further restrictions. Circumventing security controls is prohibited.

3.4. You must notify us without delay of any suspected unauthorised use of an account or any security incident, at privacy@cybertis.co.il.

4. Connecting third-party systems (Connectors)

4.1. The Platform lets the Client connect organisational systems — such as Microsoft 365 / Entra ID, Google Workspace, GitHub, monday.com, Okta, Jira, AI providers and others — in order to produce an identity and access inventory, access reviews, security metrics (for example MFA status) and compliance evidence (each, a "Connector").

4.2. Authority to consent. Whoever approves a connection represents that they are authorised to do so on behalf of the organisation (for example a Global Administrator in Microsoft 365, a Super Admin in Google Workspace or an organisation Owner in GitHub), and that the organisation is entitled, under applicable law and its own policies, to disclose to Cybertis the information the Connector reads — including informing its employees where required.

4.3. Scope of access. Connectors request read-only permissions, limited to the minimum required. The full list is shown on the provider's consent screen and detailed in the Privacy Policy. Connectors do not access the content of mailboxes, files, chats or source-code repositories. Write capabilities exist only where the Client has expressly enabled them (for example opening a remediation issue in GitHub or creating an item on a monday.com board) and are limited to that action.

4.4. Disconnecting. The Client may disconnect a Connector at any time from within the Platform, and may also revoke the permission on the provider's side (removing the enterprise application in Entra ID, uninstalling the GitHub App, or revoking access in the Google account). The effect on data already collected is described in the Privacy Policy.

4.5. Third-party services. Use of the connected systems is subject to the terms and policies of their providers (Microsoft, Google, GitHub and others). Cybertis is not affiliated with and does not act on behalf of those providers, and is not responsible for their availability, for changes to their APIs or for the accuracy of the information they return. Provider names and trademarks belong to their owners.

4.6. Data accuracy. Displayed data reflects what the provider returned at the time of synchronisation and depends on the Client's licensing and permissions with that provider. Where a value is unavailable the Platform aims to show it as "unknown" rather than as a negative value, but gaps, delays and inaccuracies may occur.

5. Acceptable use

5.1. The Platform may be used only for managing the Client's compliance, information security and privacy, and in accordance with applicable law.

5.2. You must not: (a) access or attempt to access another client's data; (b) perform penetration tests, scans or load tests without our prior written approval; (c) circumvent security mechanisms, permissions or rate limits; (d) reverse engineer, copy or create derivative works of the Platform; (e) upload unlawful content, malicious code or information you have no right to upload; (f) sell, rent or otherwise make the Platform available to third parties; (g) use the Platform or its outputs to develop a competing product.

5.3. Responsible disclosure: if you find a security vulnerability, please report it to privacy@cybertis.co.il and refrain from exploiting or publishing it until it is fixed.

6. Client content

6.1. All information, documents, evidence, questionnaire answers and data that the Client or its users upload to the Platform, or that is collected from systems the Client connected ("Client Content"), remains the Client's property.

6.2. The Client grants Cybertis a limited, non-exclusive licence, for the term of the engagement, to use Client Content solely to provide the services to the Client and to operate, secure and support the Platform.

6.3. The Client is responsible for the lawfulness of Client Content, including having a lawful basis and giving any required notice for personal data about its employees, suppliers and customers that it enters into or connects to the Platform.

6.4. Cybertis may derive aggregated statistics that do not identify any client or individual, in order to improve the service.

7. Artificial-intelligence features

7.1. Some Platform features (assistant, document drafting, finding triage, gap analysis) rely on language models from external providers. These features are enabled per Client, and the Client may ask to have them disabled.

7.2. AI outputs are drafts and aids only. They may be wrong or incomplete and must be reviewed by a qualified professional before being relied upon.

7.3. How data is handled when AI is used (including identifier redaction before sending) is described in the Privacy Policy.

8. Nature of the service

8.1. The Platform is a management and documentation tool. Scores, security-level classifications, reports, templates and recommendations produced in it are decision-support aids. They are not legal advice, not a binding opinion and not a certification by any authority of compliance with any law or standard. Professional advice is provided only under the Services Agreement.

8.2. Responsibility for the Client's compliance with applicable law and standards — including the Israeli Privacy Protection Law, 5741-1981, the Privacy Protection (Data Security) Regulations, 5777-2017, the GDPR and ISO standards — remains with the Client.

9. Availability, support and changes

9.1. We work to keep the Platform highly available, but it is provided "as is" and "as available", and we do not warrant uninterrupted or error-free operation unless the Services Agreement states otherwise.

9.2. We may update, change, add or remove features, including Connectors, and carry out planned maintenance. Features marked "beta" or "experimental" are provided without any commitment.

10. Intellectual property

10.1. All rights in the Platform — code, design, rules engines, question banks, templates, methodologies, professional content and trademarks — belong to Cybertis or its licensors. The Client receives a limited, non-exclusive, non-transferable right to use the Platform during the engagement for its internal purposes only.

10.2. Reports and documents generated for the Client from the Platform may be freely used by the Client for its own purposes, including presenting them to auditors, regulators and its customers.

10.3. Feedback and suggestions you give us may be used by us without charge or restriction.

11. Confidentiality

Each party will keep confidential the non-public information it receives from the other, use it only for the engagement and protect it with reasonable measures. Cybertis staff who access Client Content are bound by confidentiality undertakings. The confidentiality provisions of the Services Agreement prevail.

12. Privacy and data security

12.1. The handling of personal data is described in the Platform Privacy Policy, which forms an integral part of these Terms.

12.2. For personal data contained in Client Content, the Client is the controller and Cybertis acts as processor ("holder" under Israeli law) on its behalf, in accordance with the Services Agreement and the data processing agreement.

13. Limitation of liability

13.1. To the maximum extent permitted by law, Cybertis is not liable for indirect, consequential, special or punitive damages, or for loss of profits, revenue, goodwill or data, arising from the use of or inability to use the Platform.

13.2. Cybertis's total aggregate liability in connection with the Platform will not exceed the amounts actually paid by the Client to Cybertis for the services in the 12 months preceding the event giving rise to the claim, unless the Services Agreement states otherwise.

13.3. Nothing in these Terms limits liability that cannot be limited by law, including for wilful misconduct.

14. Indemnity

The Client will indemnify Cybertis for damage or expense caused by a third-party claim arising from Client Content, from connecting a system without authority, or from use of the Platform in breach of these Terms or the law — subject to notice to the Client and an opportunity to defend.

15. Suspension and termination

15.1. We may suspend or block an account or a Connector where there is a concern of a security incident, a breach of these Terms or harm to other clients, and will notify the Client as soon as practicable.

15.2. When the engagement ends, access to the Platform ends and Connectors are disconnected. Client Content is returned or deleted in accordance with the Services Agreement and the Privacy Policy. We recommend that the Client also remove the permissions granted to Cybertis applications in its own systems.

15.3. Provisions that by their nature are meant to survive termination (intellectual property, confidentiality, limitation of liability, governing law) continue to apply.

16. Changes to these Terms

We may update these Terms from time to time. We will give reasonable advance notice of a material change in the Platform or by email. Continued use after the change takes effect constitutes acceptance. The date of the last update appears at the top of this document.

17. Governing law and jurisdiction

These Terms are governed exclusively by the laws of the State of Israel. The competent courts of the Tel Aviv district have exclusive jurisdiction.

18. Language

These Terms are published in Hebrew and English. If the versions differ, the Hebrew version prevails.

19. Contact

Cybertis Ltd., 58 HaBanim Street, Herzliya, Israel · +972-3-3030151 · General: contact@cybertis.co.il · Privacy and security: privacy@cybertis.co.il