Skip to main content
NISTForgeby MALTO Cyber

NISTForge Master Subscription Agreement

Version 1.0, dated 2026-07-03

Provider: MALTO Cyber, Toronto, Ontario, Canada ("MALTO Cyber," "Provider," "we," "us")

Product: NISTForge compliance assessment software

This Master Subscription Agreement (the "Agreement") governs your subscription to and use of NISTForge. It is a legal contract between MALTO Cyber and the organization identified in the signature block below (the "Customer," "you"). Read it before you install or run the Software. By signing this Agreement, or by installing, accessing, or using the Software, you agree to be bound by it. If you are signing on behalf of an organization, you confirm that you have the authority to bind that organization.

This Agreement works together with the NISTForge Privacy Notice, which is incorporated by reference and explains what limited information we receive and what stays on your own infrastructure.

1. Definitions

  • Software means the NISTForge application, in object-code form, together with any updates, patches, and Documentation we make available to you.
  • Documentation means the setup guides, user documentation, and release notes we provide for the Software.
  • License Key means the cryptographically signed license credential we issue that enables and authorizes your use of the Software for a Subscription Term.
  • Subscription Term means the period for which you have an active, paid subscription, as selected at checkout and reflected in your billing account.
  • Order means the plan, price, and term you select at checkout, or a written order form we both sign. An Order is part of this Agreement.
  • Customer Data means all data you load into, process with, or generate through the Software, including your source documents, scan inputs, assessment content, findings, scores, and reports.
  • Your Infrastructure means the servers, systems, and environments you own or control on which you install and run the Software.
  • Early Access means the pre-general-availability status of the Software described in Section 9.

2. License grant

Subject to your compliance with this Agreement and payment of the applicable fees, MALTO Cyber grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license, for the Subscription Term, to:

  1. install and run the Software on Your Infrastructure for your own internal business use, and
  2. use the Documentation in support of that use.

The Software is licensed, not sold. We reserve all rights not expressly granted to you in this Agreement.

3. License Key and enforcement

Your right to use the Software is enabled by a License Key tied to your subscription. You agree to keep your License Key confidential and not to share, publish, or transfer it. The Software validates the License Key locally and may check for updates and license status. If your subscription ends, lapses for non-payment, or is terminated under Section 13, your License Key may be revoked and the Software may cease to operate. You will not attempt to circumvent, disable, or tamper with the License Key mechanism or any other technical protection in the Software.

4. Restrictions

You will not, and will not permit any third party to:

  1. copy, modify, translate, or create derivative works of the Software, except as expressly permitted by this Agreement;
  2. reverse engineer, decompile, or disassemble the Software, or otherwise attempt to derive its source code, except to the limited extent this restriction is prohibited by applicable law;
  3. rent, lease, lend, sell, sublicense, distribute, or provide the Software to any third party, or use it to operate a service bureau or provide the Software's functionality to third parties;
  4. remove, alter, or obscure any proprietary notices, or defeat, bypass, or share the License Key or any usage limit;
  5. use the Software to build or assist in building a competing product;
  6. use the Software in violation of any applicable law, or to process the data of a third party without that party's authorization.

5. Your responsibilities

You are responsible for:

  1. Your Infrastructure, including its provisioning, security, availability, and backups;
  2. the accuracy, quality, and legality of your Customer Data and your right to process it;
  3. maintaining the security and confidentiality of your accounts, credentials, and License Key;
  4. your own configuration and use of the Software, and for the decisions you make based on its output; and
  5. meeting the hardware and software prerequisites set out in the Documentation. The Software may rely on a local language model and other local components; where those are unavailable, features may be degraded or unavailable.

6. Data handling and privacy

NISTForge is designed to run on Your Infrastructure. Your Customer Data stays on Your Infrastructure. We do not receive, access, store, or process your source documents, scan inputs, assessment content, findings, scores, or reports. We are not a processor of your Customer Data.

The only information we receive in connection with the Software is limited account and billing information and license telemetry, as described in the NISTForge Privacy Notice. With respect to that limited information, we act as an independent controller. Nothing in this Agreement makes us a processor of your Customer Data, because that data does not reach us. If you require a formal data processing addendum for the limited billing and telemetry information we do hold, we will provide one on request.

7. Intellectual property

As between the parties, MALTO Cyber and its licensors own all right, title, and interest in and to the Software, the Documentation, and all related intellectual property. You own all right, title, and interest in and to your Customer Data and the outputs the Software generates from your Customer Data. If you send us feedback or suggestions about the Software, you grant us a perpetual, royalty-free license to use that feedback to improve our products, without obligation to you.

8. Compliance disclaimer

Please read this section carefully. It defines what NISTForge is and is not.

NISTForge is a tool that helps you carry out and document a self-assessment aligned to NIST-based frameworks. It is not, and does not provide, legal, regulatory, audit, accounting, or professional compliance advice. Its output, including any content generated with the assistance of a language model, may be incomplete, inaccurate, or unsuitable for your particular circumstances.

A score, rating, gap analysis, or report produced by NISTForge is not a certification, attestation, or guarantee. It does not establish that you meet any standard, framework, regulation, or contractual obligation, and it does not guarantee that you will pass any audit or assessment conducted by any third party. Compliance depends on facts, context, and judgment that the Software cannot fully capture.

You remain solely responsible for your compliance posture, for validating the Software's output against your own systems, risks, and obligations, and for obtaining advice from a qualified professional where appropriate. We are not liable for decisions you make based on the Software's output.

9. Early Access status

The Software, or specific features of it, may be provided on an Early Access basis. Early Access software is made available before general release. It may contain defects, may change or be discontinued, and is provided without any service level commitment, uptime guarantee, or guaranteed support response time. We may modify, suspend, or discontinue Early Access features at any time. You should not rely on Early Access software as your sole control for any critical process.

10. Warranty disclaimer

To the fullest extent permitted by law, the Software, the Documentation, and any support are provided "as is" and "as available," without warranties of any kind, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, and any warranties arising from course of dealing or usage of trade. We do not warrant that the Software will be uninterrupted, error-free, or secure, or that it will meet your requirements or produce any particular result.

11. Limitation of liability

To the fullest extent permitted by law:

  1. Neither party will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, data, goodwill, or business, arising out of or relating to this Agreement or the Software, even if advised of the possibility of such damages.
  2. Each party's total aggregate liability arising out of or relating to this Agreement will not exceed the total fees you paid to us under this Agreement in the twelve months preceding the event giving rise to the claim.

These limitations do not apply to your payment obligations, to a party's liability for its own fraud or willful misconduct, or to any liability that cannot be excluded or limited under applicable law. Some jurisdictions do not allow certain exclusions or limitations, so parts of this section may not apply to you, and nothing here removes rights you have under mandatory law.

12. Indemnification

You will defend, indemnify, and hold harmless MALTO Cyber and its founders, employees, and contractors from and against any third-party claims, losses, liabilities, damages, and reasonable legal fees arising out of your Customer Data, your use of the Software in breach of this Agreement, or your violation of applicable law.

13. Term and termination

This Agreement begins on the effective date and continues for as long as you have an active subscription. Either party may terminate this Agreement for material breach if the breach is not cured within thirty days of written notice. We may suspend or terminate your access immediately if you breach Sections 3 or 4, or if your use poses a security or legal risk. You may stop your subscription in accordance with the terms of your Order.

On termination or expiry: your license ends, your License Key may be revoked, and you must stop using and remove the Software from Your Infrastructure. Your Customer Data remains on Your Infrastructure and under your control; we do not hold it and cannot return or delete it for you. Sections 4, 6, 7, 8, 10, 11, 12, 13, 14, and 16 survive termination.

14. Fees and payment

You will pay the fees for the plan and term set out in your Order. Fees are billed through our payment processor. Unless stated otherwise in your Order, fees are exclusive of taxes, and you are responsible for any applicable sales, use, or value-added taxes. Early Access or promotional pricing applies only for the period stated and may change for subsequent terms on notice. Except where required by law, fees are non-refundable.

15. Updates and support

We may provide updates, patches, and new versions of the Software from time to time, and the Software may check for their availability. We may provide support at the level described for your plan or Order. Early Access software carries no guaranteed support response time.

16. Governing law and disputes

This Agreement is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there, without regard to conflict-of-law rules. The parties submit to the exclusive jurisdiction of the courts located in Ontario for any dispute relating to this Agreement, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information. If mandatory consumer-protection law where you are established gives you rights that cannot be waived, nothing here removes those rights.

17. General

This Agreement, together with the Privacy Notice and your Order, is the entire agreement between the parties on this subject and supersedes any prior discussions. If any provision is found unenforceable, the rest remains in effect. A failure to enforce a provision is not a waiver of it. You may not assign this Agreement without our written consent; we may assign it to an affiliate or in connection with a merger, acquisition, or sale of assets. Neither party is liable for delays or failures caused by events beyond its reasonable control. Notices to us may be sent to legal@maltocyber.com. If this Agreement conflicts with an Order we both sign, the Order controls for that transaction.