Terms of Use

These Terms have two parts. The Use of the site section applies to anyone visiting indene.io. All the other sections, up to the version history, apply to the organization that contracts the Indene platform and to the people who use it. Where a clause mentions the "site", it applies only to the site; where it mentions the "product" or the "platform", it applies only to the product.

The site content is informational and commercial. Three limits apply to everything shown on it:

• Example numbers are not measurements. Every exposure range, confidence percentage or simulation shown on the site is labelled as an example and exists to show the format of the product's output, never a real measurement of any organization.
• The site content is not legal, regulatory, actuarial or investment advice.
• We may change the site content at any time, without prior notice.

We are not liable for decisions taken on the basis of example numbers.

• Customer: the organization that contracts the product.
• User: a person who accesses the product on behalf of the Customer.
• Customer Data: all content that the Customer or its Users enter, import or connect to the product, including evidence, assessments, process data and any personal data in them.
• Personal Data: has the meaning given in Brazilian Law No. 13,709/2018 (LGPD).
• Service: the Indene platform, including Aegis and the Connectors.
• Aegis: the set of artificial intelligence functions of the product.
• Connector: the integration that reads data from a Customer tool, through the cloud or through a local agent.
• Service Order: the commercial document signed by the Customer that sets scope, price and term.

If the Customer has signed a contract with Indene (master agreement, Service Order, data processing agreement, SLA), that contract prevails over these Terms in case of conflict. These Terms apply to whatever the contract does not regulate.

1. The organization accepts these Terms by signing the Service Order or the contract.
2. Each User accepts these Terms by creating the account or accepting the invitation.
3. Whoever accepts on behalf of an organization declares to have the authority to bind it contractually.
4. Access is individual, tied to a corporate e-mail and authenticated by a one-time code, with no password. The User must keep access to their own e-mail secure, and the Customer is encouraged to turn on the second factor.
5. Access profiles define what each User sees and edits, and are assigned by the Customer's administrator.
6. The Customer keeps the list of authorized Users up to date and revokes the access of anyone who leaves the organization.

The platform offers quantification of cyber risk exposure (as a value range, never a single point), control maturity management, an evidence trail and an action plan, for institutions subject to operational and cyber resilience regulation.

Exposure ranges are statistical estimates to support decisions. They are not a guarantee of results, actuarial, legal or regulatory opinion, or investment recommendation, and the decision is always the Customer's. Outputs depend on the quality of the data entered by the Customer itself.

We grant the Customer a limited, non-exclusive, non-transferable license to use the product during the term of the contract, solely for the purposes described in the section The Service. The license may be ended only in case of termination, non-payment or breach of these Terms, with notice and a cure period of 10 days, except where there is a serious security risk. Reverse engineering, resale and use to build a competing product are prohibited.

1. Customer Data belongs to the Customer. Indene processes it only to provide the Service, under the contract and the Customer's documented instructions, and as processor under the LGPD. The Customer is the controller and answers to data subjects for that content (see the Privacy Policy).
2. The Customer grants Indene a limited license, for the duration of the contract, to use Customer Data to operate the Service.
3. Indene does not use Customer Data, not even in aggregated form, for any purpose of its own.
4. The Customer declares to have the right to process Customer Data and to connect it to the product.

1. Each party keeps the other's confidential information secret and uses it only for the purposes of the contract. The duty lasts 5 years after the relationship ends, and indefinitely for Customer Data and trade secrets.
2. Information is not confidential if it was already public through no fault of the party, already known to the party, received from a third party with no duty of secrecy or independently developed.
3. A party may disclose confidential information when the law, a court order or a competent authority (including the Central Bank of Brazil) requires it, notifying the other party where the law allows.

Indene maintains the measures described on the Security and privacy page, including per-organization isolation in the database, an immutable audit trail, encryption in transit and connector credentials encrypted at rest. Indene team access to a Customer environment is individual, with a mandatory second factor, and is logged in a platform trail.

The Customer is responsible for managing its Users and access profiles, turning on the second factor, protecting the credentials it hands to Connectors and keeping the access list up to date.

Each organization operates in a logically isolated environment, enforced by row-level security in the database, and not only by application rules. Exceptions are few, named, minimal in surface and covered by tests. One organization's data does not appear on another organization's screen, except where the organization itself grants explicit access to an external consultant.

By default, collection runs from the cloud, with a reduced-scope read credential that the Customer hands over. In a closed environment, the Customer can install a local agent that runs inside its network, keeps the credential there and only makes outbound connections to Indene. In both cases, Indene reads only what is necessary and does not write to the Customer's systems. The Customer declares to have the authority to grant that access.

1. Aegis suggests. No model output changes a score, a number or a report without a person's acceptance, and every suggestion accepted, edited or refused stays on the trail, with author and date.
2. Calls go through a single access point, are logged and ask the provider not to retain the content or use it to train models.
3. AI providers act as additional processors and appear in the subprocessor list of the Trust Center, with the country of each, before any Customer processes real data on the platform.
4. The Customer may ask for Aegis to be turned off for its organization.
5. The User should avoid entering personal data that is not needed. The decision taken on the basis of a suggestion is the Customer's.

The Customer and its Users may not:

• access another organization's data or circumvent the isolation between organizations;
• test intrusion or vulnerabilities on the platform without written authorization and a defined scope: Indene is not liable for action taken outside the authorized scope;
• reverse engineer, resell without authorization or use the product to build a competing product;
• overload the Service or try to take it down;
• enter data the Customer has no right to process, or false data: the product quantifies risk from what is declared, and false data invalidates the analysis;
• share access credentials between people;
• use the product to violate the law applicable to its regulated sector.

Anyone who finds a vulnerability may report it through the responsible disclosure channel on the Security and privacy page, and Indene does not take legal action against good-faith reporters.

The Customer authorizes the subprocessors listed in the Trust Center. Indene gives 30 days' notice of changes to that list, and the Customer may object in writing, with reasons, within that period. If the objection cannot be accommodated, the Customer may terminate the contract without penalty as to the affected Service.

Indene answers one vendor questionnaire per year and provides the third-party reports it holds. The Customer may request an additional audit, with 30 days' notice, at most once a year, with scope and hours agreed and under confidentiality, unless a regulator requires otherwise. Indene cooperates with requests from the Central Bank of Brazil and other competent authorities about the Customer, to the extent the law requires.

We use commercially reasonable efforts to keep the site and the product available. The Service status is published at status.indene.io. Scheduled maintenance is communicated in advance, wherever possible, to Customer administrators. Operational questions: contato@indene.io.

There is no SLA by default. The first-response target for support is 2 business days. A formal SLA, with an availability metric, how it is measured, credit for downtime and exclusions, exists only if it is in the Service Order.

Price, currency and billing method are set in the Service Order. Unless it provides otherwise, invoices are due in 30 days, late payment carries a 2% penalty and 1% interest per month, and the price is adjusted every 12 months by the IPCA. Amounts do not include taxes, which the Customer bears when due.

The contract runs for the term of the Service Order, and renewal follows what it provides.

1. Suspension. Indene may suspend access for non-payment or for risk to the security of the Service or of other customers, with 10 days' notice, except where the risk calls for immediate action. Access returns as soon as the cause is cured.
2. Termination. Either party may terminate as the contract provides, and for a serious breach not cured within 30 days.
3. Exit. At the end, the Customer may export its data in an open format for 30 days. After that, Indene deletes or anonymizes Customer Data within a period defined in the contract and confirms in writing, except what the law requires to be kept. Audit trail retention follows the Privacy Policy.
4. Leaving Indene does not erase the Customer's proof: what holds up the number is its evidence, and it is exportable.

1. The software, the Indene brand, the content of this site, the interface and the quantification methodology belong to INDENE SECURITY LTDA or its licensors. Customer Data remains the Customer's.
2. Indene may use the Customer's suggestions and feedback to improve the product, with no payment obligation.
3. Indene does not use the Customer's name or logo in commercial material without written authorization.

Indene defends the Customer and indemnifies it against a final judgment arising from a claim that the product, used under these Terms, infringes a third party's intellectual property right, provided the Customer gives prompt notice, lets Indene conduct the defense and cooperates. Indene may, at its option, obtain the right to use, modify the product, or end the affected Service and refund the amount paid for the unused period.

1. The Service is provided "as is", except what the Service Order expressly warrants. Exposure ranges are estimates, as the The Service section describes.
2. Cap. To the fullest extent permitted by law, each party's total liability for damages arising from the contract is limited to the amount paid by the Customer in the 12 months before the event.
3. The cap does not apply to: willful misconduct or gross negligence; breach of confidentiality; breach of personal data protection, which is subject to the specific cap set in the contract; the indemnity in the section Intellectual property indemnity; and whatever the law does not allow to be limited.
4. Mutual exclusion. Neither party is liable for indirect loss of profit or consequential damages.
5. The Customer may take out cyber insurance, and the cap may be negotiated in the contract.

While the Customer uses the product in a pilot or as a design partner, these Terms apply with the differences below, and the pilot Service Order prevails: (a) there is no SLA; (b) the data is what the Service Order indicates; (c) at the end of the pilot, the data follows the section Suspension, termination and Customer exit; (d) Indene may end the pilot with 15 days' notice.

Neither party is liable for failure caused by an event beyond its reasonable control that could not have been avoided, such as a widespread third-party infrastructure failure, an act of authority or a natural disaster. The affected party notifies the other without delay and resumes performance as soon as possible.

The parties comply with Brazilian Law No. 12,846/2013 and applicable anti-corruption law, and do not offer an undue advantage to any public or private agent in relation to the contract. Neither party uses the Service in breach of applicable economic sanctions or export controls.

Neither party assigns the contract without the other's consent, except Indene in a corporate reorganization or sale of the business, with notice to the Customer within 30 days. If a change of control of Indene places it under the control of a direct competitor of the Customer, the Customer may terminate without penalty.

Operational communications are sent to the e-mail of the Customer's registered administrator. Legal notices are sent to the address of the party in the contract and, for Indene, to contato@indene.io. Personal data matters go to dpo@indene.io. The Customer keeps these details up to date.

Material changes are communicated at least 30 days in advance to Customer administrators, by e-mail. Continued use of the site or the product after the new version takes effect amounts to acceptance, and the User may be invited to accept again. A Customer that disagrees may terminate without penalty before the effective date.

If a clause is invalid, the others remain in force. Tolerating a breach is not a waiver. These Terms, with the commercial contract, are the entire agreement on the subject. This document is published in Portuguese, English and Spanish; in case of divergence, the Portuguese version prevails.

• 2.0 · September 19, 2026: separation between site and product; acceptance by the organization and by each user; Customer Data, confidentiality, AI, connectors, subprocessors, audit, price, data exit; liability cap with exceptions.
• 1.0 · August 28, 2026: first version.

These Terms are governed by Brazilian law. The courts of the district of Santo André/SP are elected to settle any dispute, waiving any other, however privileged.