---

Effective Date: Phase-0 (pre-launch); commercial activity has not commenced.

These Terms of Service ("Terms") form a binding agreement between Ellis Intelligence LLC, a Colorado limited liability company doing business as Reply Engine ("Reply Engine", "we", "us"), and the customer subscribing to or using the Service ("Customer", "you").

The Service is for use by businesses — including B2B software companies that respond to vendor security questionnaires. The Service is not for use by consumers.

---

1. The Service

1.1 Reply Engine is a software-as-a-service application that helps B2B software companies respond to vendor security questionnaires. The Service ingests questionnaires and Customer-supplied security-posture documents and generates draft responses, each cited to a source in the Customer's own corpus or the shared baseline framework library, for human review and approval before export.

1.2 Tier-specific features and limits (including any request-volume or usage bands) are described at get-replyengine.com/pricing. Tier names, and the figures behind them, live on that page and are never restated in these Terms. Tier names: Starter, Growth, Scale. Figures live at get-replyengine.com/pricing and are never restated here.

1.3 Business Use Only. The Service is intended for use by businesses for business purposes.

1.4 Not a Security Service Provider. Reply Engine is a drafting-and-review software tool. It is not a security assessor, auditor, certifier, or compliance service, and it does not attest to, warrant, or certify your security posture. Every generated answer is a draft for your security team's review, not a security attestation. See the standalone Disclaimers at get-replyengine.com/legal/disclaimers for the full framing.

1.5 Outputs Are Drafts From Your Own Inputs. Outputs are drafts produced by AI systems from your own Inputs — the questionnaires, security-posture documents, and corpus you supply — and may generate inaccurate, incomplete, biased, or fabricated content ("hallucinations"), including citations that do not support the answer. You are solely responsible for the accuracy of any response you submit to a recipient. We do not warrant the accuracy of any Output, and the Service is not, and does not replace, professional, legal, or security-compliance advice.

1.6 No Affiliation With Any Recipient, Framework Body, or Certifying Organization. Reply Engine is not affiliated with, endorsed by, sponsored by, or acting on behalf of the publisher of any baseline questionnaire framework (for example, CAIQ or SIG-Lite), any recipient of an Output (a prospective customer, procurement portal, or auditor), or any government agency. Reply Engine does not predict, forecast, or represent how any recipient, framework body, or certifying organization will assess, review, or act on any Output, and Reply Engine does not act, and is not authorized to act, on behalf of any such party in any capacity. Using Reply Engine does not create any certification, framework-compliance status, or third-party-endorsed status. Reply Engine's Outputs, marketing pages, and app UI render as plain text/typography only — no seal, badge, ribbon, watermark, or certificate-style graphic, or other supportive-looking insignia — so no surface visually or verbally suggests such affiliation, endorsement, sponsorship, or action on any such party's behalf.

2. Account

2.1 Account creation requires an authorized representative of the Customer entity.

2.2 Each seat is for a single named individual. Seat-sharing is prohibited. Seat counts follow your tier: Starter and Growth are single-seat; Scale includes unlimited named seats within the Customer entity.

3. Subscriptions, Pricing, Billing

3.1 Starter, Growth, and Scale are monthly or annual subscriptions, billed via Stripe; annual pricing is shown at get-replyengine.com/pricing; Scale is annual-mandatory after Year 1.

3.2 Pricing at get-replyengine.com/pricing. 30-day notice for material changes.

3.3 Billing via Stripe.

3.5 Refunds. Monthly fees are non-refundable for the current period except pro rata on our material breach or on discontinuation under §10.

3.6 No Service-Level Credits or Refunds. The Service carries no uptime or response-time commitment. No service credit, fee credit, refund, or other remedy arises from any delay, outage, missed response target, or unmet support expectation. The §12.1 limited-warranty remedy and the §10.2 pro-rata refund on our own discontinuation remain the only remedies.

4. Customer Data; Flat Multi-Tenancy

4.1 Ownership. As between us, you own all data you submit, upload, or generate through the Service ("Customer Data"), including your uploaded vendor security questionnaires, your security-posture documents, your historical answer corpus, and the draft answers and exports the Service generates for you. Your security-questionnaire content and answer corpus are yours — we claim no ownership of them.

4.2 License to Us. You grant us a worldwide, non-exclusive, royalty-free license to host, store, transmit, display, copy, and process Customer Data solely to provide the Service to you, to operate and improve the Service (in aggregated and de-identified form only), and to comply with law.

4.3 No Training / No Selling. We do not sell or share Customer Data, and we do not use it to train any model or to improve a Service used by other customers. See our Privacy Policy.

4.4 Tenant Data Boundaries. The Service is multi-tenant with strict per-tenant isolation; your Customer Data is scoped to your tenant and isolation is enforced at the data-query layer. There is no nested tenancy. A limited white-label option exists on the Scale tier: where the Service applies a draft watermark or "powered by Reply Engine" attribution to a downloadable artifact, you may suppress it only on the Scale tier with the white-label PDF feature enabled.

5. Acceptable Use

5.1 No reverse engineering, no scraping, no building a competing product from the Service, no resale.

5.2 No Auto-Submission. You will not configure the Service or any integration with it to auto-submit Outputs to a recipient (a prospective customer, a procurement portal, etc.) without human review of the relevant Output. The human-approval rail is a core safety property of the Service; we may suspend any account we detect bypassing it.

5.3 No Misrepresentation of Authorship. You will not represent any Output as human-authored where a recipient reasonably needs to know it was AI-assisted, and you will comply with any AI-disclosure obligations applicable to your industry or jurisdiction.

6. AI Outputs

6.1 Drafts Only. Outputs are drafts. They are produced by AI systems that may generate inaccurate, incomplete, biased, or fabricated content ("hallucinations"), including citations that do not support the answer.

6.2 Human Review Required. You will independently review every Output before using it. You will not represent any Output as human-authored where a recipient reasonably needs to know it was AI-assisted, and you will comply with any AI-disclosure obligations applicable to your industry or jurisdiction.

6.3 Accuracy Responsibility. You are solely responsible for the accuracy of any response you submit to a recipient. A materially wrong answer submitted to a procurement team can create fraud, contract, or regulatory exposure for you. We do not warrant the accuracy of any Output, and the Service is not, and does not replace, professional, legal, or security-compliance advice.

6.4 Watermarks and Attribution. Where the Service applies a draft watermark or "powered by Reply Engine" attribution to a downloadable artifact, you may suppress the attribution only on the Scale tier with the white-label PDF feature enabled.

7. Framework Currency and Recipient Requirements

7.1 The Service's baseline framework library (for example, CAIQ and SIG-Lite templates) is maintained internally by us and may not reflect the most current version published by the relevant framework organization, or a specific recipient's own supplemental requirements.

7.2 You are responsible for confirming that the framework version and any recipient-specific requirements referenced in an Output are current before you submit it.

7.3 We will update the baseline framework library from time to time but do not guarantee it reflects every framework revision as of your submission date.

8. Intellectual Property

8.1 Service IP. We own the Service and everything comprising or underlying it, including all software and source code, machine-learning models and their configurations, prompts and prompt templates, criteria and baseline reference data, workflows, methodologies, know-how, documentation, user interfaces, designs, and brand assets, and all intellectual-property rights in them. Except for the limited, non-exclusive, non-transferable right to use the Service during the term, no right, title, or interest in any of it is granted to you, whether by implication, estoppel, or otherwise. All rights not expressly granted are reserved.

8.2 Feedback. Standard perpetual-license grant on feedback.

8.3 Customer References. We may identify you as a customer (name, logo) on the customers page unless you opt out.

8.4 IP & Assignment Rider. An IP & Assignment Rider addressing ownership and assignment of intellectual property is incorporated by reference into these Terms and controls over this §8 and over §15.4 on the subjects within its scope.

8.5 Present Assignment of Derivative IP. "Derivative IP" means all modifications, enhancements, improvements, and derivative works of or to the Company IP, and all inventions and works of authorship conceived, developed, or reduced to practice by or for us in the course of providing the Service — including any informed by your use of the Service, by Feedback, or by aggregated and de-identified telemetry. Derivative IP excludes Customer Data (§4). To the extent any Derivative IP would otherwise vest in you — by operation of law, under any work-made-for-hire or commissioned-work doctrine, because your use, Inputs, or Feedback contributed to it, or on any other basis — you hereby irrevocably and presently assign to us all right, title, and interest in and to that Derivative IP, effective automatically upon its creation and without further action or consideration. At our reasonable request and expense, you will execute confirmatory instruments and take actions reasonably necessary to perfect or confirm our ownership.

9. Privacy and Data Processing

9.1 Privacy Policy at get-replyengine.com/privacy. We are the controller for marketing-site visitors and Customer account/billing contacts, and the processor for the compliance data you place under your tenant. Where the Data Processing Addendum and these Terms conflict as to the processing of Customer Data, the DPA controls; this Privacy Policy is a notice, not a contracting instrument.

9.2 If you are subject to the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended ("CCPA"), the Colorado Privacy Act, or another data-protection regime that requires a data-processing agreement, our Data Processing Addendum at replyengine.com/dpa applies and is incorporated into these Terms upon your acceptance of it. The DPA controls over these Terms on the processing of your personal data.

10. Suspension and Termination

10.1 By You. Cancel anytime; effective at the end of the paid monthly period. 10.2 By Us. Material breach, violation of §5 (Acceptable Use), or non-payment. 30 days' notice with pro rata refund for any discontinuation we initiate, paid within 30 days after the effective date of termination. 10.3 Effect. Customer Data deleted within 30 days of termination unless retention is required by law or export is requested. 10.4 Survival. Sections 4 (data), 6 (outputs/disclaimers), 8 (IP), 11 (Confidentiality), 12 (Warranties), 13 (Liability), 14 (Indemnification), 15 (General) survive.

11. Confidentiality

Treat all Customer Data as confidential information; standard confidentiality commitments; 5-year survival; trade-secret indefinite.

12. Warranties and Disclaimers

12.1 Limited Warranty. The Service performs substantially per documentation. Exclusive remedy: repair or pro rata refund.

12.2 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN §12.1, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

12.3 No Warranty Re Output Acceptance. We do not warrant that the Service will be error-free or uninterrupted, or that any Output will be accurate, complete, or accepted by any recipient.

13. Limitation of Liability

13.1 TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, LOST REVENUE, LOST DATA, OR ANY DAMAGES ARISING FROM A FAILED CONTRACT, DISQUALIFIED BID, REGULATORY ACTION, OR FCA PROCEEDING, EVEN IF ADVISED.

13.2 OUR TOTAL CUMULATIVE LIABILITY ARISING FROM OR RELATED TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE FEES YOU PAID US IN THE TWELVE MONTHS PRECEDING THE CLAIM.

13.3 No Liability for Recipient-Side or Regulatory Outcomes. We are not liable for: any recipient's acceptance, rejection, or evaluation of an Output; any finding, inquiry, investigation, or enforcement action by any regulatory, administrative, or enforcement body of any kind — including without limitation the FTC or any state attorney general — or any claim arising under CCPA/CPRA §1798.150 or any other statute; or any allegation arising from your representation to any party about our role. This carve-out is stated as broadly as possible and applies uniformly regardless of the specific statute, regulation, or regulatory or enforcement body involved; a party asserting that this carve-out does not apply to a particular claim, statute, or regulatory or enforcement body bears the burden of establishing that, rather than us bearing the burden of having disclaimed each one individually.

14. Indemnification

14.1 Stated in the contract you execute. Both indemnities — ours for IP infringement and yours — are stated in full on the face of Article 8.6 of the Master Subscription & Services Agreement ("8.6 Indemnification"), together with the exclusions and the claim procedure. For Scale-tier Customers that Agreement is countersigned. For Starter and Growth Customers, Article 8.6 is incorporated by the click-signed Order Form you accept, with the full agreement text rendered on the page above the agree control. Those provisions govern; this §14 is a cross-reference and does not restate them.

14.2 No separate indemnity. These Terms state no indemnification obligation separate from, additional to, or narrower than SOW Article 8.6, and nothing in these Terms enlarges or limits it. Where these Terms refer to the §14 indemnity (§10.4 survival), the reference is to SOW Article 8.6.

15. General Provisions

15.1 Governing Law. Colorado. The United Nations Convention on Contracts for the International Sale of Goods ("CISG") does not apply. 15.2 Disputes. Binding arbitration via JAMS in Boulder County, CO. Each party waives any right to a jury trial and to participation in any class, collective, or representative proceeding. Either party may seek injunctive relief in court for §5, §6, §8, or §11 breaches. 15.3 Notices, Force Majeure, Entire Agreement, Modifications (30-day), Severability, No Waiver, Independent Contractors. Standard. Written notice under these Terms (email to the billing contact or in-product notice) is deemed given when sent or first displayed; any notice period runs from that date, and failure to read a notice does not extend it. 15.4 Assignment; Change of Control. You may not assign, delegate, or transfer these Terms, in whole or in part, whether by operation of law, merger, or change of control, without our prior written consent; any attempted assignment in violation of this sentence is void. We may, without your consent and without notice except as any applicable data-protection law requires, assign or transfer these Terms and all of our rights and obligations under them, in whole or in part, (a) to a successor or acquirer in connection with a merger, acquisition, or sale of substantially all of our business or assets, or (b) to an affiliate, subsidiary, or newly formed entity in connection with a corporate conversion, reorganization, or contribution or drop-down of assets undertaken to effect a sale, reorganization, or transfer of the specific business line or product to which these Terms relate. Upon such an assignment, all of our rights under these Terms pass to the assignee, the assignee assumes our obligations arising after the assignment, and your continued use of the Service constitutes acknowledgment of the assignee as "Reply Engine" going forward. A change in our ownership, control, equity holders, or entity form is not a breach of, default under, or ground to terminate, suspend, renegotiate, or re-price these Terms, and does not trigger any right of termination, consent, first refusal, most-favored-nation, audit, or refund on your part. This §15.4 controls over any contrary term in a Customer purchase order or procurement addendum.

15.5 Regional and Supplemental Terms. No jurisdiction-specific supplemental term applies today. Where a supplemental jurisdiction-specific term applies, it controls over a conflicting general term of these Terms for that jurisdiction only.

---

Contact

Reply Engine — Ellis Intelligence LLC Email: [email protected] Address: 1500 N Grant St, Ste N, Denver, CO 80203, USA

---