Terms of Service

These Terms of Service (the “Terms”) govern your access to and use of VendorLockbox. Please read them carefully. By using the service you agree to be bound by these Terms.

1. Acceptance of terms

By creating an account or otherwise using VendorLockbox, you agree to these Terms. If you are using the service on behalf of a credit union, community bank, or other organization, you represent that you have the authority to bind that organization to these Terms, and “you” refers to both you individually and that organization.

2. Description of the service

VendorLockbox provides a hosted software service for tracking third-party vendors, contracts, compliance documents, due diligence reviews, risk assessments, and related NCUA and financial-institution compliance workflows. Features, plan limits, and pricing are described on our pricing page and inside the application, and may change from time to time.

3. Account registration

You must provide accurate account information and keep it current. You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. Notify us promptly at [email protected] if you suspect unauthorized access.

Each account represents a single institution. Sharing credentials with parties outside your institution is not permitted.

4. Acceptable use

You agree not to:

• Attempt to circumvent authentication, access control, or plan limits.
• Reverse-engineer, decompile, or extract source code from the service, except to the extent this restriction is prohibited by applicable law.
• Upload malicious code, viruses, or other harmful content.
• Use the service to violate any applicable law or regulation.
• Attempt to access accounts or data belonging to other customers.
• Use the service to send unsolicited or unlawful communications.
• Interfere with the operation of the service, including by generating unreasonable load or attempting denial-of-service actions.

We may suspend or terminate accounts that violate this section, at our reasonable discretion and with notice where practicable.

5. Subscription and billing

5.1 Free trial

New accounts receive a 30-day free trial after checkout. A valid payment method is required to start the trial. You will not be charged during the trial period.

5.2 Paid subscriptions

After the trial concludes, we will charge the payment method on file for the plan you selected. Subscriptions are billed in advance, either monthly or annually depending on the plan and billing period you chose at signup.

5.3 Automatic renewal

Subscriptions renew automatically at the end of each billing period at the then-current price for your plan, unless you cancel before the renewal date.

5.4 Cancellation

You may cancel your subscription at any time from the billing settings page. When you cancel, your subscription will not renew at the end of the current billing period. You will retain access to the service through the end of the period you have already paid for. No partial or prorated refunds are issued for unused time remaining in a billing period.

5.5 Refunds

All payments are non-refundable. We may, in our sole discretion, provide credits in cases of extended service unavailability or verified billing error.

5.6 Failed payments

If a payment fails, we will retry and notify you by email. If payment is not resolved after Stripe's automated retry schedule, the subscription will be cancelled and your account will lose access to paid features. Your data will remain available for export for 30 days.

5.7 Price changes

We may change subscription prices from time to time. Existing subscriptions will continue at the current price until the next renewal. We will provide at least 30 days' notice by email before applying a new price to your renewal.

5.8 Taxes

Prices displayed do not include applicable sales, use, VAT, or similar taxes. If we are required to collect any such taxes, they will be added to your invoice.

6. Data ownership

You own your data. This includes vendor records, contracts, uploaded documents, due diligence reviews, incidents, risk assessments, notification preferences, and reports you create or upload. VendorLockbox claims no ownership rights in your content.

You grant us a limited, non-exclusive, worldwide, royalty-free license to store, transmit, process, and display your content solely to provide, operate, and improve the service for you. We may use aggregated and anonymized statistics derived from your usage to improve the product. We will never share your identifiable data with other customers or third parties for commercial purposes.

7. Intellectual property

The software, design, branding, name, logo, and documentation of VendorLockbox are owned by VendorLockbox or our licensors and are protected by copyright, trademark, and other intellectual property laws. Nothing in these Terms grants you any right to our intellectual property beyond the license to use the service described here.

8. Third-party services

The service integrates with third-party providers, including WorkOS, Stripe, Resend, PostHog, and Microsoft Azure, as described in our Privacy Policy and on our Security page. Your use of these providers may be governed by their own terms. We are not responsible for the availability or performance of these third-party providers.

9. Disclaimer of warranties

The service is provided on an “as is” and “as available” basis. To the maximum extent permitted by law, we disclaim all warranties, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, non-infringement, and any warranty arising from course of dealing or usage of trade.

We do not warrant that the service will meet your requirements, be uninterrupted, be free of errors, or that any results obtained from the service will be accurate or complete. VendorLockbox is a compliance workflow tool; it is not a substitute for professional legal, regulatory, audit, or examination advice. You are solely responsible for your institution's compliance with NCUA regulations and all other applicable laws.

10. AI-assisted features and data extraction

VendorLockbox uses AI models to assist with extracting and analyzing information from contracts, vendor documents, and related records. The following terms apply to all AI-assisted features within the service.

10.1 AI extraction is not a legal review

AI-extracted data is a starting point, not a completed legal review. Extracted information may contain errors, omissions, or misinterpretations. You are solely responsible for verifying all contract terms, deadlines, obligations, and other provisions before relying on them for business decisions, regulatory filings, or compliance determinations. VendorLockbox expressly disclaims liability for any inaccuracy in AI-extracted data.

10.2 No professional advice

VendorLockbox does not provide legal, financial, or compliance advice. AI extraction, risk scoring, due diligence templates, and other AI-assisted features are convenience tools only. They are not a substitute for qualified legal counsel, compliance officers, or regulatory advisors. Always verify critical contract terms with your legal counsel before acting on them.

10.3 Human review and approval required

AI-extracted data is surfaced for your review before being applied to your records. By clicking “Apply Extracted Data” or an equivalent confirmation action, you acknowledge that you have reviewed the extracted fields and accept responsibility for their accuracy in your records. You should compare AI-extracted information against the original source document prior to confirming.

10.4 Confidence indicators

Where confidence scores or uncertainty flags appear alongside AI-extracted fields, low-confidence values are explicitly highlighted for manual verification. The absence of a low-confidence flag does not guarantee accuracy. Critical fields - including notice periods, auto-renewal dates, and termination rights - should be independently verified against the original contract regardless of confidence level.

10.5 Audit trail

The service records whether data was AI-extracted, the date and time of extraction, and that you confirmed and applied the extracted data. This record is part of your institutional audit trail. You retain full responsibility for the accuracy of your records regardless of how data was entered.

11. Limitation of liability

To the maximum extent permitted by law, our total aggregate liability for any claim arising out of or relating to these Terms or the service, whether in contract, tort, or otherwise, will not exceed the greater of one hundred United States dollars ($100) or the amount you paid to VendorLockbox in the twelve (12) months preceding the event giving rise to the claim.

We will not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of profits, revenue, data, or business opportunities, even if we have been advised of the possibility of such damages.

12. Indemnification

You will defend, indemnify, and hold harmless VendorLockbox and its officers, employees, and agents from any third-party claim, damage, loss, liability, or expense (including reasonable attorneys' fees) arising from your violation of these Terms, your misuse of the service, or your content.

13. Termination

You may terminate your account at any time by cancelling your subscription and requesting deletion of your data. We may suspend or terminate your account if you materially breach these Terms, if required by law, or if we discontinue the service.

On termination, your right to access the service ends immediately. You may export your data for 30 days after cancellation. After that period we may delete your data as described in our Privacy Policy.

The following sections survive termination: Data Ownership (Section 6), Intellectual Property (Section 7), Disclaimer of Warranties (Section 9), AI-Assisted Features (Section 10), Limitation of Liability (Section 11), Indemnification (Section 12), Governing Law (Section 14), and any other provisions that by their nature should survive.

14. Governing law and dispute resolution

These Terms are governed by the laws of the State of Washington, United States, without regard to its conflict of laws principles. Any dispute arising under or relating to these Terms will be resolved exclusively in the state or federal courts located in King County, Washington, and you consent to the personal jurisdiction of those courts.

15. Changes to these Terms

We may update these Terms from time to time. If we make material changes we will notify you by email and post the updated Terms with a new effective date. Your continued use of the service after the effective date constitutes acceptance of the updated Terms.

16. Miscellaneous

These Terms constitute the entire agreement between you and VendorLockbox regarding the service and supersede any prior agreements. If any provision is held to be unenforceable, the remaining provisions will remain in full force and effect. Our failure to enforce any right or provision is not a waiver of that right or provision. You may not assign these Terms without our prior written consent; we may assign these Terms in connection with a merger, acquisition, or sale of assets.

17. Contact

Legal notices should be sent to [email protected].