LEGAL

Terms of Service

Last updated August 29, 2026

1. Agreement to Terms

PostureRadar is operated from the United States ("PostureRadar," "we," "us," or "our"). These Terms of Service ("Terms") govern your access to and use of PostureRadar. By creating an account, deploying the PostureRadar scanning role, or paying for a subscription, you agree to these Terms and our Privacy Policy, which is part of these Terms. If you don't agree, don't use the Service.

The Service is currently offered to businesses and individuals in the United States. You must be at least 16 years old to use it.

2. What the Service Does

PostureRadar runs read-only, automated checks against the AWS account(s) you control and connect, using a cross-account IAM role that you deploy yourself via the CloudFormation template we provide. One subscription can cover multiple AWS accounts. Findings are emailed to you every week, including a link you can use to trigger an additional scan on demand. Reports include specific remediation suggestions (console steps and a CLI command, where useful) for most findings — a few findings are disclosures (for example, noting your account uses IAM Identity Center) rather than violations with a fix, and don't carry a separate remediation suggestion. These suggestions are general guidance, not a warranty that following them resolves the finding or is appropriate for your specific environment. The Service performs the set of checks described on our FAQ, which may change or expand over time — it is not a substitute for a comprehensive security audit, penetration test, or compliance certification, and does not guarantee it will find every misconfiguration or vulnerability in your account.

3. Your Account and the Role You Deploy

You represent that you have the authority to grant PostureRadar read-only access to each AWS account you connect. You agree not to connect an AWS account you don't control or aren't authorized to grant access to, and you agree to indemnify and hold PostureRadar harmless from any claim, loss, or expense arising from your connecting an AWS account you weren't authorized to connect. If we reasonably believe an AWS account connected to your subscription was not authorized to be connected, we may suspend scanning of that account without prior notice.

You're also responsible for:

  • Deploying the CloudFormation role using a template we've published — the version current when you connected that account, or a later version we publish — without expanding its permissions. If we add checks that need new read-only permissions, we'll update the published template; older deployments keep working, but some newer checks may report limited results until you redeploy the role.
  • Keeping the email address on your account current and monitoring it for reports.
  • Removing the deployed role from your AWS account if you no longer want to be scanned — canceling your subscription does not automatically remove the role from your account.

4. Subscriptions and Billing

The subscription is billed on a recurring basis through Stripe, based on the number of AWS accounts your subscription covers ("quantity"). By subscribing, you authorize us to charge your payment method on each billing cycle until you cancel. You can manage your subscription — including canceling, updating your payment method, or changing quantity — anytime through our self-serve billing portal (postureradar.com/manage.html) or by emailing us. Cancellation and quantity decreases take effect at the end of your current billing period. Quantity increases take effect immediately (added account coverage starts right away) and are billed starting your next cycle — no partial-period charge. We don't provide refunds for partial periods. We may change pricing with notice to active subscribers before it takes effect on your next renewal.

5. Acceptable Use

You agree not to:

  • Use the Service against an AWS account you're not authorized to scan.
  • Attempt to circumvent, disable, or interfere with the Service's rate limits, authentication, or security controls.
  • Reverse-engineer or attempt to extract the source code of the Service, except where applicable law permits it.
  • Use access to the Service itself to build a directly competing product (this doesn't restrict your general AWS or security knowledge and skills).
  • Share or publicly post signed activation or "scan again" links — anyone who has one can use it until it expires.
  • Resell, sublicense, or provide the Service (or access to reports) to third parties without our prior written consent.

6. Confidentiality of Your Findings

We treat your scan findings and account information as confidential. We only disclose them to the subprocessors listed in our Privacy Policy as needed to run the Service, to our own staff as needed to operate the Service, to you, or where required by law.

7. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT IT WILL IDENTIFY EVERY SECURITY ISSUE IN YOUR AWS ACCOUNT. YOU REMAIN SOLELY RESPONSIBLE FOR THE SECURITY AND CONFIGURATION OF YOUR OWN AWS ACCOUNT. THE SERVICE IS NOT DESIGNED, CERTIFIED, OR INTENDED FOR USE IN HIPAA-REGULATED ENVIRONMENTS, AND WE DO NOT SIGN BUSINESS ASSOCIATE AGREEMENTS. WE DO NOT CLAIM PCI-DSS OR FEDRAMP COMPLIANCE FOR THE SERVICE.

8. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF DATA, REVENUE, OR PROFITS, ARISING FROM YOUR USE OF THE SERVICE. OUR TOTAL LIABILITY FOR ANY CLAIM RELATING TO THE SERVICE, WHETHER FOR DIRECT DAMAGES OR OTHERWISE, WILL NOT EXCEED THE AMOUNT YOU PAID US IN THE 12 MONTHS BEFORE THE CLAIM AROSE. THESE LIMITATIONS DO NOT APPLY TO DAMAGES ARISING FROM FRAUD OR WILLFUL MISCONDUCT, OR TO YOUR INDEMNIFICATION OBLIGATIONS UNDER SECTION 3.

9. Ownership of Your Data and Reports

You own your scan reports and the findings in them. We claim no license to them beyond what's needed to generate and email reports on your behalf.

10. Feedback

If you send us suggestions, ideas, or feedback about the Service, you grant us a perpetual, irrevocable, royalty-free license to use and incorporate that feedback into the Service without any obligation to you.

11. Termination

You may stop using the Service and cancel your subscription at any time. We may suspend or terminate your access if you violate these Terms, or discontinue the Service (or any part of it) with reasonable notice. On termination, the license to use the Service ends, but you remain responsible for removing the deployed IAM role from your AWS account yourself.

12. Changes to These Terms

We may update these Terms from time to time. If we make material changes, we'll notify active subscribers by email before the changes take effect. Non-material changes may be posted on this page and take effect on posting. Continued use of the Service after changes take effect means you accept the updated Terms.

13. Governing Law and Venue

These Terms are governed by the laws of the State of Wisconsin, without regard to its conflict-of-law principles. Any dispute arising from these Terms or the Service will be brought exclusively in the state or federal courts located in Wisconsin, and you consent to personal jurisdiction there.

14. Contact

Questions about these Terms: [email protected].