Legal
Effective date: January 1, 2026
Last updated: September 1, 2026
Publisher: Guardrail, Inc.
Contact: support@trustguardrail.com
These Terms of Service ("Terms") govern your access to and use of the platform, services, software, assessments, and associated documentation (collectively, the "Services") made available by Guardrail, Inc. ("Guardrail," "we," "us," or "our"), including, without limitation, the Browser DLP Extension, the RADAR™ Risk-Aware Data Analysis and Reporting platform, the Discovery Assessment product, the Intelligence Assessment product, and all related platform subscription features.
PLEASE READ THESE TERMS CAREFULLY BEFORE ACCESSING OR USING THE SERVICES. BY CLICKING "I AGREE," REGISTERING FOR AN ACCOUNT, PURCHASING A DISCOVERY ASSESSMENT, EXECUTING A STATEMENT OF WORK, OR OTHERWISE ACCESSING OR USING THE SERVICES, YOU ("CUSTOMER") AGREE TO BE BOUND BY THESE TERMS ON BEHALF OF THE ORGANIZATION YOU REPRESENT.
If you do not agree to these Terms, you may not access or use the Services. If you are accepting these Terms on behalf of an organization, you represent and warrant that you have the authority to bind that organization to these Terms.
“Agreement” means these Terms of Service together with any applicable Order Form, Statement of Work, Business Associate Agreement, and Benchmark Contribution Agreement, each incorporated by reference.
“Assessment Data” means findings, scores, metrics, reports, and analysis outputs generated by Guardrail in connection with performing Services for Customer, excluding PHI and Customer Confidential Information.
“Authorized Users” means individuals employed by or contracted to Customer who are authorized by Customer to access and use the Services under Customer's account.
“BAA” means the Business Associate Agreement between Guardrail and Customer governing the handling of Protected Health Information, which is incorporated into and forms part of this Agreement for Customers who are HIPAA Covered Entities or their Business Associates.
“Benchmark Data” means anonymized, de-identified, and aggregated data derived from Assessment Data across Guardrail's customer base, from which no individual organization or patient can be identified, used to generate industry benchmarks, risk indices, and comparative scoring.
“Browser DLP Extension” means Guardrail's proprietary downloadable browser extension software that monitors and analyzes data flows at the browser interface level for purposes of detecting potential PHI exposure within AI tools and systems accessed through the browser.
“Customer” means the organization, entity, or individual that has accepted these Terms and is authorized to access and use the Services.
“Customer Data” means data, information, and content submitted to or processed by the Services by or on behalf of Customer, including configuration data, organizational information, and assessment inputs.
“Discovery Assessment” means Guardrail's entry-level, time-limited, self-serve assessment service consisting of browser-level DLP monitoring and one RADAR scan, delivered over thirty (30) calendar days, as further described in Section 4.
“Documentation” means Guardrail's technical documentation, user guides, online help materials, and other related materials made available with the Services.
“Effective Date” means the date Customer accepts these Terms as described above.
“Intelligence Assessment” means Guardrail's comprehensive paid assessment service, as described in the applicable Statement of Work.
“Order Form” means a written order form, online checkout page, or similar document specifying the Services purchased, fees, and other applicable terms.
“PHI” means Protected Health Information as defined under HIPAA and the HITECH Act, including Electronic Protected Health Information (ePHI), and including Substance Use Disorder records protected under 42 C.F.R. Part 2 where applicable.
“Platform Subscription” means Guardrail's recurring subscription tier providing ongoing access to RADAR platform features, monitoring, reporting, and policy intelligence capabilities, as further described in the applicable Order Form.
“RADAR” means Risk-Aware Data Analysis and Reporting, Guardrail's proprietary AI governance assessment methodology, platform, and scoring system.
“Services” means all products, services, software, and assessments made available by Guardrail, including the Discovery Assessment, Intelligence Assessment, Platform Subscription, Browser DLP Extension, and RADAR platform.
“Statement of Work" or "SOW” means a written document executed by Guardrail and Customer describing the scope, deliverables, timeline, and fees for a specific engagement, which is incorporated into this Agreement.
The Services are intended solely for use by organizations, their affiliates, and other entities operating within regulated industries, including the healthcare and behavioral health sectors. By accepting these Terms, Customer represents and warrants that:
Customer must register for an account to access certain Services. Customer agrees to provide accurate, current, and complete information during registration and to update such information to keep it accurate, current, and complete. Customer is responsible for safeguarding its account credentials and for all activities that occur under its account. Customer must notify Guardrail immediately of any unauthorized use of its account.
The Discovery Assessment is available on a one-per-organization basis. For purposes of this restriction, "organization" means any entity sharing a common Tax Identification Number (TIN) or any entity under common majority ownership or control. Circumventing this limitation through the use of related entities, subsidiaries, or affiliated organizations is strictly prohibited.
Subject to Customer's compliance with these Terms and timely payment of all applicable fees, Guardrail grants Customer a limited, non-exclusive, non-transferable, non-sublicensable license during the applicable subscription or assessment period to:
Customer shall not, and shall not permit any Authorized User or third party to:
The Discovery Assessment is a self-service, entry-level assessment product providing:
The Discovery Assessment does not constitute and shall not be construed as: (a) a HIPAA Security Risk Assessment artifact sufficient for regulatory purposes; (b) a certification or attestation of compliance with any applicable law or accreditation standard; (c) Policy Intelligence or AI governance policy documentation; (d) a 42 C.F.R. Part 2 consent chain validation; (e) documentation sufficient for CARF, Joint Commission, URAC, or NCQA survey response; or (f) network-layer or API-layer monitoring. Customers seeking these outputs should inquire about the Intelligence Assessment or Platform Subscription.
For organizations with more than fifty (50) employees or contractors, the Discovery Assessment covers a representative subset of fifty (50) Authorized Users selected by Customer. Customer acknowledges that assessment findings reflect only the scanned subset, and that actual organizational exposure may be materially higher than findings from the subset alone. Guardrail's report will clearly indicate the scope of the scanned population.
The Intelligence Assessment is a comprehensive paid assessment engagement described in a mutually executed Statement of Work. SOW terms, scope, deliverables, and fees govern and supplement these Terms.
The Platform Subscription provides ongoing access to RADAR platform features, including continuous monitoring, reporting, policy intelligence, and support, as described in the applicable Order Form. Platform Subscription terms, tier features, and service levels are specified in the applicable Order Form.
Guardrail is a technology company. The Services are technology products and do not constitute legal advice, medical advice, compliance certification, or professional services of any kind. Customers should consult qualified legal, compliance, and clinical professionals regarding their specific regulatory obligations. Guardrail's assessment findings and PHI Exposure Scores are directional risk indicators, not definitive compliance determinations.
To the extent Guardrail processes, receives, maintains, or transmits PHI on behalf of Customer in connection with the Services, Guardrail will function as a Business Associate as defined under HIPAA, and Customer will function as a Covered Entity or Business Associate, as applicable. In such cases, the parties shall execute a Business Associate Agreement prior to any PHI being submitted to or processed by the Services. The BAA is incorporated by reference into this Agreement and governs the handling of PHI. In the event of conflict between the BAA and these Terms with respect to PHI, the BAA controls.
Guardrail acknowledges that certain Customer Data may include Substance Use Disorder records subject to 42 C.F.R. Part 2. Guardrail's handling of such records, to the extent applicable, will comply with the requirements of 42 C.F.R. Part 2 as amended by the 2024 Final Rule. Customer is responsible for ensuring that its submission of data to the Services complies with applicable consent and disclosure requirements under 42 C.F.R. Part 2.
Customer is solely responsible for its own compliance with all applicable healthcare privacy, security, and data protection laws and regulations, including HIPAA, HITECH, 42 C.F.R. Part 2, applicable state mental health and substance use disorder privacy laws, and any applicable accreditation standards. Guardrail's provision of Services does not relieve Customer of any compliance obligation.
Participation in any Guardrail Service is conditioned upon Customer's execution of Guardrail's Benchmark Contribution Agreement (the "BCA"). The BCA governs Customer's contribution of anonymized, de-identified Assessment Data to Guardrail's RADAR Benchmark Dataset.
Guardrail will de-identify and anonymize Customer Data prior to inclusion in the Benchmark Dataset in accordance with the standards established under 45 C.F.R. § 164.514(b) or 45 C.F.R. § 164.514(a), as applicable. No Benchmark Data will contain information from which an individual Customer, Customer's identity, or Customer's specific findings can be re-identified.
Guardrail may use Benchmark Data to: (a) develop and improve the RADAR scoring and assessment methodology; (b) generate industry benchmarks, indices, and comparative analysis; (c) provide aggregated market intelligence to insurance carriers, research institutions, and other third parties; and (d) support Guardrail's commercial and research activities. Guardrail's right to use Benchmark Data survives termination of this Agreement.
Customer shall pay all fees specified in the applicable Order Form, SOW, or checkout page. All fees are stated in U.S. dollars and are non-refundable except as expressly set forth in these Terms or the applicable Order Form.
The Discovery Assessment fee is due and payable at the time of purchase. The full Discovery Assessment fee will be credited one hundred percent (100%) toward Customer's purchase of a Platform Subscription or Intelligence Assessment, provided that such subsequent engagement is executed and payment is received within ninety (90) days of the Discovery Assessment delivery date. The credit expires upon the expiration of the ninety-day window and has no cash value. The credit is non-transferable and may not be applied to a subsequent Discovery Assessment.
Platform Subscription fees are billed annually in advance unless otherwise specified in the applicable Order Form. Customer authorizes Guardrail (or its payment processor) to charge the payment method on file for all fees when due. Guardrail reserves the right to suspend access to the Services if payment is not received within ten (10) days of the due date.
All fees are exclusive of applicable taxes. Customer is responsible for all taxes, levies, or duties imposed by taxing authorities on amounts payable under this Agreement, excluding taxes based on Guardrail's net income.
As between the parties, Guardrail owns and retains all right, title, and interest in and to the Services, the RADAR methodology, the Browser DLP Extension, the Benchmark Dataset, all platform software, algorithms, scoring models, weighting systems, reports, templates, and all modifications, improvements, and derivative works thereof, and all intellectual property rights therein. No rights are granted to Customer except as expressly set forth in these Terms.
As between the parties, Customer owns all right, title, and interest in and to Customer Data. Customer grants Guardrail a limited, non-exclusive, royalty-free license to process, analyze, store, and use Customer Data solely as necessary to provide the Services, fulfill Guardrail's obligations under this Agreement, and generate Benchmark Data in accordance with Section 6.
If Customer provides Guardrail with any suggestions, comments, or feedback regarding the Services ("Feedback"), Guardrail may use such Feedback freely without obligation to Customer. Customer assigns to Guardrail all right, title, and interest in and to any Feedback.
RADAR™ is a trademark of Guardrail, Inc. Customer shall not use the RADAR name, mark, or logo in any manner that could create confusion as to the source of goods or services, imply endorsement by Guardrail, or that is otherwise unauthorized.
"Confidential Information" means any non-public information disclosed by one party ("Disclosing Party") to the other party ("Receiving Party") that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.
Each party agrees to: (a) hold the other party's Confidential Information in strict confidence using at least the same degree of care it uses for its own confidential information, but in no event less than reasonable care; (b) not disclose the Disclosing Party's Confidential Information to any third party without prior written consent; and (c) use the Disclosing Party's Confidential Information only to perform its obligations or exercise its rights under this Agreement.
Confidentiality obligations do not apply to information that: (a) is or becomes publicly available through no fault of the Receiving Party; (b) was rightfully known to the Receiving Party prior to disclosure; (c) is rightfully received from a third party without restriction; or (d) is independently developed by the Receiving Party without use of Confidential Information.
If required by law or court order to disclose Confidential Information, the Receiving Party will provide prompt written notice to the Disclosing Party and cooperate in seeking a protective order, to the extent permitted by law.
THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." GUARDRAIL DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. GUARDRAIL DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS. GUARDRAIL DOES NOT WARRANT THAT ASSESSMENT FINDINGS, PHI EXPOSURE SCORES, OR OTHER SERVICE OUTPUTS WILL BE COMPLETE, ACCURATE, OR SUFFICIENT FOR ANY REGULATORY, ACCREDITATION, OR LEGAL PURPOSE. ASSESSMENT OUTPUTS ARE DIRECTIONAL RISK INDICATORS ONLY AND DO NOT CONSTITUTE COMPLIANCE CERTIFICATIONS.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL GUARDRAIL OR ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING WITHOUT LIMITATION LOSS OF PROFITS, DATA, GOODWILL, BUSINESS OPPORTUNITY, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE SERVICES, EVEN IF GUARDRAIL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. GUARDRAIL'S TOTAL AGGREGATE LIABILITY TO CUSTOMER ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE GREATER OF (A) THE TOTAL FEES PAID BY CUSTOMER TO GUARDRAIL IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY, OR (B) ONE THOUSAND DOLLARS ($1,000). THE PARTIES ACKNOWLEDGE THAT THE LIMITATIONS IN THIS SECTION REFLECT A REASONABLE ALLOCATION OF RISK AND ARE A FUNDAMENTAL ELEMENT OF THE BASIS OF THE BARGAIN BETWEEN THE PARTIES. THE FOREGOING LIMITATIONS SHALL NOT APPLY TO CUSTOMER'S INDEMNIFICATION OBLIGATIONS, BREACH OF CONFIDENTIALITY OBLIGATIONS, OR LIABILITY THAT CANNOT BE LIMITED BY APPLICABLE LAW.
Customer shall indemnify, defend, and hold harmless Guardrail and its officers, directors, employees, agents, and affiliates from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) Customer's breach of this Agreement; (b) Customer's violation of any applicable law or regulation; (c) Customer's use of the Services in a manner not permitted by this Agreement; (d) Customer Data, including any allegation that Customer Data infringes or misappropriates any third-party intellectual property right; or (e) Customer's failure to obtain required authorizations or consents for submission of Customer Data to the Services.
Guardrail shall indemnify, defend, and hold harmless Customer from and against any third-party claims alleging that the Services, as provided by Guardrail and used in accordance with this Agreement, infringe any U.S. patent, copyright, or trademark of such third party, provided that Customer promptly notifies Guardrail of the claim, provides reasonable cooperation, and permits Guardrail to control the defense and settlement. This indemnification does not apply to claims arising from (a) Customer's modification of the Services; (b) Customer's combination of the Services with third-party products not provided by Guardrail; or (c) Customer's use of the Services in violation of this Agreement.
These Terms are effective as of the Effective Date and continue until all Services ordered under this Agreement have been completed or terminated, unless earlier terminated as provided herein.
Either party may terminate this Agreement upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receiving written notice specifying the breach in reasonable detail.
Upon termination or expiration of this Agreement: (a) all licenses and rights granted to Customer shall immediately terminate; (b) Customer shall cease all use of the Services; (c) each party shall return or destroy the other party's Confidential Information as requested; and (d) Customer shall pay all amounts due and outstanding. Sections 1, 6.3, 8, 9, 10, 11, 12, 14, 15, and 16 shall survive termination.
Fees paid are non-refundable upon termination, except where termination arises from Guardrail's material uncured breach of this Agreement.
Before initiating any legal proceeding, the parties agree to attempt to resolve any dispute arising under or related to this Agreement promptly through good-faith negotiation between senior representatives or executives who have authority to settle the controversy for a period of thirty (30) days after one party provides written notice of the dispute. All negotiations pursuant to this clause are confidential and shall be treated as compromise and settlement negotiations for purposes of applicable rules of evidence.
If informal resolution fails, any dispute shall be resolved by binding arbitration administered by JAMS / AAA under its Commercial Arbitration Rules. The arbitration shall be conducted by a single arbitrator. The arbitration shall take place in Jackson, Mississippi, or by videoconference. The arbitrator's award shall be final and binding and may be entered as a judgment in any court of competent jurisdiction.
THE PARTIES AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING.
Nothing in this Section shall prevent either party from seeking injunctive or other equitable relief in a court of competent jurisdiction to prevent irreparable harm, including without limitation to protect intellectual property rights or Confidential Information.
This Agreement shall be governed by and construed in accordance with the laws of the State of Mississippi, without regard to its conflict of laws principles. Subject to the arbitration provisions of Section 14, each party consents to the exclusive jurisdiction of the state and federal courts located in Jackson, Mississippi for the resolution of any dispute not subject to arbitration.
This Agreement, together with all Order Forms, Statements of Work, the BAA (if applicable), and the Benchmark Contribution Agreement, constitutes the entire agreement between the parties regarding its subject matter and supersedes all prior agreements, understandings, and negotiations.
Guardrail may update these Terms from time to time. Guardrail will provide notice of material changes by email or through the Services at least thirty (30) days prior to the effective date of changes. Customer's continued use of the Services after the effective date of any change constitutes acceptance of the updated Terms.
Customer may not assign this Agreement or any rights or obligations hereunder without Guardrail's prior written consent, except in connection with a merger, acquisition, or sale of substantially all of Customer's assets to which this Agreement relates. Any purported assignment in violation of this Section is void. Guardrail may assign this Agreement without consent in connection with a merger, acquisition, sale of assets, or corporate restructuring.
If any provision of this Agreement is found to be unenforceable, the remaining provisions shall remain in full force and effect, and the unenforceable provision shall be modified to the minimum extent necessary to make it enforceable.
Failure by either party to enforce any right or provision of this Agreement shall not constitute a waiver of such right or provision.
Notices under this Agreement shall be in writing and delivered to Guardrail at support@trustguardrail.com and to Customer at the email address or address associated with Customer's account.
The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, employment, or fiduciary relationship.
Neither party shall be liable for delays or failures in performance resulting from causes beyond its reasonable control, including without limitation acts of God, natural disasters, pandemic, governmental action, internet outages, or labor disputes.
Section headings are for convenience only and shall not affect the interpretation of this Agreement.