Your use of RiskD3M is governed by the Bonterms Standard Online Cloud Terms (Version 1.0), published by Bonterms and incorporated here by reference, as modified and supplemented by the Provider-Specific Terms and Attachments below. Together these form the agreement between you and ElasticD3M, LLC ("ElasticD3M", "we", "us").
We use a published standard form deliberately. Bonterms terms are drafted to be balanced between provider and customer, are already familiar to enterprise legal teams, and can be reviewed once and reused, which spares your counsel the work of reading a bespoke agreement written by a vendor's lawyer. Where we depart from the standard form, we say so in section 2 rather than burying the change in a redline.
In the Bonterms terms, "Provider" means ElasticD3M, LLC. "Customer" means you and the organization you are authorized to represent. The "Cloud Service" is RiskD3M. By purchasing or using RiskD3M you accept this agreement on behalf of that organization.
The Bonterms Standard Online Cloud Terms are published by Bonterms under the Creative Commons Attribution 4.0 International licence. ElasticD3M is not affiliated with or endorsed by Bonterms, and the Provider-Specific Terms below are ours, not theirs.
These modify and supplement the Bonterms terms. Where they conflict, these control.
RiskD3M produces decision support: a transparent analysis of cyber financial materiality, an Item 1.05 worksheet, a computed disclosure window, a drafted Item 106 governance narrative, and an auditable record. RiskD3M is not legal, accounting, actuarial, audit, or investment advice, and using it does not create any professional or fiduciary relationship. RiskD3M does not determine materiality and makes no securities filing. Every output requires review and approval by your authorized officers or directors before use. The materiality determination and any disclosure decision are, and remain, yours.
Loss-exposure figures are modeled from the evidence available and are inherently uncertain; actual results may differ. Where evidence is missing we widen the stated range or decline to score, and an unobserved control domain is reported as unobserved rather than treated as satisfactory. Nothing we produce is a warranty of security, a prediction of loss, or a representation that any control will prevent an incident.
You are responsible for the accuracy and completeness of the facts and evidence you supply, for obtaining any authorizations needed to share them, for your own legal and disclosure obligations, and for the decisions you make.
Where RiskD3M measures your environment, the measurement is taken inside your own network and only scores, counts and cryptographic digests leave it. We release a posture attestation to an insurer, broker or other third party only under a consent you have recorded naming that party, with an expiry, and you may withdraw it at any time. We do not sell, license or aggregate customer posture data, and no attestation is produced without a live consent.
Fees are stated at checkout and are payable in advance. One-time engagements are billed once; subscription offerings, where available, are billed on a recurring, month-to-month basis until you end the subscription. See our Refund Policy.
ElasticD3M retains all rights in RiskD3M, its models, methodology, and software (Patent Pending). You retain your own data and receive a license to use the analysis we deliver to you for your internal business purposes.
RiskD3M is offered in the United States only and is subject to our Eligibility and Prohibited Entity Policy.
These form part of the agreement:
Our Privacy Policy describes how we handle personal information and is not part of this agreement.
This agreement is governed by the laws of the State of Texas, without regard to its conflict-of-laws rules, and the state and federal courts located in Bexar County, Texas have exclusive jurisdiction. This replaces the default governing law and courts in the Bonterms terms.
Customer data is processed in the United States. See the Data Processing Agreement.
RiskD3M, powered by ElasticD3M. Patent Pending. © 2026 ElasticD3M, LLC · All Rights Reserved.
This Addendum applies only where the Customer is the United States Government or a contractor acquiring on its behalf. It does not modify the rights or obligations of any commercial Customer.
Provider identifiers. ElasticD3M, LLC · SAM.gov Unique Entity ID (UEI): LXSZZXDYPN16 · CAGE Code: 23E31.
A1. Applicability. This Addendum applies when Customer is the United States Government, an agency or instrumentality thereof, or a prime or higher-tier contractor acquiring the Services for delivery to the United States Government under a federal prime contract, subcontract, or purchase order. Where it applies, this Addendum controls over any conflicting provision of these Terms.
A2. Commercial product and commercial service status. The Services are commercial products and commercial services within FAR 2.101. Any software component is commercial computer software and commercial computer software documentation under FAR 12.212 and DFARS 227.7202. The Government acquires only those rights customarily provided to the public, as set out in these Terms as modified by this Addendum.
A3. Order of precedence. The federal contract or order, including FAR 52.212-4 and any clause incorporated by operation of law, controls over these Terms. Consistent with GSAR 552.212-4, any provision of these Terms that conflicts with federal law or is unenforceable against the United States is deemed deleted for that engagement, and its deletion does not affect the remainder.
A4. Governing law and disputes. For Government engagements these Terms are governed by federal law, and Section 4 is superseded. Disputes are resolved under the Contract Disputes Act, 41 U.S.C. §7101 et seq.: by written claim to the Contracting Officer, then appeal to the cognizant Board of Contract Appeals or the United States Court of Federal Claims. Provisions selecting state law, state venue, or consent to personal jurisdiction do not apply.
A5. No binding arbitration. No arbitration provision applies to Government engagements. The parties may use alternative dispute resolution only as authorized by the Contract Disputes Act and the acquiring agency's procedures.
A6. Indemnification. Any obligation for Customer to defend, indemnify, or hold Provider harmless does not apply to the United States Government, which cannot obligate funds in advance of an appropriation under 31 U.S.C. §1341. Provider's own indemnity obligations, including the intellectual-property indemnity contemplated by FAR 52.212-4(h), remain in full force.
A7. Funding, renewal, and termination. No provision automatically renews a Government order or escalates price without a modification executed by a warranted Contracting Officer. Performance is subject to the availability of appropriated funds. Termination for convenience and for cause is governed by FAR 52.212-4(l) and (m).
A8. Limitation of liability. Limitations, exclusions, and disclaimers in these Terms apply only to the extent permitted by federal law, and do not limit any remedy available to the Government under the federal contract or order.
A9. Scope of Government engagements. Government engagements are advisory and deliverable-based. Provider does not ingest, process, store, or transmit Government data, Controlled Unclassified Information, or data from a Federal information system, and does not connect to, scan, or operate within a Federal information system or a contractor system processing CUI on the Government's behalf. Deliverables are produced from information the Government elects to furnish and are reviewed and approved by Customer's designated official before issuance. Accordingly the Services are not a cloud service offering requiring FedRAMP authorization. Any engagement requiring Provider to process Government data or connect to a Federal information system is outside the scope of these Terms and requires a separate written agreement.
A10. Accessibility. Provider will furnish an Accessibility Conformance Report for the Services and for deliverable formats on request, addressing the Revised Section 508 Standards at 36 C.F.R. Part 1194.
A11. Supply chain and place of performance. Provider does not provide covered telecommunications equipment or services as defined in Section 889 of the FY2019 NDAA. Services are performed in the United States by United States persons, and customer data is processed only in United States regions.
A12. Standard representations. Provider has not paid or agreed to pay any contingent fee for the award of a federal contract (FAR 52.203-5) and has not offered gratuities (FAR 52.203-3). Assignment is subject to the Anti-Assignment Act, 41 U.S.C. §6305.