Terms of Service

Last updated: July 2026

The short version: LockList runs a read only security assessment in your own browser. Use it only on accounts you are authorized to administer, understand it is guidance rather than a certification or audit, and pay only for the reports you download.

1. Agreement to these terms

These Terms of Service ("Terms") govern your access to and use of the LockList Security website, assessment tool, and reports (together, the "Service") provided by LockList Security LLC, a Montana limited liability company ("LockList", "we", "us"). By using the Service you agree to these Terms. If you do not agree, do not use the Service. If you use the Service on behalf of an organization, you represent that you are authorized to accept these Terms for that organization.

2. What the Service does

LockList provides on demand security and compliance assessments for Microsoft 365, Google Workspace, GitHub, AWS, Azure, and NinjaOne. You sign in with your own administrator account using the provider's standard OAuth flow (or, for NinjaOne, supply your own read only API client credentials), and the assessment reads your current configuration directly from your browser to evaluate it against control frameworks (such as SOC 2, ISO 27001, the CIS Benchmarks, HIPAA, HITRUST CSF, and CMMC 2.0). Data handling is described in our Privacy & Data Handling page, which is incorporated into these Terms.

3. Eligibility and authorized use

You must be at least 18 years old and able to form a binding contract.
You may only run an assessment against an account, tenant, workspace, organization, or cloud account that you own or are expressly authorized to administer and assess.
You are responsible for having the necessary administrative rights (for example, a Google Workspace super administrator or Microsoft 365 Global Administrator) and for any consent required within your organization.

4. Permissions and remediation

The assessment requests read only permissions used solely to read your current settings. If you choose to apply an optional remediation ("fix"), LockList requests the specific write permission for that fix at that moment and only makes a change as a result of an explicit action you take. Where applicable, changes are staged in a review or report only mode first. You are responsible for reviewing any change before enforcing it, and for its impact on your environment.

5. Not a certification, audit, or legal advice

The Service provides technical configuration evidence and guidance only. Reports are indicative and do not constitute a certification, an audit opinion, penetration testing, legal advice, or a guarantee of compliance or security. Framework mappings are provided to help you focus remediation; you remain responsible for confirming scope and applicability with your own auditor, counsel, or compliance officer. Achieving or maintaining compliance with any framework is your responsibility.

6. Payment, promo codes, and refunds

The assessment runs for free; downloading report files (PDF, CSV, JSONL, JSON) requires a one time payment or a valid promo code. Payments are processed by Stripe; by paying you also agree to Stripe's terms. Prices are shown at checkout. Because a report is generated and delivered immediately on payment, all sales are final and non refundable except where required by law. Promo codes have no cash value and may be withdrawn at any time.

7. Acceptable use

You agree not to:

use the Service against any account or system you are not authorized to assess;
attempt to disrupt, overload, reverse engineer, or gain unauthorized access to the Service or its infrastructure;
resell, sublicense, or misrepresent the Service or its reports; or
use the Service in violation of any applicable law or third party rights, including the terms of Microsoft, Google, GitHub, or AWS.

8. Intellectual property

The Service, including its software, branding, report templates, and framework mappings, is owned by LockList and protected by intellectual property laws. We grant you a limited, non exclusive, non transferable right to use the Service and to use the reports you generate for your own internal compliance and security purposes. The configuration data read from your environment and the findings in your reports belong to you.

9. Third party services

The Service relies on third party platforms (including Microsoft, Google, GitHub, AWS, Cloudflare, and Stripe) that operate under their own terms and are outside our control. We are not responsible for the availability, accuracy, or actions of those third party services.

10. Disclaimer of warranties

The Service is provided "as is" and "as available" without warranties of any kind, whether express or implied, including any implied warranties of merchantability, fitness for a particular purpose, and non infringement. We do not warrant that the Service will be uninterrupted, error free, or that the findings will detect every issue in your environment.

11. Limitation of liability

To the maximum extent permitted by law, LockList will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of data, profits, or goodwill, arising out of or related to your use of the Service. Our total liability for any claim relating to the Service will not exceed the amount you paid to LockList for the Service in the three months preceding the claim.

12. Indemnification

You agree to indemnify and hold LockList harmless from any claims, damages, or expenses arising from your misuse of the Service, your violation of these Terms, or your assessment of any environment you were not authorized to assess.

13. Changes and termination

We may modify or discontinue the Service, and may update these Terms, at any time. Material changes will be reflected by updating the date above. Continued use of the Service after changes take effect constitutes acceptance. We may suspend access for any use that violates these Terms.

14. Governing law and international use

LockList Security LLC is organized under the laws of, and operates from, the State of Montana, United States. These Terms are governed by the laws of the State of Montana and the applicable laws of the United States, without regard to conflict of law rules. To the extent permitted by law, any dispute arising out of or relating to the Service will be brought exclusively in the state or federal courts located in Montana, and you consent to their jurisdiction.

The Service is offered from the United States and may be accessed from other countries. If you use the Service from outside the United States, you do so on your own initiative and are responsible for complying with your local laws, including any data protection, export, or authorization requirements that apply to you or the environment you assess. Nothing in these Terms removes any mandatory consumer protection rights you may have under the laws of your country of residence, and where those rights conflict with this section, they prevail to the extent required.

15. Contact

Questions about these Terms? Email admin@locklistsecurity.com.