Terms of Service

1.Who we are, and what these Terms cover

In plain terms: Chiaro is a product operated by Y Assurance PLLC, a licensed Texas CPA firm. These Terms cover the platform. An audit is a separate signed agreement.

These Terms of Service (the “Terms”) are an agreement between the organization you represent (“Customer,” “you,” or “your”) and Y Assurance PLLC (the “Firm,” “we,” “us,” or “our”), a Texas professional limited liability company and CPA firm licensed by the Texas State Board of Public Accountancy (Firm Registration No. C12398).

The Firm owns and operates Chiaro, the platform available at chiarohq.com (together with the Chiaro MCP server, the published control library and methodology content, the evidence vault, and related services, the “Platform”). These Terms govern your access to and use of the Platform, including the readiness features described in Section 4 (the “Readiness Service”).

These Terms do not govern audit, attestation, or advisory services. Those services are provided only under a separate engagement letter signed by you and the Firm (an “Engagement Letter”). If a signed Engagement Letter conflicts with these Terms, the Engagement Letter controls for the services it covers.

Throughout these Terms, the “In plain terms” notes are reading aids only. They summarize, but the full text of each section is what binds both of us.

2.What the Platform is

In plain terms: Chiaro publishes the audit methodology, your own AI does the work against it, and the platform stores your evidence and tracks your progress.

The Platform consists of:

The portal at chiarohq.com, where you manage your account, team, subscription, agreements, and progress;
The Chiaro MCP server, which your own AI tool connects to in order to receive methodology, submit evidence, and record progress;
The published methodology, the Firm’s control library of controls, test attributes, pass criteria, and evidence guidance; and
The evidence vault, storage for the records you choose to submit.

The Platform is built on a zero-access architecture: the Firm never connects to your systems, never receives your credentials, and never runs commands in your environment. Your own AI tool performs actions locally, with your approval, and only the material you choose to submit reaches the Platform. Section 12 covers this in detail.

3.Using the Platform does not make us your auditor

In plain terms: Creating an account is not hiring an auditor. That only happens when both of us sign an Engagement Letter.

Creating an account, subscribing, using the Readiness Service, communicating with us, or requesting a meeting does not, by itself, create an auditor-client, attest, or advisory relationship between you and the Firm. Such relationships are created only by a signed Engagement Letter.

4.The Readiness Service is not an audit

In plain terms: Readiness is software plus published methodology. Your AI and your team make every judgment. Nobody at the Firm reviews or scores anything during readiness, and readiness produces no opinion, report, or certification.

The Readiness Service is a software tool and a library of published methodology. It is not an audit, examination, attestation, review, or certification, and it does not result in any CPA opinion or report. No one at the Firm evaluates your evidence, verifies your controls, scores your readiness, or renders any professional judgment through the Readiness Service. Every assessment recorded through the Readiness Service is made by you or by the AI tool you operate, and every readiness indicator displayed on the Platform reflects your own self-assessment.

Accordingly:

A readiness score is not evidence of SOC 2 compliance and may not be presented to any third party as an audit result, a certification, or an endorsement by the Firm;
No third party may rely on Readiness Service outputs for any purpose;
Use of the Readiness Service does not guarantee any outcome of any later examination; and
An actual SOC 2 examination is a separate service, at a separate fee, under a signed Engagement Letter.

5.Website content is informational

In plain terms: Marketing pages, guides, and estimates are information, not promises.

Information published on chiarohq.com about services, methodology, timelines, pricing estimates, or expected outcomes is provided for general information and is not a contractual offer or commitment. Specific scope, deliverables, fees, and timelines for an examination are set out in the applicable Engagement Letter, which prevails over any website content.

6.Eligibility, accounts, and your team

In plain terms: You must be authorized to bind your company, keep your credentials safe, be honest about team size, and take responsibility for the people you invite.

You must be at least 18 years old and authorized to bind the organization you register. The account belongs to the organization, not the individual who opened it.

You may invite team members to your workspace (“Authorized Users”). You are responsible for: (a) keeping all credentials, connection tokens, and sign-in methods confidential; (b) all activity under your account and by your Authorized Users; and (c) ensuring your Authorized Users comply with these Terms. Notify us promptly at hello@chiarohq.com if you suspect unauthorized access.

Subscription pricing is tiered by the size of your team (Section 7). You agree to report your team size accurately at signup and to update it if it changes. If your team moves into a different tier, your plan price adjusts at the start of your next billing period.

7.Subscription plans and fees

In plain terms: The subscription is $49, $59, or $69 a month depending on team size. Annual billing is 20 percent less. Prices can change with at least 30 days notice, never mid-cycle. An audit is billed separately under its own engagement letter; buying one does not change or replace the subscription.

Platform access requires a paid subscription (the “Subscription”). Current plans, priced by team size:

Team size	Monthly	Annual (billed yearly, 20% off)
1 to 5 people	$49 / month	$468 / year
6 to 10 people	$59 / month	$564 / year
11 to 20 people	$69 / month	$660 / year
More than 20 people	Custom pricing, contact us

Fees are stated in U.S. dollars and are exclusive of taxes. You are responsible for applicable sales, use, or similar taxes, other than taxes on our income. Payments are processed by Stripe; we do not store your card number.

We may change Subscription pricing by giving you at least 30 days notice by email. Price changes take effect at the start of your next billing period after the notice period, never mid-cycle. If you do not accept a price change, you may cancel before it takes effect. If an audit engagement is in progress when a price change would take effect, your current pricing continues until that engagement concludes, and you may cancel then.

Audit fees are separate. Fees for audit services are set out in the signed engagement letter for that engagement (see Section 3) and are billed separately from, and in addition to, the Subscription. Starting or purchasing an audit does not cancel, pause, or modify your Subscription. Because audit engagements run on the Platform, your Subscription must remain active for the duration of any audit engagement: the Subscription cannot be canceled while an audit engagement is in progress, and you may cancel it (Section 8) once that engagement is completed, delivered, or terminated under its engagement letter.

8.Free trial, renewal, and cancellation

In plain terms: 30 days free with a card on file, then it converts to the plan you picked unless you cancel first. Cancel anytime from your account page in a couple of clicks; the one exception is while an audit is in progress, when the subscription stays active until the audit completes. Annual plans carry a 60-day money-back guarantee.

Trial. New subscriptions begin with a 30-day free trial. A valid payment method is required to start the trial, but you are charged $0 at signup. Unless you cancel before the trial ends, your Subscription starts automatically at the end of the trial and your payment method is charged the price of the plan and billing cycle you selected at signup. We state this at the point of signup, and we will send a reminder email before your trial converts.

Renewal. Subscriptions renew automatically at the end of each billing period (monthly or annual) until canceled.

Cancellation. You may cancel at any time from your account page in the portal, or by emailing hello@chiarohq.com. Cancellation takes effect at the end of the current billing period; you keep access until then. One exception: while an audit engagement is in progress, the Subscription must remain active and cannot be canceled (Section 7); cancellation becomes available again when that engagement is completed, delivered, or terminated under its engagement letter. If you cancel during the trial, you are never charged. Except as stated in this Section 8 or required by law, payments are non-refundable and we do not prorate partial periods.

60-day money-back guarantee (annual plans). If you purchase an annual plan and are not satisfied, tell us within 60 days of your first annual charge and we will refund that charge in full and cancel the Subscription. This guarantee applies once per organization, to the first annual charge only.

Non-payment. If a renewal charge fails, we will notify you and retry. If payment is not received within 14 days of notice, we may suspend Platform access until the balance is paid.

9.Your data

In plain terms: Your data is yours. We use it only to run the service for you. Our data-handling commitments live in the Privacy Policy and the Data Processing Addendum.

“Customer Data” means the data, records, and evidence artifacts submitted to the Platform by you, your Authorized Users, or the AI tool you operate. As between the parties, you own Customer Data.

You grant the Firm a non-exclusive, worldwide license to host, process, transmit, and display Customer Data solely to (a) provide and secure the Platform and related support, (b) comply with law and applicable professional standards, and (c) as otherwise instructed by you. We do not sell Customer Data and we do not use it for advertising.

Our Data Processing Addendum is incorporated into these Terms by reference and governs the processing of personal data within Customer Data, including our subprocessor list. Our Privacy Policy describes our data practices. AI providers we use are accessed through APIs configured so that your content is not used to train their models.

We may use aggregated, de-identified usage data (which does not identify you, your personnel, or your systems) to operate, secure, and improve the Platform and methodology.

Export and deletion. You may export your evidence vault at any time while your Subscription is active and for 30 days after it ends. After that window we may delete Customer Data held on the Platform, except records we are required to retain under law or professional standards (see Section 10).

10.Confidentiality, and the records a CPA firm must keep

In plain terms: We keep your information confidential. One caveat that comes with hiring a CPA firm: engagement workpapers are ours and must be kept for at least five years, and regulators and peer reviewers can inspect them.

Each party will protect the other’s non-public information with at least reasonable care, use it only in connection with the Platform and the services, and disclose it only to personnel and service providers bound by comparable obligations. This does not apply to information that is public, already known without duty, independently developed, or rightfully received from a third party. A party may disclose information where required by law, with notice to the other party where lawful.

If the Firm performs services for you under an Engagement Letter, workpapers and engagement records prepared by the Firm are the Firm’s property and are retained for a minimum of five years, as required by AICPA professional standards and Texas Administrative Code §501.76. You cannot require their deletion. Workpapers may be inspected by peer reviewers and regulators (including the Texas State Board of Public Accountancy) under their own confidentiality obligations; such access is required by professional standards and is not a breach of these Terms.

11.Acceptable use

In plain terms: Don’t break the law with it, don’t break it, don’t misrepresent what it tells you, and don’t use it to clone it.

You agree not to:

Use the Platform to violate law or infringe another party’s rights;
Probe, disrupt, overload, or attempt to gain unauthorized access to the Platform or another customer’s data;
Submit malicious code or content you have no right to share;
Misrepresent Readiness Service outputs as an audit result, certification, or Firm endorsement (Section 4);
Resell, sublicense, or provide the Platform to third parties as a service bureau; or
Use the Platform or the published methodology to build or train a competing product or model, except as expressly permitted by an open-source license that accompanies specific published content.

We may suspend access immediately where reasonably necessary to address a security risk or a material breach of this Section, and will restore access when the issue is resolved.

12.Your AI tool and the MCP connection

In plain terms: Your AI runs on your machines, under your approval, at your cost. We never get your credentials. You are responsible for what your AI does, and everything you submit must be real and yours.

The Platform is designed to be used through an AI tool that you select, license, and operate (for example, a terminal AI agent or an AI assistant that supports MCP connections). You acknowledge and agree that:

Local execution. Your AI tool runs in your environment. Commands it executes are executed by you, on your systems, under your supervision and approval. The Firm does not access your systems and does not receive your credentials.
Your responsibility. The Firm is not the provider of your AI tool. You are responsible for your AI tool’s acts, outputs, and costs, for reviewing what it does before approving it, and for your agreement with its vendor.
Connection security. Connection tokens and authorized OAuth grants are credentials for your workspace. Keep them confidential and revoke them from the portal when no longer needed.
Evidence integrity. You agree to submit only genuine, unaltered records that belong to your organization. Submitting fabricated, altered, or third-party records as your own is a material breach and grounds for immediate termination; in connection with an examination it can also have professional and legal consequences.

13.Our intellectual property, and your license

In plain terms: We own the platform and the methodology. You get a license to use them while subscribed. Anything we open-source comes with its own license, which governs it.

The Platform, the published methodology, and all related software and content are the intellectual property of the Firm or its licensors. During your Subscription you receive a non-exclusive, non-transferable license to access and use the Platform and methodology for your internal business purposes in accordance with these Terms. No other rights are granted.

Components or content that the Firm publishes under an open-source license are governed by that license, which controls over this Section for those components. Open-source licenses cover the published code or content only: they do not grant rights to the hosted Platform, and no license is granted under these Terms or any open-source license to use our names, logos, or trademarks.

If you send us feedback or suggestions, we may use them without restriction or obligation, and we will not publicly attribute them to you without your consent.

14.Third-party services and beta features

In plain terms: We build on reputable providers, and sometimes ship features marked beta. Betas can change or disappear.

The Platform relies on third-party providers (hosting, storage, payments, email, AI processing) listed in the Data Processing Addendum’s subprocessor schedule. Your AI tool is also a third-party service governed by its own terms. We select providers carefully but are not responsible for their independent acts or omissions.

Features identified as beta, preview, or early access are provided for evaluation, may change or be withdrawn at any time, and carry no service-level commitment.

15.Disclaimers

In plain terms: The platform is provided as-is. It doesn’t promise any audit outcome, and a readiness score is your self-assessment, not our verdict.

The Platform is provided “as is” and “as available.” To the maximum extent permitted by law, we disclaim all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Platform will be uninterrupted or error-free.

Nothing in these Terms is a warranty or prediction of the outcome, content, or sufficiency of any examination or other attest service, and nothing in the Readiness Service constitutes a professional opinion of the Firm. Attest work product is governed exclusively by the applicable Engagement Letter and professional standards.

16.Limitation of liability

In plain terms: For platform issues, our liability is capped at what you paid us in the last 12 months, and neither of us is liable for indirect losses. The audit has its own liability terms in the Engagement Letter.

To the maximum extent permitted by law: (a) neither party is liable for indirect, incidental, consequential, special, or punitive damages, or for lost profits, lost business, or loss of data or reputation, arising out of or relating to the Platform or these Terms; and (b) the Firm’s aggregate liability arising out of or relating to the Platform or these Terms shall not exceed the Subscription fees you actually paid to the Firm in the 12 months preceding the event giving rise to the claim.

These limitations do not apply to a party’s willful misconduct or fraud, to your payment obligations, or to liability that cannot be limited by law. Liability arising from services under an Engagement Letter is addressed exclusively in that Engagement Letter.

17.Indemnification

In plain terms: If your misuse of the platform or false information you supply gets us sued, you cover it.

You will defend and indemnify the Firm against third-party claims, and resulting damages and reasonable costs, arising from (a) your breach of these Terms, (b) your misuse of the Platform, (c) Customer Data you had no right to submit, or (d) your knowing misrepresentation or material omission in information provided to the Firm. We will notify you promptly of any such claim and reasonably cooperate at your expense.

18.Term, termination, and survival

In plain terms: These Terms run while you have an account. Either side can end them; you can export your data for 30 days after.

These Terms apply from the date you accept them and continue while you maintain an account. You may terminate by canceling your Subscription and closing your account, subject to the audit exception in Section 8 (an in-progress audit engagement must conclude first). We may terminate for material breach that remains uncured 15 days after notice, or immediately for a breach of Sections 11 or 12 (evidence integrity), and may otherwise terminate with at least 30 days notice, in which case we will refund any prepaid fees for the period after termination.

On termination, your access ends and the data-export window in Section 9 applies. Sections that by their nature should survive do survive, including Sections 4, 9, 10, 13, and 15 through 21.

19.Governing law and disputes

In plain terms: Texas law, Travis County courts.

These Terms are governed by the laws of the State of Texas, without regard to conflict-of-laws principles. Any dispute arising out of or relating to these Terms or the Platform will be brought exclusively in the state or federal courts located in Travis County, Texas, and each party consents to their jurisdiction.

20.Changes to these Terms

In plain terms: If we change these Terms in a way that matters, you get 30 days notice by email before it applies to you.

We may update these Terms from time to time. For material changes, we will give you at least 30 days notice by email or prominent notice in the portal before the change takes effect for existing customers. Your continued use of the Platform after the effective date constitutes acceptance. If you do not accept a material change, you may cancel before it takes effect. If an audit engagement is in progress, the prior Terms continue to govern until that engagement concludes, and you may cancel then.

21.General terms

In plain terms: The usual closing mechanics: what controls over what, notices, assignment, severability.

Order of precedence. If these documents conflict, they control in this order: (1) a signed Engagement Letter and its addenda, for the attest services they cover; (2) an executed Business Associate Agreement, for protected health information; (3) the Data Processing Addendum, for personal-data processing; (4) these Terms, including the Consent to Electronic Records and Signatures they incorporate; (5) website content, which is informational only.

Entire agreement. These Terms, together with the documents they incorporate by reference, are the entire agreement between you and the Firm regarding the Platform.

Notices. We send notices to your account email; keep it current. You may send notices to us at hello@chiarohq.com.

Assignment. You may not assign these Terms without our written consent. The Firm may assign these Terms to an affiliate or successor in connection with a merger, acquisition, corporate reorganization, or sale of assets, with notice to you.

Publicity. Neither party will use the other’s name or logo publicly without written consent.

Severability; waiver; force majeure. If a provision is unenforceable, the rest remain in effect. Not enforcing a provision is not a waiver. Neither party is liable for delay or failure caused by events beyond its reasonable control, except payment obligations.

22.Contact

General: hello@chiarohq.com · Privacy: privacy@chiarohq.com · Engagement and agreements: cpa@chiarohq.com