Last Updated: April 14, 2026

Welcome to Cardinalsbyte GRC Intelligence Platform (the "Platform"). These Terms of Service ("Terms") govern your access to and use of the website hosted and any associated services, tools, or AI-driven insights provided by Northeast Cybersecurity Service LLC | CardinalsByte ("we," "us," or "our").

By accessing or using the Platform, you agree to be bound by these Terms. If you do not agree, do not use the Platform.

​

Users are prohibited from reverse-engineering, decompiling, or attempting to extract the source code of this software.  © 2026 Northeast Cybersecurity Services LLC  | CardinalsByte GRC Intelligence Platform V2.1.8. All rights reserved. Proprietary and Confidential.
 

1. Nature of Service; No Professional Advice

Northeast Cybersecurity Service LLC | CardinalsByte provides a Governance, Risk, and Compliance (GRC) tool.

• Not Legal Advice: The Platform provides automated insights, risk scoring, and compliance mapping. These are for informational purposes only and do NOT constitute legal, financial, or professional cybersecurity advice.

• User Responsibility: You are solely responsible for verifying that your use of the Platform meets your specific regulatory requirements (e.g., SOC2, HIPAA, GDPR)

​

2. AI, LLM, and Agentic Behavior Disclosure

The Platform utilizes Large Language Models (LLMs) and autonomous "Agentic" workflows to process data and generate reports.

• AI Hallucinations: You acknowledge that AI-generated content may occasionally be inaccurate, incomplete, or biased.

• Human-in-the-Loop: We strongly recommend that all AI-generated GRC outputs be reviewed by a qualified human professional before being implemented.

• Non-Reliance: We are not liable for any damages resulting from actions taken based on autonomous AI suggestions.

• Users must authorize each specific action the Agent takes

​

2.1. Assumption of Risk for Hallucinations. You acknowledge that the Platform acts as a "Decision Support Tool," not a "Decision Maker." All outputs, including compliance scores and risk assessments, are "drafts" produced by Large Language Models. You agree that Human-in-the-Loop (HITL) verification is a mandatory condition of using this Platform. You waive any claim against [Northeast Cybersecurity Service LLC | CardinalsByte] for damages resulting from unverified AI outputs.

​

2.2 . Adversarial Limitations. > You agree not to attempt "prompt injection," "jailbreaking," or other adversarial attacks designed to bypass the Platform's safety filters. Northeast Cybersecurity Service LLC | CardinalsByte] is not liable for data leakage or system errors resulting from the Subscriber’s intentional attempt to manipulate the AI’s foundational logic

​

3. Intellectual Property & Copyright Protection

This section protects your "asset" from being stolen.

• Ownership: We own all rights, titles, and interests in the Platform, including the source code (React/Next.js/Supabase architecture), database schemas, "look and feel" of the UI, and original AI prompting logic.

• Copyright: The Platform and its original content are protected by U.S. and international copyright laws.

• Restrictions: You may not (and may not allow others to):

  • Reverse engineer, decompile, or attempt to extract the source code.

  • Use "scraping" bots or AI-training crawlers to harvest our data.

  • Create a "derivative work" that competes with Northeast Cybersecurity Service LLC | CardinalsByte using our proprietary logic

​

4. User Data & Privacy

• Ownership of Your Data: You retain all rights to the raw data you upload to the Platform.

• License to Use: By uploading data, you grant us a limited license to process it solely to provide the GRC services to you.

• Security: While we use industry-standard hosting (Vercel/Supabase), no platform is 100% secure. You use the platform at your own risk regarding data breaches.

​

5. Prohibited Conduct

You agree not to use the Platform to:

• Upload malware or malicious code.

• Attempt to "jailbreak" or bypass the LLM safety filters.

• Use the tool to conduct unauthorized "pen-testing" or attacks against third parties.

​

6. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY NEW YORK LAW, [CARDINALBYTE] SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES, INCLUDING LOSS OF PROFITS, DATA, OR SECURITY BREACHES ARISING FROM YOUR USE OF THE PLATFORM. OUR TOTAL LIABILITY SHALL NOT EXCEED THE AMOUNT YOU PAID US IN THE LAST SIX MONTHS.
 

7. Disclaimer of Warranties

The Platform is provided "AS IS" and "AS AVAILABLE." We disclaim all warranties, including the implied warranties of merchantability and fitness for a particular purpose. We do not guarantee that the AI outputs will be 100% error-free. We are not responsible for outages or data leaks caused by our third-party infrastructure providers (Vercel and Supabase).

​

8. Governing Law & Jurisdiction

These Terms are governed by the laws of the State of New York. Any disputes shall be resolved exclusively in the courts located in Westchester County,  New York.

9. Changes to Terms

We reserve the right to modify these terms at any time. We will notify you by updating the "Last Updated" date at the top of this page. Your continued use of the Platform after changes are posted constitutes acceptance of the new terms.

​

10. New York Regulatory Compliance
Section 11. NYDFS & Audit Logging. > In accordance with NYDFS Part 500 guidance, the Platform maintains audit logs of AI Agent activities. We reserve the right to provide these logs to you or regulatory bodies upon legal request to satisfy compliance mandates. You agree that your use of the Platform is a "Material Change" to your cybersecurity posture that you must record in your own Risk Assessment.

11. Professional Confidentiality & Privilege Waiver
11.1. No Professional Relationship: [Northeast Cybersecurity Service LLC | CardinalsByte] is a technology provider, not a CPA firm, Law Firm, or Financial Institution or any other entity. Use of the Platform does not create a fiduciary relationship between us and your clients.

 

11.2. Waiver of Privilege (The Heppner Rule): Under recent New York case law (United States v. Heppner, 2026), the disclosure of client information to an AI platform may be viewed by courts as a "disclosure to a third party." This can waive (destroy) the Accountant-Client privilege or Attorney-Client privilege.

• Your Responsibility: As a CPA, Banker, or Professional, you must determine if uploading "Non-Public Personal Information" (NPI) to our AI workflows violates your professional ethics or privilege rules.

• Work Product: We do not guarantee that reports generated by our AI Agents will be protected from discovery in a lawsuit.

​

11.3. Circular 230 & Professional Ethics: Tax professionals acknowledge that under IRS Circular 230, they maintain "Due Diligence" obligations. You agree that the AI's output does not replace your professional judgment. You must "verify" all tax or compliance positions generated by the Platform before presenting them to the IRS or clients.

 

12. Multi-State Regulatory Responsibility

12.1. User Jurisdiction: While [Northeast Cybersecurity Service LLC | CardinalsByte] is located in New York, we recognize that your clients may be located in other states (e.g., California, Colorado, Texas). 

12.2. Direct Liability for State Laws: You (the Subscriber) are solely responsible for ensuring your use of our GRC tool complies with the specific privacy laws of your clients' home states, including but not limited to:

• CCPA/CPRA (California)

• CPA (Colorado)

• VCDPA (Virginia)

• State-specific Banking or Telecom Privacy Acts.

 

12.3. Data Protection Indemnity: If a state regulator (like the California Privacy Protection Agency) fines you because you processed a resident's data through our AI in a way that violates their specific state law, you agree that [Northeast Cybersecurity Service LLC | CardinalsByte] is not responsible. You are the "Data Controller," and we are merely the "Service Provider."

 

The Platform does not perform 'Solely Automated Decision-Making' that produces legal or significant effects. All 'Non-Compliant' flags or 'Risk Scores' are subject to a Mandatory Human Appeal process controlled by the Subscriber

13. No Agency Relationship (The "Agentic" Disclaimer)
13.1. Tool, Not Agent. You acknowledge that while the Platform utilizes "Agentic" workflows, [Northeast Cybersecurity Service LLC | CardinalsByte] is not your agent, representative, or fiduciary. The Platform does not have the authority to bind you to any legal or regulatory positions.

​

13.2. Human Approval Required. You agree that any "Action" or "Decision" suggested by the AI (e.g., filing a report, approving a risk level) is void until a human user manually reviews and "Signs Off" on the action within the Platform. You assume 100% liability for any AI-suggested actions you authorize.

14. Data Training & Privacy

14.1. No Training on Client NPI. [Northeast Cybersecurity Service LLC | CardinalsByte] represents that it does not use your "Non-Public Personal Information" (NPI) or your clients' sensitive tax/banking data to train our foundational models.
 

14.2. User Warning. Despite Section 13.1, you acknowledge that under United States v. Heppner (2026), the act of transmitting data to a third-party AI provider may still be viewed by courts as a waiver of confidentiality. You use this service with the full understanding of this judicial trend in the State of New York.

15. Output Ownership & Non-Guarantee

15.1. License to Outputs. [Northeast Cybersecurity Service LLC | CardinalsByte] claims no ownership over the specific reports generated for your clients. However, the templates, logic, and "prompts" used to create those reports remain the exclusive intellectual property of [Northeast Cybersecurity Service LLC | CardinalsByte].

15.2. No Guarantee of Regulatory Acceptance. We do not guarantee that any report generated by this tool will be accepted as "Compliant" by the IRS, SEC, NYDFS, or any other regulatory body.

​

15.3 Subscriber acknowledges that [Northeast Cybersecurity Service LLC | CardinalsByte] uses Supabase for database management and Vercel for hosting. We do not maintain physical servers. You agree that our responsibility for 'Chain of Custody' is limited to the security configurations we control within these third-party Enterprise environments.
 

16. Professional Due Diligence & Audit Responsibility:
This tool is an 'Administrative Assistant,' not a 'Certifying Officer.' CPAs and Accountants acknowledge that use of this tool does not satisfy their 'Due Diligence' requirements under IRS Circular 230 or AICPA Ethics Rules unless the outputs are independently verified by the Subscriber. [Northeast Cybersecurity Service LLC | CardinalsByte] is not liable for professional malpractice claims resulting from unverified AI-generated reports.

16.1. Not an Audit Opinion. [Northeast Cybersecurity Service LLC | CardinalsByte] is an "Audit-Readiness" tool designed to assist in the organization and mapping of compliance data. The Platform does not provide an audit opinion, attestation, or certification of any kind.

​

16.2. CPA/Banker Responsibility. CPAs, Accountants, and Financial Professionals acknowledge that under AICPA SSTS No. 1 and IRS Circular 230, they maintain a non-delegable duty to exercise due diligence. You agree that the Platform’s AI-generated mapping, risk scores, and gap analyses are "suggestive only" and must be verified by a qualified professional.

​

16.3. No Malpractice Liability. [Northeast Cybersecurity Service LLC | CardinalsByte] shall not be liable for any professional malpractice, regulatory fines, or "Material Weakness" findings resulting from the Subscriber’s failure to independently verify the Platform’s outputs

​

17: Sub-Processors.

Subscriber acknowledges that [Northeast Cybersecurity Service LLC | CardinalsByte] utilizes Google Cloud (Gemini) and Famous AI as sub-processors. We maintain Data Processing Agreements (DPAs) with these providers to ensure data is not used for foundational model training. You agree to these third-party flows as a condition of using the Platform.

​

We are not liable for delays or failures caused by the unavailability of third-party AI APIs, 'model collapses,' or rate-limiting by Google or Famous AI or Supabase or Vercel.

​

The Platform organizes and maps evidence provided by the Subscriber. [Northeast Cybersecurity Service LLC | CardinalsByte] does not guarantee the authenticity of uploaded documents and is not responsible for detecting "deepfakes" or AI-manipulated evidence provided by the Subscriber or their clients.

​

18 Algorithmic Transparency & Explainability: Pursuant to the NY RAISE Act (2026), the Company provides an "Explainability Dashboard" within the Platform. Subscriber acknowledges that this dashboard provides a summary of the logic and regulatory data sources used to generate specific GRC outputs. Subscriber agrees that this summary satisfies the Company’s legal duty for transparency and that the underlying proprietary weights and "Prompt Chains" remain protected Trade Secrets.

19. Adversarial Defense & Red-Teaming: The Company performs recurring "Adversarial Red-Teaming" to identify and mitigate AI-specific vulnerabilities, such as "Indirect Prompt Injection" and "Training Data Poisoning." Subscriber acknowledges that cybersecurity is an evolving field and that the Company’s proactive testing does not constitute a "Guarantee of Invulnerability." Subscriber is encouraged to maintain separate E&O insurance that specifically includes "AI-Risk Riders.

 

AI-Origin Labeling: To comply with California EO N-5-26 and emerging federal standards, all frameworks and WISPs generated by the Platform may contain invisible metadata or digital "watermarking" identifying the content as AI-generated. Subscriber shall not attempt to strip or remove these digital identifiers, as they are required to maintain the "Provenance and Authenticity" of the document for regulatory audits

​

Security LIST:
 

• That you use Supabase (for encrypted database storage).

• That you use Vercel (for secure hosting).

• That you do not store passwords in plain text.

Provider utilizes Enterprise-grade Gemini Workspace instances. Customer Data is never used for training foundational models