Terms of Use

Last Updated: 01.10.2026

1. Applicability.

These terms of use ("TOU") and the privacy policy, available at https://ctrl.shift.security/privacy/ ("PP" together with the TOU, the "Terms") govern the website available at https://www.shift.security/ (the “Site”) of Shift Security, Inc. and its affiliates ("Company"), and include, without limitation: (i) the publicly available vendor directory and the individual vendor profile pages published on the Site, including risk scores, letter grades, pillar and sub-signal grades, AI Posture grades, GRC compliance information and questionnaire responses based on publicly available evidence, breach history entries and supply-chain indicators (collectively, the “Ratings”); (ii) vendor search and look-up functionality; (iii) the vendor scoring methodology; and (iv) the Shift MCP server(the “MCP Server”), and any other content as may be added by the Company from time to time (“Content”, together with the Site, the “Services”) which is made available to you ("User"). These Terms constitute the entire and only agreement between Company and User with respect to the Services. By attempting to use and/or by using the Services, or any part thereof, User agrees to fully comply with and be bound by the Terms. If User does not accept the Terms, or any part thereof, User must not access and use the Services, or any part thereof, and immediately stop any use of the Services.

2. Purpose of the Directory; Nature of the Ratings.

This Section 2 sets out the nature, scope and limitations of the Ratings and is integral to the proper understanding and use of the Services.

2.1. Purpose. Company publishes the Ratings free of charge in order to make information that is already publicly available about the security posture of software vendors easier to find, compare and act upon.

2.2. Public sources only. The Ratings are derived from information that is publicly available, including external exposure and breach scanning data, leaked-credential datasets, CVE and KEV vulnerability feeds, certifications and verifiable attestations, attestations and trust-centre materials, publicly available AI information, and comparable sources.

2.3. Methodology. The Ratings are produced by applying a documented methodology, published on the Site and consisting of five weighted pillars and their constituent sub-signals, uniformly to every entity covered by the directory. The pillars, their weights and the sub-signals that feed them are published on the Site.

2.4. Factual Data and Calculated Results. The Ratings comprise two distinct kinds of statement. First, the individual data points are factual assertions drawn from the sources described above, presented as at the date and time stated on the relevant profile page. Second, the numeric scores, letter grades, pillar grades and sub-signal grades are Company’s calculated results, generated by applying the published methodology to those disclosed public signals and data points. Every such result is based solely on the public signals and data points disclosed on the profile page of the relevant vendor and on the published methodology, and does not state, imply or rest upon any undisclosed fact about any rated entity.

2.5. What a Rating is not. A Rating is not, and must not be relied upon or represented as: (i) a certification, accreditation, audit, attestation, penetration test or assessment of a rated entity’s actual security controls; (ii) a statement that any rated entity is or is not secure, is or is not compliant with any standard, has suffered any undisclosed compromise, or has acted negligently or improperly; (iii) a representation as to the completeness or currency of any rated entity’s security programme, which Company has no ability to observe from outside; (iv) an endorsement, a recommendation to enter into, decline, continue or terminate any commercial relationship; or (v) legal, financial, procurement, insurance or investment advice.

2.6. Outside-in only; point in time. The Ratings are an outside-in description of how a rated entity appears from publicly observable signals at a point in time. They do not, and cannot, describe a User’s own exposure to that entity, including which of the User’s personnel hold access and at what privilege, which integrations, tokens or credentials are live in the User’s environment, or whether any incident affecting the rated entity touches the User’s data. User must not treat a Rating as a measure of User’s own risk.

2.7. Independence; no payment for Ratings. Company has no contractual relationship with, and receives no payment, consideration or other benefit from, any rated entity in respect of that entity’s inclusion in the directory or its Rating. Rated entities do not pay for coverage, placement, score, grade, favourable treatment or removal. Claiming a profile, requesting an assessment, disputing a finding or engaging with Company commercially does not and will not change any Rating other than through the correction process provided on the Site.

2.8. Third-party names, marks and logos. Names, logos and other trade marks of rated entities and other third parties appear on the Site solely to identify the entity to which the relevant information relates. All such marks remain the property of their respective owners. Their appearance does not indicate any affiliation with, sponsorship by, endorsement by or approval from the owner, and no such affiliation or endorsement should be inferred.

3. Disputes.

Company provides mechanisms on the Site through which vendors may contest a finding and report an issue.

3.1. Contest a Finding. A vendor may dispute a specific finding through the “Contest a Finding” form on the Site, identifying the finding in question, describing what is inaccurate and, where possible, supplying supporting evidence. The form also requires a contact email. Company will only respond to forms which include all of the required information. Company makes reasonable efforts to respond to disputes within seventy-two (72) hours.

3.2. Report an Issue. General reports of errors, misattribution or other issues concerning the Site or the Ratings may be submitted through the “Report an Issue” link on the Site or to the address in Section 15.8.

4. Representations.

By using the Services User represents that (i) User is not under 18 years of age; (ii) User is authorized to use the Services, (iii) User agrees to be bound by the terms of the TOU.

5. Modification; Termination.

Company may, from time to time modify these TOU. Any amended TOU will come into effect when posted on the Site. If User does not agree to the TOU, as amended, User must stop using the Services, otherwise User will be deemed to have accepted the TOU, as amended. Without limiting any rights of Company under this TOU, it shall be clarified that Company is entitled to always, in its sole discretion, without notice, block User's access to the Services or terminate or disable User's use of the Services. Further, Company reserves the right to terminate or modify the Services, in whole or in part, in any manner at Company’s sole discretion, without notice. Company will not be liable if, for any reason, all or any part of the Services are unavailable at any time or for any period of time.

6. Permitted Use of the Ratings; Attribution.

Subject to the Terms, User may view and may share individual Ratings.

6.1. Where User shares a profile by using any “Share profile” function, User must reproduce it accurately and unaltered, and include or link to the published methodology.

6.2. User must not: (i) present a Rating as a statement of fact about a rated entity’s actual security, as a certification, or as an audit conducted by Company or by User; (ii) strip, obscure or contradict the qualifications and disclosures in Section 2; (iii) present a superseded Rating as current; (iv) combine, adjust or re-weight Ratings and continue to attribute the result to Company; or (v) use any Rating to harass, threaten, disparage or extract commercial advantage from a rated entity otherwise than in the course of genuine risk assessment.

7. Restrictions.

User shall not, and shall not permit any third party to: (i) copy, modify, translate, display, disclose, distribute, sell, license, sub-license or create derivative works of any Content, save as expressly permitted under Section 6; (ii) extract, re-utilise, scrape, harvest or otherwise obtain all or a substantial part of the Content or of the underlying database, whether by a single act or by the repeated and systematic extraction of insubstantial parts, or build or assist in building any competing dataset, directory or rating product from the Content; (iii) use the Content to train, fine-tune, evaluate or ground any machine-learning model, other than transient use by User’s own agents acting in accordance with Section 8; (iv) disrupt, or place unreasonable load on, servers or networks connected to the Site; (v) use or launch any automated system (including without limitation “robots”, “spiders” and headless browsers) to access the Site; (vi) circumvent, disable, probe, scan or otherwise interfere with security-related features of the Site; (vii) misrepresent the content, date or source of any Rating; or (viii) use the Services in breach of any applicable law, including any applicable data protection, anti-discrimination, consumer-reporting or competition law.

8. User Submissions.

Certain features of the Site allow User to submit content to Company, including dispute descriptions, supporting evidence files, assessment requests, access requests and issue reports (“Submissions”).

8.1. User represents and warrants that each Submission is accurate to the best of User’s knowledge, is made in good faith, is not defamatory, misleading, infringing or otherwise unlawful, does not contain confidential information that User is not entitled to disclose, and contains no personal data of any third party beyond the minimum necessary for Company to assess the Submission.

8.2. User grants Company a worldwide, non-exclusive, royalty-free, perpetual and irrevocable licence to use, store, reproduce and act upon each Submission for the purposes of operating the Services, investigating and resolving disputes and improving the accuracy of the Ratings, and to publish it where Company has indicated that the relevant Submission will be published.

9. Ownership.

All title, ownership rights, and intellectual property rights (including all copyrights, patents, trade secret rights and trademarks) in and to the Content (except for the Third Party Content, as defined below), shall remain the sole and exclusive property of Company, its affiliates, or their respective licensors, if any. User agrees that nothing contained in the Services shall be construed as transferring any ownership right and/or granting a license to any intellectual property right, unless otherwise explicitly set forth herein. Without limiting the foregoing, the Ratings, the scoring methodology, the pillar and sub-signal structure and the selection, compilation and arrangement of the directory as a whole are Company’s own work and, as between Company and User, Company’s exclusive property.

10. Public Source Information.

The Ratings may incorporate public signals and information from third-party sources, including trust centres, certification registries, public disclosures, third-party feeds, registries and scanning providers (“Third Party Information”). Company does not control such third-party sources and does not guarantee the accuracy or completeness of the information they provide. Alleged inaccuracies may be submitted to Company through the process described in Section 3.

11. Indemnity.

User agrees to indemnify, defend, and hold Company and its affiliates, licensors, officers, directors, employees, consultants, agents and representatives (collectively, “Indemnified Party”) harmless from any and all claims, losses, damages, liabilities, actions, or demands, and associated costs and expenses (including without limitation attorneys' fees) arising out of User's: (i) use of the Services; (ii) use of any Third Party Content and/or any other interaction with third parties through the Services; (iii) violation of the terms hereof; (iv) violation of any third party’s rights; (v) reproduction, redistribution or characterisation of any Rating otherwise than in accordance with Section 6; (vi) any Submission; or (vii) any decision taken by User or by any third party in reliance on any Rating. Company reserves the right, at such User's expense, to assume the exclusive defense and control of any matter of indemnification by User hereunder. User shall cooperate fully as reasonably required in the defense of any claim.

12. Disclaimer and Warranties.

USER UNDERSTANDS AND AGREES THAT USER'S USE OF THE SERVICES ARE AT USER'S OWN RISK. COMPANY'S SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. COMPANY AND ITS AFFILIATES EXPRESSLY DISCLAIM ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. COMPANY DOES NOT WARRANT THAT THE CONTENT OR ANY RATING IS ACCURATE, COMPLETE, CURRENT OR FREE FROM ERROR, THAT ANY UNDERLYING DATA SOURCE IS ACCURATE OR COMPLETE, OR THAT ANY RATING IS CORRECTLY ATTRIBUTED TO THE INTENDED ENTITY OR DOMAIN. COMPANY GIVES NO WARRANTY, EXPRESS OR IMPLIED, THAT ANY RATED ENTITY IS SECURE, IS COMPLIANT WITH ANY STANDARD OR LAW, HAS NOT SUFFERED OR WILL NOT SUFFER ANY SECURITY INCIDENT, OR IS SUITABLE FOR ANY PURPOSE. THE RATINGS ARE PREPARED WITHOUT KNOWLEDGE OF USER’S ENVIRONMENT, REQUIREMENTS OR RISK TOLERANCE. USER IS SOLELY RESPONSIBLE FOR ITS OWN DUE DILIGENCE AND FOR ANY DECISION IT TAKES.

13. Limitation of Liability.

IN NO EVENT SHALL COMPANY BE LIABLE TO USER OR ANY THIRD PARTY FOR ANY PUNITIVE, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES, WHETHER BASED ON WARRANTY, CONTRACT, TORT, OR ANY OTHER LEGAL THEORY. WITHOUT LIMITING THE FOREGOING, COMPANY SHALL HAVE NO LIABILITY FOR ANY LOSS OF PROFIT, REVENUE, BUSINESS, CONTRACT, GOODWILL OR REPUTATION, OR FOR ANY LOSS ARISING OUT OF ANY PROCUREMENT, CONTRACTING, PRICING, INSURANCE OR OTHER DECISION TAKEN IN RELIANCE ON ANY RATING, WHETHER BY USER OR BY ANY THIRD PARTY. NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN, COMPANY'S AGGREGATE LIABILITY TO USER OR ANY THIRD PARTY HEREUNDER SHALL NOT EXCEED US$100.

14. Miscellaneous.

14.1. To the extent that the Services, or any portion thereof, conflict with the TOU, the TOU shall prevail.

14.2. Company's failure to enforce any provision of the TOU shall not be deemed a waiver of such provision nor of the right to enforce such provision.

14.3. Company's rights under the TOU shall survive any expiration or termination of the TOU.

14.4. The TOU shall be governed by the laws of the State of New York without regard to the principles of conflict of law. The courts of the State of New York shall have exclusive jurisdiction to adjudicate any dispute arising out of the TOU. This Section binds Company and User only; it confers no rights on, and does not restrict the rights of, any person who is not a party to the TOU. Each party irrevocably waives any right to trial by jury and any right to bring or participate in any claim on a class or representative basis. Any claim arising out of or relating to the Services must be brought within one (1) year after the cause of action accrues.

14.5. If any provision of the TOU is held to be invalid, illegal or unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, or if it cannot be so modified, severed, and the remaining provisions shall continue in full force and effect.

14.6. User may not assign or transfer the TOU or any rights under it. Company may assign the TOU freely. The TOU confers no rights on any person who is not a party to it, and nothing in the TOU is intended to create, or shall be construed as creating, any duty, warranty or undertaking owed by Company to any rated entity or to any other third party.