1. Agreement to Terms
These Terms of Service ("Terms") govern access to and use of the traceunified application lifecycle management platform operated by traceunified ("traceunified," "we," "us," or "our"), including all associated websites, APIs, applications, features, documentation, and support (collectively, the "Service"). Document version 2026-10-11.
By accessing or using the Service, clicking to accept these Terms, or completing account registration, you agree to be bound by these Terms on behalf of yourself and the organization you represent ("Customer," "you," or "your"). If you do not have authority to bind that organization, or if you do not agree, you must not use the Service.
If your organization has a separately executed master subscription agreement, order form, or data processing addendum with traceunified (an "MSA"), that MSA controls in the event of a conflict with these Terms for the subjects it covers. The Data Processing Addendum at https://traceunified.com/legal/dpa applies to Personal Data processing. These Terms apply to all other users and uses of the Service.
Legal notices: legal@traceunified.com. Security: security@traceunified.com. Website: https://traceunified.com.
2. Definitions
"Customer Data" means data, content, files, configurations, and records submitted to or generated in the Service by or for Customer, including requirements, tests, risks, architecture artifacts, comments, attachments, and similar work product.
"Personal Data" means information relating to an identified or identifiable natural person that is processed in connection with the Service.
"Security Incident" means a confirmed unauthorized access to, or acquisition, disclosure, alteration, or destruction of, Customer Data or Personal Data in traceunified's possession or control that compromises the confidentiality, integrity, or availability of that data.
"Authorized Users" means individuals Customer permits to access the Service under Customer's account, including employees, contractors, and auditors.
3. Description of the Service
traceunified provides a multi-tenant, cloud-based platform for managing requirements, tests, risks, architecture, traceability, reviews, training records, and related quality and compliance artifacts for regulated and high-assurance industries.
The Service is designed to support organizations subject to frameworks such as FDA 21 CFR Part 11, ISO 13485, IEC 62304, and similar standards. traceunified provides software and technical controls; Customer remains solely responsible for its own regulatory compliance, computer system validation, quality management system, and determination that the Service is fit for Customer's intended use.
The Service is offered on a business-to-business basis. It is not a consumer product and is not intended for personal, household, or consumer use.
4. Accounts, Access, and Authentication
Access requires an account provisioned by Customer's administrator or through an approved single sign-on (SSO), directory synchronization (SCIM), or invitation workflow. Customer is responsible for designating administrators, configuring roles and permissions, enabling available security controls (including SSO enforcement and multi-factor authentication where offered), and promptly deprovisioning users who no longer require access.
Authorized Users must keep credentials confidential and use strong authentication practices. Customer is responsible for all activity under its accounts and those of its Authorized Users, whether or not authorized by Customer, except to the extent caused solely by traceunified's breach of these Terms.
Customer and Authorized Users must notify traceunified at security@traceunified.com and Customer's administrator promptly upon becoming aware of any unauthorized access to an account, lost or stolen credentials, or suspected compromise of authentication mechanisms. traceunified is not liable for loss arising from unauthorized use that results from Customer's or an Authorized User's failure to safeguard credentials or to configure available security controls.
5. Acceptable Use
Customer and Authorized Users will not: (a) attempt to gain unauthorized access to the Service, other tenants, or related systems; (b) probe, scan, or test the vulnerability of the Service except under a written authorization from traceunified; (c) interfere with or disrupt the Service or its infrastructure; (d) circumvent access controls, rate limits, audit logging, or electronic signature controls; (e) reverse engineer, decompile, or attempt to derive source code except to the limited extent permitted by applicable law that cannot be waived; (f) use the Service to store or transmit unlawful, infringing, defamatory, or malicious content, or malware; (g) resell, sublicense, or provide the Service to third parties except as expressly permitted in an MSA; or (h) use the Service in violation of export, sanctions, or anti-corruption laws.
traceunified may suspend access immediately if it reasonably believes these Terms or the security or integrity of the Service are being violated, and will notify Customer of the suspension when practicable.
6. Customer Data and Ownership
As between the parties, Customer retains all right, title, and interest in Customer Data. traceunified does not claim ownership of Customer Data and processes it only to provide, secure, support, and improve the Service, to maintain audit and compliance records, and as otherwise permitted by the MSA, these Terms, or applicable law.
Customer grants traceunified a non-exclusive, worldwide, limited license to host, copy, transmit, display, and process Customer Data as necessary to operate the Service, including maintaining tamper-evident audit trails and electronic signature records required for regulated use.
Customer represents that it has all rights and consents necessary to submit Customer Data to the Service and that Customer Data does not violate law or third-party rights. Customer is solely responsible for the accuracy, quality, and legality of Customer Data and for any decisions made based on outputs of the Service.
7. Customer Security and Compliance Responsibilities
Customer is responsible for: (a) evaluating whether the Service meets Customer's security, privacy, and regulatory requirements before use; (b) configuring the Service appropriately for Customer's risk profile; (c) managing Authorized User access on a least-privilege basis; (d) maintaining its own policies, procedures, training, and validation documentation; (e) backing up or exporting Customer Data as needed for Customer's business continuity; and (f) promptly applying instructions traceunified provides regarding security updates or configuration changes that affect Customer's tenant.
Customer acknowledges that no information system can be guaranteed free of vulnerabilities or immune to sophisticated attacks, insider misuse, zero-day exploits, social engineering, or failures of third-party infrastructure. traceunified's implementation of commercially reasonable security measures does not constitute a warranty that a Security Incident will never occur.
8. Security Incidents and Breach Allocation
If traceunified becomes aware of a Security Incident affecting Customer Data, traceunified will investigate, take reasonable containment steps, and notify Customer's designated administrator without undue delay and no later than 72 hours after confirmation (or sooner if required by law or the DPA). Notification will describe, to the extent known: the nature of the incident, categories of data involved, likely consequences, and measures taken or proposed.
Notification of a Security Incident is not an admission of fault, liability, or that any particular law has been violated. traceunified's liability arising from a Security Incident is subject to the limitations and exclusions in Sections 14 and 15.
Customer is responsible for: (a) assessing whether the incident triggers Customer's own notification duties to regulators, patients, employees, or other third parties; (b) cooperating reasonably with investigation and remediation; and (c) securing Customer-controlled systems, identity providers, email, endpoints, and API keys that integrate with the Service. traceunified is not responsible for Security Incidents caused primarily by Customer's systems, credentials, misconfiguration, Authorized Users, or Customer's third-party identity or AI providers.
Customer should maintain cyber liability, business interruption, and other insurance appropriate to its use of regulated systems. Fees paid for the Service are not a substitute for insurance proceeds.
9. Data Integrity, Audit Records, and Electronic Signatures
The Service maintains audit trails and electronic records intended to support compliance with electronic records and electronic signature requirements. Audit records are designed to be tamper-evident and are retained according to Customer's configured policies and applicable contractual commitments.
Customer acknowledges that the integrity and legal sufficiency of regulated records depend on Customer's proper use of the Service, including account management, signature meaning, change notes, and adherence to Customer's standard operating procedures. traceunified does not warrant that use of the Service alone will achieve any particular regulatory approval or inspection outcome.
10. Artificial Intelligence Features
Certain optional AI-assisted features operate only when Customer supplies its own provider credentials (bring-your-own-key). Content submitted to those features is sent to the provider Customer has configured under Customer's own agreement with that provider. traceunified does not supply a platform AI key for Customer content and does not list Customer-chosen AI providers as traceunified subprocessors.
Customer is responsible for reviewing AI outputs before relying on them in regulated decisions. AI features may produce inaccurate or incomplete results and may be disabled by Customer's administrators.
11. Third-Party Services and Subprocessors
traceunified uses infrastructure and service providers ("Subprocessors") to host and operate the Service. The current list is published at https://traceunified.com/legal/subprocessors. Material changes are noticed at least 30 days in advance per the DPA. traceunified remains responsible for Subprocessors' performance of obligations traceunified owes under these Terms to the same extent as if traceunified performed those obligations itself, subject to the limitations of liability herein.
Third-party services Customer chooses to integrate (including identity providers, email transports, and AI providers) are governed by Customer's agreements with those parties. traceunified is not responsible for their acts, omissions, availability, or security practices.
12. Service Availability and Support
traceunified will use commercially reasonable efforts to make the Service available consistent with any service levels in an MSA. The Service may be unavailable due to scheduled maintenance, emergency security patches, infrastructure provider outages, denial-of-service attacks, internet failures, or other events beyond traceunified's reasonable control.
Credits or remedies for availability, if any, are solely as stated in an MSA. Except as expressly provided in an MSA, unavailability does not entitle Customer to damages beyond the liability limits in these Terms.
13. Intellectual Property
The Service, including software, interfaces, documentation, logos, and all related intellectual property, is owned by traceunified and its licensors. These Terms grant only a limited, non-exclusive, non-transferable right to use the Service during the subscription term in accordance with the applicable agreement. No rights are granted except as expressly stated.
Feedback Customer provides about the Service may be used by traceunified without restriction or compensation, provided that Feedback does not include Customer Data that Customer identifies as confidential.
14. Disclaimers
EXCEPT AS EXPRESSLY STATED IN AN MSA, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, TRACEUNIFIED DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.
TRACEUNIFIED DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS; THAT CUSTOMER DATA WILL NEVER BE LOST, ALTERED, OR ACCESSED WITHOUT AUTHORIZATION; OR THAT THE SERVICE WILL MEET ANY PARTICULAR REGULATORY, LEGAL, OR BUSINESS REQUIREMENT. TRACEUNIFIED DOES NOT PROVIDE LEGAL, REGULATORY, VALIDATION, OR QUALITY-SYSTEM ADVICE.
15. Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES; OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, DATA, OR BUSINESS OPPORTUNITY; OR FOR COST OF SUBSTITUTE SERVICES; WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
EXCEPT FOR A PARTY'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 16, A PARTY'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, OR CUSTOMER'S PAYMENT OBLIGATIONS, EACH PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THE SERVICE OR THESE TERMS WILL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO TRACEUNIFIED FOR THE SERVICE DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY. IF CUSTOMER HAS PAID NO FEES IN THAT PERIOD, LIABILITY IS LIMITED TO ONE HUNDRED U.S. DOLLARS (US $100).
THE FOREGOING LIMITATIONS APPLY TO CLAIMS ARISING FROM SECURITY INCIDENTS, UNAUTHORIZED ACCESS, DATA LOSS, SERVICE INTERRUPTION, AND REGULATORY OR INSPECTION OUTCOMES, TO THE MAXIMUM EXTENT PERMITTED BY LAW. SOME JURISDICTIONS DO NOT ALLOW CERTAIN LIMITATIONS; IN THOSE JURISDICTIONS, LIABILITY IS LIMITED TO THE MAXIMUM EXTENT PERMITTED.
16. Indemnification
Customer will defend, indemnify, and hold harmless traceunified and its officers, directors, employees, and agents from and against any third-party claims, damages, losses, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) Customer Data or Customer's use of the Service in violation of these Terms or law; (b) Customer's failure to obtain required consents or to fulfill Customer's obligations as a data controller or regulated entity; (c) Authorized Users' misuse of the Service; (d) Customer's combination of the Service with systems or content not provided by traceunified; or (e) claims that Customer Data infringes intellectual property or privacy rights.
If an MSA includes mutual intellectual-property indemnification by traceunified, that MSA controls for the claims it covers.
17. Confidentiality
Each party may receive non-public information from the other ("Confidential Information"). The receiving party will use Confidential Information only to perform under these Terms, protect it with reasonable care, and not disclose it to third parties except to personnel and advisors under confidentiality obligations or as required by law (with prior notice where legally permitted).
Customer Data is Customer's Confidential Information. The Service's non-public features, performance data, and security documentation are traceunified's Confidential Information. Obligations do not apply to information that is or becomes public through no fault of the receiving party, was independently developed, or was rightfully received from a third party without duty of confidentiality.
18. Term, Suspension, and Termination
These Terms apply while Customer or its Authorized Users access the Service. Subscription terms, renewal, and termination for convenience are governed by the MSA or order form where one exists.
traceunified may suspend or terminate access for material breach, non-payment, legal risk, or to protect the Service or other customers. Upon termination, Customer's right to use the Service ends. Customer Data handling after termination follows the MSA, data processing addendum, and Privacy Policy. Sections that by their nature should survive (including ownership, disclaimers, liability limits, indemnification, and governing law) will survive termination.
19. Export Controls and Sanctions
Customer will not use, export, or re-export the Service except as authorized by U.S. law and the laws of the jurisdiction in which the Service is used. Customer represents that it is not located in, and will not provide access to persons in, embargoed countries or on denied-party lists maintained by the U.S. government or other applicable authorities.
20. Force Majeure
Neither party is liable for delay or failure to perform due to causes beyond its reasonable control, including acts of God, natural disasters, war, terrorism, riots, embargoes, acts of civil or military authorities, fire, floods, accidents, pandemics, strikes, shortages of transportation, facilities, fuel, energy, labor, or materials, failure of public or private telecommunications networks, denial-of-service or similar attacks, or failures of cloud infrastructure providers, provided the affected party uses reasonable efforts to mitigate and resume performance.
21. Governing Law and Disputes
These Terms are governed by the laws of the State of Delaware, USA, without regard to conflict-of-law principles. Subject to any dispute-resolution process in an MSA, the state and federal courts located in Delaware will have exclusive jurisdiction, and each party consents to personal jurisdiction there.
Before filing a claim, the parties will attempt in good faith to resolve disputes by escalating to responsible executives for at least fifteen (15) days after written notice. Nothing prevents either party from seeking injunctive or other equitable relief to protect intellectual property, Confidential Information, or the security of the Service.
22. Changes to These Terms
traceunified may update these Terms from time to time. The effective date above will be revised when changes are posted. Material changes will be communicated through the Service or to Customer's administrator with reasonable advance notice where practicable. Continued use after the effective date of changes constitutes acceptance. If Customer does not agree, Customer must stop using the Service and may terminate per the MSA.
23. General
These Terms, together with any MSA, order forms, and data processing addendum, constitute the entire agreement between the parties regarding the Service and supersede prior or contemporaneous agreements on the same subject. If any provision is held unenforceable, the remainder remains in effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.
Failure to enforce a provision is not a waiver. Customer may not assign these Terms without traceunified's prior written consent, except to a successor in connection with a merger or sale of substantially all assets; traceunified may assign to an affiliate or successor. Notices to traceunified may be sent to legal@traceunified.com. Notices to Customer may be sent to Customer's administrators via the Service or the email addresses on file.
24. Contact
Legal questions: legal@traceunified.com. Security concerns and suspected incidents: security@traceunified.com. Privacy: privacy@traceunified.com. Website: https://traceunified.com.