Last updated: October 14, 2026
1. Who we are and what these Terms cover
These Terms are an agreement between you and Cyber Strategy Institute Inc. (“CSI,” “we,” “us”), 1207 Delaware Ave #3397, Wilmington, DE 19806.
They cover the website at cyberstrategyinstitute.com and its subdomains, agency-check.app, our free tools and assessments, downloadable resources, and the paid services we sell online (together, the “Services”).
Some Services have their own schedule, which is part of these Terms:
Schedule A covers the Strategic Certainty Session.
Schedule B covers our hosted MCP Services: AI SAFE² MCP, Agency Check, and any future hosted MCP server that links to it.
Schedule C covers everything else sold through our checkout: digital downloads, courses and training, memberships, and other subscriptions.
If a schedule conflicts with these Terms, the schedule controls for that Service. If you have a signed agreement with CSI (a master services agreement, statement of work, order form, or government contract), that agreement controls over both.
2. Accepting these Terms
You accept these Terms when you use the Services, check the box at checkout, or connect an MCP client to a CSI server. If you accept on behalf of an organization, you confirm you have authority to bind it, and “you” means that organization.
3. Eligibility
You must be at least 18 years old. You may not use the Services if you are on a U.S. government restricted-party list, or if you are located in, or ordinarily resident in, a country or region subject to comprehensive U.S. sanctions. You agree to follow U.S. export control laws that apply to anything you receive from us.
4. Accounts, tokens and keys
Some Services use an account, an access token, or an API key. Keep them confidential, and tell us promptly at policy@cyberstrategyinstitute.com if you think one has been exposed.
A free token is limited to one per person.
An individual paid token is for one named person. It may not be shared, pooled, or placed behind a gateway, proxy, or shared service that lets other people use it.
A team token covers the users named on the order.
No token may be published, resold, or embedded in software you distribute.
We may revoke and reissue any credential to protect you or the Services.
5. Acceptable use
You agree not to:
use the Services to break the law, or to attack, probe, or disrupt any system you are not authorized to test;
try to bypass rate limits, tier limits, authentication, or any security control on a Service;
reverse engineer or extract the hosted Services, except as the license of an open-source component allows;
send automated traffic at a volume that degrades the Services for others;
submit another person’s personal information unless you have the right to share it;
use outputs of the Services to train a model or build a dataset that competes with them;
misrepresent CSI’s involvement, or present our outputs as a certification, audit opinion, or endorsement.
6. Open-source materials
AI SAFE², the Cognitive Sovereignty Framework, CryptoSHIELD, the safe2 CLI, and other repositories we publish are licensed under the license file in each repository. Nothing in these Terms limits the rights those licenses give you. The hosted Services, our website content, and our names and logos are not open source.
7. Our intellectual property
We own the Services, our website content, our methods, scoring models, rulesets, templates, and our names and logos. We give you a limited, non-exclusive, non-transferable right to use the Services as these Terms allow. If you send us feedback, we may use it without obligation to you.
8. Your content
You keep ownership of what you submit, including intake answers, prompts, code, documents, and text you ask us to check. You give us permission to host, process, and transmit it only as needed to provide the Services to you, keep them secure, and meet legal duties. Schedule B sets stricter limits for the hosted MCP Services.
9. Information, not professional advice
Our outputs are decision support. That includes assessment scores, maturity ratings, Decision Cards, MCP findings, compliance mappings, and Session deliverables. They are not legal, financial, tax, or investment advice. They are not a compliance certification, audit opinion, penetration test, or guarantee that any system, person, or business is secure or honest. Our Services can miss things. You make the final decision and you own the outcome. For legal or financial decisions, consult a licensed professional.
10. Third-party services
The Services work with products we do not control, including MCP clients and AI assistants (such as Claude, Cursor, Codex, and Meta’s Muse), and the providers that run our checkout, payments, client portal, and hosting (such as SamCart, Stripe, SuiteDash, and Cloudflare). Their own terms govern their products. CSI is independent and is not affiliated with, endorsed by, or sponsored by any of them unless we say so in writing.
11. Payments
Prices are shown on the order page at the time you buy. Our checkout at secure.cyberstrategyinstitute.com runs on SamCart; some Services take payment through Stripe. You authorize us and those payment processors to charge your payment method for the amounts shown, plus applicable taxes. Refunds, cancellations, and renewals are set in the schedule for each Service. Before opening a payment dispute, contact us at policy@cyberstrategyinstitute.com; most issues resolve faster that way.
12. Privacy
Our Privacy Policy explains how we handle personal information. For the hosted MCP Services, the data commitments in Schedule B apply, and where they are stricter than the Privacy Policy, Schedule B controls. Business customers can request a data processing addendum at policy@cyberstrategyinstitute.com.
13. Disclaimers
To the extent the law allows, the Services are provided “as is” and “as available.” We disclaim all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement. We do not promise the Services will be uninterrupted or error-free, or that they will catch every risk.
14. Limitation of liability
To the extent the law allows:
neither party is liable to the other for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or data; and
CSI’s total liability for all claims relating to the Services is limited to the amount you paid CSI for the Service giving rise to the claim in the 12 months before the claim, or $100 if you used only free Services.
These limits do not apply where the law does not permit them.
15. Indemnity
If a third party brings a claim against CSI because of content you submitted or your breach of Section 5, you agree to cover CSI’s reasonable costs and losses from that claim. This section does not apply to consumers where local law prohibits it.
16. Suspension and termination
You may stop using the Services at any time. We may suspend or end your access if you breach these Terms, if your use creates a security risk, or if the law requires it. Where practical, we will give notice first. Sections 5 through 9, 13 through 15, 17, 19, 20 and 21 survive termination.
17. U.S. Government users
If you acquire a Service for or on behalf of a U.S. federal, state, or local government entity, your contract or purchasing instrument controls. Any provision of these Terms that applicable law prohibits for that entity, such as open-ended indemnity, automatic renewal, or a choice of governing law, does not apply to it to the extent prohibited. Our software and documentation are commercial products and commercial computer software as defined in the Federal Acquisition Regulation.
18. Changes to these Terms
We may update these Terms. We will post the new version on this page with a new “Last updated” date. For paid subscriptions, we will email you at least 30 days before a material change, and the change applies to you from your next renewal, not during a term you have already paid for. Continued use of free Services after an update means you accept it.
19. Governing law and disputes
Delaware law governs these Terms, without regard to conflict-of-laws rules. Before filing any claim, each side agrees to send the other a written notice and try in good faith to resolve it for 30 days. After that, claims go to the state or federal courts located in New Castle County, Delaware, and both sides consent to that jurisdiction. Either side may bring an individual claim in small claims court. Either side may seek urgent injunctive relief in any competent court to protect its intellectual property or confidential information.
20. General
These Terms, the schedules, and any order you place are the entire agreement on their subject. You may not assign these Terms without our consent; we may assign them in a merger, acquisition, or sale of assets. Neither side is liable for delays caused by events beyond its reasonable control. If a provision is unenforceable, the rest stays in effect. A failure to enforce a right is not a waiver.
If you are a consumer in the European Union, the United Kingdom, or another place with mandatory consumer protections, nothing in these Terms limits the rights those laws give you. When you ask for immediate access to digital content or a digital service, you agree that we may begin right away, and you acknowledge that, where the law allows, your right to withdraw from the purchase ends once delivery begins.
21. Free assessments, tools and downloads
Our free assessments (including the AI Governance, Engineered Certainty, CNAPP, and Maritime Compliance assessments), free tools, and downloadable resources are Services under these Terms, and their results are decision support under Section 9.
When you complete an assessment, we use your answers to produce your results, to follow up with you about them, and to build de-identified, aggregated benchmarks that never identify you or your organization. We keep assessment responses for 24 months, then delete them. You can ask us to delete them sooner at policy@cyberstrategyinstitute.com.
You may use downloaded resources inside your organization. You may not resell them, or republish them as your own.
22. Email, newsletter and text messages
Transactional messages (receipts, access details, scheduling, security notices, and changes to these Terms) are part of the Services. They continue while you have an active purchase or subscription.
Marketing email and our newsletter are sent only if you opt in. Every message has an unsubscribe link, and we honor it within 10 business days.
Text messages. We send marketing texts only to numbers whose owner opted in through a separate consent. Consent is never a condition of a purchase. Message frequency varies. Message and data rates may apply. Reply STOP to cancel or HELP for help. Carriers are not liable for delayed or undelivered messages.
We do not sell or rent your email address or phone number.
23. Contact
Cyber Strategy Institute Inc., 1207 Delaware Ave #3397, Wilmington, DE 19806
Email: policy@cyberstrategyinstitute.com
Web: cyberstrategyinstitute.com/contact-us/
Schedule A: Strategic Certainty Session
This schedule applies when you buy a Strategic Certainty Session (the “Session”). It is part of the CSI Terms of Service.
A1. What you are buying
A fixed-fee, fixed-scope advisory engagement made up of:
an intake questionnaire you complete (about 15 to 20 minutes);
an AI-assisted preliminary analysis of your answers, reviewed personally by Vincent Sullivan;
one 60-minute live Session, held by video call and led by Vincent Sullivan;
a written Strategic Certainty Brief, including a governance maturity baseline, top five findings, a regulatory alignment snapshot, and a prioritized 90-day roadmap, delivered within 10 business days after the Session.
The Session uses the current published versions of AI SAFE² and the AI Sovereignty Maturity Model (AISM).
A2. What is not included
The Session does not include enterprise-wide audits, penetration testing, code review, architecture redesign, policy development, control implementation, compliance certification, legal opinions, or continuous monitoring. We do not access your systems or install anything. Any of that work requires a separate written agreement.
A3. Scheduling and expiry
You will receive the intake questionnaire and a scheduling link after purchase. The Session must take place within 90 days of purchase. We will grant one 30-day extension if you ask before the deadline. If the Session is not held by the deadline, it expires without refund, but only if we offered you at least three available time slots within that period. If we did not, you receive a full refund.
A4. Cancellation, rescheduling and refunds
Before you submit the intake questionnaire: cancel for a full refund by emailing policy@cyberstrategyinstitute.com. The questionnaire counts as submitted when you press its final submit button; saved drafts do not count.
After you submit the intake questionnaire: preparation has started, so the fee is non-refundable. You may reschedule once at no charge with at least 48 hours notice.
No-show: if you miss the Session without at least 24 hours notice, the Session is forfeited.
If we cancel or cannot deliver: we will offer a new time. If we cannot hold the Session within the expiry period, or do not deliver the Brief, we will refund the fee in full. That refund is your sole remedy for non-delivery.
A5. What you need to provide
You agree to give accurate intake answers and to bring the decision-makers who need the findings. Do not share any of the following in the intake or the Session unless we agree in writing first:
classified information;
Controlled Unclassified Information (CUI) or export-controlled technical data;
protected health information, payment card data, or government identification numbers;
credentials, secrets, or keys.
The Session is designed to work from a description of your environment, not from sensitive data.
A6. AI-assisted analysis
We process your intake answers with third-party AI tools to prepare the preliminary analysis. We use providers whose terms prohibit training their models on our customers’ data. Vincent Sullivan reviews that analysis before the Session, and every finding in your Brief is reviewed by a person before delivery.
A7. Confidentiality
We treat your intake answers, Session discussion, and Brief as confidential. We use them only to deliver the Session and the Brief. We do not disclose them except to service providers bound by confidentiality who help us deliver, or where the law requires. This duty lasts three years after delivery, and indefinitely for anything that is a trade secret. It does not cover information that is public, that you already shared without restriction, or that we develop independently.
A8. De-identified research use
We may combine de-identified findings from many Sessions into aggregate research, such as AISM benchmark reports. Nothing published will identify you or your organization. You can opt out at any time by emailing policy@cyberstrategyinstitute.com; your opt-out applies to every publication after we receive it.
A9. Recording
Sessions are not recorded unless both sides agree in writing before the call.
A10. Your rights in the Brief
You may use, copy, and share the Brief inside your organization and with your advisers, auditors, insurers, board, and regulators. CSI keeps ownership of its frameworks, methods, templates, and scoring models, including AI SAFE² and AISM. You may not publish the Brief, or describe it as a CSI certification or endorsement, without our written consent.
A11. No ongoing commitment
The Session is complete when the Brief is delivered. Neither side has any further obligation. Implementation work, if you want it, is quoted and contracted separately.
Schedule B: Hosted MCP Services
This schedule applies to CSI’s hosted Model Context Protocol servers (the “MCP Services”): AI SAFE² MCP (Free, Pro, Team, and Enterprise tiers), Agency Check (free checks, paid tiers, and the optional Decision Report), and any other hosted MCP server CSI operates that links to this schedule. It is part of the CSI Terms of Service.
Software you install locally, such as the @aisafe2/mcp package or the safe2 CLI, is governed by the license in its repository. This schedule covers the hosted endpoints, tokens, and outputs.
B1. What the MCP Services do, and what they never do
Agency Check reviews only what you or your agent send to it, and returns a Decision Card: what is supported, what is still unknown, and one next step. Agency Check:
never contacts anyone, blocks anything, buys, sends, books, cancels, or acts on your behalf;
never gives a score and never calls anything “safe”;
shows every finding a check identifies on the free card. The paid Decision Report adds depth; it never holds back a red flag.
No Decision Card state, including “Ready to review,” means an action is safe, approved, or recommended. A check can only weigh what it was given, and it can miss things.
AI SAFE² MCP classifies agents, scores risk, maps controls to frameworks, and, on paid tiers, reviews implementations against AI SAFE² controls. It reports; it does not change your code, approve a release, or deploy anything.
B2. You and your agent stay in control
Your MCP client or AI agent decides what to send us and what to do with our output. We do not control it. Our outputs are built for a human decision. If you configure an agent to act on our outputs automatically, you do so at your own risk, and you remain responsible for what your agent does.
B3. What happens to what you send
Content: zero retention. Content (text, quotes, drafts, forms, code, and anything else you submit for a check or review) is processed in memory only to produce your output. It is never written to storage, logs, or analytics. While we process it, we treat it as your confidential information.
Receipts. Agency Check issues signed receipts for each check. A receipt holds cryptographic hashes and the outcome, never the content you shared. We keep receipts for 90 days so you can retrieve them.
No secondary use. We do not sell your content, use it for advertising, or use it to train AI models. We do not take referral fees or commissions from any business, product, or person that a check reviews.
AI providers. The MCP Services do not send your content to third-party AI models. If that changes, we will update this schedule before the change takes effect.
Security metadata. To prevent abuse, investigate incidents, and identify attack trends, we log request metadata: time, client or token identifier, tool called, ruleset version, response status, and network address. We keep it for 90 days, then delete it. It never contains the content you submitted.
Aggregate metrics. We derive counts and trends from that metadata, such as how often each check module fires. Aggregates contain no network address, token, or content, and we keep them for up to 3 months, the limit set by our analytics provider, then they are deleted.
Account and billing data for paid tiers is handled under our Privacy Policy.
Service providers. We run the MCP Services on Cloudflare. Paid tiers use SamCart or Stripe for payment, and SuiteDash for account and token delivery. These providers process data only to run their part of the service.
B4. Plans, billing and cancellation
Free tiers cost nothing. We may change their limits or end them with 30 days notice.
Paid subscriptions (AI SAFE² MCP Pro, Agency Check paid tiers, and any future MCP subscription) renew automatically each month or year, at the price shown at purchase, until you cancel.
Cancel before your renewal date to avoid the next charge. You can cancel online at any time from the subscription link in your purchase receipt, or by emailing policy@cyberstrategyinstitute.com. Cancellation takes effect at the end of the paid period. We do not give partial refunds for unused time.
Reminders and price changes. We email a reminder at least 15 days before each annual renewal, and give at least 30 days notice of a price change.
Feature reductions. If we materially reduce a paid subscription’s features during a paid term, you may cancel and receive a prorated refund for the unused time.
Agency Check Decision Report is a one-time purchase. If the report fails to generate, we will refund it.
Team and Enterprise tiers are governed by an order form, which controls over this schedule.
B5. Tokens and limits
Token rules are in Section 4 of these Terms. Usage limits for each tier are shown on the product page. We may throttle traffic that exceeds them, and may revoke a token that is exposed, shared, or abused.
B6. Versions, availability and changes
We version our rulesets and controls, and where an output identifies its version, that version is the one that produced it. We may update rulesets, controls, and tools at any time to improve accuracy or security. The MCP Services have no uptime commitment unless an Enterprise order form includes one.
B7. Independence
Agency Check works with Meta’s Muse and with other agents as a connector. It is not made by, affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. Muse is a trademark of Meta. The same applies to any MCP client you use with AI SAFE² MCP.
B8. Security research
We welcome good-faith security research on the hosted MCP endpoints. Report findings to policy@cyberstrategyinstitute.com and give us reasonable time to fix them before disclosure. Stop at proof of concept. Do not access other users’ data, degrade the service, or use social engineering. This safe harbor covers the hosted MCP endpoints only. It does not cover CSI’s website, checkout, client portal, internal systems, or any third-party provider. We will not pursue legal action against research that follows these rules.
Schedule C: Other checkout purchases
This schedule applies to anything you buy through our checkout that is not covered by Schedule A or B, including digital downloads (templates, checklists, guides, reports), courses and training, memberships, bundles, and order bumps or upsells. It is part of the CSI Terms of Service.
C1. Delivery
Access is delivered by email or through our client portal after payment clears. Courses may be hosted on a third-party learning platform, whose terms also apply to your use of it.
C2. Your license
You get a non-exclusive, non-transferable license to use the product inside your own organization, or for personal use if you bought as an individual. You may adapt templates for internal use. You may not resell the product, share login access, redistribute it, or publish it as your own.
C3. Refunds
Digital downloads are final once delivered. If a file is defective or never arrives, tell us within 14 days and we will replace it or refund you.
Courses and training: full refund within 14 days of purchase if you have completed less than 20% of the content.
Memberships and subscriptions follow the renewal, cancellation, and reminder rules in Schedule B4.
Bundles, bumps and upsells are separate purchases; each follows the rule for its type.
Request a refund at policy@cyberstrategyinstitute.com with your order number.
C4. Payment plans
If you buy on a payment plan and a payment fails, we may pause access until the balance is current. You remain responsible for the remaining payments.
C5. Offer-specific terms
If a product page or checkout states different terms for that offer, those terms apply to that offer and control over this schedule.