Terms of use: NexusGRC Compliance for Jira

1. Parties and definitions

These terms are between Abdelilah Cherkaoui, an individual based in Morocco, identified in the legal notice below ("we", "us") and the organisation that installs the app on its Atlassian site ("you").

• App: NexusGRC Compliance for Jira, the Atlassian Forge app described on its Marketplace listing.
• Site: the Atlassian Jira site on which the app is installed.
• Customer data: the content and the personal data that you and your users enter in the app or that the app creates from it.
• Edition: Standard or Advanced.

2. License

Subject to these terms, we grant you a limited, non-exclusive, non-transferable, non-sublicensable license to install and use the app on your site for your internal business purposes, for as long as your subscription or trial is active. The edition you may use is the one carried by your Atlassian license; you see it in the "Manage apps" page of Jira, not in the app. We keep all rights not granted here. The app and its content are proprietary; no source code is licensed to you.

Purchase through Atlassian. You obtain the app, its trial and its subscription through the Atlassian Marketplace. Prices, billing, payment, renewals and refunds are handled by Atlassian under the Atlassian Marketplace terms that apply to your purchase; these terms govern your use of the app.

3. Editions, trial and inactive license

• The app comes in two editions. Standard covers the assessment, the action plan, evidence (including free Jira queries), risks, the light asset register, audits, access reviews, monitoring, e-mail reminders, the policy editor with flowcharts and Word and PDF files, and import and export with Excel templates. Advanced adds the AI assistant, the audit pack, the Jira Service Management evidence presets, the reading of Jira Service Management Assets, several active frameworks at once and custom roles.
• Trial and price: the conditions are those shown on the Marketplace listing when you install the app. During a trial, the AI assistant is limited to a preview: 100,000 tokens for the whole trial (section 6).
• Without an active license (expired, cancelled or absent) the app becomes read-only: you can still open and read every screen and download your evidence files, and every change is refused. Your data is not deleted. Routine clean-up continues: files uploaded and never attached, old reminder entries, and the roles of closed accounts.
• In a Forge development or staging environment, where Forge provides no license object, the app opens with the Advanced edition so that it can be tried.

4. What you may not do

You may not, and you may not let others:

1. copy, modify, translate or create derivative works of the app or of its content, except as the law allows despite this clause;
2. reverse engineer, decompile or try to extract the source code of the app, except as the law allows despite this clause;
3. rent, sell, sublicense or provide the app to a third party as a service;
4. bypass, disable or tamper with the license, edition or budget checks of the app;
5. use the app to break the law, to infringe the rights of others, or to store content you have no right to store;
6. upload files that contain malware, or try to reach data of another customer or of another site;
7. use the app in breach of the terms of Atlassian that apply to your site.

5. Customer data

• You own your Customer data. You give us the right to process it only to provide the app to you, as the privacy policy and the data processing agreement describe.
• You are responsible for the content you enter, for having the right to enter it, and for the lawful basis of the personal data it contains. The app does not read the content of files you upload.
• The app keeps its data in the Forge storage of your site and in Jira; it has no server of ours. We run no server that receives the data the app stores: only the app's code, running in Atlassian Forge, processes it. We see function logs (counts and codes only) and whatever you choose to send us for support. The one request that reaches a site we run is the gadget thumbnail (privacy policy, section 3).
• Data handling at the end of the relationship is in section 13.

6. AI assistant (Advanced edition)

• The assistant is part of the Advanced edition and uses Forge LLMs, a service of Atlassian. It has 12 functions: tasks, policies, flowcharts, risks, controls, the Statement of Applicability, evidence and tests. For a request, the app sends the text of the one object the person asks about, as the privacy policy lists, section 4. It never sends the content of evidence files, the audit log, access reviews, or the register of people, vendors and incidents. Before sending, it removes e-mail addresses, web addresses, account identifiers and mentions, and replaces the people the object names (owner, approver, assignees, the person asking) by their role.
• Anything your users type in a title, a description, a note or a policy text is sent. The name of a colleague or a third party written in free text is not recognised and is sent as typed; do not put in these fields what you do not want the model to receive.
• The output is a suggestion that you must check. It may be incomplete, out of date or wrong. It is neither stored nor applied by the app, and you decide what to do with it. It is not legal, audit or certification advice.
• The publisher sets a token budget for the whole app: 750,000 tokens a month by default for each installation, of which one person can use at most 40%. During a 30-day trial the budget is 100,000 tokens for the whole trial. You cannot change it or switch the assistant off inside the app. Past the budget, or if the publisher sets the budget to 0, the app answers with a standard answer computed without a model. There is no top-up.
• The service behind the assistant belongs to Atlassian. Where it processes requests, how long it keeps them and whether it uses them for training are not established for this app.
• We do not promise that the assistant, or the model behind it, will be available or unchanged.

7. Framework content, and no affiliation

• The framework content in the app (titles, summaries, evidence examples, mappings between ISO 27001 and SOC 2, assessment questions, monitor definitions) is written by us in our own words. Requirement codes (for example A.5.15 or CC6.1) are references that let you find the requirement in the official document. They are not official text.
• "ISO", "IEC" and "AICPA" are used only to name the documents that our content refers to. We are not affiliated with, endorsed by or certified by ISO, IEC or the AICPA. If you need the official requirements, obtain the standards from their publishers: the app does not replace them.
• Atlassian, Jira, Forge and Confluence are trademarks of Atlassian. NexusGRC Compliance for Jira is an independent app and is not endorsed by Atlassian.

8. The app does not certify anyone

The app helps you prepare for an audit and track your own work. It is not an auditor, a certification body or a legal adviser. It does not certify, attest or guarantee that you meet ISO 27001, SOC 2 or any other standard, and using it does not make an organisation compliant or certified. The app lists what to remove after an access review; it never changes an access itself.

9. Third-party platform

The app runs only on Atlassian Forge and works inside Jira. Its availability depends on Atlassian's services and on your use of them, and we are not responsible for them. Atlassian's terms govern your use of Jira and Forge. Atlassian is not a party to these terms and is not responsible for the app, its support or its maintenance.

10. Warranty

To the extent the law allows, the app and its content are provided "as is" and "as available". We give no warranty of merchantability, of fitness for a particular purpose, of non-infringement, of uninterrupted or error-free operation, or that the app will help you pass an audit or obtain a certification. We do not state that the app is certified or independently tested.

Some Atlassian platform features that the app uses are, at the date of this page, in Atlassian's "Preview" stage: the storage of evidence files, the workflow validator and a filter on the trigger that reacts to ticket changes. Atlassian may change or withdraw a Preview feature, and we give no commitment on the availability of these features, evidence files included.

11. Limitation of liability

To the extent the law allows:

• neither party is liable for indirect or consequential loss, including loss of profit, revenue, business, goodwill or data, or the cost of a substitute service;
• our total liability arising from the app or these terms, whatever its basis, is limited to the amounts you paid for the app in the twelve months before the event that gave rise to it, or one hundred euros (EUR 100) if you paid nothing, for example during a trial;
• you remain responsible for keeping your own exports of your data (section 13) and for checking what the app and its AI assistant produce before relying on it.

These limits do not apply to liability that the law does not allow to be limited or excluded, in particular for fraud or gross negligence, which article 232 of the Moroccan Code of Obligations and Contracts does not allow to be excluded in advance, and for death or personal injury.

12. Support and security

Support is described on the support page. To report a vulnerability, use the channel described there.

13. Term, termination and what happens to your data

• You may stop at any time by cancelling the subscription or uninstalling the app. We may end your license for a material breach of these terms that you do not remedy within a reasonable period set out in our written notice.
• Before uninstalling, you may export your data: the "Your data" block of the "Audit pack" page gives a zip of CSV files, settings and a manifest, in every edition; evidence files are downloaded separately in the app.
• On uninstallation, Forge first deletes the app's data "softly"; Atlassian then destroys it at the end of the retention period of its Standard Data Retention and Disposal policy, which Atlassian documents in its SOC 2 report. If a reinstallation is requested within 21 days, Atlassian can relink it to the old data. Reinstalling restores nothing automatically. The tickets the app created in Jira, with their property and labels, stay in your Jira.
• An inactive license does not delete your data. Routine clean-up continues: files uploaded and never attached, old reminder entries, and the roles of closed accounts.
• Sections 5, 7, 8, 10, 11 and 14 survive termination.

14. General

• Changes. We may update these terms; we will publish the updated terms on this page and change the date shown at the top. A change that reduces your rights applies from your next renewal, unless the law or Atlassian requires it earlier.
• Order of precedence. For personal data, the data processing agreement prevails over these terms.
• Severability. If a clause is held invalid, the rest of these terms stays in force and the clause is replaced by a valid one as close as possible to its purpose.
• Assignment. You may not transfer these terms without our written consent. We may transfer them to a successor of the app, with notice to you.
• Force majeure. Neither party is liable for a failure caused by an event beyond its reasonable control, within the meaning of articles 268 and 269 of the Moroccan Code of Obligations and Contracts, including an outage of Atlassian's services.
• Governing law and courts. These terms are governed by Moroccan law, excluding the United Nations Convention on Contracts for the International Sale of Goods. Before going to court, the parties will try for 30 days to settle a dispute in good faith. Failing that, the commercial court of Rabat, Morocco, has exclusive jurisdiction, unless a mandatory rule gives jurisdiction to another court.
• Contact. contact@nexusgrc.net.

15. Legal notice

Publisher: Abdelilah Cherkaoui, an individual based in Salé, Morocco, not registered as a company at the date of this page. Contact: contact@nexusgrc.net. Publication director: Abdelilah Cherkaoui. The app runs on Atlassian Forge (Atlassian); this website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States.