Terms of service

Version 0.2 · Effective October 31, 2026 · Draft pending counsel review

These terms are an agreement between you and TrustBox LLC of Chicago, Illinois ("TrustBox", "we"). They cover trustbox.dev and the TrustBox service: the trust centers we host at tbox.page addresses and on customers' own domains, the customer admin at app.trustbox.dev, and their APIs. If you accept them for a company or agency, you confirm you're allowed to. Questions: legal@trustbox.dev.

Who they cover

• Customers: cloud service providers who subscribe to TrustBox to run a trust center for a FedRAMP offering, and the people they add to their account.
• Agency users: federal users who sign in to a customer's trust center or call its API.
• Visitors: anyone who reads trustbox.dev or a public trust center page.

If you're a customer, our subscription terms also apply to you. They cover plans, prices, billing, renewal, late payment and cancellation. Our privacy policy says what personal data we collect and why.

What TrustBox is

TrustBox hosts a trust center for one FedRAMP offering. It publishes the offering's public FedRAMP information as a web page and as FedRAMP's JSON format, gives verified federal users access to the agency-only certification data the customer uploads, logs that access, and gives the customer the records FedRAMP's Certification Data Sharing rules ask for.

What we promise about FedRAMP, and what we don't

• The service is built to support FedRAMP's Certification Data Sharing rules for trust centers. We publish which rules the platform supports and how.
• Many of those rules are the provider's to meet, not ours. You decide what you share, with whom and how it's marked (Responsible Information Sharing, CDS-CSO-RIS). You prepare your certification reports and Ongoing Certification Reports and publish them on time (CDS-CSO-FRC and FedRAMP's reporting schedule). You send FedRAMP the notices you owe it, such as the notice of an access denial within 5 business days (CDS-UTC-AAD); we draft it and remind you, and you submit it.
• You stay responsible for your FedRAMP certification and everything it requires of you. Using TrustBox doesn't guarantee any FedRAMP outcome, and we don't decide whether your offering meets FedRAMP's requirements.
• We aren't affiliated with FedRAMP, GSA or any agency. The TrustBox trust center itself needs no FedRAMP certification, and we don't claim one.

Your content

You own everything you put into TrustBox: your FedRAMP data, documents, reports, settings and the records of who accessed them. You let us store, process, back up and display it only to run the service for you. That includes publishing what you make public and showing agency-only content to the users your trust center grants access. We don't sell your content, use it to train AI models, or use it for anything else.

You decide what to upload, what's public and what's agency-only. Uploaded documents are agency-only unless you choose otherwise. Under FedRAMP's rules a trust center grants verified federal users access without a manual approval step (CDS-TRC-USH), so you're responsible for what you upload, how it's marked, and having the right to share it.

Records FedRAMP's rules make us keep

Some of what the service holds exists so you, your agencies and FedRAMP can rely on it later: the snapshot of your trust center kept for each Ongoing Certification Report, and the log of who accessed your certification data. We keep these records unchanged for their retention period, which our privacy policy gives for each kind of record, even after your subscription ends.

Agency users

Agency-only content is for the federal user who was granted access, for official use. Don't share sign-in links, sessions or API credentials. Access is logged. The logs go to the provider whose trust center you use, who may give them to FedRAMP or your agency.

The provider decides what its trust center holds, and the provider can deny or remove an agency's access. TrustBox doesn't review a provider's content and isn't responsible for it.

If you use TrustBox for a US federal agency, these terms apply to you only as far as federal law allows. Federal law governs them, and any clause an agency can't accept, such as indemnification, automatic renewal or a choice of state law or courts, doesn't apply to you.

Acceptable use

Don't use TrustBox to:

• break the law or anyone's rights;
• upload malware, or content you don't have the right to share;
• get around sign-in, access controls or rate limits, or sign in as someone else;
• test the service's security or load without our written permission (to report a vulnerability, see security.txt);
• resell the service without an agreement with us.

What we do

We run the service with reasonable care, keep it on infrastructure separate from your offering, encrypt your content in transit and at rest, and tell you promptly if we learn of a security incident that affects it. We don't promise the service will be uninterrupted; any availability commitment is in your order.

Suspension and ending the service

We may suspend or end an account that seriously breaks these terms, with notice first where we reasonably can. What happens when a customer doesn't pay is in the subscription terms: it never turns off a trust center automatically.

When a subscription ends, you have 30 days to export your content and access records. After that we delete your content from the service, except the records FedRAMP's rules make us keep, which stay for their retention period. Backups expire on their normal schedule.

Warranties and liability

Except as these terms or your order say, the service is provided as is. As far as the law allows, neither of us is liable to the other for indirect, incidental, special or consequential damages or lost profits. Each party's total liability is limited to the fees you paid us in the 12 months before the claim. These limits don't apply to fees you owe, or to fraud, gross negligence or wilful misconduct.

Law and disputes

Illinois law governs these terms, setting aside its conflict-of-laws rules. Disputes go to the state or federal courts in Cook County, Illinois.

Changes

We may update these terms. Each version has a number and an effective date, and earlier versions stay published at trustbox.dev/terms with their numbers. For changes that affect customers, we email customers at least 30 days before they take effect. When a change is material, we ask customers to accept the new version when they next sign in.

Other versions

• Version 0.1, effective October 24, 2026