General Terms of Service for Ordnad

1 Scope and Nature of the Service

Ordnad provides a specialized digital B2B software platform for organizational resilience, risk and vulnerability assessments (RSA per FORSA/MSB methodology), systematic capability evaluations (KDU), operational analysis (commitments, critical dependencies, protective resources), disruption scenario cascade simulations (based on NRSB 2025 and MSB risk catalogues), consolidated action planning, regulatory compliance (such as the Swedish Cybersecurity Act (2025:1506) / NIS2 and CER), and operational registers (departments, personnel, crisis organization, suppliers, products, and Dual-Use PDA export control).

The Service is designed as an internal operational methodology and decision support system. The Service does not constitute formal legal counsel, statutory certification, or regulatory auditing. Ordnad does not act as legal counsel or regulatory representative on behalf of the Customer.

2 User Responsibilities, Accounts, and Security

To access the Service, authorized user accounts are required. The Customer is responsible for:

• Ensuring all registration details and organizational records provided are complete, accurate, and current.
• Safeguarding credentials, Multi-Factor Authentication (MFA) tokens, and one-time verification links against unauthorized disclosure.
• Promptly notifying Ordnad upon identifying any suspected credential compromise or unauthorized access.
• Ensuring all data uploaded to the Service complies with applicable Swedish and European laws.

3 Classified Information and Defense Secrecy Restrictions

While Ordnad provides both cloud-native and sovereign deployments, specific prohibitions apply regarding classified information:

• Public Cloud Prohibition: The Customer is strictly prohibited from uploading, entering, or processing information classified under the Swedish Protective Security Act (Säkerhetsskyddslagen 2018:585) or defense secrecy under the Public Access to Information and Secrecy Act (OSL) into Ordnad's standard public cloud infrastructure.
• Security Protection Agreement (SUA): Processing of security-classified information is only permissible if the parties have executed a formal Security Protection Agreement (SUA / Säkerhetsskyddsavtal) and deployed an approved sovereign, isolated, or on-premise infrastructure instance (e.g., via se.ordnad.com or containerized on-premise deployments).
• Classification Obligation: The Customer maintains sole and unconditional responsibility for conducting proper information classification before entering data into the Service.

4 Disclaimer Regarding Regulatory Compliance (NIS2, CER, and Audits)

Ordnad continuously maintains its methodologies, scenarios, and templates against evolving national regulatory benchmarks. However, the following terms govern:

• No Guarantee of Regulatory Approval: Ordnad does not warrant that use of the Service guarantees regulatory compliance or formal approval during supervisory audits by authorities (such as MSB, MCF, PTS, Finansinspektionen, or County Administrative Boards).
• Customer Accountability: Operational continuity decisions, incident reporting declarations, and regulatory compliance obligations remain the sole responsibility of the Customer and its governing board.
• Independent Expertise: For binding legal interpretations or complex cybersecurity certification, the Customer is advised to engage qualified independent counsel.

5 Terms Governing AI-Powered Capabilities (Human-in-the-Loop)

Certain modules within the Service leverage artificial intelligence (hosted on dedicated sovereign infrastructure in Sweden and the EU) to assist with document analysis, threat synthesis, and data structuring:

• Advisory Nature: AI-generated outputs, recommendations, and synthesized assessments constitute automated drafts and may contain inaccuracies or incomplete context.
• Human-in-the-Loop Mandate: All content produced by AI features must be reviewed, validated, and approved by qualified human personnel prior to taking operational, strategic, or legal action.
• Zero Model Training: Customer operational data and uploaded files are never used to train public AI models.
• Limitation of Liability for AI Outputs: Ordnad assumes no liability for damages or losses resulting from unverified decisions executed directly on the basis of AI-generated content.

6 Intellectual Property and Data Ownership

Ownership and intellectual property rights are structured as follows:

• Customer Data Ownership: The Customer retains full and unencumbered ownership of all operational data, personnel records, facility information, continuity plans, and documents entered into the Service.
• No Model Training: Ordnad is strictly prohibited from using Customer data or uploaded proprietary records to train, fine-tune, or calibrate public or third-party artificial intelligence models.
• Ordnad Proprietary Rights: The Service, software code, UI designs, underlying methodology, preparedness templates, calculation engines, and trademarks remain the exclusive property of Ordnad or its licensors and are protected under copyright and IP legislation.

7 Limitation of Liability

To the maximum extent permitted by applicable mandatory law:

• Consequential Damages: Under no circumstances shall Ordnad be liable for indirect, consequential, punitive, or special damages, including lost business profits, loss of business continuity, or loss of operational data.

Ordnad’s aggregate financial liability toward the Customer for all claims arising under these Terms shall be limited to the total fees actually paid by the Customer for the Service during the twelve (12) months preceding the incident.

8 Availability and Force Majeure (Wartime & Crisis Events)

Ordnad is engineered for high operational resilience. The following provisions govern extraordinary service interruptions:

Ordnad shall be excused from liability and fulfillment of service level commitments if prevented or substantially hindered by circumstances beyond its reasonable control (Force Majeure). Such events include, without limitation: states of heightened preparedness, war or acts of war, state-sponsored hostile cyber operations against national infrastructure, sabotage, severe nation-wide disruptions in power or telecommunication grids, fire, or government intervention.

9 Amendments to these Terms

Ordnad reserves the right to amend these Terms. In the event of material revisions, Customers will be notified in writing via email or through the Service at least 30 days prior to effectiveness. Continued use of the Service after the effective date constitutes full acceptance of the revised terms.

10 Dispute Resolution and Governing Law

These Terms shall be governed by and construed in accordance with the substantive laws of Sweden. Any dispute, controversy, or claim arising out of or in connection with these Terms shall be settled by the public courts of Sweden, with the District Court of Stockholm (Stockholms tingsrätt) as the court of first instance.