Terms of Service

Effective October 19, 2026 · RuneSpoke Inc.

In short. SOC Binder helps you collect and organize evidence for SOC 1 and SOC 2 audits. It is not an auditor, a CPA firm or a lawyer, and using it does not make you compliant. Your data stays yours. Read the full terms below; they are what applies.

1. Agreement

These Terms are an agreement between you and RuneSpoke Inc., a Delaware corporation (“RuneSpoke,” “we,” “us”), and govern your use of SOC Binder at socbinder.com and its related services (the “Service”). By creating an account or using the Service you accept these Terms and our Privacy Policy. If you accept on behalf of an organization, you confirm you have authority to bind it, and “you” means that organization. If you do not agree, do not use the Service.

2. What the Service is — and is not

The Service connects, read-only, to systems you authorize (such as AWS and GitHub), records configuration as evidence, tracks programme records such as your risk register, workforce roster and policies, and lets you share evidence with your auditor.

The Service is not an audit, a CPA firm, or legal, accounting or compliance advice. It issues no audit opinion and cannot make anyone “SOC 2 certified.” Only an independent licensed CPA firm can examine your controls and issue a report. Policy and document templates are starting drafts that you must review and adapt. Automated results can be incomplete or wrong — for example if a role lacks a permission or a system is not connected — and you are responsible for reviewing them, for your own compliance, and for what you represent to auditors, customers and regulators.

3. Your account

You must give accurate information and keep it current, including an email address you can receive mail at.
You are responsible for your credentials and for everything done under your account. Two-factor authentication is required for every account.
Tell us promptly at security@socbinder.com if you suspect unauthorized access.
If you add a mobile number, you agree to receive the texts you turn on: sign-in and password-reset codes, and alerts. Message frequency varies; message and data rates may apply. Reply STOP to opt out or HELP for help. We never send marketing texts. A texted code is a weaker second factor than an authenticator app, and some actions always require the app.
You must be at least 18 and able to form a binding contract.

4. Connecting your systems

You choose what to connect and what access to grant. We provide a read-only AWS role template using AWS’s SecurityAudit policy, and the Service only reads. You are responsible for the permissions you grant — including any broader-than-necessary scope on a token you create — for keeping the access appropriate, and for removing it when you stop using the Service. Your use of AWS, GitHub and other third-party services remains governed by their terms.

Binder Fixes. If you deploy the optional fix role, you authorize us to make the changes it lists when a fix is approved in the Service — by one of your owners or admins, or automatically where you have chosen to let low-risk fixes through without approval. Each fix is described, with what it could break, before it is approved. You are responsible for deciding which fixes to approve and for any effect a change has on your systems; delete the fix role to withdraw this authorization at any time.

The SOC agent. If enabled for your organization, the SOC agent uses artificial intelligence to explain findings and propose fixes. Its output can be wrong or incomplete; review it before acting. It can only propose fixes from our published list, through the same approval process as anyone else. If you add your own Anthropic API key, runs use your Anthropic account: Anthropic bills you directly, your agreement with Anthropic governs that use, and you are responsible for the key and the limits on it.

5. Acceptable use

You will not, and will not let anyone else:

use the Service unlawfully, or to infringe anyone’s rights;
connect systems or upload data you are not authorized to;
upload malware, or probe, scan or test the Service’s security except as our Security page permits;
interfere with or overload the Service, or get around its limits or access controls;
access another customer’s data, or attempt to;
reverse engineer the Service except where the law allows it; or
resell or provide the Service to third parties without our written permission.

6. Your data

You own the data you put into or collect with the Service (“Customer Data”). You give us a limited license to host, process, transmit and display it only as needed to provide, secure and support the Service for you, and as the law requires. We do not sell Customer Data or use it to train machine-learning models. You are responsible for having the right to provide it — including any notices or consents your staff, vendors or others are owed for the personal information you enter about them. Where we process personal information on your behalf, our Data Processing Addendum applies; email legal@socbinder.com for a copy to sign.

7. Fees

Plans are described on our Pricing page. Until we turn on billing, the Service is provided without charge. We will give you at least 30 days’ notice before you are charged anything, and you may close your account before then without cost.

8. Changes and availability

We are a small company improving the Service continuously, and we may add, change or remove features. We aim to keep the Service available but do not promise that it will be uninterrupted or error-free, and we offer no service-level agreement unless one is agreed in writing.

9. Our intellectual property and your feedback

We and our licensors own the Service, including its software, design and content other than Customer Data. These Terms grant you only the right to use it. If you send us suggestions, we may use them without obligation to you.

10. Confidentiality

Each of us will keep the other’s non-public information confidential, use it only for the purposes of these Terms, and protect it with at least reasonable care. This does not cover information that is or becomes public through no fault of the recipient, was already known to it, is independently developed, or must be disclosed by law (with notice where lawful).

11. Disclaimer of warranties

To the maximum extent permitted by law, the Service is provided “as is” and “as available,” and we disclaim all warranties, express, implied or statutory, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the Service’s results are accurate or complete, that using it will result in a favorable audit outcome, or that it will be uninterrupted or error-free.

12. Limitation of liability

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data or goodwill, arising out of or relating to these Terms or the Service, even if advised of their possibility. Each party’s total liability arising out of or relating to these Terms or the Service will not exceed the greater of the amounts you paid us for the Service in the twelve months before the event giving rise to the claim, or one hundred U.S. dollars (US$100). These limits do not apply to your payment obligations, your breach of section 5, or your obligations under section 13, or where the law does not allow them.

13. Indemnity

You will defend and indemnify RuneSpoke against third-party claims, and the resulting losses and reasonable costs, arising from Customer Data, your breach of section 5, or your violation of law.

14. Term and termination

You may stop using the Service and ask us to close your account at any time by emailing support@socbinder.com. We may suspend or end your access if you materially breach these Terms, if the law requires it, or to protect the Service or other customers; where reasonable we will tell you first and give you a chance to fix the problem. For 30 days after an account closes you may ask us for an export of your Customer Data; after that we delete it as our Privacy Policy describes. Sections 2, 6 and 9 through 16 survive termination.

15. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. The exclusive venue for any dispute arising out of or relating to these Terms or the Service is the state and federal courts located in the State of Delaware, and each party consents to their jurisdiction. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

16. General

Changes to these Terms. We may update these Terms. For a material change we will email account owners at least 30 days before it takes effect; continuing to use the Service after that date means you accept it.
Entire agreement. These Terms, with any order or Data Processing Addendum we both sign, are the whole agreement between us about the Service.
Assignment. You may not assign these Terms without our consent; we may assign them to a successor in a merger, acquisition or sale of assets.
Force majeure. Neither party is liable for delay caused by events beyond its reasonable control.
Severability and waiver. If any part is unenforceable, the rest stands. Not enforcing a term is not a waiver of it.
Notices. We send notices to your account email address. Send yours to legal@socbinder.com or to the address below.

17. Contact

RuneSpoke Inc.
8 The Green, Suite G
Dover, DE 19901
United States
legal@socbinder.com