Terms and Conditions

Last revised: January 2026

These Noru Terms and Conditions (“Terms”) are entered into by and between The GRC Company AB (559546-0014), a Swedish company with a place of business at Johan Häggs väg 4, 131 50 Stockholm, Sweden (“Noru”), and the entity or person placing an order for, registering for, or accessing the Services (“Customer”). Each of Noru and Customer may be referred to as a “Party” and together as the “Parties”.

These Terms govern Customer’s access to and use of Noru’s products and services (the “Services”) and apply to Customer’s use of the Services whether Customer (i) completes an online ordering or checkout process (including via Stripe or similar payment providers), (ii) accepts a private offer through a cloud service provider marketplace, (iii) executes a written order form, or (iv) accesses the Services on a free trial basis.

By placing an order for, registering for, or accessing the Services, Customer agrees to be bound by these Terms to the exclusion of all other terms.

These Terms consist of the terms and conditions set forth below and incorporate by reference any ancillary documents expressly referenced herein, including applicable order forms, service level agreements, support policies, data processing addenda, and security addendum (collectively, the “Agreement”).

The “Effective Date” of these Terms is (a) the effective date of the first Order Form executed by the Parties, (b) the date Customer first accepts a private offer containing an Order Form or (c) in the case of Trial Services, the date Customer receives its credentials to access the Services accepting these Terms through Noru’s free trial sign-up, as applicable.

Section 1. Services and Support.

1.1. Services. “Services” means the Noru products and services that are made available to Customer by Noru hereunder. Subject to the terms and conditions of these Terms, Noru will make the Services available to Customer for the service period of Customer’s subscription specified on the applicable Order Form (“Service Period”). Noru will provide the Services in accordance with the Service Level Agreement available at https://noru.tech/legal/sla.

1.2. Support. Noru will provide commercially reasonable support during the Service Period in accordance with Noru’s Support Policy, available at www.noru.tech/legal/support-policy (or such other URL as provided by Noru).

Section 2. Fees and Payment; Trial Services.

2.1 Fees, Billing and Auto-Upgrades

• 2.1.1 Fees. “Fees” means the fees payable by Customer to Noru for the applicable Services as set forth in the applicable Order Form or checkout flow. Customer agrees to pay all Fees in accordance with the pricing and billing terms specified therein.
• 2.1.2 Subscription Fees. Customer will pay the subscription Fees specified in the applicable Order Form or checkout flow for the Service Period. Except as expressly stated in this Agreement, all payment obligations are non-cancelable and Fees are non-refundable.
• 2.1.3 Automatic Upgrades. If Customer’s usage of the Services exceeds the usage limits associated with Customer’s current subscription tier, Noru may automatically upgrade Customer to the appropriate higher subscription tier and charge Customer the applicable increased Fees for the remainder of the Service Period.
• 2.1.4 Billing Authorization. Customer authorizes Noru (and its payment processors) to charge the payment method on file for all Fees, including subscription Fees, automatic upgrades, add-on purchases, renewals, and applicable Taxes.

2.2 Late Payments and Suspension. If any undisputed Fees are not received by Noru by the due date, Noru may, without limiting its other rights and remedies: (a) charge interest on such past due amounts at the rate of one and one-half percent (1.5%) per month or the maximum rate permitted by law, whichever is lower; and (b) suspend Customer’s access to the Services until all outstanding amounts are paid in full. Suspension of the Services shall not relieve the Customer of its obligation to pay any Fees due under this Agreement.

2.3 Fee Disputes. If Customer has a bona fide belief that an invoice is incorrect, Customer must notify Noru in writing within thirty (30) days of the invoice date (“Dispute Period”). The Parties will work together in good faith to resolve the dispute. Any undisputed portion of the invoice remains payable in accordance with this Agreement. If Customer does not notify Noru of a dispute within the Dispute Period, the invoice shall be deemed accepted and payable.

2.4 Taxes. Fees do not include any taxes, levies, duties or similar governmental assessments, including value-added, sales, use, GST, withholding or similar taxes (“Taxes”). Customer is responsible for all Taxes associated with its purchase of the Services, excluding taxes based on Noru’s net income, property, or employees.

2.5 Price Changes. Noru may change its Fees for the Services from time to time. Any Fee changes will take effect at the start of Customer’s next Service Period. Noru will provide Customer with reasonable prior notice of any Fee increases.

2.6 Cloud Marketplace Billing. Where Customer purchases the Services through a third-party cloud marketplace (such as AWS Marketplace, Google Cloud Marketplace, or Azure Marketplace), Customer agrees that Fees shall be billed and collected through such marketplace in accordance with the applicable marketplace terms. Any refunds shall be provided in the form of marketplace credits where applicable.

2.7 Currency and Payment Processing. Fees will be charged in the currency specified in the applicable Order Form or checkout flow. Customer is responsible for any foreign exchange fees, bank charges, or payment processing fees imposed by Customer’s payment provider.

2.8 Trial Services. If Customer registers for a free trial, Noru will provide the Trial Services for the trial period specified at signup. At the end of the trial period, Customer’s subscription will automatically convert to a paid subscription unless Customer cancels prior to the end of the trial. Customer Information will be permanently deleted following the trial period unless Customer enters into an Order Form for the Services.

2.9 Reseller Purchases. The Parties agree that Customer may purchase the Services through a reseller authorized by Noru to sell its products and services (“Authorized Reseller”). Noru subscriptions purchased via Authorized Resellers are governed by these Terms. Services purchased through an Authorized Reseller, including multi-year subscriptions, are not subject to cancellation by Customer unless terminated in accordance with Section 3. Where Customer purchases the Services through an Authorized Reseller, the Authorized Reseller will enter into an Order Form with Noru for the purchase of Services that references these Terms. Authorized Reseller and Customer will enter into a separate agreement setting forth the fees to be paid by Customer to Authorized Reseller for such Services, as well as any other terms or conditions that apply between them. Noru hereby agrees that, subject to receiving payment from the Authorized Reseller, it shall be responsible to Customer, pursuant to the terms and conditions of these Terms, for providing the Services under any such Order Form. Customer hereby acknowledges that Noru will not be responsible for the obligations of any Authorized Reseller to Customer under such separate agreement, for the acts or omissions of Authorized Reseller, or for any third party products or services furnished to Customer by any Authorized Reseller. For the avoidance of doubt, where Customer purchases the Services through an Authorized Reseller, (a) Sections 2.1 and 2.2 above will be of no effect and (b) the Fees Customer pays, including any increases thereto upon renewal, will be determined by the Authorized Reseller, as payment and taxes will be addressed in the agreement between Authorized Reseller and Customer.

Section 3. Term and Termination.

3.1. Term and Renewal.

• 3.1.1. Terms. These Terms commence on the Effective Date and will remain in effect until all Order Forms have expired or been terminated in accordance with this Section 3.
• 3.1.2. Order Form. The Service Period for each Order Form shall be set forth therein; provided that if the Order Form does not specify a Service Period, the Service Period will be one (1) year. Unless otherwise expressly stated in the applicable Order Form, upon expiration of the Service Period, the Customer’s subscription will automatically renew for successive one- (1) year Service Periods unless Customer provides Noru with notice of termination at least thirty (30) days prior to the end of the then-current Service Period.

3.2. Termination for Cause. A Party may terminate these Terms or an Order Form for cause (a) upon written notice to the other Party of a material breach if such breach remains uncured after ten (10) days from the date of the breaching Party’s receipt of such notice; (b) if the other Party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation or assignment for the benefit of creditors that is not dismissed within sixty (60) days of the commencement thereof; or (c) immediately by Noru if Customer violates Section 4.5 (Prohibited Uses) of these Terms. Non-payment of Fees by Customer for thirty (30) days after the due date of an invoice and any violation of Section 4.5 (Prohibited Uses) will be considered material breaches of these Terms.

3.3. Effect of Termination and Survival. Termination of these Terms will concurrently terminate all active Order Forms. Upon termination of these Terms and/or an Order Form, (a) Customer will have no further right to use the Services under the terminated or canceled Order Form(s) and Noru will remove Customer’s access to the same, and (b) unless otherwise specified herein, Customer will not be entitled to a refund of Fees paid; provided that if Customer terminates for Noru’s uncured material breach in accordance with Section 3.2 (Termination for Cause), Customer shall be entitled to a pro-rata refund of any prepaid, unused Fees paid to Noru. The following Sections will survive termination: Section 2 (Fees and Payment) for any Fees due and payable at the time of termination, Section 3.3 (Effect of Termination and Survival), Section 4 (Ownership, License, and Use of the Services), Section 5 (Confidentiality), Section 7.3 (Disclaimers), Section 8 (Indemnification), Section 9 (Limitation of Liability), and Section 10 (Miscellaneous). Termination of these Terms will not limit a Party’s liability for obligations accrued as of or prior to such termination or for any breach of these Terms.

Section 4. Ownership, License, and Use of the Services.

4.1. Ownership. Each Party will retain all rights, title and interest in any of its patents, inventions, copyrights, trademarks, domain names, trade secrets, know-how and any other intellectual property and proprietary rights (“Intellectual Property Rights”). Noru will retain all Intellectual Property Rights in and to the Services and all components of, or used to provide, the Services and any other materials developed by Noru in its performance hereunder that derive from, improve, enhance or modify the Services or other Noru pre-existing intellectual property (collectively with the corresponding Intellectual Property Rights, “Services Information”). Customer will retain Intellectual Property Rights in all information uploaded to the Services by or on behalf of Customer (other than Feedback as described below), including any outputs or results thereof produced by the Services from such information (excluding any Noru intellectual property embedded therein) (collectively, “Customer Information”).

4.2. Feedback. Customer may, under these Terms, provide suggestions, enhancement requests, recommendations about the Services, or other feedback to Noru (“Feedback”). Customer hereby grants Noru a fully paid-up, royalty-free, worldwide, transferable, sub-licensable (through multiple layers), assignable, irrevocable and perpetual license to implement, use, modify, commercially exploit, incorporate into the Services, or otherwise use any Feedback; provided that Noru may not breach its obligations of confidentiality under Section 5 in doing so. Noru also reserves the right to seek intellectual property protection for any features, functionality or components that may be based on or that were initiated by such Feedback and, as between the Parties, Noru shall own all right, title and interest in and to such derivatives.

4.3. Licenses. Subject to Customer’s compliance with the terms and conditions of these Terms (including any limitations and restrictions set forth on an applicable Order Form), Noru hereby grants Customer a non-exclusive, non-transferable, non-sublicensable limited right and license to access and use the Services or Trial Services, as applicable, solely during the applicable Service Period or Trial Service Period for Customer’s internal business purposes. Customer hereby grants Noru a non-exclusive, non-transferable, non-sublicensable right and license to use Customer Information solely to provide the Services to Customer. Notwithstanding anything to the contrary, Noru may generate, collect, use, and analyze usage data generated or derived from Customer’s use of the Services (“Usage Data”), including log data and metadata, to develop, improve, promote, support, and operate its products and services; provided that such Usage Data may only be shared with third parties in a manner that is aggregated and/or anonymized and does not identify Customer or any Authorized Users.

4.4. Authorized Users. Customer may designate and provide access to the Services to its authorized employees, agents, or contractors (each an “Authorized User”). Customer is responsible for all use and misuse of the Services by Authorized Users and for adherence to all terms of these Terms by any Authorized Users as though such Authorized Users were parties hereto, and references to Customer herein will be deemed to apply to Authorized Users as necessary and applicable. Customer agrees to promptly notify Noru of any unauthorized access or use of which Customer becomes aware. Authorized Users are strictly prohibited from sharing their accounts or account passwords and their doing so is a material breach of these Terms by Customer.

4.5. Prohibited Uses. Customer will not, and will not permit any Authorized Users or third parties to, directly or indirectly: (a) “frame”, distribute, resell, or permit access to the Services by any third party other than as allowed by the features and functionality of the Services; (b) use the Services in violation of applicable laws, rule or regulations; (c) interfere with, disrupt, or gain unauthorized access to the Services; (d) successfully or otherwise, attempt to: decompile, disassemble, reverse engineer, discover the underlying source code or structure of, or copy the Services; (e) provide Noru any Customer Information or Feedback that is unlawful, defamatory, harassing, discriminatory, or infringing of third party Intellectual Property Rights; (f) transfer to the Services or otherwise use on the Services any code, exploit, or undisclosed feature that is designed to delete, disable, deactivate, interfere with or otherwise harm or provide unauthorized access to the Services; (g) use any robot, spider, data scraping, or extraction tool or similar mechanism with respect to the Services; (h) provide access to the Services to an individual associated with a Noru Competitor (as defined below); (i) extract information from the Services or otherwise access or use the Services in furtherance of replicating the Services or otherwise competing with Noru; (j) encumber, sublicense, transfer, rent, lease, time-share or use the Services in any service bureau arrangement or otherwise for the benefit of any third party; (k) copy, distribute, manufacture, adapt, create derivative works of, translate, localize, port or otherwise modify any aspect of the Services; (l) introduce into the Services any software containing a virus, worm, “back door”, Trojan horse or similarly harmful code; (m) remove or otherwise alter any proprietary notices or labels from the Service or any portion thereof; or (n) permit any third party to engage in any of the foregoing proscribed acts (each of (a) through (n), a “Prohibited Use” and, collectively, “Prohibited Uses”). A “Noru Competitor” is any entity that provides the same or similar goods and services to those provided by Noru, as would be determined by a reasonable individual. Customer will promptly notify Noru of any violations of the Prohibited Uses and take all necessary steps to prevent or cease any such use(s). Noru reserves the right to suspend Customer and/or Authorized User’s access to the Services in the event Noru reasonably suspects Customer or an Authorized User is in breach of this Section.

4.6. Artificial Intelligence.

• 4.6.1. AI Features. Customer acknowledges that the Services offer features that leverage the use of artificial intelligence, machine learning, or similar technologies provided by Noru and/or its licensors (“AI Features”). Noru will not, and will not permit any third party to, use any Customer Information to train any artificial intelligence or machine learning models.

Section 5. Confidentiality.

“Confidential Information” means any non-public financial, technical, or business information disclosed by a party (“Disclosing Party”) to the other party (“Receiving Party”) that is designated as confidential or that reasonably should be understood to be confidential. Services Information is Noru’s Confidential Information and Customer Information is Customer’s Confidential Information. The Receiving Party shall protect Confidential Information using at least reasonable care and shall not disclose or use it except as permitted under these Terms. Disclosure may be made to employees, affiliates, and contractors with a legitimate need to know and who are bound by confidentiality obligations. Confidential Information does not include information that is publicly available, independently developed, or lawfully received from a third party. Disclosure required by law is permitted with prior notice where legally allowed. The Disclosing Party may seek injunctive relief for any breach of this Section.

Section 6. Privacy and Security Practices.

Noru will implement and maintain appropriate administrative, physical and technical safeguards during the Service Period to protect the security, confidentiality and integrity of Customer Information, as described at https://trust.noru.tech (or such other URL as provided by Noru). The Data Processing Addendum available at https://noru.tech/legal/dpa (“DPA”) is hereby incorporated by reference and shall govern the data processing activities carried out as part of the Services.

Section 7. Representations, Warranties, and Disclaimers.

7.1 Authority. Each party represents that it has the legal authority to enter into these Terms. 7.2 Limited Warranty. Noru warrants that the Services will materially conform to applicable documentation during the Term. This warranty does not apply where non-conformance results from Customer’s misuse or use outside the documentation. Customer’s sole remedy for breach is termination for cause under Section 3.2. 7.3 Disclaimers. Except as expressly stated above, the Services and all related outputs and information are provided “as is” and “as available” without warranties of any kind. Noru disclaims all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement. Noru is not responsible for Customer’s compliance programs, and the Services are only tools to assist Customer in meeting its own compliance obligations.

Section 8. Indemnification.

8.1. By Noru. Noru will defend Customer against any claim, demand, suit, or proceeding made or brought against Customer by a third party alleging that the use of the Services as permitted hereunder infringes or misappropriates the intellectual property rights of a third party (a “Claim Against Customer”), and will indemnify Customer from any damages, attorney fees and costs finally awarded against Customer as a result of, or for amounts paid by Customer under a settlement approved by Noru in writing of, a Claim Against Customer. Noru will have no liability for any Claim Against Customer arising from (a) Customer’s modification of the Services, (b) use of the Services in combination with products or services not provided by Noru, or (c) use of the Services in violation of these Terms.

8.2. By Customer. Customer will defend Noru against any claim, demand, suit, or proceeding made or brought against Noru by a third party alleging that Customer Information, or Customer’s use of the Services in violation of these Terms, infringes or misappropriates the intellectual property rights of a third party or violates applicable law (a “Claim Against Noru”), and will indemnify Noru from any damages, attorney fees and costs finally awarded against Noru as a result of, or for any amounts paid by Noru under a settlement approved by Customer in writing of, a Claim Against Noru.

8.3. Procedure. The indemnified Party must (a) promptly notify the indemnifying Party in writing of the claim, (b) grant the indemnifying Party sole control of the defense and settlement of the claim, and (c) provide the indemnifying Party with all assistance, information and authority reasonably required for the defense and settlement of the claim.

Section 9. Limitation of Liability.

9.1 Exclusion of Certain Damages. To the maximum extent permitted by applicable law, neither party shall be liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, including without limitation lost profits, lost revenue, business interruption, loss of goodwill, or loss of data, whether arising in contract, tort, negligence, or otherwise, even if advised of the possibility of such damages.

9.2 Liability Cap. Except as set forth in Section 9.3, each party’s total aggregate liability arising out of or relating to this Agreement shall not exceed the total fees paid by Customer to Noru in the twelve (12) months preceding the event giving rise to the claim. For claims arising from a party’s breach of its confidentiality, security, or data protection obligations, such liability shall be capped at two (2) times that amount.

9.3 Exceptions. Nothing in this Agreement limits or excludes liability for: (a) fraud, gross negligence, or intentional misconduct; (b) a party’s indemnification obligations; (c) Customer’s payment obligations; (d) Customer’s violation of the Acceptable Use or Prohibited Use provisions; or (e) any liability that cannot be excluded under applicable law.

9.4 Risk Allocation. The parties acknowledge that this Section 9 reflects a reasonable allocation of risk and that the fees would be substantially higher if Noru were required to assume additional liability beyond that set forth herein.

Section 10. Miscellaneous.

10.1 Entire Agreement; Order of Precedence. This Agreement, the DPA and all active Order Forms constitute the entire agreement between the Parties and supersede all prior or contemporaneous agreements, proposals, or communications. In the event of a conflict between this Agreement and an Order Form, the Order Form shall control. Any terms in Customer purchase orders or procurement portals shall have no force or effect.

10.2 Assignment. Neither Party may assign this Agreement without the prior written consent of the other Party, except in connection with a merger, change of control, sale of substantially all assets, or to an affiliate upon written notice. Any permitted assignee shall assume all obligations hereunder.

10.3 Severability. If any provision of this Agreement is held unenforceable, such provision shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions shall remain in full force and effect.

10.4 Relationship of the Parties. The Parties are independent contractors. This Agreement does not create a partnership, joint venture, agency, fiduciary, or employment relationship. There are no third-party beneficiaries to this Agreement.

10.5 Notices. All notices under this Agreement shall be in writing and delivered by email or nationally recognized courier to the addresses specified in the applicable Order Form and shall be deemed given upon receipt.

10.6 Governing Law and Venue. This Agreement shall be governed by and construed in accordance with the laws of Sweden, without regard to conflict of law principles. Any dispute arising out of or relating to this Agreement shall be brought exclusively in the courts of Stockholm, Sweden.

10.7 Export Compliance. Customer shall comply with all applicable export control and economic sanctions laws and shall not use the Services in any prohibited jurisdiction or provide access to any restricted person or entity.

10.8 Anti-Corruption. Customer represents that it has not offered or received any improper or illegal payment or inducement in connection with this Agreement and shall comply with all applicable anti-corruption laws.

10.9 Publicity. Noru may use Customer’s name and logo to identify Customer as a client in marketing materials unless Customer objects in writing.

10.10 Modifications. Noru may modify this Agreement from time to time. If Noru makes a material change, Noru will provide reasonable notice (e.g., by email or through the Services). Customer’s continued use of the Services after the effective date of the change constitutes acceptance of the modified Agreement.

10.11 Third-Party Products and Services. Customer may enable integrations with third-party products and services, which are governed by their own terms. Noru makes no warranties and assumes no liability for third-party products or services, including audits, certifications, or testing services performed by independent providers.

10.12 Force Majeure. Neither Party shall be liable for failure or delay caused by events beyond its reasonable control, except for Customer’s payment obligations.

10.13 Waiver. A Party’s failure to enforce any provision shall not constitute a waiver of future enforcement of that or any other provision.