Terms
Terms of Use
Effective date 2026-09-06Last updated 2026-09-06
These terms are an agreement between you and Qavren Solutions LLC (“we”, “us”) covering your use of TTX Commander at ttxcommander.com and everything reachable from it — the facilitator console, the participant app, and the reports the service produces. By creating an account, running an exercise, or joining one from a link, you accept them. If you are accepting on behalf of an organisation, you are confirming you have the authority to bind it, and “you” means that organisation.
1. What the service is
TTX Commander is a training simulation. It is not security advice, legal advice, or compliance advice. Nothing produced by the service — no inject, no non-player-character line, no grade, no score, no recommendation, no after-action report — is professional advice, and none of it should be relied on as the basis for a security, legal, or regulatory decision. Use qualified professionals for that.
An exercise is a facilitated, fictional incident. The scenarios, the pressure, the adversary, and the consequences are invented. They are designed to make a team practise decision-making under stress, not to model your specific environment, your specific threat profile, or your specific obligations.
2. No warranty about audits, frameworks, or certification
The service maps moments in an exercise to SOC 2 and ISO 27001 control identifiers and produces an after-action report describing what was exercised, with references back to the events that are its evidence.
We do not warrant that running an exercise satisfies SOC 2, ISO 27001, or any other framework, control, regulation, or auditor requirement. The report is a record you may choose to present. Whether it is accepted, whether it is sufficient, and what else you must do is decided by your auditor, your assessor, or your regulator — not by us and not by the software. We are not a certification body, we do not perform audits, and we are not affiliated with AICPA, ISO, or any accreditation body. Control mappings in the service are our editorial judgement about what a scenario exercises, and you should review them before relying on them.
3. AI-generated content, and who is responsible for it
The game master is an AI model. Its output is generated, not authored in advance, and it can be wrong. It may state something inaccurate, contradict itself, produce material that is unrealistic or tonally inappropriate, or fail to produce anything useful at all. The service constrains it — it is instructed to narrate the effects of an incident rather than attacker technique, a content classifier and a validator sit between the model and the exercise, and the system falls back to authored material when a turn cannot be used — but none of that makes the output correct or safe by default.
A human facilitator remains responsible for what is delivered to participants. In co-pilot mode, moves are held for facilitator approval before they land; in self-serve mode they are not. Whichever mode you run, you are responsible for watching the exercise, for stopping it, and for what the people in your room are shown. Do not run an unattended exercise for participants who have not been briefed that the content is AI-generated fiction.
4. Your account, and your guest links
- You must give accurate account information and keep your credentials secure. You are responsible for everything done under your account.
- Join links mint a guest identity confined to one session. Anyone holding a valid link can act in that session as the role it was issued for. Treat a join link as a credential. Send it only to the people you intend to have in the exercise, and issue a fresh one rather than reusing an old one.
- You are responsible for the participants you invite, including telling them before the exercise that what they type is recorded and processed by a third-party AI provider.
- You must have the authority to run the exercise on behalf of your organisation and to submit the material you put into it.
5. Acceptable use
The Acceptable Use Policy is part of these terms. It is short and it matters — it is where the rules about real credentials, real customer data, and rehearsing attacks live. Breaking it is a breach of this agreement.
6. Ownership
Yours
You own your exercise data and your after-action reports: the text your participants type, the record of your session, and the reports generated from it. You grant us a licence to host, process, transmit, and display that material for the purpose of operating the service and providing it to you — which necessarily includes transmitting it to our sub-processors, as described in the Privacy Policy. That licence exists so we can run the service; it does not let us use your exercise content for anything else.
Ours
We own the platform: the software, the game-master system, the scoring and control mapping, the report templates, the TTX Commander name and marks, and the scenarios we author and ship with the service. Nothing in these terms transfers any of that to you. You get a non-exclusive, non-transferable right to use the service while this agreement is in force. You may use the reports you generate however you like, including presenting them to auditors and customers. You may not copy, resell, or redistribute our authored scenarios outside your own exercises, reverse-engineer the service, scrape it, or use it to build a competing product.
7. Suspension and termination
You may stop using the service at any time. We may suspend or terminate access where you breach these terms or the Acceptable Use Policy, where required by law, or where continued use presents a risk to the service or other customers. Where the situation allows it, we will give notice and an opportunity to fix the problem first; for a serious breach — an attempt to use the service to plan a real attack, for instance — we may act immediately. After termination you may request a copy of your exercise data for a reasonable period. Sections 2, 3, 6, 8, 9, 10, and 12 survive termination.
8. Disclaimer of warranties
To the fullest extent permitted by law, the service is provided “as is” and “as available”, without warranties of any kind, whether express, implied, or statutory. We specifically disclaim the implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. We do not warrant that the service will be uninterrupted, error-free, or secure; that generated content will be accurate, complete, appropriate, or fit for any purpose; that an exercise will improve your security posture; or that a report will satisfy any auditor, framework, or legal obligation. Some jurisdictions do not allow certain disclaimers, in which case those disclaimers apply only to the extent permitted.
9. Limitation of liability
To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, lost revenue, lost data, or business interruption, arising out of or relating to the service, however caused and on any theory of liability, even if advised of the possibility.
To the fullest extent permitted by law, our total aggregate liability arising out of or relating to these terms and the service is limited to the greater of (a) the amounts you paid us for the service in the twelve months before the event giving rise to the claim, and (b) one hundred United States dollars (US$100).
These limits do not apply to liability that cannot be excluded or limited by law.
10. Indemnity
You will defend, indemnify, and hold harmless Qavren Solutions LLC and its officers, employees, and agents from any claim, demand, loss, liability, or expense (including reasonable legal fees) arising out of: your use of the service; the material you or your participants put into an exercise, including any real credential, secret, personal data, or regulated data submitted in breach of the Acceptable Use Policy; your use of, or reliance on, an after-action report, including any representation you make to an auditor, customer, or regulator about it; your breach of these terms or of applicable law; and any claim by a participant you invited.
11. Changes to these terms
We may update these terms. When we do, we will change the effective date at the top of the page, and for material changes we will give account holders notice before they take effect. Continuing to use the service after a change takes effect means you accept the updated terms. If you do not accept them, stop using the service.
12. Governing law and disputes
These terms are governed by the laws of [JURISDICTION], without regard to its conflict-of-laws rules. The courts located in [JURISDICTION] have exclusive jurisdiction over any dispute arising out of or relating to these terms or the service, and each party consents to that jurisdiction and venue. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
13. General
These terms, together with the Acceptable Use Policy, the Privacy Policy, and any order form or written agreement signed between us, are the entire agreement about the service. If a provision is held unenforceable, the rest stays in force. Failing to enforce a provision is not a waiver of it. You may not assign this agreement without our written consent; we may assign it in connection with a merger, acquisition, or sale of assets. Neither party is liable for a failure to perform caused by events beyond its reasonable control.
Contact
Qavren Solutions LLC
[ENTITY ADDRESS]
[email protected]