Government & Enterprise Terms Addendum

1. Scope

This Government & Enterprise Terms Addendum (“Enterprise Addendum”) applies when the Customer executes an Enterprise Order Form with GovCertix LLC (“AutoSAM”). It supplements the AutoSAM General Terms of Service and is intended for federal, state, and local government agencies, prime contractors, and enterprise organizations that require additional contractual commitments.

2. Governing terms hierarchy

In the event of a conflict between applicable documents, the following order of precedence applies (highest to lowest):

1. Executed Enterprise Order Form
2. This Enterprise Addendum
3. AutoSAM General Terms of Service

Where a provision in a higher-priority document directly conflicts with a lower-priority document, the higher-priority provision controls.

3. Data residency

Upon general availability, AutoSAM will store and process all Customer data exclusively within United States–based infrastructure and will not transfer, replicate, or store Customer data outside the continental United States. Sub-processor selection is contractually gated on US-only data residency for Customer data. Customers executing an Order Form prior to GA acknowledge that no Customer data is currently being processed or stored by AutoSAM.

4. Audit rights

Customers operating under an Enterprise Order Form may conduct or commission one (1) audit per twelve-month period to verify AutoSAM’s compliance with this Enterprise Addendum and applicable data protection obligations. Audits are subject to the following conditions:

• The Customer must provide at least thirty (30) days’ prior written notice to AutoSAM.
• Audits will be conducted during business hours and in a manner that minimizes disruption to AutoSAM’s operations.
• The Customer bears the cost of the audit unless the audit reveals a material breach by AutoSAM.
• AutoSAM will cooperate in good faith and provide reasonable access to relevant documentation, systems, and personnel.

5. Security assessment cooperation

Upon request, AutoSAM will provide Enterprise Customers with completed security questionnaires, SOC 2 Type II reports (when available), penetration test summaries, and other documentation reasonably necessary to support the Customer’s security and risk assessment processes. Requests should be directed to sales@autosam.io.

6. Business Associate Agreement (BAA)

For Customers subject to HIPAA or other regulations requiring a Business Associate Agreement, AutoSAM can provide a BAA upon request. Please contact our sales team at sales@autosam.io to initiate the BAA process.

7. FISMA & FedRAMP positioning

AutoSAM is not currently FedRAMP authorized. Upon general availability, AutoSAM’s infrastructure will run on SOC 2 Type II-attested cloud providers with US-only data residency, TLS 1.3 encryption in transit, AES-256 encryption at rest, and Postgres row-level security for multi-tenant isolation. Current-state security controls will be documented in an Order-Form-specific security exhibit prior to GA. GovCertix LLC’s FedRAMP-authorization posture (including any pursuit of an authorization path such as FedRAMP Moderate) will be represented separately at the Order-Form stage and is not warranted by these Terms.

Federal agencies and contractors requiring FISMA compliance should contact sales@autosam.io to discuss current security controls and our FedRAMP readiness timeline.

8. Modifications

AutoSAM will provide Enterprise Customers with at least sixty (60) days’ prior written notice before making material changes to this Enterprise Addendum. Changes will not apply retroactively to existing Order Forms unless mutually agreed in writing.

9. Contact

For enterprise contracting, security questionnaires, or questions about this Addendum, contact:

GovCertix LLC
Attn: Enterprise Contracts
2461 Eisenhower Ave, Suite 200
Alexandria, VA 22314
Email: sales@autosam.io

10. Export control (ITAR/EAR)

AutoSAM does not accept, process, store, or transmit data subject to the International Traffic in Arms Regulations (ITAR, 22 CFR §§ 120–130) or the Export Administration Regulations (EAR, 15 CFR §§ 730–774). Customers shall not upload, paste, or otherwise transmit ITAR- or EAR-controlled technical data or defense articles through the platform. GovCertix LLC will not grant exceptions to this restriction. This restriction is consistent with the document-custody model described in Section 13.

Questions about export-controlled data handling should be directed to sales@autosam.io.

11. Section 889 NDAA compliance

GovCertix LLC’s supplier-selection policy excludes covered telecommunications equipment and services from the entities identified under Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232). Upon general availability, GovCertix LLC will select US-based cloud providers that maintain their own Section 889 compliance representations. Customers requiring a binding, current-state Section 889 representation letter may request one as part of an executed Enterprise Order Form; the general policy statement in this section does not constitute such a representation absent a signed Order-Form-level representation letter. Requests may be directed to sales@autosam.io.

12. Custom SLA terms

Enterprise Customers may negotiate custom Service Level Agreement (“SLA”) terms as part of their Order Form. Custom SLA terms specified in an executed Order Form supersede any publicly posted SLA target for the duration of the Order Form term. Contact sales@autosam.io to discuss custom SLA arrangements.

13. Document custody & data minimization

AutoSAM takes no custody of Customer documents. Active-contract clause extraction is processed entirely in the Customer’s browser and the file is never transmitted to AutoSAM; roster imports are parsed in the Customer’s browser so that only validated structured data (never the file itself) is transmitted to AutoSAM. AutoSAM performs no image processing. Derived and structured data (for example, clause identifiers, attestations, and roster rows) is intentionally retained to deliver the service and does not constitute document custody. This custody model mirrors the practice used in DoD’s own CMMC assessments (32 CFR §§ 170.17–170.18), where assessors do not retain an organization’s artifacts and only a SHA-256 integrity hash manifest is recorded to eMASS. The Customer remains responsible for classifying its own material; AutoSAM’s best-effort marking scan does not guarantee detection of unmarked CUI.