Terms of Service

Last updated: 2026-07-26

These Terms of Service ("Terms") govern your use of ControlDrill, including the website at controldrill.com, the application at session.controldrill.com, facilitated tabletop exercises, evidence packets, and related services (together, the "Service"). The Service is operated by O'Shea & Sons, LLC ("we", "us", or "our").

By creating an account, purchasing an exercise, or using the Service, you agree to these Terms. If you do not agree, do not use the Service.

1. The Service

ControlDrill facilitates incident-response tabletop exercises. For each purchase, the Service may tailor a scenario to your context (using information you provide, including optional plan text or documents), run a timed exercise with participants you invite, record decisions and discussion, and produce an evidence packet that documents what happened in the room.

The Service produces an EXERCISE and an EVIDENCE record. It is NOT a certification, audit, compliance verdict, pass/fail grade, or guarantee of any outcome. A tabletop exercise is a structured discussion under a scenario. It is not a technical disaster-recovery (DR) test, failover test, or live recovery of production systems. We never assert that you meet a regulatory, contractual, or framework control. Framework names may appear as context only. Whether any artifact satisfies an auditor or control is between you and that third party.

See also the Privacy Policy and Data Processing Agreement for roles, subprocessors, and data handling.

2. Accounts, identity, and eligibility

You must provide accurate account information and keep access secure. Buyers sign in to purchase and manage exercises (for example via Google sign-in). Participants join an exercise via an email magic link issued for that exercise. Participant access is magic-link based; it is not enterprise single sign-on or federated identity for the room.

You are responsible for activity under your account and for the people you invite. You must be able to form a binding contract and must not use the Service if prohibited by applicable law.

3. Purchases and billing

ControlDrill is sold as a one-time purchase of $299 USD per exercise (unless we agree otherwise in writing or display a different price at checkout). Payment is processed by Stripe. Taxes may apply where required.

Fees are generally non-refundable once charged, except where required by law or where we agree in writing (for example a clear billing error on our side). Contact hello@controldrill.com with your account email, charge date, and reason if you need help with a charge.

4. Acceptable use

You agree not to:

Upload content you do not have the right to process, or use the Service to process data unlawfully
Attempt to bypass authentication, rate limits, or security controls
Resell or white-label the Service without our written consent
Misrepresent exercise output as a compliance certification, audit opinion, DR/failover result, or guarantee
Interfere with the Service or other customers' use of it
Violate applicable law

We may suspend or terminate access for abuse, non-payment, legal risk, or material breach.

5. Your content

You retain rights to account data, plan text, documents, stack descriptions, participant details, and exercise inputs you submit. You grant us a limited license to host, process, and display that material solely to operate the Service for you (including tailoring, running the exercise, and producing the packet). You represent that you have the right to submit that material and to invite the participants you list.

Uploaded plans and exercise data are used only to tailor and run your exercises and to produce your evidence. We do not use customer content to train models. See the Privacy Policy and DPA.

6. Intellectual property

The Service, brand, software, scenarios (except your confidential inputs), and documentation are owned by us or our licensors. These Terms do not transfer ownership. You may not copy, reverse engineer (except where law forbids that restriction), or create derivative works of the Service except as allowed by law or written agreement. You may use your evidence packet and exercise records for your internal compliance, audit, and training purposes.

7. No warranty of compliance outcomes; AS IS

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

We do not warrant that the Service will be uninterrupted, that tailoring or facilitation will match any particular standard, or that the evidence packet will satisfy any auditor, regulator, customer, or framework control. Output is informational evidence of an exercise that occurred, not a compliance verdict.

8. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE ARE NOT LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR GOODWILL. OUR TOTAL LIABILITY FOR CLAIMS ARISING OUT OF THE SERVICE IS LIMITED TO THE AMOUNTS YOU PAID US FOR THE SERVICE IN THE TWELVE (12) MONTHS BEFORE THE CLAIM (OR ONE HUNDRED US DOLLARS IF YOU HAVE NOT PAID US).

Some jurisdictions do not allow certain limitations; in those cases, our liability is limited to the fullest extent permitted.

9. Indemnity

You will defend and indemnify us against claims arising from your use of the Service, content you upload, participants you invite, or your violation of these Terms or third-party rights, except to the extent caused by our willful misconduct.

10. Termination

You may stop using the Service at any time. We may suspend or terminate the Service or your account with notice when reasonably practicable, or immediately for abuse, legal risk, or non-payment. Provisions that by nature should survive (including disclaimers, liability limits, and indemnity) survive termination. Handling of uploaded plans and exercise data after termination is described in the DPA and Privacy Policy.

11. Changes

We may update these Terms. Material changes will be posted on this page with an updated date. Continued use after the effective date constitutes acceptance. If you do not agree, stop using the Service.

12. Governing law

These Terms are governed by the laws of the State of Illinois, USA, without regard to conflict-of-law rules, except where mandatory consumer protections of your residence apply. Courts in Illinois have exclusive jurisdiction for disputes, subject to those mandatory protections.

13. Contact

O'Shea & Sons, LLC
Email: hello@controldrill.com
Website: https://controldrill.com/