Terms of Use and End User Licence

These Terms of Use and End User Licence (the “Terms”) govern your use of RiskOS — Risk Management (“RiskOS”), a risk register for macOS published by MAHTCA GLOBAL and sold only through the Mac App Store. They form an agreement between you and MAHTCA GLOBAL. Please read them before you install the app; by using it, you accept them.

1. Overview and how these Terms fit together

RiskOS runs on your Mac. It records risks, scores them on a 5×5 matrix of likelihood against impact, calculates a residual score from the effectiveness of the controls you link, tracks treatment actions, assets, vendors, framework coverage, indicators and events, and reports on all of it. Per-client profiles carry their own methodology, appetite and branding.

These Terms sit alongside Apple’s Licensed Application End User Licence Agreement, the standard licence applying to every application bought from the App Store, which governs your relationship with Apple as distributor and sets the Usage Rules for installing and using the app. These Terms are the publisher’s own and cover what Apple’s does not. Where these grant you more, these apply; where a provision here cannot stand with the Usage Rules, those Rules govern and the rest continues unaffected. The Privacy Policy and the Acceptable Use Policy form part of these Terms.

2. Acceptance, withdrawal and termination

You accept these Terms by downloading, installing or using RiskOS. If you do not accept them, do not install the app, and remove it if installed. You may withdraw at any time by ceasing to use RiskOS and removing it; that does not delete exports, reports or backups you have already saved elsewhere, which remain yours.

Your licence terminates automatically, without notice, if you materially breach these Terms. You must then stop using RiskOS and remove it from every device on which you installed it. Termination gives no right to a refund except as Apple’s terms provide, and does not affect anything that accrued before it. The sections on ownership, intellectual property, disclaimers, liability, indemnity and governing law survive it, as does anything that by its nature should.

3. Age requirement

RiskOS is intended for adults using it in a professional capacity. You must be at least 16, and old enough under your country’s law to enter a binding agreement; below the age of majority where you live, only with the consent of a parent or guardian who accepts these Terms for you. If you accept them for an organisation, you confirm that you may bind it, and “you” means both.

4. The licence granted to you

Subject to these Terms and Apple’s Usage Rules, MAHTCA GLOBAL grants you a personal, non-exclusive, non-transferable, revocable, limited licence to install and use RiskOS on Apple-branded devices you own or control, for your own use and the internal business purposes of the organisation you represent, including registers and reports for clients you advise.

It belongs to the person or organisation that acquired it and is not counted per client, register or report: keep as many client registers as your profile entitlement allows, and give the resulting reports to the clients they concern.

5. What the licence is not

RiskOS is licensed to you, not sold. MAHTCA GLOBAL retains all right, title and interest in it, and you receive no rights beyond those granted above.

You may not reverse engineer, decompile, disassemble, attempt to derive the source code of, modify, adapt or create derivative works from RiskOS, except so far as applicable law expressly permits despite this restriction, and then only after giving MAHTCA GLOBAL written notice and a fair opportunity to supply what you need. You may not circumvent any purchase, entitlement or profile limit, or use RiskOS as these Terms or the Acceptable Use Policy forbid.

6. Permitted use and what you are responsible for

RiskOS records and computes; it does not judge. You are responsible for everything you enter — the wording of a risk, the likelihood and impact you choose, the owner you name, the effectiveness you attribute to a control, the dates, the evidence, the vendor and asset details — and for its accuracy, lawfulness and currency.

Where you record information about identifiable people, such as colleagues named as owners or contacts at a vendor, you are responsible for complying with the data protection law that applies to you. RiskOS does not review or verify what you record, and nothing in it states that your register is correct or complete.

7. No data collection by the publisher

RiskOS has no account, no sign-in, no email address and no licence key. It performs no analytics, no telemetry, no crash reporting, no advertising and no tracking of any kind, and builds no profile of you. MAHTCA GLOBAL operates no servers for RiskOS and offers no sync. For Apple’s App Privacy framework the app declares “Data Not Collected” in every category, and its privacy manifest declares that it does not track. The only network use is Apple’s own App Store and StoreKit, for purchases and restoring them: Apple never receives your register, and MAHTCA GLOBAL never receives your payment details.

One consequence is worth stating plainly: because MAHTCA GLOBAL never holds your register, it cannot recover, restore, inspect or produce it, for you or anyone else. Support is advice about using the app, not access to your data.

8. Local processing and storage on your device

Everything RiskOS does happens on your Mac. The register itself — risks with their assessment history and audit trail, controls, actions, assets, vendors, frameworks, indicators and events — together with your settings, appetite thresholds, saved filters, column arrangements, profiles and report branding, lives on the device you use. Exports and backups are written only where you choose; imports read only the files you pick.

You are responsible for the security of that device: keeping macOS current, protecting the account that signs in to it, encrypting the disk if your circumstances warrant, and deciding who else may use it.

9. The register exists in one place, and backups are yours

Because the register lives on your Mac and nowhere else, its survival depends on you. If the device is lost, stolen, damaged or erased and you hold no backup, the register is gone; neither MAHTCA GLOBAL nor Apple holds a second copy. RiskOS gives you a backup that carries the whole register and your settings, and reminds you to make one. A reminder is not a guarantee: keeping backups, keeping more than one, and keeping one away from the machine, are your responsibility.

Three behaviours are deliberate, and worth understanding before you rely on them.

• Restoring from a backup replaces the register rather than merging into it. RiskOS says what that means and asks you to confirm, but once confirmed the restore stands and what was there before is not retained.
• A backup written by a newer version of RiskOS is refused rather than partially read. Refusal is the safe outcome: a half-read register would look complete and would not be. Update to at least the version that wrote the backup, then restore.
• Scores are always recalculated from the register in front of you rather than read from an imported file, so a figure in a file cannot override the methodology and appetite in force.

10. Scores, bands and coverage are not advice

RiskOS scores a risk from 1 to 25 on a 5×5 matrix and bands it: Low 1–4, Medium 5–9, High 10–16, Critical 17–25. It derives a residual score from the controls you link, compares it against your appetite, and states framework coverage plainly. Each output is arithmetic performed on judgement you supplied; a well-formed number does not make a poorly-formed assessment sound.

RiskOS is a tool for recording and computing judgement. It is not professional, legal, regulatory, audit, insurance or financial advice, and nothing it produces should be treated as such. It does not certify compliance with any standard, framework, scheme or regulation, and no report, score, band, coverage state or export is a certification, an audit opinion or an assurance report. Decisions remain yours; where one carries legal, regulatory or financial consequences, take advice from a qualified professional who knows your circumstances.

11. Frameworks, catalogues and material you import

RiskOS includes the RiskOS Control Baseline, a starting set of controls written by MAHTCA GLOBAL, and the category structure of the NIST Cybersecurity Framework 2.0. Each is labelled in the app as what it is: a structure to work from, not a statement that you comply with anything, and no substitute for the source material that applies to you.

Anything you import is yours to be responsible for: you must have the right to use it and hold any licence its owner requires, including where a standard restricts copying. MAHTCA GLOBAL is not the licensor of material you bring in. Where a standard is named, the reference is descriptive; those names belong to their owners and imply no endorsement or accreditation.

12. Exports, reports and printing

RiskOS exports branded PDF, self-contained HTML, live Excel and CSV reports, and prints them. Once a file is written it is outside the app: where it is stored, who receives it and how long it is kept are your decisions. A completed register gathers an organisation’s weaknesses into one document — worth a thought before you attach one to an email.

A report may carry your business name, tagline, contact details, registration line and a logo you supply; by supplying them you confirm that you may use them. A report reflects the register at the moment you produced it and does not update itself, so treat it as a dated statement.

13. Purchases, payments and refunds

RiskOS is a paid, one-time purchase including one profile. Three non-consumable in-app purchases raise the number of profiles you may keep. There are no subscriptions and nothing renews.

Apple is the merchant of record for the app and every in-app purchase. Billing, receipts, taxes, cancellations and refunds are handled by Apple under its own terms, and pricing and availability are set through the App Store. MAHTCA GLOBAL never sees your payment details and cannot issue or decline a refund; refund requests go to Apple.

If your entitlement ever decreases — a purchase refunded, or a device signed in to a different Apple Account — profiles beyond the cap are locked, never deleted. Their contents stay intact and open again as soon as a sufficient tier is owned or restored.

14. Apple’s role and third-party beneficiaries

These Terms are between you and MAHTCA GLOBAL, not Apple, which is not a party to them and is not responsible for RiskOS or its contents.

• Apple has no obligation whatsoever to furnish any maintenance or support services in respect of RiskOS.
• If RiskOS fails to conform to any applicable warranty, you may notify Apple, and Apple may refund the purchase price to you. To the maximum extent permitted by applicable law, Apple has no other warranty obligation whatsoever with respect to RiskOS.
• MAHTCA GLOBAL, not Apple, is responsible for addressing any claim relating to RiskOS, including product liability claims, claims that the app fails to conform to a legal or regulatory requirement, and claims under consumer protection legislation.
• MAHTCA GLOBAL, not Apple, is responsible for the investigation, defence, settlement and discharge of any third-party claim that RiskOS, or your possession and use of it, infringes that party’s intellectual property rights.
• You represent that you are not located in a country subject to a United States government embargo or designated by it as terrorist-supporting, and that you are not on any United States government list of prohibited or restricted parties.

Apple and Apple’s subsidiaries are third-party beneficiaries of these Terms. Upon your acceptance of these Terms, Apple has the right — and is deemed to have accepted the right — to enforce these Terms against you as a third-party beneficiary of them.

15. Maintenance and support

MAHTCA GLOBAL alone is responsible for any maintenance and support for RiskOS. Support comes through the support page and by email at riskos@mahtca.com, in English, on reasonable efforts during ordinary business hours in Romania. No response time is promised except where mandatory law requires one.

Support can help you use RiskOS. It cannot recover a register, restore a backup you no longer hold or read your data, because MAHTCA GLOBAL holds nothing of yours. When you write, send only what describes the problem, and redact anything sensitive. Updates may be released through the Mac App Store, but there is no obligation to provide any particular update or period of support, and the minimum macOS version a release requires may rise above macOS 14.0.

16. Your content remains yours

Everything you record in RiskOS is yours. MAHTCA GLOBAL claims no ownership of it, takes no licence over it, and asserts no right to use, publish or disclose it. That is not only a statement of intent: because nothing leaves your Mac, there is nothing on which such a right could operate.

17. Intellectual property in RiskOS

RiskOS, including its interface, artwork, icon, report layouts, wording, the RiskOS Control Baseline and the documentation on this site, is owned by MAHTCA GLOBAL and protected by copyright and other law. “RiskOS” and “MAHTCA GLOBAL” are its marks, and nothing here lets you use them except to refer to the product accurately and fairly.

If you send suggestions or feedback, MAHTCA GLOBAL may use them without restriction, obligation or compensation. You are never obliged to, and should not include confidential information when you do.

18. Privacy and data protection roles

The Privacy Policy explains the whole of how RiskOS handles information; the short version is that it collects none.

Where you record personal data about other people, you are the controller of it and you determine why and how it is processed. MAHTCA GLOBAL does not receive, process or store it and has no means of access to it, and so does not act as your processor; no data processing agreement is needed, because there is no transfer on which one could rest. If you contact support, MAHTCA GLOBAL receives what you put in your message and uses it only to answer you. Purchases are handled by Apple, which processes payment information under its own terms.

19. Security

RiskOS is built with reasonable care and runs within the protections macOS applies to apps from the Mac App Store. Beyond that, the security of your register follows from your own environment: the currency of your operating system, the strength of your credentials, whether the disk is encrypted, and where backups and exports are kept.

No software and no device is perfectly secure, and nothing here warrants that RiskOS or your Mac cannot be compromised. If you believe you have found a security weakness, write to riskos@mahtca.com with enough detail to reproduce it, and allow a fair period for a fix before disclosing it.

20. No warranty

To the maximum extent permitted by applicable law, RiskOS is provided “as is” and “as available”, with all faults and without warranty of any kind. MAHTCA GLOBAL disclaims all warranties and conditions, express, implied or statutory, including merchantability, satisfactory quality, fitness for a particular purpose, accuracy and non-infringement.

In particular, it does not warrant that RiskOS will meet your requirements, that its operation will be uninterrupted or free of defects, or that any score, band, coverage state or report will be accurate, complete or sufficient to satisfy an obligation you owe somebody else. Nothing here limits the consumer rights in section 24.

21. Limitation of liability

To the maximum extent permitted by applicable law, MAHTCA GLOBAL is not liable for indirect, incidental, special, consequential or punitive loss; for loss of profits, revenue, business, goodwill or anticipated savings; for the loss, corruption or inaccessibility of any register, backup or export; for regulatory penalties, fines or adverse findings; or for the cost of substitute software, however caused.

Its total aggregate liability in connection with RiskOS and these Terms is limited to the amount you actually paid for RiskOS and its in-app purchases in the twelve months preceding the event giving rise to the claim. Nothing here excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded.

22. Indemnity

If you use RiskOS for business or professional purposes, including for clients, you will indemnify MAHTCA GLOBAL against third-party claims, liabilities, losses and reasonable costs arising from use in breach of these Terms, from content you record or distribute, from material you import without the rights it requires, or from decisions taken on the basis of what RiskOS produced. This section does not apply to a consumer where mandatory law provides otherwise.

23. Export control and sanctions

You must comply with all applicable export control and sanctions laws, including those of Romania, the European Union and the United States. You may not use, export or re-export RiskOS in breach of them, or make it available where doing so is prohibited. The representations in section 14 on embargoed countries and prohibited-party lists apply at all times.

24. Consumer rights that mandatory law preserves

If you use RiskOS as a consumer — for purposes outside your trade, business or profession — you keep every right the mandatory law where you live gives you, and nothing here removes or restricts those rights. In the European Union and the European Economic Area that includes the statutory rights of conformity for digital content and the remedies available when it does not conform.

Because Apple is the merchant of record, the right of withdrawal, the refund process and any cooling-off period are administered by Apple under its terms, and a refund request goes to Apple. If you have a complaint, please write to riskos@mahtca.com first; most matters are settled that way. If one cannot be, you may refer it to a consumer dispute resolution body competent where you live.

25. Changes to RiskOS

RiskOS will change over time. Features may be added, adjusted or withdrawn, the layout of a report may be revised, and the minimum version of macOS may rise. Updates are distributed through the Mac App Store. There is no obligation to keep any particular feature indefinitely, and where a change materially reduces functionality you have paid for, the release notes will say so.

26. Changes to these Terms

These Terms may be updated as the app develops or the law changes. The version number and effective date appear at the top of this page, and material changes are described here. A change takes effect on the date stated, and continued use after it means you accept it; if you do not, stop using RiskOS and remove it. No change alters the terms on which a purchase you have already made was sold.

27. Severability, waiver and assignment

If any provision is held invalid or unenforceable, it will be modified to the least extent necessary to make it enforceable, or severed if it cannot be, and the rest continues in force. A delay in enforcing a provision is not a waiver. You may not assign these Terms or your licence except as Apple’s Usage Rules permit; MAHTCA GLOBAL may assign them on a merger or sale of the business, provided your rights are not reduced.

28. Entire agreement

These Terms, with the Privacy Policy, the Acceptable Use Policy and Apple’s applicable terms, are the entire agreement between you and MAHTCA GLOBAL concerning RiskOS, and supersede any earlier understanding about it. Nothing here limits liability for fraud.

29. Governing law and jurisdiction

These Terms are governed by the law of Romania, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods (Vienna, 11 April 1980). The courts competent for the registered office of MAHTCA GLOBAL have jurisdiction over any dispute in connection with them. If you are a consumer, this choice does not deprive you of the protection of the mandatory law where you live, and you may bring proceedings in the courts of that country.

30. Contact and trader information

RiskOS is published by MAHTCA GLOBAL. Questions about these Terms, a purchase or the app are welcome by email, and the support page answers the most common.