Cyber Insurance Readiness Disclaimer

What CyberWave does, and does not do, in relation to cyber insurance

1. The one sentence that matters most

If you tell an insurer or a broker something that is not true, or leave out something material, your insurer may refuse to pay a claim or may treat the policy as void — and nothing CyberWave produces changes that or takes it off you.

Everything else in this document supports that sentence. Read it before you send anything from your Workspace to an insurer or a broker.

2. Why this document exists

CYBER WAVE INC., a corporation existing under the laws of Ontario, Canada (Ontario Corporation Number 1000780137), located in Markham, Ontario, Canada ("CyberWave", "we", "us" or "our") provides CyberWave Sentinel (the "Services"), which includes a Cyber Insurance Readiness capability.

This document applies to the Cyber Insurance Readiness features of CyberWave Sentinel, the Cyber Insurance Submission Pack, and any CyberWave advisory work touching insurance readiness.

Cyber insurance is the area where a readiness product is most easily misread as something it is not. A workspace that organises your controls, produces a readiness score and drafts answers to an underwriting questionnaire can look, to a busy reader, like insurance advice. It is not, and this document draws the line plainly rather than in a footnote.

This document is incorporated into the Terms of Service. If it conflicts with Terms §27, Terms §27 prevails.

3. Who this applies to

The Services are sold to organisations for business use. When you accept the Terms or create an account, you represent that you are of legal age to contract, that you are using the Services for business or professional purposes and not for personal, family or household purposes, and that you have authority to bind the organisation you act for.

Where mandatory consumer protection or other law nonetheless applies to you, that law prevails over anything here that would give you less. A term of ours that conflicts with a mandatory right is read down, not enforced.

4. What CyberWave does

CyberWave helps you get ready. Concretely, the Services:

• help you prepare for underwriting and security questions — by scoping the questions that insurers commonly ask against the controls you actually have;
• organise your evidence — a library with owners, status and expiry, so that a control you have can be shown rather than asserted;
• identify possible gaps — between the position you can currently evidence and the position an underwriting question implies;
• support remediation planning — a prioritised roadmap, actions with owners, and progress you can see;
• produce readiness material you can work from: a readiness score and summary, an evidence-gap explanation, a roadmap narrative, renewal talking points, a broker summary, an underwriter evidence package, and draft answers to a cyber-insurance questionnaire.

Availability depends on your plan. The Cyber Insurance Submission Pack — an evidence and questionnaire package assembled from your Workspace — is a separate one-time service at US$499 (excluding taxes), arranged by contacting us rather than bought through self-service checkout.

Several of these features are AI-assisted. Where they are, the AI Features & Data Use Notice applies in addition to this document: AI features are assistive and optional, outputs may contain errors, they do not replace professional judgement, and they must be reviewed before they are relied on.

5. What CyberWave is not, and does not do

CyberWave is not an insurer or an insurance broker, does not bind coverage, does not interpret policy coverage as legal advice, and does not guarantee coverage, premium reduction, claim payment or insurer acceptance. You remain responsible for complete and truthful representations to your insurer or broker.

In more detail — each of these is a thing we do not do, and none of them becomes something we do because a feature makes it convenient:

6. Your disclosure duty stays with you

This is the section to act on.

You are solely responsible for the accuracy and completeness of everything you tell an insurer or a broker — in an application, a questionnaire, a renewal submission, a broker email, a claim notice or a conversation. That duty is yours before you use the Services, while you use them, and after.

• A misrepresentation to an insurer can void coverage. Depending on the policy and the applicable law, a material misstatement or a failure to disclose something material can allow an insurer to deny a claim or to treat the policy as if it had never existed. That is the worst possible time to find out that a questionnaire answer was optimistic.
• Only you, or your licensed broker, make representations to an insurer. We do not make them for you, and material produced in the Services is not a representation by us to anyone.
• Verify before you adopt. Anything the Services generate is a starting point. When you send it on, you are making the statement, not us — so check each statement against what is actually true of your organisation on the date you send it.
• Garbage in, garbage out, and the consequence is yours. Readiness output reflects the data in your Workspace. If a control is recorded as implemented when it is not, if evidence is stale, or if a record was never completed, output derived from it will be wrong in the same way and just as confidently.
• Currency matters. A control that was in place in March is not a true answer in September. Check the date on the evidence, not just its presence.
• When in doubt, state exactly what is true today, and ask your broker. "We are implementing this, and here is our current position" is a defensible answer. An overstatement is not, and neither is leaving out something material.

7. Readiness output is not an underwriting decision

A readiness score, gap list, roadmap, broker summary, underwriter package or Submission Pack reflects the data in your Workspace and CyberWave's readiness methodology. It is not an insurance application, a binder, a quote, a coverage opinion, an actuarial assessment or a representation to any insurer.

Readiness scores and percentages are internal management indicators. They are not certifications, ratings or audit conclusions, they are not endorsed by any standards body, insurer or regulator, and no insurer, broker or other third party is obliged to accept them, to give them weight, or to recognise the methodology behind them. An underwriter may reach a different view of the same facts. That is the underwriter's job.

8. Draft questionnaire answers: how to use them safely

The Services can draft answers to a cyber-insurance questionnaire from your Workspace. This is the single most useful feature in the readiness module and the one with the most downside if it is used carelessly, so it gets its own rules.

1. Read every drafted answer. Do not submit a set of drafts as a batch because they look right.
2. Check each answer against the underlying evidence, not against the Workspace record that summarises the evidence.
3. A control described as implemented must actually be implemented, in production, across the scope the question asks about — not planned, not partially rolled out, not implemented for the engineering team only.
4. Answer the question that was asked. Underwriting questions are drafted narrowly and a nearly responsive answer can read as a misstatement later.
5. Have the right person confirm the technical answers, and keep your own record of who checked AI-assisted material before it went out.
6. Send it through your broker where you have one. That is what they are for, and they are licensed to do the part we are not.

9. A gap list is not an assurance that no gaps exist

Gap identification is bounded by what is in your Workspace and by the framework and questionnaire in scope. An empty gap list means "nothing was identified in the material available", not "your organisation has no gaps." We do not audit you, we do not test your controls, and we do not scan your environment to verify what a record claims. Do not represent a clean readiness position as an independent verification of anything.

10. Our relationship with insurers and brokers

We do not act for any insurer, and we do not act as your intermediary with one. If you ask, we may tell you the categories of professional you might approach; that is not a recommendation of any particular firm, and you should make your own enquiries and satisfy yourself about licensing.

11. Licensing

CyberWave is not licensed as an insurance agent, broker or adjuster in any jurisdiction, and does not hold itself out as one. Where you need the help of a licensed intermediary, use your own licensed broker. If our licensing position changes, we will say so expressly, name the licence, and update this document before any activity that relies on the licence begins.

12. Claims and incidents

If you suffer a security incident or a loss you think may be covered:

• Follow your policy. Cyber policies can impose notice requirements and time limits. Read yours, meet them, and ask your broker or your insurer if you are unsure what they require.
• Notify your insurer or broker directly. We do not report incidents or claims to your insurer on your behalf, we do not manage a claim for you, and telling us is not telling them.
• We do not provide emergency incident response. Sentinel is a readiness and governance platform, not an incident response retainer.
• Check your policy before you engage a responder. Where your policy requires you to use its panel or approved vendors, use them; if you are unsure, ask your broker or your insurer first.

13. Contractual position

• This document is incorporated into the Terms of Service and forms part of the agreement between you and CyberWave. Terms §27 prevails on any conflict.
• The disclaimers of warranty, the limitation of liability and the exclusion of indirect and consequential loss in the Terms apply to everything described here, including any lost coverage, denied claim, increased premium or uninsured loss.
• Nothing in this document limits a liability that cannot lawfully be limited.
• Where advisory work is involved, the Professional Services Schedule and the applicable statement of work apply in addition to this document.

14. Free trials

The free trial is a 14-day trial of the plan you select, Essentials or Full Platform only. No payment card is required, there is no automatic charge, and a trial does not automatically convert to a paid subscription. A trial is not a paid plan and includes no fees. Continuing after the trial means choosing a paid subscription, and your data is not deleted because a trial ended. The Cyber Insurance Submission Pack is a separate paid service and is not part of a trial.

15. Changes to this document

We will update this document if the readiness features, the Submission Pack service or our licensing position changes, and we will change the version string when we do. Where a change is material we will give notice as the Terms require.

16. Contact

Contact CyberWave by email at support@cyberwave.ca, with the topic in the subject line.