STIGreviewer End-User License Agreement

Version 1.0 — Effective September 7, 2026

This End-User License Agreement (this “Agreement”) is a legal agreement between STIG Solution LLC, a North Carolina limited liability company (“Licensor,” “we,” “us,” or “our”), and the individual or entity that accepts it (“Licensee,” “you,” or “your”). It governs your acquisition and use of the STIGreviewer software, in object-code form, together with any updates, upgrades, patches, supplements, and documentation we make available (collectively, the “Software”).

The Software is provided free of charge. It is freeware, not open-source software, and no source code rights are granted.

READ THIS AGREEMENT CAREFULLY. IT CONTAINS A DISCLAIMER OF WARRANTIES, A LIMITATION OF LIABILITY, AND A CHOICE OF LAW AND EXCLUSIVE FORUM.

1. Acceptance

You accept this Agreement by clicking “I Accept” (or a similar control), or by installing, accessing, or using the Software, whichever occurs first. If you do not agree, do not install, access, or use the Software.

If you accept this Agreement on behalf of a company, agency, or other legal entity, you represent and warrant that you have the authority to bind that entity, and “you” and “Licensee” refer to that entity.

We may present a revised version of this Agreement in connection with a new release. Revised terms apply prospectively from the date you accept them.

2. License Grant

Subject to your compliance with this Agreement, Licensor grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to install and use the Software for your internal purposes, including:

(a) personal, organizational, or internal commercial use;

(b) use in support of cybersecurity, compliance, or system assessment activities; and

(c) use within government, contractor, academic, or enterprise environments.

There is no limit on the number of devices on which you may install the Software, and no fee, license key, or activation is required.

Your employees and your contractors may exercise this license solely on your behalf and for your internal purposes, provided that you remain responsible for their compliance with this Agreement. Using the Software to perform compliance, assessment, or consulting work for your own customers under your own contracts is permitted internal use; the restrictions in Section 3 on redistribution, resale, and automated integration continue to apply.

3. Restrictions

Except as expressly permitted in Section 2, and except to the extent a restriction below is prohibited by applicable law, you will not, and will not permit any third party to:

3.1 Redistribution. Distribute, publish, host, mirror, sublicense, lease, rent, lend, or otherwise transfer the Software to any third party without Licensor’s prior written permission. This includes hosting the Software or its installer for download on any third-party website or repository, including the Software in any software package, image, toolkit, or system build, and redistributing the installer within any automation framework or distribution channel. Requests for redistribution authorization may be sent to mail@stigsolution.com.

3.2 Commercial exploitation. Sell, resell, or charge any fee for the Software, include the Software in any commercial product offering, resale package, or paid service, or make the Software available to third parties on a service bureau, time-sharing, hosted, or managed-service basis. Using the Software internally in the course of your own commercial activities is permitted under Section 2 and is not restricted by this Section.

3.3 Automated integration and platform embedding. Integrate or embed the Software into automated systems, continuous integration or deployment pipelines, DevSecOps platforms, security orchestration tools, compliance automation tools, or enterprise security or compliance management platforms, or wrap or expose the Software’s functionality through any API, service, or automation layer, in each case without Licensor’s prior written authorization. The Software is intended for direct use by individual users within their local computing environment. Organizations wishing to automate or integrate the Software should contact mail@stigsolution.com; Licensor offers separately licensed products for these use cases.

3.4 Modification and reverse engineering. Modify, adapt, translate, or create derivative works of the Software, or decompile, disassemble, reverse engineer, or otherwise attempt to derive the source code, algorithms, or underlying structure of the Software, except to the extent this restriction is prohibited by applicable law (and in that case, only after providing us with prior written notice and a reasonable opportunity to supply the necessary interoperability information).

3.5 Notices and protections. Remove, obscure, or alter any copyright, trademark, or other proprietary notice, or circumvent or disable any technical protection measure.

3.6 Unlawful use. Use the Software in violation of any applicable law or regulation, including export control and sanctions laws.

3.7 Competing products. Use the Software to develop a competing product.

Unauthorized redistribution, commercial exploitation, or automated integration of the Software is a material breach of this Agreement and terminates your license immediately under Section 14.

4. Third-Party and Open-Source Components

The Software includes third-party and open-source components licensed under their own terms, identified in the NOTICE or THIRD-PARTY-NOTICES file distributed with the Software. Those terms govern those components and, to the extent they grant you broader rights than this Agreement, those broader rights control as to that component only. Third-party components are provided without warranty or indemnity from Licensor.

5. Support and Updates

The Software is provided free of charge and without any support commitment. Licensor may, at its sole discretion, respond to questions sent to mail@stigsolution.com, but has no obligation to provide support, maintenance, bug fixes, or updates.

Licensor may update the Software, modify or remove features, release new versions, or discontinue the Software entirely, at any time and without notice. Where Licensor publishes updates, they are available at https://stigsolution.com/stigreviewer/.

6. Your Data and Software Behavior

6.1 Your data. You retain all right, title, and interest in the checklists, scan results, artifacts, configurations, and other data you process with the Software (“Your Data”). Licensor claims no ownership of Your Data.

6.2 Local processing; no data collection. The Software processes STIG checklists and related data locally on the systems where you install it. The Software does not collect, transmit, or store Your Data externally. Licensor does not receive, process, retain, or have any ability to access Your Data. Unlike Licensor’s commercial products, the Software requires no license key, performs no activation, and makes no network connection to Licensor for licensing purposes.

6.3 Sensitive data. You acknowledge that Your Data may include Controlled Unclassified Information (CUI), vulnerability data, system configuration data, or other sensitive information. You are solely responsible for handling Your Data in accordance with your organization’s security policies and all applicable laws, regulations, and contractual obligations, including where applicable DFARS 252.204-7012 and NIST SP 800-171, and for the security of the systems on which you install the Software.

6.4 Support data. If you voluntarily send Licensor files, logs, or screenshots in connection with a question or bug report, you are responsible for redacting or sanitizing any CUI, classified, or otherwise restricted information before sending. Licensor will use such materials solely to respond to your inquiry and will delete them on request.

6.5 Privacy. Licensor’s handling of any personal information, including information you provide by email or through our website, is described in our Privacy Policy at https://stigsolution.com/privacy/, which is incorporated by reference.

7. Intellectual Property and Ownership

The Software is licensed, not sold, and is provided free of charge without any transfer of ownership. Licensor and its licensors retain all right, title, and interest in and to the Software, including all copyrights, patents, trademarks, trade secrets, and other intellectual property rights, and all modifications, enhancements, and derivative works of it, regardless of who creates them. No rights are granted except as expressly stated in this Agreement.

This Agreement grants you no rights to the STIGreviewer or STIG Solution names, logos, branding, source code, or documentation. You may not use those names in any manner that suggests endorsement, sponsorship, or affiliation without Licensor’s prior written permission.

Feedback. If you provide suggestions, feature requests, or other feedback, you grant Licensor a perpetual, irrevocable, worldwide, royalty-free license to use and incorporate it into the Software without obligation or attribution. Feedback is provided voluntarily and is not your confidential information.

8. Non-Affiliation and Trademarks

STIG Solution LLC is an independent company. The Software is not affiliated with, endorsed by, sponsored by, certified by, approved by, or supported by the United States Department of Defense, the Defense Information Systems Agency (DISA), the National Institute of Standards and Technology, or any other government agency or third party. “STIG,” “eMASS,” “DISA,” and other third-party names are the trademarks or registered trademarks of their respective owners and are used solely for descriptive and interoperability purposes under nominative fair use.

Security Technical Implementation Guides and related cybersecurity guidance published by DISA or other government publishers are U.S. Government works and remain the property of their respective publishers. The Software does not modify their authoritative meaning, and the authoritative source remains the publishing agency.

9. U.S. Government End Users

9.1 Restricted rights. The Software is “commercial computer software” and the documentation is “commercial computer software documentation” as those terms are used in FAR 2.101, FAR 12.212, and DFARS 227.7202. Consistent with FAR 12.212 and DFARS 227.7202-1 through 227.7202-4, if the Software is acquired by or on behalf of any agency or instrumentality of the U.S. Government, the Government acquires only those rights in the Software and documentation customarily provided to the public under this Agreement, and no greater rights. Any use, duplication, disclosure, modification, or distribution beyond those rights is prohibited. Unpublished rights are reserved under the copyright laws of the United States. The commercial computer software rights legend at FAR 52.227-19 and the restricted-rights notices at DFARS 252.227-7014 and 252.227-7202 apply as applicable. That the Software is provided at no charge does not place it in the public domain, make it a work of the U.S. Government, or expand the rights acquired.

9.2 Federal supremacy. If Licensee is an agency or instrumentality of the U.S. Government, then to the extent any provision of this Agreement is inconsistent with federal law, federal law controls and that provision does not apply. Without limiting the foregoing, the following provisions do not apply to such a Licensee: the governing law and forum provisions of Section 15 (federal law and the exclusive jurisdiction provisions applicable to the United States apply instead); any obligation of Licensee to indemnify, defend, or hold harmless (to the extent it would violate the Anti-Deficiency Act, 31 U.S.C. § 1341, or exceed the authority of the contracting officer); and any jury-trial waiver. All other terms remain in effect.

10. Export Control and Sanctions

You represent that you are not located in, organized under the laws of, or ordinarily resident in a country or region subject to comprehensive U.S. sanctions, and that you are not identified on any U.S. government restricted- party list. You will comply with the U.S. Export Administration Regulations and all other applicable export control and sanctions laws, and will not export, re-export, or transfer the Software in violation of them.

11. Compliance Disclaimer and Responsibility for Decisions

The Software is a support tool for cybersecurity review and analysis. It does not make authoritative compliance determinations and does not replace professional cybersecurity judgment, system authorization processes, or official compliance assessments.

Use of the Software does not guarantee, establish, or demonstrate compliance with DISA STIG requirements, NIST SP 800-53, NIST SP 800-171, the Risk Management Framework, federal cybersecurity policy, or any other regulatory, contractual, or compliance standard.

All compliance determinations, risk decisions, system authorization decisions, and accreditation actions remain the sole responsibility of the system owner, authorizing official, security control assessor, or other responsible authority. You are solely responsible for independently validating all outputs, analyses, and findings generated by the Software before relying on them for any operational, security, compliance, or contractual purpose.

12. Disclaimer of Warranties

THE SOFTWARE AND ALL RELATED DOCUMENTATION ARE PROVIDED “AS IS” AND “AS AVAILABLE,” FREE OF CHARGE, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, LICENSOR EXPRESSLY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, OR USAGE OF TRADE.

LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, THAT DEFECTS WILL BE CORRECTED, THAT THE SOFTWARE WILL MEET YOUR REQUIREMENTS, OR THAT ITS OUTPUT WILL BE ACCURATE, COMPLETE, OR RELIABLE. WITHOUT LIMITING THE FOREGOING, LICENSOR DOES NOT WARRANT THAT USE OF THE SOFTWARE WILL RESULT IN COMPLIANCE WITH, OR A FAVORABLE ASSESSMENT, AUTHORIZATION, OR ACCREDITATION UNDER, ANY STANDARD, FRAMEWORK, OR REGULATORY REQUIREMENT. THE ENTIRE RISK ARISING OUT OF USE OR PERFORMANCE OF THE SOFTWARE REMAINS WITH YOU.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES, SO SOME OF THE ABOVE EXCLUSIONS MAY NOT APPLY TO YOU.

13. Limitation of Liability

13.1 Exclusion of damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL LICENSOR OR ITS MEMBERS, OFFICERS, EMPLOYEES, CONTRACTORS, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF DATA, PROFITS, REVENUE, BUSINESS, OR GOODWILL, OR FOR ANY SECURITY INCIDENT, COMPLIANCE FAILURE, FAILED OR REVOKED AUTHORIZATION, OPERATIONAL DISRUPTION, GOVERNMENT CONTRACT IMPACT, OR COST OF SUBSTITUTE PRODUCTS OR SERVICES, ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SOFTWARE, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

13.2 Cap. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, LICENSOR’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SOFTWARE, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US$100).

13.3 Exceptions. Nothing in this Agreement limits liability for fraud, fraudulent misrepresentation, or any other liability that cannot be limited or excluded under applicable law. Some jurisdictions do not allow the limitation or exclusion of liability for certain damages, so some of the above may not apply to you.

13.4 Allocation of risk. You acknowledge that the Software is provided at no charge, that these limitations reflect the allocation of risk in this Agreement, and that Licensor would not make the Software available on these terms without them. These limitations are an essential basis of the bargain and apply even though you have paid nothing for the Software.

14. Term and Termination

14.1 Term. This Agreement is effective on your acceptance and continues until terminated.

14.2 Termination. You may terminate at any time by ceasing all use of the Software and deleting all copies. Your rights terminate automatically and immediately, without notice, if you breach Section 3. Licensor may also terminate this Agreement or discontinue the Software at any time, for any reason, on notice posted at https://stigsolution.com/stigreviewer/ or delivered by any reasonable means.

14.3 Effect. On termination, all licenses granted end, and you must stop using the Software, uninstall and delete all copies, and, on request, certify in writing that you have done so. Your Data stored locally on your systems is unaffected and remains yours.

14.4 Survival. Sections 3, 4, 6.1, 6.3, 7, 8, 9, 10, 11, 12, 13, 14.3, 14.4, 15, and 16 survive termination.

15. Governing Law and Forum

15.1 Governing law. This Agreement and any dispute arising out of or relating to it or the Software are governed by the laws of the State of North Carolina, without regard to its conflict of laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

15.2 Exclusive forum. The state and federal courts located in Buncombe County, North Carolina have exclusive jurisdiction and venue over any dispute arising out of or relating to this Agreement, and each party consents to personal jurisdiction there and waives any objection based on inconvenient forum.

15.3 Injunctive relief. Licensor may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property rights or to enforce Section 3, without posting bond.

15.4 Limitations period. No action arising out of this Agreement may be brought more than one (1) year after the cause of action accrues.

16. General Terms

16.1 Assignment. You may not assign or transfer this Agreement or the license, in whole or in part, by operation of law or otherwise, without Licensor’s prior written consent. Licensor may assign this Agreement freely. Any attempted assignment in violation of this Section is void.

16.2 Entire agreement. This Agreement is the entire agreement between the parties regarding the Software and supersedes all prior or contemporaneous proposals, communications, and agreements, including any prior version of this Agreement.

16.3 Amendment and waiver. Except as provided in Section 1, this Agreement may be amended only in a writing signed by both parties. No failure or delay in exercising a right waives it, and no waiver of one breach waives any other.

16.4 Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable, or if that is not possible, severed, and the remaining provisions remain in full force. In particular, if any limitation in Section 12 or 13 is held unenforceable in whole or in part, the remaining limitations continue to apply to the maximum extent permitted by law.

16.5 Independent contractors. The parties are independent contractors. This Agreement creates no partnership, joint venture, agency, or employment relationship.

16.6 Third-party beneficiaries. There are no third-party beneficiaries to this Agreement.

16.7 Notices. Notices to Licensor must be in writing and sent to the address below, with a copy by email, and are effective on receipt.

16.8 Headings. Headings are for convenience only and do not affect interpretation.

17. Contact

Licensing, redistribution, and automation authorization inquiries:

STIG Solution LLC
27 Applegate Ln
Asheville, NC 28803
mail@stigsolution.com