Skip to content
Context GRC

Legal

Terms & Conditions

Last updated 14 November 2026.

Scope and acceptance

These Website Terms & Conditions govern your use of goevolve.com, operated by GoEvolve LLC, doing business as GoEvolve Assurance, based in Washington State.

These terms also govern the communications you have with us through this website, including phone, email, and SMS messages related to an inquiry you make.

These terms do not govern the Context GRC software itself. Context GRC is provided under a separate written license agreement negotiated between your organization and GoEvolve LLC.

SMS / Text Messaging Program Terms

GoEvolve Assurance uses conversational SMS messaging only for pilot and information inquiries, callback and briefing coordination, and direct follow-ups related to your request. We do not send marketing blasts or automated promotional campaigns.

You can opt in to SMS messages in either of the following ways:

  • Verbally during an inbound phone call to (253) 322-0800 when you provide your mobile number and ask us to use SMS as your preferred return contact method.
  • By checking the separate, optional SMS opt-in checkbox on the website Request a Pilot form.

Message frequency varies based on your inquiry and active conversation. Message and data rates may apply.

To opt out of SMS messages, reply STOP, CANCEL, UNSUBSCRIBE, QUIT, or END at any time. You will receive one confirmation message and no further SMS messages unless you opt in again.

For help, reply HELP, email info@goevolve.com, or call (253) 322-0800.

Wireless carriers are not liable for delayed or undelivered messages.

See our Privacy Policy for details on how we handle phone numbers and SMS consent data.

Acceptable use

This site is intended for informational use by people working in utilities and other organizations. You agree not to use automated tools to scrape or probe the site, interfere with its operation, or submit confidential operational, OT, or vulnerability details through the public form.

Informational content and compliance disclaimer

Website materials describe Context GRC capabilities designed to support compliance programs. Context GRC is not itself certified, authorized, or accredited under NERC CIP, FedRAMP, CMMC, or other regulatory programs. Information on this site does not constitute legal or regulatory advice.

Intellectual property

Trademarks, logos, text, and graphics on this site belong to GoEvolve LLC. All rights are reserved.

Disclaimers and limitation of liability

This site is provided "as is" without warranties of any kind. To the extent permitted by law, GoEvolve LLC is not liable for indirect, incidental, or consequential damages arising from your use of this website.

Governing law

These terms are governed by the laws of Washington State, without regard to conflict-of-law principles.

Changes to these terms

We will update the date at the top of this page when these terms change.

Contact us

Questions about these terms can be sent to info@goevolve.com or (253) 322-0800. GoEvolve LLC, doing business as GoEvolve Assurance, Washington State.

Trust & Security

Built to be inspected

Designed to support your programs. It does not confer certification.

  • Air-gap ready

    Containerized on-prem or private cloud. Every front-end library is vendored locally with documented licenses and SHA-256 manifests, so there are no runtime CDNs.

  • Credentials & MFA

    PBKDF2-HMAC-SHA256 at 600,000 iterations, a NIST SP 800-63B passphrase policy, and TOTP multi-factor authentication.

  • Secrets

    Integration credentials are Fernet-encrypted with a rotation script. Secrets are injected through Docker secrets.

  • Transport & ledger

    TLS between services and a hash-chained, tamper-evident audit ledger of recorded actions.

  • Worker isolation

    Ed25519-signed task envelopes, a least-privilege worker database role under row-level security, pre-persistence DLP screening, and fenced untrusted document text in prompts.

  • Access control

    Role-based access with per-context role grants, and context-scoped views and roles.

  • Supply chain

    177 exact-pinned packages with about 3,000 SHA-256 hashes. CI gates: Bandit, TruffleHog, pip-audit --strict, a copyleft license gate, and Trivy.

  • Attributable approvals

    AI-proposed controls, mappings, and actions are staged for a named, authenticated reviewer to approve across four triage touchpoints, with the decision recorded. Cmd+K opens the command palette.

Licensing

  • Licenses are Ed25519-signed tokens verified locally, with no phone-home.
  • Tiers are set by the number of contexts and internal users.
  • Free Auditor: auditor accounts never consume a seat.
  • After a 14-day grace period the platform moves to a read-only archive. It never locks you out of your records.