Terms & Conditions

1. Who we are

Firewall Valley is a business name of Vantir Group LLC ("Firewall Valley," "we," "us," or "our"). Firewall Valley is a Vantir Group company. These Terms & Conditions ("Terms") govern your use of firewallvalley.com (the "Site") and any services we provide to you (the "Services").

2. Accepting these Terms

By using the Site or engaging us for Services, you agree to these Terms. If you are using the Site or Services on behalf of a company, you confirm that you have authority to bind that company, and "you" includes that company.

If you and we sign a separate engagement letter, statement of work or services agreement (an "Engagement Agreement"), that document controls to the extent it conflicts with these Terms. Otherwise, these Terms apply in full.

3. Using this website

The Site is for general information only. Reading the Site, or contacting us through it, does not create a client relationship. Content on the Site — including our summaries of 23 NYCRR Part 500 and other regulations — may be incomplete or out of date and should not be relied on as a statement of your obligations.

Do not send passwords, account numbers, Social Security numbers, borrower files or other nonpublic personal information through the Site's contact form or by unencrypted email.

You agree not to misuse the Site, including by attempting to gain unauthorized access, interfering with its operation, scraping it at a volume that burdens it, or using it for any unlawful purpose.

4. Our services

We provide cybersecurity consulting, Microsoft 365 configuration, risk assessments, written policies and other compliance documentation, and related advisory services for mortgage brokers and similar businesses. The scope of any engagement is limited to what is described in the applicable Engagement Agreement or written proposal. Anything not expressly included is out of scope.

Our deliverables are prepared from the information, access and systems you make available to us at a point in time. Your environment, the threat landscape, vendor products and regulations all change, and a deliverable may not remain accurate after it is delivered.

5. Not legal, accounting or regulatory advice

We are not a law firm or an accounting firm, and nothing we provide is legal, accounting, tax or regulatory advice. Information we provide about regulations — including whether you may qualify for a limited exemption under 23 NYCRR 500.19(a) or an exception under the FTC Safeguards Rule — is general in nature. You are responsible for determining your own legal and regulatory obligations and should consult your own attorney.

You, not Firewall Valley, are the regulated entity. You are solely responsible for decisions about your cybersecurity program, for any certification, acknowledgment, notice of exemption or other filing made to the New York State Department of Financial Services or any other regulator, and for the accuracy of those filings. We do not sign, certify or submit regulatory filings on your behalf unless an Engagement Agreement expressly says so.

6. Your responsibilities

You agree to:

• provide complete and accurate information, and tell us promptly about changes that affect our work;
• give us the access, approvals and cooperation reasonably needed to perform the Services, and use accounts with no more privilege than the work requires;
• review our deliverables and recommendations before relying on them, and decide which to implement;
• remain responsible for operating, maintaining, monitoring and backing up your own systems and data, including the security of accounts you control;
• train your personnel and enforce your own policies; and
• comply with all laws and regulations that apply to your business.

We are not responsible for any failure or delay caused by inaccurate or incomplete information, by your decision not to implement a recommendation, or by changes you or your other providers make to your environment.

7. Our use of artificial intelligence

We use artificial intelligence tools, including agentic AI, to help review configurations, gather evidence and draft documents. A qualified member of our team reviews AI-assisted work before it is delivered to you. AI-assisted output can still contain errors or omissions, and our human review does not guarantee that a deliverable is error-free. You remain responsible for reviewing deliverables before you rely on or submit them.

8. Third-party products and services

Our work often involves products and services we do not control, such as Microsoft 365, Microsoft Azure, loan origination systems, CRMs, internet service providers and other vendors. We are not responsible for the availability, performance, security, pricing, changes or failures of any third-party product or service, and your use of them is governed by your agreements with those providers.

9. No guarantee of outcomes

No security program can eliminate risk. Cybersecurity services reduce risk; they do not prevent every attack. We do not guarantee that you will pass any audit or examination, avoid findings, penalties or enforcement action, or that your systems, accounts or data will be free from unauthorized access, phishing, business email compromise, wire fraud, ransomware, malware, data loss or any other security incident.

10. Disclaimer of warranties

Except as expressly stated in a signed Engagement Agreement, the Site and the Services are provided "as is" and "as available." To the fullest extent permitted by law, we disclaim all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy and that the Site or Services will be uninterrupted, secure or error-free.

11. Limitation of liability

To the fullest extent permitted by law, in no event will Firewall Valley, Vantir Group LLC, or their owners, members, managers, officers, employees, contractors or agents be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, business, goodwill or data, or costs of substitute services, arising out of or relating to the Site or the Services — including any damages arising from a cyberattack, data breach, unauthorized access, ransomware, wire or payment fraud, regulatory fines or penalties, breach notification or credit monitoring costs, or claims by your customers or borrowers — even if we were advised of the possibility of such damages.

Our total liability for all claims arising out of or relating to the Services will not exceed the fees you actually paid us for the specific Services giving rise to the claim during the twelve (12) months before the event giving rise to the claim. For claims relating only to use of the Site, our total liability will not exceed one hundred U.S. dollars (US$100).

These limitations apply regardless of the legal theory (contract, tort, negligence, strict liability or otherwise) and even if a remedy fails of its essential purpose. They do not limit liability that cannot be limited under applicable law, such as liability for our own fraud or willful misconduct.

12. Indemnification

You agree to defend, indemnify and hold harmless Firewall Valley, Vantir Group LLC, and their owners, members, managers, officers, employees, contractors and agents from and against any claims, losses, liabilities, damages, fines, penalties, costs and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) your information systems, data or business operations; (b) any security incident affecting you or your customers; (c) your regulatory obligations, filings or certifications; (d) your failure to implement our recommendations or to follow your own policies; (e) information you provided to us; or (f) your violation of these Terms or of any law — except to the extent caused by our own fraud or willful misconduct.

13. Security incidents and notifications

If you experience a cybersecurity incident, you are responsible for any notice required by law or regulation, including any notice to the New York State Department of Financial Services within the time required by 23 NYCRR 500.17 and any notice to affected individuals. We may help you if an Engagement Agreement covers incident support, but we do not make notifications on your behalf unless it expressly says so. Please contact your own counsel and, if you have one, your cyber insurance carrier promptly.

14. Confidentiality

We will keep non-public information you share with us during an engagement confidential and use it only to provide the Services, except where disclosure is required by law, is to our personnel and contractors who need it and are bound by confidentiality obligations, or is otherwise permitted by an Engagement Agreement. Access we are given to your systems will be used only for the agreed scope. See our Privacy Policy for how we handle personal information.

15. Intellectual property

The Site and its content, design, logos and trademarks belong to Vantir Group LLC or its licensors. You may view the Site for your own information but may not copy, republish or create derivative works from it without our permission.

Once you have paid for a deliverable in full, you may use and modify it for your own internal business and compliance purposes. We keep ownership of our pre-existing materials, templates, methods, tools and know-how, and of general knowledge we gain while performing the Services.

16. Fees

Fees, payment terms and any expenses are set out in the applicable proposal or Engagement Agreement. Unless it says otherwise, fees are non-refundable once the related work has been performed.

17. Time limit for claims

To the extent permitted by law, any claim arising out of or relating to the Site or the Services must be brought within one (1) year after the claim arose, or it is permanently barred.

18. Governing law and venue

These Terms are governed by the laws of the State of New York, without regard to its conflict-of-laws rules. You agree that any dispute will be brought exclusively in the state or federal courts located in the State of New York, and you consent to their jurisdiction. Before filing any claim, each party agrees to try in good faith to resolve the dispute informally for at least thirty (30) days after written notice.

19. Changes to these Terms

We may update these Terms from time to time. The "Last updated" date above shows when they last changed. Changes apply from the date posted; they do not change a signed Engagement Agreement unless both parties agree in writing.

20. General

If any part of these Terms is found unenforceable, the rest remains in effect and the unenforceable part will be enforced to the maximum extent permitted. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our written consent; we may assign them to an affiliate or successor. These Terms, together with any Engagement Agreement, are the entire agreement between us about their subject matter.

21. Contact us

Vantir Group LLC (Firewall Valley)
400 Rella Blvd, Montebello, NY 10901
info@firewallvalley.com