Terms

Terms of service

The rules for using Palena: what we owe you, what you take on, and where the limits sit. Written to be read once and understood, rather than to be long. Where a signed agreement with MC3 says something different, that agreement wins.

Last updated: August 23, 2026
Provider: MC3 Technologies

01 / Agreement

The agreement

Palena is operated by M3 Technical Solutions, LLC, doing business as MC3 Technologies. In these terms, "MC3", "we" and "us" mean that company, and "you" means both the person using an account and the organization that person acts for.

Using Palena means accepting these terms. If you are using it on behalf of an organization, you confirm you are authorized to accept them for that organization, and they bind it.

Which document wins

Most clients reach Palena through a compliance engagement, which has its own signed paperwork. These terms cover the platform; they do not replace that paperwork. Where the two say different things about the same subject, the order of precedence is:

01Your signed Statement of WorkScope, deliverables, fees, timelines, and any service commitments for your engagement. Nothing on this page changes what you agreed there.
02Your signed non-disclosure agreementHow each side handles the other's confidential information.
03These terms of serviceUse of the platform itself.
04The privacy policyHow we handle personal data, incorporated into these terms by reference.

General

If any provision of these terms is found unenforceable, the rest stays in force and that provision is narrowed only as far as needed. Not enforcing a provision on one occasion does not waive it. You may not transfer your rights under these terms without our written consent; we may transfer ours in connection with a merger, acquisition, or sale of the business.

02 / Scope

What Palena is

Palena is a tool for preparing and documenting CMMC compliance work, used alongside advisory services from MC3. This section is the most important one on the page, because the difference between preparation and certification is the difference between a useful record and a false claim.

What it does

Guides you through scoping, assessment questions, and evidence collection, one step at a time.
Stores your answers and evidence as a documented, reviewable record.
Puts your work in front of MC3 reviewers, who return it with findings or approve it.
Produces compliance documentation and holds the agreements you sign with MC3.

What it does not do

It does not certify you. MC3 is a Registered Provider Organization, not an accredited third-party assessor, and no output of this platform is a CMMC certification.
It does not make your self-assessment true. A self-assessment and the score you file remain your own attestation, made on your own responsibility.
It does not give legal advice. Compliance guidance here, including from MC3 reviewers, is not a legal opinion.
It does not guarantee an outcome. No approval, score, or document from Palena guarantees you will pass an official assessment or win a contract.

Where an official assessment is required, it is performed by an accredited third-party assessment organization, and where a formal opinion is required you should get one from a qualified professional. Palena is the work you bring to those; it is not a substitute for either.

03 / Access

Accounts and access

There is no public sign-up. MC3 creates each account and invites it, which means account access follows your engagement and your role in your organization.

How access works

Accounts are created by MC3 and issued by invitation, with a one-time temporary passwordNo public sign-up
Multi-factor authentication must be set up and kept workingRequired, not optional
An account is for one named person and must not be shared or transferredOne person per account
You see the assessments and evidence of the organizations you belong toScoped to your organization
MC3 administrators can read and act on client work in order to review itReviewer access
You must tell us promptly if an account is compromised, or if someone leaves and should lose accessYour responsibility

You are responsible for what happens under your account, including work submitted by anyone you let use it. If you believe someone has gained access to it, write to us at mc3.cmmchelp@mc3technologies.com and we will lock it.

04 / Your side

Your responsibilities

A compliance record is only worth what the inputs are worth. What we need from you is narrow but not negotiable.

Accuracy

Answer assessment questions truthfully and completely, to the best of your knowledge. MC3 reviews your work but does not independently verify the state of your systems, and cannot detect an answer that is simply untrue.
Upload evidence that genuinely reflects your environment, and keep it current. Evidence that describes an intended state rather than an actual one makes the record misleading.
Correct answers when things change. If a control stops being met after you answered, the record needs updating rather than leaving.
Understand that scores and self-assessments you file with the government are your own attestations. Filing one you know to be inaccurate can carry serious legal consequences for your organization, and using Palena does not shift that exposure to MC3.

Rights in what you upload

Only upload material you are allowed to share with us — you must own it or have permission to disclose it.
Do not upload classified information. Palena is not accredited for it, and nothing in these terms or your engagement paperwork authorizes it.
Take care with personal data about your staff. Upload only what the evidence genuinely requires.
Keep your own copies. Palena holds your compliance record, but it is not a backup service and should not be your only copy of anything.

05 / Ownership

Your content

Who owns what

Your answers, evidence files, and the compliance record built from themYours
The permission you give MC3 to store, process, and review that content in order to deliver the serviceLimited licence to us
Palena itself — the platform, its assessment content, templates, and documentationOurs
Documents generated for you, once delivered under your engagementYours to use
Aggregate, de-identified statistics about platform usage that identify no clientOurs to use

The permission you give us is limited to running the service for you and is not a right to use your material for anything else. We do not sell client content, and we do not use it to train AI models. Handling of personal data is covered by the privacy policy, and confidential information on both sides is covered by the non-disclosure agreement you signed.

06 / Signatures

Electronic signatures

Palena is where you sign your non-disclosure agreement and your Statement of Work. By signing in the platform you agree to do business electronically, and you accept that an electronic signature carries the same legal weight as a signature on paper.

What a signature records

Each signature is stored with an audit record, which is what makes a signed document hold up later.

Who signed, taken from the signed-in account rather than typed inNamed signer
When it was signed, recorded from our own clockServer timestamp
The network address and browser identification of the signing deviceSigning context
A cryptographic fingerprint of the exact file signed, so the copy can be proved unalteredDocument fingerprint

Before you sign

Signing requires that you be authorized to bind your organization. Read the document first — it is downloadable before and after signing, and you should keep your own copy. A signature cannot be withdrawn in the platform once made; if something was signed in error, contact us and we will handle it as a matter between the parties rather than by deleting the record. As explained in the privacy policy, signed agreements and their audit records are kept indefinitely and are not removed when an account is closed.

07 / Automated features

Automated features

Palena includes an assistant that answers questions, and an automated screening pass that reads submitted evidence and raises findings for a reviewer. Both use a large language model, and both can be wrong.

How to treat their output

Automated output is informational. It is not a legal opinion, not a compliance determination, and not a substitute for advice from a qualified professional.
A language model can state something incorrect confidently. Verify anything you are relying on, and raise it with your MC3 reviewer if it matters.
Screening findings are an aid to a human reviewer. An MC3 reviewer approves or returns every submission — no submission is decided by automation alone.
Neither feature knows your systems. It sees only what is in your assessment and the files you uploaded.

What these features send to the model, and where that runs, is set out in the privacy policy. MC3 does not warrant that automated output is accurate or complete, and you remain responsible for the answers you submit and the attestations you make.

08 / Acceptable use

Acceptable use

Palena holds other organizations' compliance records alongside yours. These rules exist to keep that separation intact.

You must not

Try to reach an account, organization, assessment, or file that is not yours, whether by guessing an address, altering a request, or any other means.
Probe, scan, or attempt to defeat the platform's security, or test it for vulnerabilities without our written permission. If you find a weakness, tell us — see below.
Upload malware, or use the platform to attack anything.
Interfere with the platform's availability, including by automating requests at a volume that degrades it for others, or by working around rate limits.
Scrape or bulk-extract content, or copy the platform's assessment material, templates, or documentation for use outside your own engagement.
Reverse engineer, resell, sublicense, or provide the platform to a third party as a service.
Impersonate anyone, or misrepresent who you act for.
Use the platform to break the law, or to prepare a filing you know to be false.

Reporting a security problem

If you find a vulnerability, report it to mc3.cmmchelp@mc3technologies.com and give us a reasonable chance to fix it before telling anyone else. We will not pursue you for a good-faith report that stops at demonstrating the problem, does not access or alter anyone else's data, and does not degrade the service. Do not use another client's record to prove a point.

09 / Availability

Availability and changes

We aim to keep Palena available and working well, and we take the protection of what is in it seriously. We do not, however, promise uninterrupted service on this page. Any uptime or response commitment you have is the one written into your Statement of Work.

We may change, add, or remove platform features as the product and the CMMC program develop. Where a change would materially reduce functionality your engagement depends on, we will give you reasonable notice. Maintenance may make the platform briefly unavailable, and we will avoid business hours where we can.

Assessment questionnaires are versioned. Work you have already submitted stays associated with the version you answered it under, so a later change to the questionnaire does not silently rewrite your record.

10 / Ending access

Suspension and termination

How access ends

You can ask us to close your account at any time, and we will action itOn your request
We may suspend an account immediately where there is a security risk, or a serious breach of the acceptable use rulesImmediate, for cause
We may end access for other breaches of these terms if they are not fixed after noticeAfter notice
Access normally ends when your engagement ends, as set out in your Statement of WorkWith the engagement

What happens to your data

Export what you need before access ends, and ask us if you need help getting a copy. After termination we keep and delete data as described in the privacy policy. Note in particular that signed agreements, their signature audit records, and the platform's audit log are deliberately retained, and survive the closure of the account that produced them. Obligations that are meant to outlast access — confidentiality under your non-disclosure agreement, fees already owed, the disclaimers and liability limits below — continue to apply.

11 / Limits

Disclaimers and liability

Stated plainly rather than in capitals, but these are real limits and you should read them.

Disclaimers

Except where your Statement of Work says otherwise, the platform is provided as it is, without warranties of any kind, whether express or implied — including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement.
We do not warrant that the platform will be uninterrupted or error-free, that it will meet every requirement you have, or that its content and guidance are complete or free of mistakes.
We do not warrant any compliance outcome. That includes passing an official assessment, achieving a particular score, and winning or keeping a contract.

Limitation of liability

Neither party is liable to the other for indirect, incidental, special, consequential, or punitive damages, or for lost profits, lost revenue, lost contracts, or lost or corrupted data, even if it was warned such loss was possible.
MC3's total liability arising out of or relating to the platform and these terms is capped at the fees you paid MC3 under your engagement in the twelve months before the claim arose. Where there are no such fees, it is capped at one hundred United States dollars.
These limits do not apply to liability that cannot be limited by law, and do not cut down any different allocation of liability agreed in your Statement of Work — that document controls for the services it covers.
You will indemnify MC3 against third-party claims arising from your content, from your use of the platform in breach of these terms, or from an attestation you filed that was inaccurate.

12 / Changes and contact

Changes and contact

We may update these terms as the platform and the CMMC program change. When we do, we update this page and move the "Last updated" date at the top — set by hand in the same change as the text, so it marks a real revision. Where a change materially affects your rights or obligations, we will tell you directly rather than relying on you noticing, and continuing to use Palena after that means accepting the new version.

Changes to these terms do not change a signed Statement of Work or non-disclosure agreement. Those are amended only the way they themselves say they can be — in writing, signed by both sides.

Questions about these terms

Ask before you agree to something you are unsure of. Questions about scope, fees, or deliverables are usually answered faster by your MC3 engagement contact than by this page.

Email MC3 Technologies mc3.cmmchelp@mc3technologies.com Privacy policy

M3 Technical Solutions, LLC dba MC3 Technologies

The agreement

Using Palena means accepting these terms. If you are using it on behalf of an organization, you confirm you are authorized to accept them for that organization, and they bind it.

Availability and changes

Changes and contact

Changes to these terms do not change a signed Statement of Work or non-disclosure agreement. Those are amended only the way they themselves say they can be — in writing, signed by both sides.

Terms of service

The agreement

Which document wins

General

What Palena is

What it does

What it does not do

Accounts and access

How access works

Your responsibilities

Accuracy

Rights in what you upload

Your content

Who owns what

Electronic signatures

What a signature records

Before you sign

Automated features

How to treat their output

Acceptable use

You must not

Reporting a security problem

Availability and changes

Suspension and termination

How access ends

What happens to your data

Disclaimers and liability

Disclaimers

Limitation of liability

Changes and contact

Palena Assistant

Terms of service

The agreement

Which document wins

General

What Palena is

What it does

What it does not do

Accounts and access

How access works

Your responsibilities

Accuracy

Rights in what you upload

Your content

Who owns what

Electronic signatures

What a signature records

Before you sign

Automated features

How to treat their output

Acceptable use

You must not

Reporting a security problem

Availability and changes

Suspension and termination

How access ends

What happens to your data

Disclaimers and liability

Disclaimers

Limitation of liability

Changes and contact