What you may not do with this.
This policy is part of the terms of service and applies to govexpress.ai, app.govexpress.ai, and anything either of them produces. Breaking it is a material breach of those terms.
02 — WHO THIS APPLIES TO
Everyone who uses the service — signed in or not, paying or not. Free vendor search has no account behind it, which makes it the surface most exposed to the three restrictions below, so it is covered by them in the same words as everything else.
If you are using the service on behalf of a company, that company is bound by this policy and is responsible for what the people it gives access to do with it.
03 — EXTRACTION, REVERSE ENGINEERING, AND DERIVED WORKS
These three are the ones we will actually enforce, and they are the reason this page exists.
Programmatic access
Except through an interface GovExpress publishes for that purpose, you may not access the Service programmatically. You may not use scripts, bots, crawlers, headless browsers, browser extensions, or any automated process to access, copy, or index the Service or its data.
Reverse engineering
You may not reverse engineer or attempt to reverse engineer any part of the Service. Reverse engineering includes attempting to determine, infer, replicate, or reconstruct the Federal Readiness Score methodology — its indicators, weights, thresholds, normalization, or evaluation logic — whether by inspection, by systematic querying, by differential comparison of outputs across inputs, or by training a model on Service outputs.
Derived works and competing use
You may not resell, sublicense, or redistribute Service data or outputs, use them to build or improve a competing product, or use them as training data for any model.
The middle one deserves a sentence of explanation, because it is wider than the usual version. Scoring runs server-side and clients receive final scores, bands and narratives only — see the security page — so nobody can read the model off a page. The realistic attack is not decompilation: it is asking the service thousands of slightly different questions and inferring the model from how the answers move, or training a model on our outputs until it approximates ours. Both are named above. Both are breaches.
Our robots.txt welcomes search and answer-engine crawlers to this public marketing site, deliberately — it carries no customer data and we want the methodology indexed. That permission is what it says it is and nothing more: it is not a licence to bulk-extract the corpus, and it does not reach the signed-in application at all.
04 — CONDUCT
You may also not:
- Present a GovExpress score as a certification, an accreditation, or a government endorsement — of yourself or of anyone else.
- Use the service to harass, defame, or misrepresent another company.
- Submit intake data you do not have the right to submit, or anyone else’s confidential information.
- Submit controlled unclassified information, classified information, export-controlled technical data, or personal information about consumers. The service is not built to hold any of it.
- Probe, scan, or attack the service outside the terms of our vulnerability disclosure policy.
- Share an account, or resell access to one, so that more people use the service than the seats you bought.
- Remove, obscure, or alter any attribution, source note, or disclosure attached to data we publish.
The vulnerability disclosure exception is a real one and we mean it — good-faith security research inside the scope of our disclosure policy is welcome, and we will not pursue you for it.
05 — WHAT WE DO NOT RESTRICT
Read the methodology and disagree with it
The whole point of publishing it is that you can argue with it. Write to us and tell us where it is wrong.
Quote us, with attribution
Quote a figure, a finding, or a page in your own analysis, deck, or article, with a link back. That is not redistribution and we are not going to pretend it is.
Use your own report however you like, inside your business
Show it to your board, your investors, your capture partner, your prime. It is licensed to you in perpetuity for internal business use.
Search without an account
Vendor search is free, needs no login, and stays that way. Ordinary browsing is not “programmatic access”, and nothing here is a reason to make you sign in.
06 — HOW THIS IS ENFORCED
Where a breach is fixable and is not causing harm, we tell you before we act and give you a chance to stop. Where it is causing harm — to the service, to another customer, or to the integrity of the data — we may suspend or close the account first and explain afterwards.
Suspension for breach does not entitle you to a refund. The terms set out the refund position in full.
We may also take the ordinary technical measures any service takes to keep itself available and its data intact. We do not describe those measures here, for the same reason nobody publishes the floor plan of their own vault.
07 — QUESTIONS, AND REPORTING ABUSE
If you want to do something this policy appears to prohibit — an integration, a research project, a bulk export for a legitimate purpose — ask. Write to hello@govexpress.ai and describe it. A published interface is how that gets granted, and asking is how one gets built.
If you think somebody is misusing the service or misrepresenting a GovExpress score, tell us at hello@govexpress.ai. Security issues have their own front door: the vulnerability disclosure policy.