Terms of Service

1. The service

The Service helps organisations classify and document their AI systems, and show that they comply with the EU AI Act and related data protection law (the EU GDPR and the UK GDPR). It includes:

• A Navigator that classifies the risk of an AI system.
• A Guided Discovery workflow that records evidence against each regulatory requirement.
• A System Registry that lists an organisation's AI systems and their Classification Decision Records (CDRs).
• A sealed audit trail of compliance decisions, ready for a regulator to review.
• Access controls for compliance, legal and oversight roles within each organisation.

Rules compute every determination in the Service from our regulatory corpus, your answers and facts stated in your own description with a verified source. AI writes only the explanations beside citations and the guidance that checks your Guided Discovery answers. We keep the corpus traceable and reviewed, and you can report a problem with any output to support@standardintelligence.com. You review outputs before relying on them. The Service is not legal advice.

We tell you in advance of a material change to how your analysis is produced, except for urgent security or legal fixes.

We improve the Service continuously. We announce material changes to features in the product or by email to administrators.

2. Accounts

You must give accurate information when you sign up. You are responsible for keeping your sign-in details secure and for all activity on your account. If you suspect unauthorised access, tell us promptly at security@standardintelligence.com.

Each user must have their own account. You must not share sign-in details.

Each customer organisation's administrators ("organisation administrators") are responsible for inviting users, assigning roles and removing users who leave the organisation. The administration panel in the Service provides the tools for these tasks.

3. Plans, billing and trials

We offer the Service on subscription plans. You see the plan terms, including prices, included usage and charges for extra usage, when you sign up and whenever you change plan. Our prices exclude VAT and similar taxes. Where UK VAT applies, we add it at the current rate. If you are a business outside the UK, you account for any local VAT under the reverse charge.

If we offer a free trial, we describe its length and the features it includes when you sign up. Before a trial ends, we tell you and invite you to move to a paid plan before we charge anything. If you cancel before the trial ends, you pay nothing.

Subscriptions renew automatically for the same period unless you cancel in advance. You can cancel in the administration panel or by email to billing@standardintelligence.com. Cancellation takes effect at the end of the current period. We do not refund fees already paid, except as clause 12 provides or where the law requires it.

If a payment fails, we retry it and tell the organisation administrator. We may suspend access to the Service if a payment is still unpaid more than 14 days after its due date.

Stripe processes payments under its own terms. We keep only the references we need to match payments to invoices. Our Privacy Policy describes the data we hold.

4. Acceptable use

You must not:

• Use the Service to break any law or regulation, including data protection law and export controls.
• Upload content that you do not have the right to upload.
• Use the Service to develop a competing product.
• Try to reverse-engineer the Service or to access another organisation's data.
• Probe, scan or test the vulnerability of any system, except as our Vulnerability Disclosure Policy allows or with our explicit written permission. We welcome coordinated disclosure of vulnerabilities at security@standardintelligence.com.
• Submit malicious code, try to exhaust resources or interfere with other customers' use of the Service.
• Enter special categories of personal data, such as health data, biometric data or political opinions, in AI system descriptions or other free-text fields in the product.

We may suspend or end your access for a serious or repeated breach of this clause. We give notice where we practicably can.

5. Customer data and intellectual property

You keep all rights, title and interest in the data and content that you upload to the Service ("Customer Data"). You give us a limited licence to process Customer Data only as needed to provide the Service and as set out in our Data Processing Agreement (DPA). We send you the DPA on request.

We do not use Customer Data to train AI models. Our AI sub-processors keep it for no more than 30 days, for abuse monitoring, where they keep it at all.

We keep all rights, title and interest in the Service, including its software, designs, documentation and trade marks. These Terms give you the right to use the Service. They do not transfer any other rights in our intellectual property to you.

You allow us to use anonymous, aggregated usage data to improve the Service. We do not share aggregated data in a form that could identify your organisation unless you give us prior written consent.

6. Confidentiality

Each party treats the other party's non-public information as confidential. Each party uses that information only to perform these Terms. Each party protects it with at least the care it applies to its own confidential information, and never less than reasonable care. Customer Data is the customer's confidential information by default.

Either party may disclose confidential information where the law, a court or a regulator requires it. Where the law allows, it tells the other party first and discloses only what is required.

Confidentiality obligations continue for five years after these Terms end. Trade secrets stay confidential for as long as they qualify as trade secrets under English law.

7. Service levels and availability

We aim to provide a reliable Service. Any specific availability commitments and any credits for downtime are set out in the order form or in a separate Service Level Agreement (SLA) signed with it. Without a signed SLA, we provide the Service on a best-effort basis and make no contractual uptime commitment.

Planned maintenance may briefly affect availability. We give reasonable notice in advance, except for security or stability fixes that cannot wait.

8. Security

We apply appropriate technical and organisational measures to protect Customer Data. These include encryption in transit and at rest, logical separation of each organisation's data, protection of the audit trail of compliance decisions against unauthorised change, and the measures set out in our DPA.

If we discover a personal data breach that affects Customer Data, we notify the organisation administrator without undue delay. We do so within 48 hours of becoming aware of the breach at the latest. We give you the information you need to meet your own obligation under Article 33 of the UK GDPR or the EU GDPR, whichever applies to you.

9. Suspension and termination

You can cancel as clause 3 describes. Clause 3 also covers suspension for unpaid fees.

We may end the Service if fees are more than 30 days overdue. We may suspend or end the Service for a material breach that you do not put right within 30 days of our written notice. We may suspend or end the Service immediately if:

• (a) you commit a serious or repeated breach of clause 4; or
• (b) we reasonably believe that continuing the Service would expose us or other customers to legal or security risk.

When the Service ends:

• We close your organisation's account but keep it intact for 90 days. During that time, you can download a full export of Customer Data, including the audit trail and Classification Decision Records. If you cancelled, you can also reactivate the account with everything as it was. If we ended the Service under this clause, you can reactivate it only with our agreement.
• After 90 days, we delete Customer Data, including the audit trail and Classification Decision Records. You can ask us to delete it sooner. We then delete it within 30 days of your request. Deleted data leaves our backups within 30 days.
• We keep billing records for six years, as UK tax law requires. Our Privacy Policy states how long we keep each kind of personal data.

10. Warranties and liability

We warrant that we provide the Service with reasonable skill and care. Beyond this warranty, we provide the Service "as is". Except as these Terms expressly state, we exclude all terms implied by statute or common law, to the extent the law permits.

The Service is a compliance and documentation tool. It is not legal advice. The customer remains responsible for compliance decisions and for submissions to regulators.

Liability cap. Subject to the next paragraph, our total aggregate liability under or in connection with these Terms in any 12-month period is limited to the fees you paid us under these Terms in the 12 months before the event that gave rise to the liability.

Nothing in these Terms excludes or limits any liability that English law does not allow us to exclude or limit. This includes liability for death or personal injury caused by negligence, for fraud and for fraudulent misrepresentation.

We are not liable for indirect or consequential loss, loss of profit or loss of business opportunity. We are not liable for loss of data where the loss arises because you did not keep your own backups of Customer Data that you exported.

11. Indemnity

You will indemnify us against losses we suffer that arise from:

• your breach of clause 4 (Acceptable use); or
• a claim by a third party that Customer Data you uploaded infringes their intellectual property or breaches their privacy rights.

If such a claim arises, we tell you promptly. We let you conduct the defence, provided you do so without harming our reasonable interests. We cooperate reasonably, at your cost.

12. Changes to these terms

We may change these Terms from time to time. We tell you about material changes in advance, in the product or by email to the organisation administrator. A change that materially reduces your rights or increases your obligations takes effect at your next renewal, unless you agree to it earlier or the law requires it sooner. If you do not accept it, you can cancel before that renewal. If the law requires it sooner, you may cancel and we refund the unused part of any prepaid fees. Each published change updates the version number and the date shown with these Terms.

13. Governing law and jurisdiction

The laws of England and Wales govern these Terms and any dispute or claim that arises from them. The courts of England and Wales have exclusive jurisdiction. However, we may bring proceedings to enforce our intellectual property rights in any competent jurisdiction.

We offer the Service to organisations. If you are nevertheless a consumer, the mandatory consumer protection laws of your country of residence also apply.

14. General

• Assignment. You may not assign these Terms without our prior written consent. We may assign these Terms, with notice to you, as part of a merger, an acquisition or a sale of all or substantially all our assets.
• Notices. Send notices to us at legal@standardintelligence.com, with a copy to our registered office address. We send notices to you at the email address of the organisation administrator account.
• Force majeure. Neither party is liable for a failure or delay caused by events outside its reasonable control, provided it acts promptly to limit the effect.
• Severability. If a clause cannot be enforced, the rest of these Terms stay in effect.
• Entire agreement. These Terms, the DPA, any signed order form and any signed Service Level Agreement are the entire agreement between us about the Service. They replace any earlier agreements on the same subject. Our Privacy Policy explains how we handle personal data as a controller. It does not form part of these Terms.

15. Contact

• Sales and contracts: sales@standardintelligence.com
• Legal: legal@standardintelligence.com
• Privacy: privacy@standardintelligence.com
• Security: security@standardintelligence.com
• Billing: billing@standardintelligence.com
• Support: support@standardintelligence.com