Terms of service

1. The agreement

These terms are an agreement between the business that operates GhostAudit at ghostaudit.ai ("GhostAudit", "we") and the organization that creates an account or signs an order ("customer", "you"). By creating an account or using the service you accept them on behalf of that organization and confirm you have authority to do so. If you have a signed agreement with us, that agreement prevails where it conflicts with these terms.

2. The service

GhostAudit provides software for governing an organization's use of AI: an AI system inventory, discovery of AI tools, endpoint sensors (a browser extension and a desktop agent), framework assessments, a regulation tracker and document generation. The features available to you depend on your plan, as described on the pricing page.

We may improve and change the service. We will not materially reduce the core functionality of a plan during a paid subscription term.

3. Accounts

You are responsible for your users, for keeping credentials confidential, and for activity under your accounts. Tell us promptly at [email protected] if you suspect unauthorized access. Users must be at least 18.

4. Trials

We may offer a free trial, currently 14 days. During a trial the service is provided as is, without the commitments in sections 10 and 12. At the end of a trial the workspace is limited or suspended unless you subscribe; we may delete trial data after a reasonable period. One trial is offered per organization: signing up again after deleting a workspace continues the earlier trial period.

5. Subscriptions, fees and seats

Paid plans are priced per covered employee per month, billed monthly or annually in advance, as shown at checkout or in your order. A covered employee is a person reported by a sensor in the last 30 days, or the purchased seat count, whichever is higher. If your covered employees exceed your purchased seats, we may charge for the additional seats pro rata from the next billing date, after notifying you.

Subscriptions renew for successive terms of the same length unless either party cancels before renewal. Fees are exclusive of taxes, which you are responsible for, other than taxes on our income. Except where these terms or the law say otherwise, fees are non-refundable. We may change prices with effect from your next renewal, with at least 30 days' notice.

If a payment is overdue we may, after notice, suspend the service until it is paid.

6. Your data

You keep all rights in the data you and your sensors submit to the service ("customer data"). You grant us the rights needed to host, process and display it in order to provide and support the service, and for no other purpose. We do not use customer data to train machine-learning models.

Where customer data includes personal data, the data processing addendum applies and forms part of these terms. You are the controller of that data; we are your processor.

You can export documents and audit logs from the service. After termination we delete customer data as described in the addendum.

7. Your responsibilities for employee monitoring

If you deploy the sensors, you decide whether and how to do so. You are responsible for having a lawful basis, for informing your employees and other users, for consulting employee representatives where required, and for choosing an identity mode appropriate to your jurisdiction. The sensors provide a place to display your notice to employees; the content and adequacy of that notice are yours.

8. Acceptable use

Your use of the service must comply with our acceptable use policy, which is part of these terms.

9. Our intellectual property

We and our licensors own the service, the sensors, the AI tool catalog, the requirement library, the regulatory content and the document templates. We grant you a non-exclusive, non-transferable right to use them during your subscription for your internal business purposes. Documents you generate from your own data are yours to use, edit and share without restriction.

If you send us feedback, we may use it without obligation to you.

10. Service commitments

We will provide the service with reasonable skill and care, and maintain the security measures described on our security page or better. Specific availability or support commitments apply only if stated in an order or a signed service-level agreement.

11. Not legal advice

The regulatory summaries, applicability mapping, assessments and generated documents are tools to support your own compliance work. They are not legal advice and do not guarantee compliance with any law or standard, or certification against any framework. You are responsible for your compliance decisions and should take advice from qualified counsel.

12. Warranties and disclaimers

Each party warrants that it has the authority to enter this agreement. Except as expressly stated in these terms, the service is provided without warranties of any kind, whether express, implied or statutory, including warranties of merchantability, fitness for a particular purpose and non-infringement, to the fullest extent the law allows.

13. Limitation of liability

To the fullest extent the law allows, neither party is liable for indirect, incidental, special or consequential loss, or for loss of profits, revenue or data. Each party's total liability arising out of this agreement in any 12-month period is limited to the fees paid or payable by you for the service in that period. These limits do not apply to liability that cannot be limited by law, to your payment obligations, or to either party's liability for fraud or wilful misconduct.

14. Confidentiality

Each party will protect the other's confidential information with reasonable care, use it only to perform this agreement, and disclose it only to those who need it and are bound to protect it, or where required by law.

15. Term and termination

These terms apply for as long as you have an account. You may cancel at any time with effect from the end of the current billing term. Either party may terminate for the other's material breach that is not remedied within 30 days of notice. We may suspend accounts that seriously breach the acceptable use policy or put the service at risk.

16. Self-hosted software

If you run GhostAudit on your own infrastructure, your order or licence agreement governs the software licence, and you are responsible for operating, securing, backing up and updating your deployment. Sections 6, 7, 8, 9 and 11 to 14 of these terms apply to self-hosted use.

17. Changes to these terms

We may update these terms. We will post the new version here and, for material changes, notify account administrators at least 30 days before they take effect. Continued use after that date is acceptance.

18. Governing law

This agreement is governed by the law named on your order form. If there is no order form, or it names none, it is governed by the law of the place where the operator of GhostAudit is established, and the courts of that place have exclusive jurisdiction, without limiting either party's right to seek urgent relief elsewhere.

19. General

This agreement, with any order and the documents it refers to, is the whole agreement between the parties on its subject. Neither party may assign it without the other's consent, except to a successor to its business. If part of it is unenforceable the rest remains in force. Notices to us go to [email protected]; notices to you go to the email of your account owner.

20. Contact

GhostAudit, [email protected]. Registered company details are stated on order forms and invoices and are available on request.