Trust documents

Terms of Service

Effective date: 2026-10-01

These terms form the agreement between CrossTenant Ltd, a company registered in England & Wales (company no. 17349672), registered office Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds IP28 7DE ("Vaze", "we", "us") and the organisation that creates or uses a Vaze workspace ("you", the "Customer").

1. Definitions

• Service — the Vaze console at app.vaze.ai, any associated software, documentation and support we provide.
• Free Service — the ongoing management and basic-security foundation made available for £0, without payment details.
• Order — an optional written or online agreement for paid optimisation, advanced security or policy capabilities, tailored work or another paid service, stating its scope, fees and term.
• Estate — one organisation's set of connected AI vendor accounts as represented in the Service. A managed service provider may hold several.
• Connected Vendor — an AI vendor account (for example an OpenAI organisation, an Anthropic organisation, a GitHub organisation, a Microsoft 365 tenant, a Google Workspace domain or an OpenRouter account) for which you have supplied Vaze a credential.
• Authorised User — an individual you permit to sign in to the Service.
• Customer Data — data you or your Authorised Users put into the Service, and data the Service reads from a Connected Vendor on your instructions.
• DPA — the Data Processing Agreement, which forms part of this agreement.

2. The agreement

This agreement consists of these terms, the DPA, the sub-processor list and any Order you expressly agree. You do not need an Order to use the Free Service. If these documents conflict, an Order prevails for the commercial points it covers, and the DPA prevails on data-protection matters. Our privacy policy describes how we handle personal data; it is a notice, not a contractual term.

This agreement starts when you first accept it, sign an Order or begin using the Service, whichever happens first, and continues for the term in section 10.

3. The Service and your licence to use it

We grant you a non-exclusive, non-transferable right to use the Service during the term for your internal business purposes, or, where your Order says so, to administer the AI estates of organisations you are contracted to manage. You must not resell the Service, reverse-engineer it, use it to build a competing product, or attempt to access another customer's estate.

Early access

The Service is in a founder-led early-access phase. Features may change, and figures the console cannot measure are labelled as absent, partial or attested rather than estimated. Early-access terms in an Order override this section where they differ.

4. Your authority over the vendor accounts you connect — the load-bearing clause

You may connect a vendor account only if you are, or act with the authority of, an administrator of that account entitled to grant the credential you supply. For an estate you administer on another organisation's behalf, you confirm that your agreement with that organisation permits you to connect it and to let Vaze read the data described in the privacy policy. You are responsible for every action your Authorised Users take through the Service, including proposing, approving and executing a change at a Connected Vendor. We may suspend an estate if we reasonably believe this section has been breached.

5. Accounts, access and security

• Sign-in is federated only: customers sign in with a Google identity, and Microsoft sign-in is enabled only for a single pinned Microsoft directory, not for arbitrary Microsoft organisations. Vaze holds no passwords. The Service is for organisations even where an identity provider does not label an address as a work account.
• You control which identities are Authorised Users and what roles they hold. Capabilities such as approver or break-glass grant no read or write on their own.
• Vendor credentials you supply are stored server-side and never returned to the browser. You should scope them read-only wherever the vendor allows, and you can revoke them at the vendor at any time; the Service then reports that source as unavailable rather than filling the gap.
• You must tell us promptly if you believe an Authorised User's identity or a connected credential has been compromised.

6. Fees, invoicing and payment

The Free Service costs £0. It does not require a payment card, does not create an invoice and does not convert into a paid service automatically. We charge only for a paid service that you expressly accept in an Order.

Fees for a paid service are those set out in its Order. Unless the Order says otherwise, paid recurring services are charged per estate (company), per month, in advance. All fees are exclusive of VAT and any other applicable taxes, which you pay in addition at the prevailing rate. Invoices are payable within 14 days of the invoice date unless the Order states otherwise. We may increase paid fees on renewal by giving you at least 30 days’ notice before the renewal date; if you do not accept an increase, you may terminate the affected Order with effect from the end of its current term. Interest on overdue amounts under a paid Order accrues as provided by the Late Payment of Commercial Debts (Interest) Act 1998. We may suspend only the affected paid service if an invoice is more than 30 days overdue and we have given you at least 7 days’ written notice, limiting the suspension to what is necessary and restoring access as soon as the overdue amount is paid.

7. Suspension

We may suspend access to the Service or to an estate where we reasonably believe there is a security risk, a breach of section 4, unlawful use or non-payment after notice. We will restore access when the cause is resolved and tell you why access was suspended unless the law prevents it.

8. Availability, maintenance and support

The Service runs as a single instance and carries no uptime commitment at this stage. Availability is monitored externally and a responder is notified of a readiness failure; that is a detection control, not a service-level agreement. Support channel, response expectation and maintenance notice are as follows: support is by e-mail to the contact in section 18, with a best-efforts response within two business days; planned maintenance is notified at least 48 hours ahead where practical; no service-level agreement or service credits are offered at this stage.

9. Data protection and Customer Data

Customer Data remains yours. We process it only to provide the Service, under the DPA, and we do not sell it, use it for advertising or use it to train machine-learning or AI models. The DPA sets out roles, security measures, sub-processors, breach handling and deletion.

10. Term, renewal and termination

The Free Service continues until you close it or either party terminates it by written notice. A paid service has the initial term, renewal and notice periods set in its Order and in section 6. Either party may terminate for a material breach that is not remedied within 30 days of written notice.

What happens on termination

Your access ends. You should revoke each connected credential at its vendor. At your choice Vaze returns or deletes the personal data processed on your behalf under section 9 of the DPA, with live return and deletion completed within 30 days. Restricted recovery copies expire through the disclosed recovery schedules; a fixed all-copy 90-day deadline is not part of this release. The DPA and Privacy Notice explain the separately retained security records. Vaze's deletion does not delete data held independently by your Connected Vendors.

11. Intellectual property

We own the Service and everything in it except Customer Data. You grant us the right to process Customer Data to provide the Service. Feedback you give us may be used without obligation.

12. Confidentiality

Each party will keep the other's confidential information confidential, use it only for this agreement and protect it with reasonable care, except where disclosure is required by law or the information is already public through no fault of the recipient.

13. Warranties and disclaimers

We will provide the Service with reasonable skill and care. Beyond that, the Service is provided as is. In particular:

• Figures come from your vendors. The Service reports what a Connected Vendor's API returns. Where a vendor exposes no figure, or a read fails, the Service labels the absence; it does not estimate. A labelled absence is not a defect.
• Attested answers are yours. Readiness scores combine measured vendor data with answers your operators attest to. The Service does not verify an attestation.
• Recommendations are not advice. A recommendation or a proposed action is information for a human decision, not legal, financial or security advice.
• The audit trail has stated limits. Its integrity properties, and the two limits the design carries, are stated on the security page. Nothing in these terms extends them.

Direct writes — the enforced approval gate

The Service executes a change at a Connected Vendor only for a narrowly registered kind of action, only after that action has been proposed and approved under your own policy, and only when an Authorised User explicitly executes it. Emergency execution requires a written reason and consumes the approval. You acknowledge that the person who executes an action, not Vaze, decides that it should happen.

14. Liability

14.1 Nothing in this agreement limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot be limited or excluded by law.

14.2 Subject to 14.1, neither party is liable to the other, in contract, tort (including negligence), breach of statutory duty or otherwise, for loss of profit, loss of business, loss of goodwill or loss of anticipated savings, or for any indirect or consequential loss.

14.3 Subject to 14.1, each party's total liability to the other arising out of or in connection with this agreement in each period of 12 months beginning on the date this agreement starts, or on an anniversary of that date, is limited to the greater of (a) the total fees paid and payable by the Customer for that period and (b) £1,000. The Free Service is provided without charge; limit (b) applies to it.

14.4 The limit in 14.3 does not apply to the Customer's obligation to pay fees properly due under an Order, or to the Customer's liability under section 15.

14.5 Nothing in this section limits either party's liability to a data subject. As between the parties, liability under the DPA is subject to this section.

15. Indemnity

You will indemnify us against loss, damage and reasonable costs arising from a claim by a third party that results from a breach of section 3 (use restrictions) or section 4 (authority over the accounts you connect), including a claim by the owner of an account you connected without authority. We give no intellectual-property indemnity at this stage; if that changes it will be set out in an Order.

16. Changes to these terms

We may update these terms. For a material change, we publish the change on the relevant page and e-mail the Customer’s primary account contact (and any billing contact named in a paid Order) at least 30 days before a material change takes effect. If a change materially disadvantages you, you may terminate with effect from the date it takes effect; for an affected paid service, we refund the unused proportion of prepaid fees. Continued use after the change takes effect is acceptance of it.

17. General

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Neither party may assign it without consent, except to a successor of its business. If a clause is unenforceable the rest stands. This agreement is the entire agreement on its subject.

18. Contact

contact@vaze.ai · CrossTenant Ltd (company no. 17349672)