Terms of Service

This is the most important clause in the document, so it goes first rather than in a schedule at the end.

The service maps regulations to obligations, obligations to controls, and controls to evidence. Those mappings are researched and deterministic, and we show you our working. They are still a starting point for professional judgement, not a legal opinion about your organisation.

You remain responsible for your own regulatory compliance. Where the service indicates a regulation applies or an obligation is satisfied, you should have that confirmed by someone qualified to give the advice before you rely on it in a filing, an audit, or a response to a regulator.

You need an account to use the service. You are responsible for what happens under it, for keeping your credentials confidential, and for the accuracy of the organisation profile you supply - the applicability engine reasons from it, so wrong inputs produce wrong conclusions.

API keys are shown once, when created. We store only a hash, so we cannot recover a lost key and neither can anyone who reads our database. Keys carry a scope: an agent key can run audits but can never approve their findings. Treat keys as credentials, rotate them when someone leaves, and tell us immediately if one is exposed.

You own the compliance content you put into LedgerAI. We claim no ownership of it. You grant us only the licence needed to host, process and display it back to you, and to your colleagues you have granted access.

We do not use your compliance content to train models, and we do not sell it.

You may export your data. Attestations are designed to be verifiable independently of us: a signed audit pack can be checked by a regulator through the public verifier without a LedgerAI account, which means your evidence does not become worthless if you stop being a customer.

Do not:

• use the service to break the law, including the laws it helps you track;
• upload content you have no right to upload;
• attempt to access another organisation’s workspace, or probe, scan or test our access controls without written permission;
• falsify evidence or attestations - the point of a cryptographically signed audit pack is that it means something;
• resell or white-label the service without an agreement that says you may.

If you find a security flaw, tell us rather than exploiting it. The Security page explains how.

We work to keep the service available, but we do not currently offer a contractual uptime guarantee. Parts of the product are in active development and may change, and features offered in beta may change substantially or be withdrawn.

To the extent the law permits, the service is provided as-is. We do not warrant that it will be uninterrupted, error-free, or that its regulatory mappings are complete or current for every organisation in every jurisdiction. Regulation changes; our content follows it, but not instantaneously.

To the extent the law permits, we are not liable for indirect or consequential loss, for lost profits, or for regulatory penalties incurred by you. Nothing here limits liability that cannot lawfully be limited, including liability for fraud or for death or personal injury caused by negligence. Nothing here limits any right you have under the Consumer Protection Act 68 of 2008 where it applies to you.

You may stop using the service and close your account at any time. We may suspend or terminate an account that breaches these terms, and we will tell you why unless we are legally prevented from doing so.

These terms are governed by the law of the Republic of South Africa, and the South African courts have jurisdiction.

If we change these terms materially, we will update the effective date and tell account holders. Continuing to use the service after that constitutes acceptance.

Questions: vuyo@quantyx.co.za.