Terms of Service
These terms cover your use of Oxelone: the console at dash.oxelone.com, the agent and browser extension you install on your machines, and the API.
Who the agreement is with
The agreement is between [Company legal name], [registered address] ("Oxelone", "we") and the organisation that creates a workspace ("you"). The person who accepts these terms confirms they can bind that organisation. A signed order form or master agreement takes precedence over this page where they differ.
Your workspace and your accounts
- You decide who joins your workspace and what role each person holds.
- Keep sign-in credentials private. Tell us at once if you think an account was used without permission.
- You are responsible for what happens in your workspace, including the policies you enable.
The agent on your machines
You install the agent and extension only on machines you are entitled to manage, and you tell the people who use them that AI activity is inspected, as the law where they work requires. Policies you set to Enabled can block, redact or hold requests. Test new policies in Monitor first.
Acceptable use
- Do not use Oxelone to monitor people unlawfully or outside your organisation.
- Do not try to break, probe or overload the service, other than through our disclosure process.
- Do not resell the service, or copy it to build a competing product.
Your data
You own the data your workspace sends us. You give us the rights we need to run the service for you, and nothing more. The Privacy Policy says what we store and for how long.
Fees
Fees, billing periods and payment terms are set in your order form. [Trial terms, if any].
Availability and changes
We work to keep the service available and tell you in advance about planned maintenance. We may change the service. We will not remove a material feature you pay for without [30] days' notice.
Warranties and liability
Apart from what your order form promises, the service is provided as is. Neither side is liable for indirect or consequential loss. Each side's total liability is capped at the fees paid in the [12] months before the claim. The caps do not apply where the law forbids them.
Ending the agreement
Either side may end the agreement as your order form sets out. When it ends, you can export your data for [30] days. After that, we delete your workspace.
Governing law
These terms are governed by the law of [jurisdiction], and disputes go to the courts of [venue].
Privacy Policy
For the data your workspace sends us, you are the controller and we are your processor. For our own customer records and this website, we are the controller.
What we store
| Data | What it is | Kept |
|---|---|---|
| Accounts | Name, email address, role, a hash of the password, sign-in codes and session records. | While the account exists |
| Machines | Machine name, operating system, the AI tools found on it and their settings, as the agent reports them. | While the machine is enrolled |
| Interactions | Prompts, responses and uploads the agent inspects. Your workspace decides whether text is stored, and how stored text looks where PII and secrets were found: Permanent, Restricted, Masked or None. | Your workspace's logging setting |
| Connector records | Settings and metadata from the platforms you connect. File contents and conversation text are never stored. | While the connection exists |
| Alerts, issues, audit log | What your policies raised, and who did what in the console. | [retention period] |
How we use it
We use workspace data only to run the service for you: inspecting interactions, enforcing your policies, showing results in your console and supporting you when you ask. We do not sell it, and we do not use it to train AI models.
Who can see it
- People in your workspace, according to the roles you give them. Viewing text held under Restricted needs a permission you grant, and every view is written to the audit log first.
- Our operators see service health and counts, not your content.
- The subprocessors below, for the part of the service each one runs.
Where it is held
Workspace data is held on Amazon Web Services in Frankfurt, Germany (eu-central-1). [Transfer mechanism for any processing outside the EEA].
Your rights
People in a workspace should contact that organisation first, because it controls their data. We help our customers answer those requests. For data we control, you can ask us for access, correction, deletion, restriction or a copy: write to privacy@oxelone.com. You can also complain to your data protection authority.
Subprocessors
These companies run part of the service for us. We tell customers [30] days before adding one.
| Company | What it does | Where |
|---|---|---|
| Amazon Web Services | Servers and database for the console and API | Frankfurt, Germany |
| Cloudflare | Network edge, the tunnel to our servers, and this website | Global edge network |
| [Email provider] | Sign-in codes and invitations, sent from no-reply@oxelone.com | [region] |
| [Model provider] | Only if your workspace uses our default model for the AI Judge. With your own provider, that provider is yours, not ours. | [region] |
A data processing agreement is available on request from legal@oxelone.com.
Security
- All traffic between your machines, the console and our servers is encrypted in transit.
- Credentials for the platforms you connect are encrypted in our database.
- Agent releases are signed, and the agent checks the signature before it updates itself.
- Access inside a workspace follows the roles you assign, and sensitive views are audited.
Reporting a vulnerability
Write to security@oxelone.com privately, and do not open a public issue. Tell us what you found and how to reproduce it. We acknowledge reports within [3 business days], and we do not pursue good-faith research that follows this process.
Contact
Help with the console, the agent or your account. [address to create]
Vulnerability reports, privately.
Data requests and questions. [address to create]
Contracts and the processing agreement. [address to create]
[Company legal name] · [registered address] · [company number]