Terms of Service

Draft. These terms have not yet been reviewed by counsel and are published for comment. They do not replace the agreement in your pilot contract, which governs where the two differ.

These terms govern your use of Xorah. Clause 4 is the one to read first: the service produces a recommendation, and a qualified person of yours signs. Nothing here transfers responsibility for a quality record away from you.

1. Definitions

“We”, “us”, “Xorah” — the provider of the service. “You”, “customer” — the organization that accesses the service, and each user acting on its behalf. “Service” — the Xorah quality-document review application, its API, and this website.

“Customer documents” — the quality documents, drawings, specifications, purchase orders, requirement files and related material you upload. “Reports” — the graded output the service produces from them, including each characteristic's status, confidence score and reasoning. “Customer data” — customer documents, reports, and your account and audit records together.

2. Agreement to these terms

By accessing the service you agree to these terms. If you are agreeing for a company, you confirm you are authorized to bind it, and “you” means that company.

If you hold a separate signed agreement with us — a pilot contract, a master services agreement, a data processing addendum, an NDA — that agreement governs wherever it differs from these terms, and these terms fill the gaps.

3. What the service does

The service reads a quality document you supply, extracts the measured values it contains, maps each value to the governing requirement from the drawing, specification or purchase order you supply, and grades it. Every graded characteristic carries a status, a confidence score, and a line of reasoning. Grading is performed by deterministic code against the requirements you provide.

The service is a review aid. It is not a certification body, not a testing laboratory, not a quality management system of record, and not a substitute for the engineering or metallurgical judgment of a qualified person.

4. The service recommends. You approve.

This clause is not boilerplate. It describes how the product is built and where responsibility sits.

• Output is a recommendation and an audit trail. It is not an inspection record, not a certificate of conformance, and not a sign-off. No setting turns it into one.
• A qualified person of yours must review and accept each report before it is relied on or released. The service records who did so; it never does so itself.
• The service can be wrong. It may misread a value from a scanned page, map a value to the wrong requirement, or grade correctly against a requirement you supplied incorrectly. Characteristics it is not confident about are routed to a person, but that routing is a safeguard, not a warranty that everything it did decide is right.
• The service cannot verify that a source document is authentic, current, or issued by whom it claims. It grades what the page says.
• You remain responsible for the conformity of your parts and for your obligations to your customers and to any accrediting, certifying or regulatory body — including under AS9100, API specifications, NACE MR0175/ISO 15156, ASTM and ASME standards, and any customer quality clause. Using the service transfers none of that to us.

5. Accounts and access

You are responsible for your users' activity, for keeping credentials confidential, and for telling us promptly at legal@xorah.net if you believe an account has been compromised. Access is for your organization's own use; do not share credentials outside it or resell access.

6. Your documents stay yours

You keep all right, title and interest in customer documents and in the reports produced from them. We claim no ownership.

You grant us only the narrow, non-exclusive license needed to run the service for you: to host, store, process and display that material to your own authorized users, and to produce the reports you ask for. The license exists to operate the service and ends when the material is deleted.

You confirm you have the right to upload what you upload, including under any confidentiality obligation you owe your own customers.

7. We do not train models on your data

We do not use customer documents or reports to train, fine-tune, or evaluate any machine-learning model, ours or anyone else's. We do not permit any vendor to do so through us. This is not a setting you have to find and switch on; it applies to every account by default, and we will not change it without your written agreement.

Reading a scanned document requires a model. That inference runs inside the same cloud account and network boundary your documents already sit in, under a zero-retention configuration, and no part of a document is sent to a third-party model endpoint. See the Privacy Policy for detail.

8. What we own

We own the service: the application, the grading engine, the extraction pipeline, the requirement-encoding format, and the specification library we build, together with all improvements to them. Nothing here transfers any of it to you beyond the right to use the service.

Where you supply your own encoded specifications or requirement files, those remain customer documents and clause 6 applies to them.

You may give us feedback. If you do, we may use it to improve the service without obligation to you, and feedback should not contain your confidential information.

9. Acceptable use

You will not, and will not permit anyone else to:

• supply requirements you know to be superseded or inaccurate, or otherwise use the service to manufacture a record you know to be false;
• present a report as an inspection record, certificate of conformance, or completed sign-off contrary to clause 4;
• reverse engineer, decompile, or attempt to derive the source of the service, or use it to build or train a competing product;
• probe, scan, or test the security of the service, attempt to access another customer's environment, or circumvent any access control;
• upload malware, or material you have no right to upload;
• resell, sublicense, or provide the service as a bureau to third parties without our written agreement.

We may suspend access without notice where continued use threatens the security or integrity of the service or another customer, and will tell you why as soon as we reasonably can.

10. Export-controlled and regulated material

Quality documents in aerospace and energy work frequently carry export-controlled technical data. You are responsible for determining what applies to your documents before you upload them, and for holding any license or authorization required.

Do not upload material subject to ITAR, the EAR, classified material, or material carrying a comparable restriction, unless we have agreed in writing that the environment you use is configured for it and the necessary authorizations are in place. Tell us before you need this; it is a deployment decision, not a checkbox.

Each party represents that it is not owned or controlled by, and will not provide the service to, a person or entity subject to U.S. sanctions or on a denied-party list, and that it will comply with applicable anti-corruption and sanctions laws.

11. Infrastructure, sub-processors, and security assurance

The service runs on Amazon Web Services, which is our sole infrastructure sub-processor. We remain responsible to you for the service, including for that provider's part in it. Sub-processors are listed in the Privacy Policy, and we will give notice before adding one with access to customer documents.

Once a year, and whenever your customer's flow-down obligations reasonably require it, we will complete a security questionnaire and provide the documentation we hold about our controls. We do not hold a SOC 2 report or ISO 27001 certificate today and do not claim one. On-site or hands-on audits of our systems are by written agreement only, at your cost, and subject to reasonable scope, notice, and confidentiality — a single-tenant environment cannot be opened to one customer without touching the isolation that protects the rest.

12. Fees, and service provided at no charge

Fees, billing period, and notice terms are as set out in your order form or pilot contract. Fees are exclusive of tax. Unless that document says otherwise, undisputed invoices are payable within 30 days, and we may suspend access to a materially overdue account after written notice.

Where no order form is in force, the service is provided at no charge and either party may stop at any time. For no-charge use — trials, evaluations, proofs of concept — the service is provided “as is” with no warranty of any kind, we have no indemnity obligation under clause 16, and our total liability is limited to US$100. Clause 7 (no training) and our confidentiality and data-handling obligations apply in full to no-charge use, because those are the promises that would be worthless if they only applied once an invoice existed.

13. Confidentiality

Each party will protect the other's confidential information with at least reasonable care, use it only to perform under these terms, and disclose it only to personnel who need it and are bound by equivalent obligations. Customer documents and reports are your confidential information.

These duties do not apply to information that is public through no fault of the receiving party, was already known to it, or is independently developed. Disclosure compelled by law is permitted, with notice to the other party where we are lawfully able to give it. Any separate NDA between us applies in addition to this clause.

14. Availability and stage of development

The service is early and under active development, currently running in a paid pilot. We do not commit to an uptime figure unless your signed agreement states one. Features may change; we will give reasonable notice before a change that materially reduces functionality you rely on. For as long as we provide the service to you, we will not remove the audit trail or the human sign-off step — if that ever ceased to be true we would tell you before it happened, and you could terminate under clause 19.

We may offer features labeled beta, preview, or evaluation. Those are provided as is, may be changed or withdrawn at any time, carry no warranty and no indemnity, and are excluded from any service commitment. Do not use them for a record you intend to rely on.

15. Warranties and disclaimer

We warrant that we will provide the service with reasonable skill and care, and in accordance with the security and data-handling commitments in clause 7 and the Privacy Policy as they stand at the effective date, or as later amended in your favor.

Beyond that, and to the fullest extent the law allows, the service is provided “as is” and “as available”. We disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the service will be uninterrupted or error-free, that it will extract every value from every document correctly, or that any individual grading call is correct. Nothing in these terms excludes liability that cannot lawfully be excluded.

16. Indemnification

By us. We will defend you against a third-party claim that the service, used as permitted, infringes that party's intellectual property rights, and pay damages finally awarded or agreed in settlement. If the service becomes, or in our reasonable opinion is likely to become, subject to such a claim, we may modify it so it is non-infringing, obtain a license, or terminate the affected access and refund prepaid unused fees. This is your exclusive remedy for infringement, and it does not apply to claims arising from customer documents, from modifications you make, from combination with anything we did not supply, or from use contrary to these terms.

By you. You will defend us against a third-party claim arising from customer documents, from your use of the service contrary to these terms, or from reliance on a report that was not reviewed and accepted under clause 4, and pay damages finally awarded or agreed in settlement.

In each case the indemnified party must give prompt written notice, allow the other to control the defense, and provide reasonable cooperation at the indemnifying party's expense. No settlement admitting fault or imposing an obligation on the indemnified party may be made without its consent.

17. Limitation of liability

Neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or goodwill, however caused, even if advised such damages were possible.

General cap. Each party's total aggregate liability arising out of or relating to the service is limited to the fees paid or payable by you in the twelve months before the event giving rise to the claim, or to the amount your signed agreement states if it states one.

Enhanced cap. For claims arising from a breach of clause 7 (no training), clause 13 (confidentiality), or our data-security obligations, that limit is instead three times the fees paid or payable in that twelve-month period. We would rather carry a real, stated number for the risk that actually matters here than an unlimited one no company our size could honor.

Outside the caps. The caps do not apply to your payment obligations, to either party's indemnity obligations under clause 16, or to fraud or willful misconduct.

No claim may be brought more than one year after the claiming party first knew or should reasonably have known of the facts giving rise to it.

For the avoidance of doubt: we are not liable for a part shipped, scrapped, reworked, accepted or rejected on the strength of a report that was not reviewed and accepted by a qualified person of yours as clause 4 requires.

These allocations of risk are a basis of the bargain and apply even if a limited remedy fails of its essential purpose.

18. Term, termination, and what happens to your data

These terms apply for as long as you use the service. Either party may terminate as its order form provides, or on 30 days' written notice where none applies, or immediately for a material breach the other does not remedy within 30 days of notice.

On termination you may export your documents and reports for 30 days. After that window we delete customer data from live systems within 30 days, and from backups as those backups expire on their normal cycle, other than what we must retain by law. We will confirm deletion in writing on request. Clauses 1, 6, 7, 8, 13, 15, 16, 17, 20, 21 and 22 survive termination, along with any accrued payment obligation.

19. Changes to these terms

We may update these terms. The effective date above changes when we do. Where a change materially affects your rights we will give notice at least 30 days before it takes effect, and if you object you may terminate before that date without penalty and receive a refund of prepaid unused fees. Continued use after the effective date means you accept the updated terms. Where you hold a signed agreement with a fixed term, these terms as they stood at signature apply for that term.

20. Governing law and disputes

These terms are governed by the laws of the State of Texas, United States, without regard to its conflict-of-laws rules, and the U.N. Convention on Contracts for the International Sale of Goods does not apply. The parties will attempt in good faith to resolve any dispute by escalation between senior representatives for 30 days. Failing that, the state and federal courts located in the State of Texas, United States have exclusive jurisdiction, and each party consents to that venue. Either party may seek injunctive relief in any court to protect its intellectual property or confidential information. Each party waives any right to a jury trial.

21. Order of precedence, and the whole agreement

These terms, any order form or pilot contract, any data processing addendum, and any NDA between us together form the whole agreement on this subject and replace anything said before it. Where they conflict, they take precedence in this order: (1) the data processing addendum, for anything about personal data; (2) the signed order form or pilot contract; (3) the NDA, for anything about confidentiality; (4) these terms. A purchase order's pre-printed terms have no effect.

22. Notices and general

Notices to us go to legal@xorah.net; notices to you go to the administrative contact on your account. Notice is effective on delivery, or the next business day if sent outside business hours. Neither party may assign these terms without the other's consent, except to a successor to substantially all of its business, on notice. If a provision is unenforceable, it is narrowed to the minimum extent needed and the rest stands. A failure to enforce a provision is not a waiver of it. Neither party is liable for delay caused by events outside its reasonable control. Nothing here creates a partnership, agency, or employment relationship. There are no third-party beneficiaries. We may name you as a customer only with your written permission.

23. Contact

Questions about these terms: legal@xorah.net. See also the Privacy Policy.