Terms of Service

The agreement between you and Safeheld consists of: (a) your Order Form; (b) these Terms; (c) our Data Processing Addendum (where applicable); and (d) any applicable product-specific terms.

If there is a conflict, precedence is: Order Form → product-specific terms → these Terms → policies.

Platform: Safeheld's hosted services, APIs, dashboards, and related documentation. Client Data: data submitted to or processed through the Platform. Authorised User: an individual allowed by Client to access the Platform.

You confirm you are acting for a business entity and have authority to bind that entity. You are responsible for all activity under your tenant, including user provisioning, permissions, and credential security.

You must promptly notify Safeheld of any suspected unauthorised access, credential compromise, or material misconfiguration that could impact security or regulatory reporting.

Safeheld provides continuous reconciliation, breach detection, evidence generation, and governance tooling for client fund protection workflows. The Platform supports compliance operations but does not constitute legal or regulatory advice.

Client remains responsible for regulatory interpretations, filings, supervisory communications, and all final compliance decisions.

• No unauthorised access attempts, reverse engineering, or security testing without written approval.
• No use of the Platform for unlawful activity, sanctions evasion, or fraud.
• No upload of malicious code or data designed to disrupt the service.
• No resale, sublicensing, or use of the service for third-party bureau operations unless agreed in writing.

Fees and commercial terms are set out in the Order Form. Unless otherwise stated, subscriptions renew automatically for successive terms. Either party may give non-renewal notice at least 30 days before the renewal date.

Overdue invoices may incur interest and temporary service restrictions after notice and a commercially reasonable cure period.

Client retains all right, title, and interest in Client Data. Safeheld acts as processor for Client Data and will process it only to provide and secure the Platform, as documented in the agreement.

Each party will protect the other party's Confidential Information using at least reasonable care and only use that information for contractual performance.

Safeheld maintains administrative, technical, and organisational controls aligned to enterprise standards, including encryption in transit and at rest, least-privilege access controls, audit logging, and monitored production infrastructure.

Safeheld will notify Client without undue delay after confirming a security incident affecting Client Data and provide timely updates, remediation status, and post-incident summary.

Safeheld targets enterprise-grade availability and publishes status updates for incidents and scheduled maintenance. Planned maintenance is communicated in advance where practicable.

Support channels, response targets, and escalation paths are defined by plan tier and any support schedules in your Order Form.

Safeheld and its licensors own all intellectual property rights in the Platform, including software, models, schemas, documentation, trademarks, and derivative works.

Client receives a limited, non-exclusive, non-transferable right to use the Platform during the subscription term for internal business operations.

Safeheld warrants that the Platform will materially conform to published documentation under normal use. Except as expressly stated, services are provided "as is" and all implied warranties are disclaimed to the maximum extent permitted by law.

Except for excluded liabilities, each party's aggregate liability is capped at fees paid or payable by Client in the 12 months preceding the claim event.

Neither party is liable for indirect, incidental, special, consequential, or punitive damages, or loss of profits, goodwill, or anticipated savings.

Nothing limits liability for fraud, wilful misconduct, death/personal injury from negligence, or liabilities that cannot be excluded by law.

Either party may terminate for material breach not cured within 30 days of written notice. Safeheld may suspend access immediately where necessary to mitigate acute security risk or legal non-compliance.

Upon termination, Client may request data export during the agreed retrieval window. Safeheld then deletes or anonymises Client Data in line with contractual retention commitments, unless longer retention is legally required.

These Terms are governed by the laws of England and Wales. Courts of England and Wales have exclusive jurisdiction, unless the parties agree an alternative dispute mechanism in writing.

Safeheld may update these Terms for legal, regulatory, security, or product reasons. Material changes are notified in advance. Continued use after the effective date constitutes acceptance.