Customer-Hosted Software Agreement

00About this agreement

If documents conflict, they apply in this order: (a) the Order Form; (b) a Statement of Work, for the services it describes; (c) these terms; (d) the Security Policy; and (e) the Documentation.

Previous versions are available on request. A signed Order Form stays on the version it refers to until both parties agree to move to a later one.

01Definitions and interpretation

1. 1.1

   In this agreement:

   • Agreement means these terms, the Order Form, any Statement of Work and any documents they incorporate.
   • Alto Foundry means Alto Foundry Pty Ltd (ABN 26 700 585 093).
   • Business Day means a day other than a Saturday, Sunday or public holiday in Melbourne, Victoria.
   • Confidential Information means information disclosed by or for a party that is marked confidential or that a reasonable person would understand to be confidential. Customer Data is the Customer's Confidential Information. The Software, Documentation and the terms of the Order Form are Alto Foundry's Confidential Information.
   • Customer means the organisation named in the Order Form.
   • Customer Data means data processed by the Software in the Customer Environment, including documents, meeting content, findings, comments, audit records and user information, and any output generated from them.
   • Customer Environment means the cloud subscriptions, networks, identity services, AI services and other infrastructure the Customer uses to run the Software, whether operated by the Customer or by a provider on its behalf.
   • Documentation means the deployment guides, infrastructure templates, release notes and user guides Alto Foundry provides for the Software.
   • Fees means the fees in the Order Form or a Statement of Work.
   • Licensed Scope means the limits on use in the Order Form, such as the number of Users, environments or business units.
   • Order Form means an ordering document for the Software that refers to these terms.
   • Release means a version of the Software, including updates, patches and new versions Alto Foundry makes generally available to its customers.
   • Security Policy means Alto Foundry's security policy published at alto-foundry.com.au/security.
   • Software means the Alto Foundry software named in the Order Form, such as RedactAI or Archer, in object code and container image form, with its infrastructure templates and every Release supplied under this Agreement.
   • Statement of Work means a document describing professional services that refers to these terms.
   • Support Services means the support and maintenance described in clause 8 and Schedule 2.
   • Term means the licence term in the Order Form, and each renewal.
   • User means an individual the Customer authorises to use the Software, such as an employee or contractor.
2. 1.2

   "Including" and similar words do not limit what comes before them. Headings are for convenience only. Amounts are in Australian dollars. A reference to a law includes that law as amended or replaced.

02Licence

1. 2.1

   Grant. Subject to this Agreement and payment of the Fees, Alto Foundry grants the Customer a non-exclusive, non-transferable licence during the Term to install, run and configure the Software in the Customer Environment, and to let Users use it, for the Customer's internal business purposes and within the Licensed Scope.

2. 2.2

   Environments. Unless the Order Form says otherwise, the licence covers one production environment and a reasonable number of non-production environments for testing, staging and disaster recovery.

3. 2.3

   Contractors and managed service providers. The Customer may let its contractors and managed service providers deploy and operate the Software on its behalf. The Customer is responsible for their compliance with this Agreement.

4. 2.4

   Restrictions. The Customer must not, and must not let anyone else:

   • use the Software beyond the Licensed Scope, or provide it to third parties as a hosted or managed service;
   • sublicense, sell, rent or distribute the Software;
   • modify, reverse engineer, decompile or disassemble the Software, except to the extent the law allows despite this restriction, or as the Documentation describes for configuration;
   • remove proprietary notices, or circumvent licence or security controls;
   • use the Software to build a competing product; or
   • use AI output from the Software as the only basis for a decision that significantly affects an individual's legal rights, employment, health, credit or access to services, without meaningful human review.
5. 2.5

   Open-source components. The Software includes open-source components listed in its notices. Each is licensed under its own licence, and nothing in this Agreement restricts the Customer's rights under those licences.

03Delivery and deployment

1. 3.1

   Delivery. Alto Foundry will make the Software and Documentation available through a container registry, repository or other secure method agreed with the Customer.

2. 3.2

   Deployment. The Customer deploys the Software using the Documentation, unless the parties agree that Alto Foundry will provide deployment services in a Statement of Work. Alto Foundry will perform any deployment services with due care and skill, and with the access the Customer grants under clause 6.

3. 3.3

   Prerequisites. The Customer is responsible for providing a Customer Environment that meets the prerequisites in the Documentation, such as the cloud services, regions, network connectivity, identity configuration and AI model capacity the Software needs.

04Responsibilities

1. 4.1

   Customer. The Customer controls and is responsible for the Customer Environment, including:

   • cloud subscriptions, regions, resource sizing and the cost of running them;
   • networking, private connectivity, DNS, firewalls and egress rules;
   • identity, access policies, group membership, Conditional Access and access reviews;
   • keys, secrets, certificates and their rotation;
   • backups, disaster recovery, monitoring and incident response for the environment;
   • retention, deletion, records management and decisions to disclose or publish exported material;
   • choosing, configuring and contracting for AI services and other third-party services used with the Software; and
   • applying Releases, including security updates, within a reasonable time.
2. 4.2

   Alto Foundry. Alto Foundry is responsible for the Software as supplied, including its secure development, its conformance with the Documentation, the security of its default configuration as documented, and providing Releases and Support Services under clause 8.

3. 4.3

   Shared responsibility. The Security Policy sets out how security responsibilities are divided between the parties in more detail.

4. 4.4

   Review before disclosure. RedactAI proposes redactions, and Archer drafts notes, for people to review. The Customer is responsible for having suitably trained Users review findings and output before relying on them, and for checking exported documents before they are shared or released. Automated detection may miss information or flag too much.

05Customer Data

1. 5.1

   Ownership. As between the parties, the Customer owns Customer Data.

2. 5.2

   Data stays in the Customer Environment. The Software is designed to store and process Customer Data only in the Customer Environment and in services the Customer configures. As supplied, it does not send Customer Data, usage measures or telemetry to Alto Foundry or its suppliers.

3. 5.3

   No training. Alto Foundry will not use Customer Data to train, fine-tune or improve AI models.

4. 5.4

   AI and third-party services. The Software uses the AI service the Customer configures, by default Azure OpenAI in the Customer's own subscription. If the Customer configures another AI provider or integration, Customer Data sent to it is handled under the terms between the Customer and that provider. That provider is not Alto Foundry's subcontractor.

5. 5.5

   Privacy. The Customer is responsible for compliance with privacy laws for the Customer Data it processes with the Software, including giving notices and responding to individuals' requests. Alto Foundry will give reasonable assistance on request, at its then-current rates where the assistance goes beyond Support Services.

06Access to the Customer Environment

1. 6.1

   No standing access. Alto Foundry has no access to the Customer Environment or Customer Data unless the Customer grants it.

2. 6.2

   When access is granted. If the Customer grants Alto Foundry access, or sends it Customer Data, for deployment, support or diagnosis, Alto Foundry will:

   • access and use Customer Data only to perform the requested work, in line with the Customer's instructions;
   • use only named personnel who are bound by confidentiality, through the access method and permissions the Customer approves, from encrypted, company-approved devices located in Australia;
   • comply with the Customer's reasonable security policies that it has been given in writing beforehand;
   • not copy Customer Data out of the Customer Environment unless the Customer asks in writing;
   • securely delete any Customer Data it holds once the work is done, and confirm this on request; and
   • comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles in handling any Personal Information.
3. 6.3

   Security incidents. If Alto Foundry becomes aware of unauthorised access to Customer Data while it holds or can access that data, it will notify the Customer without undue delay, and in any case within 72 hours, and give the Customer the information it reasonably needs to meet its obligations, including under the Notifiable Data Breaches scheme.

07Software security

1. 7.1

   Secure development. Alto Foundry will develop the Software in line with the secure development practices in the Security Policy, and will use industry-standard measures to keep malicious code out of each Release.

2. 7.2

   Vulnerabilities. If Alto Foundry becomes aware of a vulnerability in a supported Release that it rates high or critical, it will notify the Customer, and provide a fix or workaround within the timeframes in Schedule 2.

3. 7.3

   Assurance. On request, once in each 12-month period, Alto Foundry will answer a reasonable security questionnaire about the Software, and provide a list of the third-party components in a Release.

08Support and updates

1. 8.1

   Support. During the Term, Alto Foundry will provide Support Services as set out in Schedule 2 and the Order Form: help with using, configuring and upgrading the Software, and fixing defects in it.

2. 8.2

   Releases. Alto Foundry will make Releases available to the Customer as they become generally available, with release notes describing changes, security fixes and any upgrade steps.

3. 8.3

   Supported Releases. Alto Foundry supports the current Release and the Release before it. The Customer decides when to apply Releases, but Alto Foundry is not responsible for defects fixed in a Release the Customer has not applied.

4. 8.4

   Exclusions. Support Services do not cover problems caused by the Customer Environment, third-party services, modifications not made by Alto Foundry, or use that does not follow the Documentation. Alto Foundry may help with these at its then-current rates if the Customer asks.

5. 8.5

   Professional services. Deployment, training, configuration and other services are provided under a Statement of Work. Unless it says otherwise, they are charged on a time and materials basis at the rates in the Order Form.

09Fees, invoicing and GST

1. 9.1

   Fees. The Customer will pay the Fees. Unless the Order Form says otherwise, licence and Support Services Fees are invoiced annually in advance, and professional services monthly in arrears.

2. 9.2

   Payment. Invoices are payable within 30 days of the invoice date.

3. 9.3

   GST. Fees are exclusive of GST unless stated otherwise. If GST is payable on a supply under this Agreement, the Customer will pay the GST amount at the same time as the Fees, once it has received a valid tax invoice. Terms used in this clause have the meanings in the A New Tax System (Goods and Services Tax) Act 1999 (Cth).

4. 9.4

   Disputes. If the Customer disputes an invoice in good faith, it must tell Alto Foundry in writing before the due date and pay the undisputed part. The parties will try to resolve the dispute within 15 Business Days.

5. 9.5

   Price changes. Alto Foundry may change the Fees for a renewal Term by giving at least 60 days' notice before the renewal.

6. 9.6

   Cloud costs. The Customer pays its own cloud, AI and third-party service costs for running the Software, which are not part of the Fees.

10Licence compliance

1. 10.1

   Self-certification. Because the Software does not report usage to Alto Foundry, the Customer will, once in each 12-month period on request, confirm in writing that its use is within the Licensed Scope.

2. 10.2

   Additional use. If the Customer's use exceeds the Licensed Scope, the parties will agree an updated Order Form, and the additional use is charged at the Order Form rates from when it began.

11Term and termination

1. 11.1

   Term. This Agreement starts on the date the Order Form is signed or accepted and continues until every Term and Statement of Work under it has ended.

2. 11.2

   Renewal. Unless the Order Form says otherwise, each Term renews for a further 12 months unless either party gives written notice of non-renewal at least 60 days before it ends. Alto Foundry will remind the Customer at least 90 days before renewal.

3. 11.3

   Termination for breach. Either party may terminate this Agreement by written notice if the other party materially breaches it and does not remedy the breach within 30 days after receiving notice describing it, or immediately if the breach cannot be remedied.

4. 11.4

   Insolvency. Either party may terminate this Agreement by written notice if the other party becomes insolvent, has an administrator, receiver or liquidator appointed, or stops carrying on business, to the extent the law allows.

5. 11.5

   Effect. When this Agreement ends:

   • the licence and Support Services end, and the Customer must stop using the Software and remove it from the Customer Environment within 30 days, and confirm this in writing on request;
   • Customer Data remains in the Customer Environment and under the Customer's control. During the 30 days, the Customer may continue to use the Software in read-only mode only to export its data;
   • each party returns or destroys the other's Confidential Information on request, subject to legal record-keeping; and
   • the Customer pays Fees owing up to the date it ends. If the Customer terminates under clause 11.3, Alto Foundry refunds prepaid Fees for the period after termination.
6. 11.6

   Transition. On request, Alto Foundry will provide reasonable help to export Customer Data or move to another system, at its then-current rates.

7. 11.7

   Survival. Clauses 5, 6, 9 (for amounts owing), 11.5, 12, 13, 15, 16, 17 and 18, and any other clause that by its nature should continue, survive the end of this Agreement.

12Intellectual property

1. 12.1

   Alto Foundry's rights. Alto Foundry and its licensors own the Software, the Documentation, any deliverables that are general improvements to them, and their underlying know-how. The Software is licensed, not sold.

2. 12.2

   Customer's rights. The Customer and its licensors own Customer Data, and any Customer-specific configuration, instructions and templates it creates.

3. 12.3

   Feedback. Alto Foundry may use feedback about its products without restriction or obligation, provided it does not identify the Customer or its Users as the source without consent, and does not include Customer Data.

13Warranties

1. 13.1

   Mutual. Each party warrants that it has the authority to enter this Agreement, and will comply with the laws that apply to its performance of it.

2. 13.2

   Software. Alto Foundry warrants that, for 90 days after each Release is made available, that Release, when deployed and used in line with the Documentation, will perform materially as described in the Documentation.

3. 13.3

   Services. Alto Foundry warrants that it will perform Support Services and professional services with due care and skill, using appropriately qualified personnel.

4. 13.4

   Remedy. If Alto Foundry breaches clause 13.2 or 13.3 and the Customer tells it during the warranty period, Alto Foundry will correct the defect or re-perform the services. If it cannot do so within 30 days, the Customer may terminate the affected Software or services and receive a refund of the Fees paid for them for the period after termination, or for the defective services. Subject to clause 14.2, this is the Customer's exclusive remedy for breach of clauses 13.2 and 13.3.

14Disclaimer and Australian Consumer Law

1. 14.1

   Disclaimer. Except as expressly set out in this Agreement, and to the extent the law allows, Alto Foundry does not warrant that the Software will be error-free, that it will find all information that should be redacted, or that AI output will be accurate, and excludes all other warranties, conditions and guarantees. Alto Foundry is not responsible for the Customer Environment or third-party services.

2. 14.2

   Australian Consumer Law. Nothing in this Agreement excludes, restricts or modifies any guarantee, right or remedy under the Australian Consumer Law or other law that cannot be excluded. Where the law allows Alto Foundry to limit its liability for failing to meet such a guarantee, its liability is limited, at its option, to replacing or repairing the goods or supplying the services again, or paying the cost of doing so.

15Limitation of liability

1. 15.1

   General cap. Subject to clauses 15.3 and 15.4, each party's total liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence), under statute or otherwise, is limited to the General Cap in Schedule 1.

2. 15.2

   Increased cap. For an Increased Claim, each party's total liability is limited to the Increased Cap in Schedule 1. This amount is in addition to, not part of, the General Cap. An Increased Claim is a claim arising from a party's breach of clause 6 (Access to the Customer Environment) or clause 16 (Confidentiality).

3. 15.3

   Excluded loss. Except for an Increased Claim, neither party is liable for loss of profit, revenue, goodwill or anticipated savings, loss or corruption of data (except to the extent caused by Alto Foundry's breach of clause 6), or indirect or consequential loss.

4. 15.4

   Unlimited liability. Clauses 15.1 to 15.3 do not limit liability for: (a) death or personal injury caused by negligence; (b) fraud or wilful misconduct; (c) a party's obligations under clause 17 (Indemnities); (d) the Customer's breach of clause 2.4 or its obligation to pay Fees; or (e) any liability that cannot be limited by law.

5. 15.5

   Contribution. Each party's liability is reduced to the extent the other party, or its personnel or providers, caused or contributed to the loss. This includes losses caused by the Customer Environment or by Releases the Customer has not applied. Each party must take reasonable steps to mitigate its loss.

16Confidentiality

1. 16.1

   Obligations. Each party will use the other's Confidential Information only to perform or receive the benefit of this Agreement, will not disclose it except as this clause allows, and will protect it with at least reasonable care.

2. 16.2

   Permitted disclosure. A party may disclose Confidential Information to its employees, contractors and professional advisers who need to know it and are bound by confidentiality obligations at least as protective as this clause.

3. 16.3

   Exclusions. Confidential Information does not include information that is or becomes public through no fault of the recipient, that the recipient already knew or independently developed, or that it lawfully receives from a third party without a duty of confidence.

4. 16.4

   Required disclosure. A party may disclose Confidential Information if required by law or a stock exchange, after giving the other party reasonable notice where the law allows, so it can seek protection.

17Indemnities

1. 17.1

   By Alto Foundry. Alto Foundry will defend the Customer against any third-party claim that the Software, as supplied by Alto Foundry and used in line with this Agreement, infringes that third party's intellectual property rights, and will pay the damages and costs finally awarded, or agreed in a settlement Alto Foundry approves.

2. 17.2

   By the Customer. The Customer will defend Alto Foundry against any third-party claim arising from Customer Data, including the Customer's disclosure of documents processed with the Software, or the Customer's breach of clause 2.4, and will pay the damages and costs finally awarded, or agreed in a settlement the Customer approves.

3. 17.3

   Process. The party seeking protection must notify the other promptly, let it control the defence and settlement (provided no settlement admits fault or imposes obligations on the protected party without its consent), and give reasonable help at the other party's cost.

4. 17.4

   Exclusions. Clause 17.1 does not apply to claims arising from Customer Data, the Customer Environment, third-party services, modifications not made by Alto Foundry, open-source components used under their own licences, a superseded Release where the current Release would have avoided the claim, or use combined with products Alto Foundry did not supply where the claim would not have arisen otherwise.

5. 17.5

   Mitigation. If the Software is, or Alto Foundry reasonably believes it may be, subject to an infringement claim, Alto Foundry may obtain the right for the Customer to keep using it, modify or replace it so it doesn't infringe without materially reducing its functionality, or, if neither is reasonably possible, terminate the affected licence and refund prepaid Fees for the period after termination.

18General

1. 18.1

   Entire agreement. This Agreement is the entire agreement between the parties about its subject matter. Terms in a purchase order or other Customer document do not apply, even if Alto Foundry accepts or signs it.

2. 18.2

   Variation and waiver. This Agreement may be varied only in writing signed or accepted by both parties. A failure or delay in exercising a right is not a waiver of it. If a provision is unenforceable, it is read down or severed and the rest continues.

3. 18.3

   Force majeure. Neither party is liable for a delay or failure caused by events beyond its reasonable control, other than an obligation to pay money, provided it notifies the other party and takes reasonable steps to limit the effect. If the event continues for more than 30 consecutive days, either party may terminate the affected Software or services by written notice, and Alto Foundry will refund prepaid Fees for the period after termination.

4. 18.4

   Assignment and subcontracting. Neither party may assign this Agreement without the other's consent, which must not be unreasonably withheld, except to a successor in a merger, restructure or sale of all or substantially all of the relevant business, with notice. Alto Foundry may subcontract, and remains responsible for its subcontractors.

5. 18.5

   Business continuity. If Alto Foundry stops carrying on business without a successor that assumes this Agreement, the Customer may continue to use the Release it is running for the rest of the paid Term.

6. 18.6

   Publicity. Neither party may use the other's name or logo in marketing without its prior written consent.

7. 18.7

   Notices. Notices must be in writing and sent to the addresses in the Order Form, or for Alto Foundry to hello@alto-foundry.com.au. An email notice is received when it enters the recipient's information system, unless the sender receives a delivery failure.

8. 18.8

   Relationship. The parties are independent contractors. This Agreement does not create a partnership, joint venture, agency or employment relationship, or confer rights on third parties.

9. 18.9

   Compliance. Each party will comply with anti-bribery laws, including Division 70 of the Criminal Code Act 1995 (Cth), with Australian sanctions and export control laws, and, where it applies, the Modern Slavery Act 2018 (Cth).

10. 18.10

    Disputes. Before starting court proceedings (other than for urgent interim relief), a party must give the other written notice of the dispute, and senior representatives of both parties must meet and try in good faith to resolve it within 20 Business Days. If they cannot, either party may refer it to mediation administered by the Resolution Institute, or start proceedings.

11. 18.11

    Governing law. This Agreement is governed by the laws of Victoria, Australia, unless Schedule 1 says otherwise. Each party submits to the non-exclusive jurisdiction of the courts of Victoria and the courts that can hear appeals from them.

12. 18.12

    Execution. An Order Form may be signed electronically and in counterparts, which together form one document.

S1Schedule 1: Order Form variables

The Order Form may set the following. Where it doesn't, these defaults apply.

S2Schedule 2: Support Services

Support is available by email at hello@alto-foundry.com.au, from 9am to 5pm Melbourne time on Business Days. The Order Form may add extended hours or a dedicated channel. Response times are measured within support hours, from when Alto Foundry receives a request with enough information to begin work.

Targets assume the Customer gives reasonable cooperation, such as logs, reproduction steps and access under clause 6 where needed. Missing a target is not by itself a breach of this Agreement, but repeated failure to meet Severity 1 or 2 targets is a material breach.