Terms of Service
These terms cover your use of Oxelone: the console at dash.oxelone.com, the agent and browser extension you install on your machines, and the API.
Who the agreement is with
The agreement is between Oxelone ("we") and the organisation that creates a workspace ("you"). The person who accepts these terms confirms they can bind that organisation. A signed order form or master agreement takes precedence over this page where they differ.
Your workspace and your accounts
- You decide who joins your workspace and what role each person holds.
- Keep sign-in credentials private. Tell us at once if you think an account was used without permission.
- You are responsible for what happens in your workspace, including the policies you enable.
The agent on your machines
You install the agent and extension only on machines you are entitled to manage, and you tell the people who use them that AI activity is inspected, as the law where they work requires. Policies you set to Enabled can block, redact or hold requests. Test new policies in Monitor first.
Acceptable use
- Do not use Oxelone to monitor people unlawfully or outside your organisation.
- Do not try to break, probe or overload the service, other than through our disclosure process.
- Do not resell the service, or copy it to build a competing product.
Your data
You own the data your workspace sends us. You give us the rights we need to run the service for you, and nothing more. The Privacy Policy says what we store and for how long.
Fees
Fees, billing periods and payment terms are set in your order form. A trial, where offered, is free for the period shown when it starts, and it ends without charge unless you choose a plan.
Availability and changes
We work to keep the service available and tell you in advance about planned maintenance. We may change the service. We will not remove a material feature you pay for without 30 days' notice.
Warranties and liability
Apart from what your order form promises, the service is provided as is. Neither side is liable for indirect or consequential loss. Each side's total liability is capped at the fees paid in the 12 months before the claim. The caps do not apply where the law forbids them.
Ending the agreement
Either side may end the agreement as your order form sets out. When it ends, you can export your data for 30 days. After that, we delete your workspace.
Governing law
These terms are governed by the law named in your order form, and disputes go to the courts it names. Before going to court, both sides first try in good faith to settle a dispute by talking to each other.
Privacy Policy
For the data your workspace sends us, you are the controller and we are your processor. For our own customer records and this website, we are the controller.
What we store
| Data | What it is | Kept |
|---|---|---|
| Accounts | Name, email address, role, a hash of the password, sign-in codes and session records. | While the account exists |
| Machines | Machine name, operating system, the AI tools found on it and their settings, as the agent reports them. | While the machine is enrolled |
| Interactions | Prompts, responses and uploads the agent inspects. Your workspace decides whether text is stored, and how stored text looks where PII and secrets were found: Permanent, Restricted, Masked or None. | Your workspace's logging setting |
| Connector records | Settings and metadata from the platforms you connect. File contents and conversation text are never stored. | While the connection exists |
| Alerts, issues, audit log | What your policies raised, and who did what in the console. | While the workspace exists, unless you delete them sooner |
How we use it
We use workspace data only to run the service for you: inspecting interactions, enforcing your policies, showing results in your console and supporting you when you ask. We do not sell it, and we do not use it to train AI models.
Who can see it
- People in your workspace, according to the roles you give them. Viewing text held under Restricted needs a permission you grant, and every view is written to the audit log first.
- Our operators see service health and counts, not your content.
- The subprocessors below, for the part of the service each one runs.
Where it is held
Workspace data is stored in data centres in Frankfurt, Germany, inside the European Union. Where a subprocessor handles personal data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses.
Your rights
People in a workspace should contact that organisation first, because it controls their data. We help our customers answer those requests. For data we control, you can ask us for access, correction, deletion, restriction or a copy: write to [email protected]. You can also complain to your data protection authority.
Subprocessors
These companies run part of the service for us. We tell customers 30 days before adding one, and you can object in that time.
| Service | What it does | Data it handles |
|---|---|---|
| Cloud hosting | Servers and database for the console and API, in the EU | All workspace data |
| Network edge | Secure connection to our servers, this website, and its cookieless visit counts | Traffic in transit, encrypted |
| Email delivery | Sign-in codes and invitations, sent from [email protected] | Email address and the message |
| AI model | Only if your workspace uses our default model for the AI Judge. With your own provider, that provider is yours, not ours. | The text the AI Judge checks |
A data processing agreement is and the named list of subprocessors are available on request from [email protected].
Security
- All traffic between your machines, the console and our servers is encrypted in transit.
- Credentials for the platforms you connect are encrypted in our database.
- Agent releases are signed, and the agent checks the signature before it updates itself.
- Access inside a workspace follows the roles you assign, and sensitive views are audited.
Reporting a vulnerability
Write to [email protected] privately, and do not open a public issue. Tell us what you found and how to reproduce it. We acknowledge reports within 3 business days, and we do not pursue good-faith research that follows this process.
Contact
Help with the console, the agent or your account.
Vulnerability reports, privately.
Data requests and questions.
Contracts and the processing agreement.