We process your documents only to run the service you configured, on your instruction.
Three subprocessors, all named, none permitted to train on your data.
We tell you about a breach within 48 hours of becoming aware, with what we know at that point.
You get your data out on exit, then we delete it within 30 days.
This page is the version we ask customers to accept as part of the agreement. If your counsel needs a signable copy or has redlines, ask us. We would rather work through them than have you sign something you have not read.
1. Roles
For personal data in your documents, your systems and the memory and records built from them, you are the controller and XCM-AI Ltd is the processor. This agreement forms part of the terms of service and applies for as long as we process that data. Where it conflicts with the terms on a data protection point, this agreement wins.
For your own account details and our correspondence with you, we are the controller; that is covered by the privacy notice.
2. Scope of processing
We process your data to do the things the product does: ingest documents, build and maintain your organisation's knowledge graph, run the AI employees you have configured, produce decision records, and support you when something goes wrong. The subject matter, categories and duration are set out in the annex below.
3. Instructions, and the limits we will not cross
Your configuration is your instruction: which systems are connected, what each AI employee may do, which limits apply. We process on that basis and no wider. If we think an instruction breaches data protection law, we will say so and not simply comply.
We do not train models on your data, and neither may our subprocessors.
We do not use it to build benchmarks, case studies or marketing material without your specific written agreement.
We do not sell it, share it for advertising, or enrich it from third-party sources.
We do not use one customer's data to answer another customer's question. Each organisation has its own graph.
4. Subprocessors
You give general authorisation for our current subprocessors: Microsoft Azure, Groq and Cohere. Each is under written terms no less protective than this agreement, including the prohibition on training.
Before a new subprocessor starts processing, we give you at least 30 days' written notice saying what it does and what would reach it. You may object on reasonable data protection grounds; if we cannot resolve it, you may terminate the affected part of the service without penalty. We remain responsible for their acts and omissions.
5. Security measures
Encryption
In transit and at rest, using platform-managed keys on Azure UK.
Separation
A dedicated knowledge graph per organisation on a shared database, with tenant binding enforced and every query path tested against cross-tenant access in CI. We do not claim per-tenant infrastructure, because that is not what this is.
Permissions
Enforced per request against the system the document came from. A person sees only what they could already open; an AI employee reaches only what its job description names.
Logging
Access and configuration changes are recorded and attributable, including ours.
Backups
Encrypted, held in the same UK region, and aged out on the retention schedule in clause 11.
What we do not have is on the trust and compliance page, including the certifications we do not hold yet.
6. Personnel and access
Our people are bound by confidentiality. Access to production data is limited to those who need it to run or support the service, is logged, and is removed when a role changes. We will not look at your documents for any reason other than supporting you or investigating a security issue, and support access is recorded so you can see it happened.
7. Breach notification
If we become aware of a personal data breach affecting your data, we tell you within 48 hours, sooner where we can, with what we know at that point, even if the picture is incomplete. You get what is affected, when it happened, what we have done, and what we recommend you do. We keep updating as we learn more, and we will not wait for a complete account before telling you.
Notifying regulators and individuals is yours as controller; we give you what you need to do it, promptly and without charge.
8. Data subject requests
If an individual comes to us about data you control, we do not respond substantively: we forward it to you without undue delay. Where a request needs work inside the product, we help: locating what is held, exporting it, correcting it, or deleting it including from the memory graph rather than only the source document.
9. International transfers
Storage and the database are in the United Kingdom. Model providers operate internationally, so text sent for inference may be processed outside the UK, under the UK International Data Transfer Addendum to the EU standard contractual clauses or equivalent safeguards. There is one region and no residency selection; if data must never leave the UK, say so before signing.
10. Audit and assistance
We give you the information you reasonably need to demonstrate compliance, including our security pack and answers to your questionnaire. There is no third-party audit report to hand you, so instead: once a year, or after a material incident, we will take an audit call or a documented review with your team, at your cost for anything beyond a reasonable amount of time.
We also help with your data protection impact assessments, particularly the automated decision-making section, where the trust level model and decision records are usually the material you need.
11. Return and deletion
On termination you have 30 days to export documents, memory and decision records in a usable form, with help from us. We then delete your data from live systems within 30 days, and backups age out within a further 30. We confirm deletion in writing if you ask, and we will keep data longer only where the law requires it or you have asked us to in writing.