You own your data and the output produced from it. We own the software.
You decide what your AI employees may do alone. That grant is yours, and so is responsibility for setting it sensibly.
The product produces judgements, not guarantees. Keep work supervised until the evidence says otherwise.
Either side can end it with notice, and you can take your data out first.
1. Who these terms bind
These terms are between XCM-AI Ltd, registered in the United Kingdom, and the organisation subscribing to the service. Together with the order form, the data processing agreement and the acceptable use policy, they form the whole agreement. Where documents conflict, the signed order form governs, then the DPA, then these terms.
Whoever accepts them confirms they can bind the organisation. If you are evaluating rather than buying, they apply to your use of any trial or solution-partner environment too.
2. The service
Xalios provides software in which you configure AI employees: named agents with written job descriptions that read documents, hold memory of your organisation, and take actions within limits you grant. We give you access for the subscription term for your internal business use.
The product is early. Features change, and some change in response to what solution partners find. We will not remove something you depend on without telling you first, and material changes come with notice rather than a release note you have to read to discover.
3. Autonomy, and who is responsible for it
This is the clause that matters most, so it is in plain words. You decide what each AI employee may do without asking: which systems, which document types, which value ceilings, who it escalates to. We enforce that grant outside the model, and nothing the system reads can widen it. What we cannot do is decide for you whether a given grant is wise for your business.
So: actions taken inside a boundary you granted are your actions, in the same way that work delegated to a member of staff is. We are responsible for the grant being enforced faithfully, for the record being accurate, and for demotion working when you use it. We are not responsible for a commercial outcome you chose to automate.
Two practical obligations follow. Keep an owner named for every AI employee, and keep work supervised until your own agreement-rate evidence supports moving it. If you grant trusted autonomy on week one, that is a choice we will have advised against.
4. Your responsibilities
Access
Keep credentials secure, remove people who leave, and tell us promptly if you think an account is compromised.
Your data
You confirm you have the right to give us the documents you connect, and to have them processed as configured.
Oversight
Review what needs reviewing. An approval queue nobody reads is not oversight, and we cannot supply the judgement for you.
Acceptable use
Stay inside the acceptable use policy. The prohibitions there are short and none of them will surprise you.
Regulated work
If your sector imposes obligations on how decisions are made, meeting them stays with you. We will give you the records to evidence it.
5. Data and ownership
You own your documents, the memory built from them, and the decision records produced. You grant us the licence needed to run the service for you and nothing wider. We own the software, models we build, and anything we develop generally, and we will not build a feature out of your specific data without asking.
No customer data trains any model, ours or a provider's. That is contractual with our subprocessors, not a preference. Aggregate operational metrics that cannot identify you or your counterparties may be used to run and improve the service.
6. Fees
As set out in your order form, annually or monthly in advance, payable within 30 days, exclusive of VAT. Pricing explains how the commercial model works, including the parts that are not a fixed number yet.
Price changes take effect at renewal with at least 60 days' notice, never mid-term. Solution-partner pricing is fixed for the agreed period; if it changes at renewal you will hear the reason, not just the number.
7. Availability and support
Support is UK business hours, with best effort outside them. There is no credits-backed SLA as standard, and we would rather say that here than in a footnote. If you need a contractual availability commitment, raise it before signing and we will tell you straight whether we can give one.
Work in progress is not lost during an outage: items queue and are worked when the service returns, with the delay visible on the record.
8. What we warrant, and what we don't
We warrant that we will provide the service with reasonable skill and care, that autonomy limits you set are enforced as configured, and that decision records accurately reflect what happened.
We do not warrant that every output is correct. The product makes judgements over documents, and judgements can be wrong, which is the entire reason trust levels, approvals and records exist. Nor do we warrant uninterrupted operation, or that prompt injection has been eliminated: no one reading documents and then acting on them can honestly claim that, and we will not.
9. Liability
Neither side excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded.
Otherwise each party's total liability is capped at the fees paid or payable in the 12 months before the claim, and neither is liable for indirect or consequential loss, or for lost profits, revenue or anticipated savings. Your data protection obligations and ours sit in the DPA and are not cut down by this clause.
One thing the cap does not shift: if we failed to enforce an autonomy limit you configured, that is our failure and we will not argue that you should have supervised more.
10. Term, exit, and getting your data out
The term is in your order form and renews unless either side gives 30 days' notice before renewal. Either side may terminate for material breach not remedied within 30 days, and we may suspend access immediately for a serious acceptable-use breach or a live security risk, with a reason, in writing.
On termination you get 30 days to export your documents, memory and decision records in a usable form, and help doing it. Then we delete, per the privacy notice. We will not hold your records hostage over a commercial disagreement.
11. Changes, and governing law
Material changes to these terms come with at least 30 days' notice to customers; if a change genuinely disadvantages you, tell us and we will discuss it rather than point at a clause. Neither side may assign without consent, except to a successor of the whole business.
These terms are governed by the laws of England and Wales, with the courts of England and Wales having exclusive jurisdiction. If your counsel needs redlines, send them: get in touch and a person will work through them with you.