Prufy platform terms of service

• Platform: the Prufy service at app.prufy.io, with its features, interfaces and API.
• Customer: the organisation that contracts the Platform. It is a party to these terms.
• User: a person the Customer gives access to its organisation on the Platform.
• Administrator / Auditor: the roles the Customer assigns to each User. The Administrator manages the organisation's people (invite, change role, revoke access); the Auditor works on audits without managing people.
• Customer Content: everything the Customer and its Users upload, create or generate on the Platform: projects, notebooks, documents, files, tests, findings, cases, reports and results, including AI-generated proposals.
• AI Proposal: the text, table, chart or result the Platform generates with an artificial intelligence model at a User's request.

Prufy makes the Platform available to the Customer to plan, perform, document and review internal audit work. These terms are completed by the order, proposal or contract signed with the Customer (the "Order") and by the Data Processing Agreement. In case of conflict, the Order prevails, then the Data Processing Agreement on personal data matters, then these terms.

The Platform is a minimum viable product (MVP) in production. Its features may change, expand or be withdrawn; Prufy will give reasonable advance notice of changes that materially reduce what was contracted.

• Access is by invitation only. Only the organisation's Administrator invites people, changes roles and removes access, including to a specific notebook. Nobody who is not a member of an organisation or does not hold a valid invitation can access it.
• Users sign in with an account from a supported identity provider: Google or Microsoft (Microsoft Entra ID, work or school accounts and personal Microsoft accounts). Prufy does not manage its own passwords. Signing in does not grant access on its own: the person must be a member of an organisation or hold a valid invitation.
• The Customer is responsible for keeping its list of Users and roles up to date, revoking access for anyone who no longer needs it, and ensuring its Users comply with these terms.
• Each User is responsible for protecting their account and must notify their Administrator and hello@prufy.io if they suspect unauthorised access.

The Customer and its Users may not:

• use the Platform for unlawful purposes or to process data without a legal basis;
• upload malicious code or content that infringes third-party rights;
• attempt to access other organisations' data, circumvent access controls or test the Platform's security without Prufy's written authorisation;
• deliberately overload the Platform, or extract data or models from it in an automated way outside the provided APIs;
• try to make the AI models reveal their instructions or act against these terms;
• resell the Platform or make it available to third parties outside the organisation, unless the Order allows it.

The Customer decides what data it uploads. It should avoid uploading special categories of personal data or data it does not need for the audit, and is responsible for having a legal basis to process it.

AI Proposals are drafts. They may be incomplete or wrong. Prufy does not take professional decisions: final validation rests with the auditor. Before keeping, using or communicating an AI Proposal, a User must review it and decide on it. Decisions recorded on the Platform are attributed to the person who takes them.

The Customer is responsible for the audit conclusions, opinions, reports and decisions it issues, whether or not it used AI Proposals to prepare them. The Platform does not provide legal, financial or audit advice.

To generate AI Proposals, the Platform sends the model only the information needed for each request, with email addresses masked and known subjects pseudonymised, through OpenRouter, which routes it to the model and may process it outside the European Economic Area. On every request, Prufy asks OpenRouter to use only providers that do not retain or use the data (data_collection: deny and zdr). The names of the resources mentioned (files, findings, tasks) are sent unmasked.

• Customer Content belongs to the Customer. AI Proposals generated for the Customer are part of its Content.
• The Customer grants Prufy a limited, non-exclusive, non-transferable licence to host, process and display Customer Content solely to provide the Platform, in accordance with the Data Processing Agreement.
• Prufy does not use Customer Content to train AI models or for its own purposes.
• The Platform, its software, design, trademarks and documentation belong to Prufy or its licensors. The Customer receives a limited, non-exclusive, non-transferable right of use for the term of the Order.
• If the Customer sends suggestions about the Platform, Prufy may use them without obligation, without including Customer Content.

Each party will treat the other's non-public information as confidential, use it only to perform these terms and protect it with at least the care it applies to its own. Customer Content is always the Customer's confidential information. The obligation does not apply to information that was already public, was lawfully received from a third party or was independently developed, and yields to a legal obligation or an order from an authority, which will be communicated to the other party where the law allows. It lasts for the term of the Order and five years after.

The Customer is the controller of the personal data in its Content and Prufy acts as processor, under the Data Processing Agreement (Art. 28 GDPR). Prufy is the controller of Users' account and security data, as explained in the Platform privacy policy.

Prufy makes reasonable efforts to keep the Platform available and secure, but during the MVP phase it does not offer a service level agreement (SLA) unless agreed in the Order. There may be interruptions for maintenance, updates or external causes; Prufy will try to give advance notice of scheduled ones. Support is provided by email at hello@prufy.io.

Price, invoicing and payment terms are those of the Order. Amounts do not include applicable taxes.

Prufy may suspend access for a User or for the organisation, to the minimum extent necessary, in case of a security risk, use contrary to section 05, an order from an authority, or non-payment not remedied after notice. Prufy will notify the Customer beforehand, except in an emergency, and will restore access once the cause disappears.

• These terms apply for as long as the Order is in force.
• Either party may terminate the Order if the other materially breaches it and does not remedy the breach within 30 days of notice.
• On termination, the Customer has 30 days to download its Content with the Platform's export features or ask Prufy for a copy. After that, Prufy will delete Customer Content from the Platform, including its files, unless the law requires it to be kept. Backups are deleted in their ordinary cycle.
• Sections 07, 08, 14 and 16 survive termination.

• The Platform is provided "as is" during the MVP phase. Prufy does not warrant that it is error-free or that its AI Proposals are accurate, complete or fit for a particular purpose.
• Neither party is liable for lost profits, loss of business, reputation or data of an indirect nature, or for indirect or consequential damages.
• Prufy's total liability for any cause related to the Platform is limited to the amounts paid by the Customer in the twelve months before the event giving rise to it.
• These limits do not apply to wilful misconduct, gross negligence or anything the law does not allow to be limited.

Prufy may update these terms. It will publish the current version with its date and notify the Customer of material changes at least 30 days in advance. If the Customer does not accept them, it may terminate the Order before they take effect.

These terms are governed by Spanish law. The parties submit to the courts of Santander, Spain, unless the law imposes another.