Terms of Service

The following verified supplementary provisions (v1.0-RC1, 8 November 2026) prevail over the general provisions further down in this document in case of conflict.

1. MASTER SERVICE AGREEMENT — TECHNICALLY VERIFIED PROVISIONS

1.1 AI provider model

Govexa may provide its artificial-intelligence functions through one of the following models:

1. Govexa-managed Anthropic — default provider;
2. Govexa-managed OpenAI — optional provider, when enabled;
3. Customer-Directed AI / BYOAI — Customer's own Anthropic or OpenAI account/API key;
4. Customer-Hosted AI — Customer's own Ollama server or another customer-controlled endpoint supported by Govexa.

Unless Customer requests a different option, Govexa-managed Anthropic may be used.

1.1.1 Setting up a customer-specific connection

A customer-owned AI account/API key or Ollama connection is configured only by a Govexa platform administrator and only on Customer's written instruction.

Connection details are stored encrypted with AES-256-GCM in the sensitive fields supported by Govexa and are not displayed again in clear text in application interfaces.

For customer-controlled Ollama endpoints, the connection security controls applied by Govexa under the current technical implementation include mandatory HTTPS and SSRF protection against internal-network targets.

Not writing sensitive connection details to decision/audit records during a connection test is the intended current behaviour.

1.1.2 No silent fallback

If Customer-Directed AI or Customer-Hosted AI is configured for a tenant, a failure of that connection does not cause Govexa to fall back automatically or silently to its own Anthropic/OpenAI account without Customer's knowledge. Use of an alternative provider requires Customer's configuration/instruction.

1.1.3 AI outputs and human oversight

Govexa does not turn AI outputs directly into final control, risk, audit or compliance decisions. Supported suggestions are subject to human review/approval through the proposals mechanism.

AI outputs may contain errors, omissions or hallucinations. They are not legal advice, certification, an independent audit opinion or a guarantee of regulatory compliance.

1.2 Tenant separation

Govexa uses PostgreSQL Row Level Security controls for the logical separation of tenant-scoped data and includes tenant-isolation tests in its CI process. This control does not remove Customer's responsibility for its own user/permission configuration.

1.3 Security

In the current architecture Govexa applies TLS, AES-256-GCM field encryption for certain sensitive fields, management of secrets through environment variables, an append-only audit log and secure-development controls.

"MFA", "EU-only hosting", "WORM-certified records", "documented RPO/RTO" or "30-day automatic offboarding" are committed only if actually enabled and offered under the separately stated plan/contract.

1.4 Termination, export and deletion

After termination, data return, export and deletion are carried out in line with current technical capabilities, applicable law, backup cycles, the nature of security/audit records and the process the parties expressly agreed in the Order Form/DPA.

As long as the current product has no automatic tenant-wide export and no automatic 30-day permanent deletion tool, Govexa makes no commitment that "all data will be definitively deleted within 30 days".

Customer Content and security/audit records may be subject to different retention regimes. Minimal records that must be kept for legal obligation, security, dispute or integrity reasons may be retained after content data is deleted, only for the necessary period and purpose.

1.5 Anonymous and aggregated statistics

On expiry of the agreement or during deletion of Customer Data, Govexa may produce anonymous and aggregated statistical data only if all of the following conditions are met:

• the data is not capable of identifying any natural person or Customer, directly or indirectly;
• the tenant link and direct customer identifiers have been removed;
• free text, record names, personal data, files, secrets and trade-secret content are not included;
• dates are handled at no more than the aggregation level needed to reduce re-identification risk — at month level in the planned design;
• small numbers and sensitive distributions are converted into appropriate ranges/buckets;
• the data must not allow re-identification when matched with other reasonably accessible datasets;
• re-identification risk is assessed periodically.

Anonymous/aggregated statistics meeting these conditions may be used indefinitely for product development, capacity planning and comparison/benchmarking.

Customer may object in writing to the production of such anonymous statistics when the agreement is concluded or later. For a tenant with an effective objection, no new anonymous benchmark dataset is created for this purpose during termination/offboarding.

Data that does not meet the anonymity threshold may not be used under this clause and remains subject to the contractual and legal regime for Customer Data/personal data.

General provisions

1.1 Parties and scope

These Terms of Service ("Terms") govern access to and use of the Govexa website, platform, software-as-a-service subscriptions, modules, APIs, artificial-intelligence functions, documentation and related services (collectively, the "Services") supplied by [to be completed], trading as Govexa, registered at [to be completed], registration/tax number [to be completed] ("Govexa", "we", "us", "our").

By creating an account, accepting an order, purchasing a subscription or using the Services, the customer ("Customer", "you") agrees to these Terms. If you act for an organisation, you represent that you are authorised to bind it.

1.2 The Govexa Service

Govexa is an AI-native, context-aware Governance, Risk and Compliance ("GRC") platform. Depending on the purchased plan, the Services may include organisation and process modelling, asset and data inventories, compliance-framework and obligation management, risk and control management, audit and assurance workflows, evidence and findings, corrective actions, vendor/third-party management, technical exposure and vulnerability information, dashboards, reporting and AI-assisted analysis.

Features, limits, seats, storage, modules, support levels and other entitlements are determined by the applicable pricing page, checkout, Order Form or written commercial proposal.

Govexa is a decision-support and workflow platform. It is not a law firm, certification body, statutory auditor or regulatory authority. Use of Govexa does not by itself guarantee certification or compliance with ISO standards, GDPR, KVKK, the EU AI Act or any other law or framework.

1.3 Licence

Subject to payment and compliance with these Terms, Govexa grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the subscription term to access and use the Services for Customer's internal business purposes.

No source code, model, algorithm, trademark, design, database or other Govexa intellectual-property ownership is transferred.

1.4 Accounts and authorised users

Customer is responsible for authorised users, account security and confidentiality of credentials. Customer must promptly notify Govexa of suspected unauthorised access. Accounts may not be sold, shared with unauthorised persons or used to circumvent plan limits.

1.5 Plans, fees, taxes and renewal

Govexa may offer monthly, annual, multi-year, usage-based, trial or custom enterprise plans. Applicable price, currency, taxes where shown, billing period and recurring nature of a subscription will be disclosed before purchase.

Where a subscription is designated as automatically renewing, it renews for the stated period unless cancelled before the next renewal in accordance with the checkout and billing terms.

1.6 Paddle as Merchant of Record

For transactions processed through Paddle, Paddle acts as the Merchant of Record / authorised reseller for the transaction. Paddle may handle checkout, payment collection, applicable transaction taxes, invoices, subscription billing, refunds, chargebacks and payment-related buyer support under Paddle's applicable buyer terms and policies.

Govexa remains responsible for supplying the Govexa Service. Where Paddle is Merchant of Record, Customer must not treat Govexa as the payment merchant for that transaction, and payment refunds are processed through Paddle.

1.7 Cancellation

An automatically renewing subscription may be cancelled before the next renewal through the available billing interface, Paddle Customer Portal or other method provided for the transaction. Unless mandatory law or a written Order Form states otherwise, cancellation prevents future renewal and does not automatically refund an already commenced billing period. Access normally continues until the paid period ends.

1.8 Customer Data

"Customer Data" means data, documents, evidence, configurations, prompts, files and other content submitted to the Services by or for Customer.

As between Govexa and Customer, Customer retains its rights in Customer Data. Customer represents that it has all necessary rights, notices, permissions and lawful bases to submit and process Customer Data.

Customer is responsible for determining whether special-category, sensitive, confidential, regulated or export-controlled information may lawfully be entered into the Service and for configuring its use accordingly.

1.9 Artificial intelligence and provider choice

Govexa includes AI-assisted functions. Subject to plan and technical availability, Customer may use:

1. Anthropic — default integrated AI provider;
2. OpenAI — optional integrated AI provider; or
3. Customer-Provided AI / Bring Your Own AI ("BYOAI") — a supported model, API endpoint, account or API credential supplied by Customer.

Unless Customer selects another supported option, Anthropic may be used as the default AI provider.

When an integrated AI function is invoked, the minimum data technically necessary to perform the requested function may be transmitted to the selected provider. This can include prompts, relevant contextual data and generated outputs.

For Govexa-managed commercial AI integrations, Govexa will use commercial/API offerings intended for business use. Govexa does not intentionally use Customer Content to train public or general-purpose AI models unless Customer expressly agrees otherwise. Third-party providers remain subject to their own commercial terms, DPAs, retention rules, security controls and legally required processing.

For BYOAI, Customer is responsible for its provider account, credentials, licensing, model choice, geographic configuration, retention settings and legal basis. Govexa is not responsible for the independent acts, availability or data practices of a provider selected and contracted directly by Customer.

1.10 AI output and human oversight

AI-generated risk scores, mappings, summaries, audit questions, classifications, recommendations, gap analyses and other outputs may be incomplete or inaccurate. They are decision-support information, not legal advice, certification, an audit opinion or a regulatory determination.

Customer must apply appropriate human review before relying on AI output for material legal, compliance, security, employment, financial or other decisions.

1.11 Infrastructure and third-party services

Govexa may use third-party providers necessary to operate, secure and deliver the Services, including:

• Vercel — web/application and cloud infrastructure;
• Railway — backend, compute, database and infrastructure services;
• Cloudflare — DNS, CDN, routing, DDoS protection, WAF and network/security services;
• Anthropic — default AI inference provider;
• OpenAI — optional AI inference provider;
• Paddle — Merchant of Record, checkout, billing, tax and payment operations.

A provider's inclusion does not mean that every provider processes every Customer's data. Actual processing depends on configuration and functionality used.

Govexa may replace or add providers where reasonably required for security, legal, technical or operational reasons, subject to applicable data-protection obligations.

1.12 Data location and international transfers

Govexa aims to use European-region infrastructure and regional processing controls where technically and commercially appropriate. Govexa does not promise that all data will remain exclusively in the EU/EEA unless an EU-only commitment is expressly stated in a separate written agreement or applicable enterprise plan.

Some providers or subprocessors may process or store data outside the EU/EEA. For example, provider architecture, support, security, metadata or AI processing may involve international transfers.

For GDPR-protected personal data transferred outside the EEA, Govexa will use an applicable lawful transfer mechanism, such as an adequacy decision, European Commission Standard Contractual Clauses ("SCCs"), an applicable Data Privacy Framework mechanism or another mechanism permitted by Articles 44–49 GDPR, together with supplementary measures where appropriate.

For personal data subject to Turkish Law No. 6698 ("KVKK"), international transfers will be managed using the mechanisms permitted by the applicable KVKK cross-border transfer regime, including adequacy decisions, appropriate safeguards, standard contracts or other lawful mechanisms as applicable.

1.13 Acceptable use

Customer must not use the Services to violate law or third-party rights; introduce malware; attempt unauthorised access; bypass security or usage controls; disrupt availability; reverse engineer except where mandatory law permits it; resell the Services without authorisation; or use Govexa to facilitate unlawful, fraudulent or abusive activity.

Govexa may suspend access where reasonably necessary to prevent material security risk, abuse, non-payment or material breach, subject to applicable law and reasonable notice where appropriate.

1.14 Intellectual property

Govexa and its licensors retain all rights in the Services, software, user interfaces, documentation, databases, workflows, trademarks and AI-related technology. Feedback voluntarily provided about the Service may be used to improve Govexa without transferring Customer Data ownership.

1.15 Confidentiality

Each party must protect the other party's confidential information using reasonable care and use it only for the contractual relationship. Confidentiality does not cover information that is public without breach, independently developed, lawfully received from another source or required to be disclosed by law.

1.16 Availability and changes

Govexa will use commercially reasonable efforts to provide the Services. Maintenance, security events, provider failures and circumstances outside reasonable control may cause interruptions. A binding SLA applies only if expressly agreed in writing.

Govexa may update features and these Terms for legal, regulatory, security, technical or operational reasons. Material changes affecting existing subscriptions will be communicated where required by law or contract.

1.17 Suspension and termination

Govexa may suspend or terminate Services for material breach, unlawful use, non-payment or material security risk. Where reasonably possible, Govexa will give notice and an opportunity to cure.

Customer may terminate as provided in its subscription or Order Form. Accrued rights survive termination.

1.18 Warranties and liability

To the maximum extent permitted by law, Govexa does not warrant uninterrupted or error-free operation or that AI outputs will always be accurate.

For business Customers, and except for liability that cannot lawfully be limited, Govexa's aggregate liability arising from the Services will not exceed the fees paid or payable for the affected Services during the twelve months preceding the event giving rise to the claim, unless a different cap is agreed in an Order Form. Neither party is liable for indirect or consequential losses, loss of profit or anticipated savings to the extent such exclusion is lawful.

Nothing excludes liability for fraud, wilful misconduct, death or personal injury caused by negligence where such exclusion is prohibited, or mandatory data-protection/consumer rights that cannot be waived.

1.19 EU/EEA consumers

EU/EEA: Nothing in these Terms limits mandatory consumer rights. Where a Customer legally qualifies as a consumer, statutory withdrawal and digital-service conformity rights may apply.

For digital content not supplied on a tangible medium, withdrawal rights may be lost after supply begins where all conditions required by applicable law are satisfied, including prior express consent and acknowledgement. For services started during the withdrawal period at the consumer's express request, applicable law governs withdrawal and any proportionate payment.

1.20 Consumers in Türkiye

TR: For transactions where Customer is a consumer, mandatory rights under Law No. 6502 on Consumer Protection, the Distance Contracts Regulation and other applicable consumer legislation remain reserved.

A consumer generally has a 14-day withdrawal right for a distance service contract beginning when the contract is concluded, subject to statutory exceptions. Applicable exceptions may include services performed instantly in electronic form, intangible goods delivered instantly and services whose performance begins with the consumer's approval before expiry of the withdrawal period, to the extent the legal conditions for the exception are met.

1.21 B2B Customers

Where Customer purchases Govexa for commercial or professional purposes and is not legally a consumer, consumer withdrawal provisions do not apply unless mandatory law states otherwise.

1.22 Governing law and disputes

For B2B Customers, unless an Order Form provides otherwise, these Terms are governed by the laws of the Republic of Türkiye, without prejudice to mandatory conflict-of-law rules. [to be completed] shall have jurisdiction where legally permissible.

EU/EEA consumers retain mandatory protections of the law of their habitual residence and access to competent courts provided by mandatory law. Consumers in Türkiye retain statutory rights to apply to competent Consumer Arbitration Committees and Consumer Courts.

1.23 Contact

[to be completed]
Trading name: Govexa
Registered address: [to be completed]
Registration/Tax No.: [to be completed]
Email: legal@govexa.io
Support: hello@govexa.io
Website: https://govexa.io

• — — — — — — — — — — — — — — — — — — — — — — — --