Terms of Service

Last updated: 5 July 2026 · CSOAI Ltd (Companies House 16939677) · OPEN SOURCE ENTERPRISE GOVERNMENT

1. Acceptance of Terms

By installing, deploying, accessing, or using DEFONEOS ("the Platform"), you agree to be bound by these Terms of Service. If you do not agree, do not use the Platform.

For open-source deployments, the applicable open-source license (Section 3) takes precedence. For enterprise and government deployments, the applicable commercial agreement (Sections 4-5) supplements these Terms.

2. License Tiers

See Pricing for full tier comparison.

3. Open Source License (Apache 2.0 / MIT)

• Use: Commercial and non-commercial use, free of charge
• Modify: Fork, adapt, and modify the source code
• Distribute: Redistribute original or modified versions
• Patent grant: Apache 2.0 includes an explicit patent grant and retaliation clause
• Sublicense: Incorporate into proprietary products (subject to license terms)

3.1 Conditions

• Include the original copyright notice and license text
• State significant changes made to the files
• Apache 2.0: If you file a patent lawsuit alleging the software infringes a patent, your license terminates

3.2 Trademark

The names "DEFONEOS", "CSOAI", "SOV3", and associated logos are trademarks of CSOAI Ltd. The open-source license does not grant trademark rights. You may reference DEFONEOS descriptively but may not use the marks to endorse or promote your products without written permission.

4. Enterprise License

The Enterprise License supplements the open-source license with:

• Managed hosting: CSOAI-hosted DEFONEOS infrastructure in customer-selected region
• SLA: 99.9% uptime guarantee (see Section 7)
• Priority support: 24/7 support with defined response times
• Compliance packaging: JSP 936, JSP 440, Cyber Essentials documentation
• SIGIL audit verification: Third-party audit-ready Ed25519 chain
• Custom MCP development: Build bespoke sensor integrations
• Training: Onboarding, operator training, and certification

5. Government License

• Sovereign deployment: Air-gapped, Crown infrastructure, no external data flow
• Source code escrow: Full source held in Crown escrow for continuity
• Operational sovereignty: CSOAI Ltd personnel do not access classified data
• JSP 440 / 936 compliance: Built-in compliance generation and audit
• SC/DV clearance: Support personnel cleared to appropriate level
• Termination rights: Crown retains rights to operate software in perpetuity upon termination for national security purposes

6. Acceptable Use

You agree NOT to:

• Use DEFONEOS for unlawful activities, terrorism, human rights violations, or war crimes
• Deploy DEFONEOS in contravention of UK export controls, UN sanctions, or arms embargoes
• Remove or alter SIGIL audit chain entries (this violates the cryptographic integrity guarantee)
• Use DEFONEOS to process personal data in violation of GDPR / UK GDPR (see Privacy Policy)
• Reverse-engineer the CSOAI-hosted platform (open-source code is already available — this applies only to proprietary hosted components)
• Deploy DEFONEOS as a weapon system without appropriate military licensing and clearance

7. Service Level Agreement

SLA credits: If CSOAI fails to meet the uptime SLA in any month, service credits are applied per the enterprise agreement. See full SLA terms in the commercial agreement.

8. Payment & Billing

• Billing cycle: Monthly (Pro/Enterprise) or per-contract (Government)
• Payment methods: BACS, credit card, purchase order
• Late payment: Overdue invoices accrue interest at 8% over Bank of England base rate (Late Payment of Commercial Debts Act 1998)
• VAT: UK VAT (20%) applied where applicable. VAT number on invoice.
• Refunds: Annual subscriptions: pro-rata refund within 30 days of renewal. Monthly: no refund for partial months.

9. Intellectual Property

• DEFONEOS software: Owned by CSOAI Ltd, licensed under Apache 2.0 / MIT (open source) or commercial license (enterprise/government)
• SIGIL chain format: Ed25519-signed hash chain protocol — CSOAI Ltd proprietary, freely usable
• Contributions: Community contributions to open-source repos are licensed under the same Apache 2.0 terms (CLA may be required)
• Customer data: Remains the property of the customer at all times. CSOAI Ltd claims no rights to customer data.
• Feedback: Feedback and suggestions may be used by CSOAI Ltd to improve the platform without obligation

10. Warranty Disclaimer

11. Limitation of Liability

• Open source: To the maximum extent permitted by law, CSOAI Ltd shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits or revenues
• Enterprise: Total liability limited to the amount paid by the customer in the preceding 12 months
• Government: Liability caps and exclusions as defined in the Crown contract
• Exclusions: Nothing in these Terms excludes liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be excluded under English law

12. Indemnification

You agree to indemnify and hold harmless CSOAI Ltd, its officers, directors, and employees from any claims, damages, or expenses (including legal fees) arising from:

• Your misuse of the Platform
• Your violation of these Terms
• Your violation of applicable laws or third-party rights
• Your deployment configuration choices (open-source tier)

13. Termination

• Open source: License terminates upon breach of Apache 2.0/MIT terms. You may stop using at any time.
• Enterprise: Either party may terminate with 30 days' written notice. CSOAI Ltd may terminate immediately for material breach or non-payment.
• Government: Termination governed by Crown contract terms. Source code escrow ensures continuity.
• Effect of termination: Licenses granted cease. SIGIL audit chain remains accessible for the retention period (7 years). Customer data export available for 30 days post-termination.

14. Export Control

• UK Strategic Export Control: Export Control Order 2008, dual-use items
• UK Military List: ML-classified items (if deployed as military system)
• UN arms embargoes: Prohibited destinations
• EU Dual-Use Regulation: Where applicable
• US ITAR/EAR: If incorporating US-origin components (DEFONEOS core does not)

The purchaser is responsible for obtaining all necessary export licenses. CSOAI Ltd provides UK export classification information upon request.

15. Compliance & Audit

• SIGIL chain: All platform actions are Ed25519-signed and auditable. Customers and regulators may verify chain integrity at any time.
• JSP 936: AI/ML compliance documentation generated automatically. See JSP 936 page.
• JSP 440: Manual handling controls mapped for classified deployments.
• EU AI Act: Article 50 transparency and watermarking passports supported.
• GDPR / UK GDPR: Data processing compliant. See Privacy Policy.
• Audit access: Enterprise and Government customers have full read access to their SIGIL chain for audit purposes.

16. Governing Law

These Terms are governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

For government contracts, the Crown Commercial Service terms and any applicable framework agreement terms take precedence.

17. Changes to Terms

CSOAI Ltd may update these Terms from time to time. Material changes will be notified via the SIGIL chain and this page at least 30 days before taking effect. Continued use after the effective date constitutes acceptance.

18. Contact