Terms of Service

“Service” means the CoverProof SM&CR gap analysis, declaration, and evidence pack platform, including all software, tooling, APIs, and documentation made available to the Subscriber. “Subscriber” means the FCA-regulated firm that has entered into a subscription order with CoverProof Ltd. “Authorised Users” means the individuals (employees, contractors, or officers of the Subscriber) to whom the Subscriber grants access credentials. “CoverProof” means CoverProof Ltd, the operator of the Service.

The Service is delivered as cloud-hosted software-as-a-service. No on-premises installation is provided. CoverProof grants the Subscriber a non-exclusive, non-transferable right to access and use the Service for the Subscriber's own internal compliance purposes during the subscription term, subject to these Terms and payment of applicable fees. Access is granted via Authorised Users only.

Subscription fees are as stated in the applicable order form or checkout page at the time of purchase. Subscriptions automatically renew for successive periods equal to the initial term unless the Subscriber cancels at least 30 days before the renewal date via the account dashboard or by written notice to billing@coverproof.co.uk. All fees are exclusive of UK VAT, which will be charged at the applicable rate where required by law.

The Subscriber and its Authorised Users must not:

• use the Service for any unlawful purpose or in breach of applicable law or regulation;
• resell, sublicense, white-label, or otherwise make the Service available to third parties as a standalone product;
• attempt to access, query, or extract data belonging to any other Subscriber;
• scrape, copy, or reverse-engineer any part of the Service or its underlying technology or classification methodology;
• use the Service to generate compliance documentation, declarations, or evidence packs that are distributed externally without first passing through the compliance officer review gate within the platform.

CoverProof retains all intellectual property rights in the Service, including its software, classification methodology, training data, documentation, and all derivative works thereof. Nothing in these Terms transfers any IP from CoverProof to the Subscriber. The Subscriber retains all intellectual property rights in its own uploaded data, firm structures, and configurations. The Subscriber grants CoverProof a limited processing licence to use Subscriber data solely to provide and improve the Service as described in the Data Processing Agreement.

Each party will protect the other's confidential information with at least the same degree of care it applies to its own confidential information, and in any event no less than reasonable care. CoverProof's confidential information includes (without limitation) its classification methodology, pricing structures, and product roadmap. Subscriber data, including firm structures and individual records, constitutes the Subscriber's confidential information. Neither party will disclose the other's confidential information to any third party except as required by law, regulatory obligation, or court order, in which case reasonable advance notice will be given where legally permitted.

The parties' respective UK GDPR obligations and controller/processor roles are set out in the Data Processing Agreement (available at coverproof.co.uk/data-processing-agreement), which forms part of these Terms. In the event of conflict between these Terms and the DPA on data protection matters, the DPA prevails.

CoverProof will implement and maintain appropriate technical and organisational security measures commensurate with the nature of the data processed and the risks presented by the Service. A description of these measures is published at coverproof.co.uk/security, which is incorporated into these Terms by reference.

CoverProof targets 99.5% monthly uptime for the core classification and declaration workflows, excluding scheduled maintenance windows (which will be announced at least 24 hours in advance where practicable). In the event of a material outage exceeding 4 consecutive hours in any calendar month that is caused by CoverProof (and not by a third-party infrastructure provider or force majeure event), the Subscriber may request a service credit of one day's pro-rata subscription fee per 4-hour block of downtime. Service credits must be requested within 14 days of the outage by emailing support@coverproof.co.uk. Service credits are the Subscriber's sole and exclusive remedy for service availability failures.

CoverProof's aggregate liability to the Subscriber for all claims arising under or in connection with these Terms in any 12-month period is limited to the total fees paid by the Subscriber to CoverProof during that same 12-month period. This liability cap does not apply to:

• CoverProof's liability for a personal data breach caused by its negligence or wilful default;
• infringement by CoverProof of the Subscriber's intellectual property rights;
• death or personal injury caused by CoverProof's negligence; or
• any liability that cannot be excluded or limited by applicable law, including fraud or fraudulent misrepresentation.

Neither party is liable for indirect, consequential, incidental, special, or punitive loss, including loss of profits, loss of revenue, loss of data (other than direct costs of data recovery), or loss of business, whether arising in contract, tort, or otherwise, even if advised of the possibility of such loss.

CoverProof will indemnify, defend, and hold harmless the Subscriber against any third-party claims, costs, damages, and legal fees arising from an allegation that the Service itself (excluding any Subscriber-provided data or content) infringes a third party's intellectual property rights under the laws of England and Wales, provided that: (a) the Subscriber notifies CoverProof promptly in writing upon becoming aware of the claim; (b) the Subscriber gives CoverProof sole control of the defence and settlement of the claim; and (c) the Subscriber provides reasonable cooperation and assistance at CoverProof's expense.

CoverProof may suspend the Subscriber's access to the Service immediately and without prior notice in the event of a material breach of the Acceptable Use clause (section 4) or failure to pay fees within 14 days of the due date. Either party may terminate the subscription on 30 days' written notice. On termination for any reason, the Subscriber's data will remain available for export from the dashboard for 30 days, after which CoverProof will delete it, except where retention is required by law or regulatory obligation (as described in the Privacy Policy).

The Subscriber (and, where required by applicable law or regulatory obligation, the FCA, PRA, or other relevant UK regulatory authority with jurisdiction over the Subscriber) may audit CoverProof's compliance with these Terms and the DPA once per calendar year on reasonable written notice, or at any time following a material security incident affecting the Subscriber's data. CoverProof may satisfy this audit right by making available a current SOC 2 Type II report or equivalent third-party security assessment, in lieu of permitting an on-site audit.

CoverProof will give the Subscriber at least 14 days' advance written notice before:

• adding a new sub-processor to its supply chain in connection with the Service;
• making a material change to the Service that reduces or removes functionality the Subscriber currently relies upon; or
• amending these Terms in a way that materially affects the Subscriber's rights or obligations.

These Terms are governed by the law of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising under or in connection with these Terms. These Terms, together with the Data Processing Agreement and any applicable order form, constitute the entire agreement between the parties with respect to the Service and supersede all prior agreements, representations, and understandings on the same subject matter. In the event of any conflict between these Terms and the DPA, the DPA prevails on all data protection matters. If any provision of these Terms is found to be unenforceable, the remaining provisions will continue in full force and effect.