Terms and Conditions - SafeForge AI

These Terms and Conditions ("Terms") govern your access to and use of SafeForge (the "Service"), a cloud-hosted hazard and risk management application operated by SafeForge AI ("SafeForge AI", "we", "us", "our").

SafeForge AI (ABN 89190664116) operates SafeForge. We are based in Victoria, Australia; our full registered postal address is available on request via support@safeforge.ai.

By creating an account, starting a trial, subscribing to, or otherwise using the Service, you agree to these Terms. If you are agreeing on behalf of an organisation, you confirm you have authority to bind that organisation, and "you" and "your" refer to that organisation.

If you do not agree to these Terms, do not use the Service.

1. Definitions

"Service" — the SafeForge web application, its features, APIs, exports, and documentation, accessed at app.safeforge.ai or any successor address.
"Organisation" — the workspace created for your business or team within the Service. Each user account belongs to exactly one Organisation.
"Customer Data" — all data you or your users enter, import, or generate within the Service, including hazards, controls, threats, causes, consequences, requirements, assumptions, risk ratings, comments, audit history, and uploaded files.
"AI Features" — the optional, opt-in functionality within the Service that sends Customer Data content to a third-party large language model provider for analysis and returns advisory output.
"Organisation Admin" — a user holding the administrator role for an Organisation, with authority over billing, user management, and AI policy.
"Authorised User" — an individual you permit to access the Service under your subscription, occupying a paid seat.
"Subscription" — your paid plan for the Service, managed through our payment processor.
"Workshop Link" — a password-protected web address, created by an Authorised User, through which people outside your Organisation can read a risk workshop and sign in to it without an account (Section 6A).
"Participant" — a person who opens a Workshop Link. A Participant is not an Authorised User and does not occupy a seat.

2. The Service

SafeForge is a tool for managing safety and risk information. It helps safety and engineering teams import, structure, analyse, visualise, review, and export hazard logs and associated risk data. It provides a structured change-control process, an audit trail, bow-tie visualisations, dashboards, collaborative review workflows, and optional AI-assisted analysis.

The Service is provided on a software-as-a-service basis. There is nothing to install; the Service is accessed through a web browser.

We may add, change, or remove features over time. We will not make changes that materially reduce the core functionality of your paid plan during a billing period without notice.

3. The Service is a Tool, Not a Safety Case

This section is fundamental to your use of the Service. Read it carefully.

SafeForge is an information management tool. It is not a safety case, a safety assessment, a regulatory submission, or a substitute for the professional judgement of a competent safety engineer.

You acknowledge and agree that:

Outputs are starting points, not conclusions. Every artefact the Service produces — including imported data, structured hazard logs, dashboards, visualisations, exports, and AI-generated suggestions — is a starting point for your own analysis. It is not a finished work product and must not be relied upon as one.
The safety engineer is responsible for every decision. Responsibility for the identification, assessment, treatment, and closure of every hazard, and for the adequacy of every control, rests entirely with you and the qualified people in your organisation. The Service does not make safety decisions; it assists the humans who do.
The Service is not safety-critical software. SafeForge is an information management tool — equivalent in function to a structured spreadsheet with better organisation and an audit trail. It is not developed, certified, or represented as compliant with software safety integrity standards such as DO-178C, EN 50128, EN 50657, IEC 61508, ISO 26262, or similar. The safety integrity of your hazard management process depends on the procedures and competent review your organisation wraps around the tool — not on the tool itself.
You must independently verify everything. You are responsible for independently checking the accuracy, completeness, and suitability of all data and outputs before relying on them for any safety, engineering, regulatory, commercial, or other purpose.
Not evidence of legal compliance. Use of the Service does not, on its own, demonstrate or establish that any statutory, regulatory, or contractual safety duty applicable to your jurisdiction has been discharged — including duties commonly expressed as "So Far As Is Reasonably Practicable" (SFAIRP), "As Low As Reasonably Practicable" (ALARP), "As Low As Reasonably Achievable" (ALARA), or any equivalent risk-reduction principle. Demonstrating that such a duty has been met requires the professional judgement of a competent person, the supporting analysis, and the wider safety case — not the artefacts produced or stored by a tool. The Service assists those judgements; it does not make them and is not a substitute for them.
Project rules and Assist checks. A project rule is written by your Organisation's project admin, not by SafeForge AI. A rule or an Assist check lists records that differ from what the rule or the check describes. A rule that finds nothing, or a check that passes, is not a statement by SafeForge AI that a hazard log, a control or a design is complete, sufficient, compliant or accepted by any regulator.

4. AI Features

AI Features are optional and disabled by default. They are enabled per Organisation by an Organisation Admin, and then per project, and they can be disabled again at any time.

When you enable and use AI Features, you agree that:

AI output is advisory only. Suggestions produced by AI Features are advisory. They are never automatically applied to your hazard log. Every AI suggestion stays marked as AI-generated and unconfirmed until an Authorised User explicitly and deliberately confirms it, and it is not treated as your content until then. This confirmation step is built into the Service and is a core control on which these Terms rely.
AI output may be wrong. Large language models can produce output that is incorrect, incomplete, outdated, or inconsistent. AI output must be treated as a draft to be reviewed by a competent person, exactly as you would treat the AI provisions of Section 3. Never accept an AI suggestion you have not independently verified.
You control what is processed. When AI Features are enabled, the Service sends the minimum content needed for the task to our third-party AI provider. For AI checks and suggestions, that is the textual content of the specific entities being analysed (for example, hazard titles and descriptions, control descriptions, threat and consequence descriptions) and the project's industry context (such as jurisdiction and regulatory framework). When you import a spreadsheet with AI assistance, each column's heading and a few sample values are sent, together with summary counts and check findings about the file's structure; whole rows and the rest of the file are not. The in-app assistant reads your project through the same permission-checked tools you use, so what it sends can also include project names, dates, change-request records, change history, document names and document excerpts a user has confirmed for AI use. People named in structured fields (owners, reviewers, authors, attendees) are replaced with placeholders before anything is sent; names typed into free text cannot be reliably detected and may be sent as written. Workshop notes and transcripts are only used if a user brings them in (a meeting transcript needs a recorded consent basis first), and then only short excerpts are sent, with speakers' names replaced by role labels. The Service does not send your Organisation name, user email addresses, or whole files. Full detail of what is and is not sent is in our Privacy Policy.
The assistant proposes; people decide. AI Features do not act on your behalf. The in-app assistant can read your project and can prepare work for you to review: it can stage proposed changes to your hazard log as a change request, and add draft items to workshop and key-risk working material. Everything it prepares is marked as AI-generated and unconfirmed until a person accepts it. It cannot submit, approve, commit, close or delete anything, and it cannot change your hazard log except through a change request that a person reviews and approves.

Inherent risks of generative AI; third-party provider terms. AI Features rely on large language models supplied by a third-party AI provider. SafeForge AI implements reasonable, industry-standard mitigations against known categories of AI misbehaviour — including input sanitisation against prompt-injection patterns, strict JSON-schema validation of AI check output before display, role-anchored system prompts, a server-side filter that removes legal or regulatory verdict language from the assistant's answers and from results returned by connected assistants, and limiting the in-app assistant to tools that can read, or propose changes for human review, within the signed-in user's own permissions. Even so, large language models can produce output that is offensive, biased, hallucinated, factually wrong, culturally inappropriate, or otherwise unsuitable. By enabling and using AI Features you acknowledge this inherent risk. SafeForge AI does not warrant the output of the third-party AI provider; that provider's own terms of service apply to the underlying model output, and SafeForge AI's liability for AI Features remains subject to Sections 10 and 11.

Connecting your own AI assistant. You may connect an AI assistant of your own choosing to the Service (for example, through the Model Context Protocol). A connected assistant signs in as one of your Authorised Users and can see and do only what that user could in the Service; changes it proposes follow the same change-request and review process. The assistant, its underlying model and its provider are chosen and controlled by you, not by SafeForge AI: content the assistant reads from the Service is processed under your agreement with that provider, and SafeForge AI is not responsible for the assistant's output, its handling of your data, or its availability. SafeForge AI remains responsible for the Service's own controls — permission checks, the change-request and review process, the verdict filter applied to results returned into the Service, and the audit record of the changes the assistant makes and of any request the Service refuses.

Authority and compliance. AI Features are enabled by an Organisation Admin on behalf of your Organisation. The person who enables them warrants that they have authority to make that decision for the Organisation, and that enabling AI Features — and the resulting processing of hazard and control content by the third-party AI provider — complies with your Organisation's own policies, procedures, and any regulatory or contractual obligations you are subject to. SafeForge AI is not responsible or liable for AI Features being enabled, or for content being sent for AI processing, where the Organisation Admin did so without authority or in breach of your Organisation's own policies. The decision, and responsibility for it, rests with you.

Acknowledgement of these AI terms. Acknowledgement of this Section 4 is required when AI Features are enabled for an Organisation, and again from each user before they use AI Features. If this Section changes materially, a renewed acknowledgement may be required before AI Features can continue to be used. This is in addition to your acceptance of these Terms generally.

5. Acceptable Use

You must use the Service lawfully and only for its intended purpose: managing safety and risk information.

You must not, and must not permit any Authorised User to:

use the Service to store or process content that you are not lawfully entitled to store or process;
attempt to gain unauthorised access to the Service, other Organisations' data, or our infrastructure;
probe, scan, or test the vulnerability of the Service, or breach or circumvent any security or authentication measure;
interfere with or disrupt the integrity or performance of the Service;
reverse engineer, decompile, or attempt to extract the source code of the Service, except to the extent this restriction is prohibited by law;
resell, sublicense, or provide the Service to third parties outside your Organisation except as expressly permitted (for example, inviting external collaborators into your Organisation as Authorised Users); or
use the Service to build a competing product.

Classified, controlled, and protectively-marked content. The following restriction applies in full and without modification:

> Users must not store classified, export-controlled (ITAR/EAR), or protectively > marked content. Describe hazards at the risk level, not the vulnerability level. > Do not store specific exploit details, CVE identifiers, attack vectors, > credentials, or penetration test results. SafeForge is a safety > hazard management tool, not a vulnerability management tool.

Cyber security risk. The Service is a safety hazard management tool. It is not a cyber security risk management tool, a cyber risk register, an information security management system, or a vulnerability management tool, and must not be used as your system of record for any of those. A cyber attack may legitimately be recorded as a threat or cause within a safety hazard analysis — for example, where a cyber compromise could lead to a physical safety consequence — but the Service must not be used to manage cyber security risk in its own right, and, as set out above, must not hold vulnerability, exploit, credential, or penetration-test detail. Cyber security risk must be managed in systems built and, where applicable, accredited for that purpose.

Defence and military safety standards do not change this. The Service supports hazard log formats and risk frameworks associated with defence and military safety standards (for example, MIL-STD-882E and DEF STAN 00-56). Supporting these formats does not mean the Service is accredited, certified, or appropriate for security-classified, protectively-marked, or export-controlled defence content. Defence, government, and contractor customers must hold any classified or protectively-marked hazard analysis in systems accredited for that purpose, and may use the Service only for material at an unclassified, publicly-releasable level.

The Service is not accredited for handling classified or protectively-marked information. Customers with such requirements should contact us about other arrangements before storing any such content. You are solely responsible for any breach of this restriction and for any consequences arising from content you store in the Service.

6. Accounts and Organisations

One Organisation per account. Each user account belongs to exactly one Organisation. External collaborators are invited into your Organisation as Authorised Users.
Account security. Authentication is handled by our identity provider using passwordless sign-in (a one-time code or link sent to your email, or supported single sign-on). You are responsible for keeping access to your email account and any linked SSO accounts secure, and for all activity that occurs under your Authorised Users' accounts.
Roles. The Service uses per-project roles (Administrator, Engineer, Approver, Viewer), an Organisation-level administrator role, and an Organisation-level read-only seat. You are responsible for assigning roles appropriately and for the actions of the users to whom you grant them.
Accurate information. You must provide accurate account and billing information and keep it up to date.

6A. Shared Workshop Links

An Authorised User who can edit a risk workshop can share it by a Workshop Link.

What a Participant can do. Read the workshop as it stands (its risks, causes, consequences and controls, the workshop's frame, and the documents it lists), sign in with a name, job role and organisation, and, if you allow it, download the workshop's worksheet. A Participant cannot change the workshop's content.
AI-written sections on the link. Sharing a workshop sends its three AI-written sections to the link ("How this risk comes about", "Compared with good practice" and "Past incidents"), each as soon as it is written or refreshed, each marked AI-generated with who asked for it and when. "Past incidents" is written from an AI assistant's recall and says so; check each entry against its source. You can hide any of the three from the link, and take an entry out, at any time; a hidden section is not sent. Your assistant's working, what it proposes and what it drafts for you are never shown on the link.
What a Participant can send. If you turn it on for a link, a signed-in Participant can leave notes on the workshop's content and suggest additions to it (a control, a cause, a consequence, a risk or an action). Nothing a Participant sends changes the workshop by itself: an Authorised User who can edit the workshop decides, one item at a time, what is done with each. What a Participant sends, with their name as they typed it and the time, becomes part of the workshop's record and is Customer Data of your Organisation. The other Participants signed in on the same link see it with the sender's name, unless you have turned off the list of who has signed in, in which case they see it with the sender's initials; someone watching without signing in sees it with the sender's initials. A suggestion you add to the workshop becomes workshop content like any other row, marked with who suggested it.
Removing what was sent, and removing a Participant. You can remove a note or a suggestion: its text is deleted, and the record keeps that one was removed, by whom and when. You can remove a Participant: they leave the list and the attendance record and their device can no longer open the link; what they sent stays in the record, marked as from a removed person, unless you remove it too. You can turn off new sign-ins on a link without affecting the Participants already on its list.
Your own AI assistant may read notes, when you ask it to. Notes and suggestions, as Participants send them, are not sent to any AI provider by SafeForge AI and are not used to train any model. They are not returned to an AI assistant connected to the Service unless you, the facilitator, ask your own connected assistant to read them. Before anything is read, the Service shows you exactly which notes and suggestions will be read, with their text, and lets you leave any out. It then returns to your assistant the text of each, what it is on, its state and the sender's initials only: never the sender's name, job role or organisation. That text is processed under your agreement with your assistant's provider (see "Connecting your own AI assistant"). Whatever your assistant proposes from it waits for you: nothing is added to the workshop, and no answer is sent to a Participant, until you press the button yourself. Notes and suggestions are not sent to any AI otherwise.
How long a link lives. A Workshop Link works for 14 days from when it is created or last shared again. You can stop sharing at any time, and share the same link again. Stopping, or the link running out, removes nothing from the workshop: its content, its list of Participants and its record are kept. A link keeps working after you close the workshop or add it to your hazard log, until you stop sharing or it runs out, so people can read and download what was agreed. Cancelling a workshop stops its link.
You are responsible for the link. You decide who receives the link and its password, and you are responsible for what they can read through it. People who open a link do so under the conditions "Using a shared workshop", which the sign-in page shows them; the Organisation is responsible for the people it gives a link to following those conditions. Send the password separately from the link. Anyone who has both can read the workshop while the link is live. Do not share by link any content that the recipients are not entitled to see, and stop sharing when the link is no longer needed.
You are responsible for the Participant record. When Participants sign in, your Organisation collects their names, job roles and organisations and is the controller of that record; we hold it for you as your processor (see the Privacy Policy, Section 2). The same applies to the notes and suggestions Participants send. You must have a lawful basis for collecting it, tell Participants what you do with it if you use it outside the workshop, and correct or remove an entry, or remove what a Participant sent, when a Participant asks. Attendance is as typed: the Service does not verify who a Participant is. Your confirmation of the list is the check.
Acceptable use of a link. Section 5 applies to everything done through a Workshop Link. In addition, no one may use a Workshop Link to: sign in as another person; try passwords they were not given; collect the list of Participants for any purpose other than the workshop; send notes or suggestions that are unlawful, abusive or unrelated to the workshop; or load the link, or send through it, by automated means in a way that burdens the Service.
Limits and protection. Up to 100 Participants can sign in to one workshop. A Participant can send up to 10 notes and suggestions a minute and up to 100 on one workshop, each of up to 500 characters. We limit how often a link can be requested, and we pause a device or network that enters wrong passwords repeatedly. We may suspend a Workshop Link that is being abused or that puts the Service or other customers at risk, and we will tell the Organisation Admin when we do.

7. Billing Authority and the Billing Admin Capability

Subscription billing actions — increasing or decreasing paid seat quantity, replacing the stored payment method, and cancelling the Subscription — are gated to a specific capability called Billing Admin. Billing Admin is a permission flag layered on top of the Organisation Admin role: only an Organisation Admin can hold it, and not every Organisation Admin does.

The founding admin (the user who first creates the Organisation) is automatically granted Billing Admin. Other Organisation Admins do not receive Billing Admin automatically; an existing Billing Admin must grant it explicitly from the Members page.

7.1 What Billing Admins can do

A Billing Admin can:

Submit a seat-change request that increases the paid seat count, subject to the self-serve cap shown at the time of the request.
Submit a seat-change request that decreases the paid seat count, in which case they must name the specific members who will be removed at the time the change takes effect. Organisation Admins cannot be auto-removed by a seat-change request and must be demoted to Member first.
Update the stored payment method via the Stripe-hosted Customer Portal.
Cancel the Subscription via the Stripe-hosted Customer Portal.
Grant or revoke Billing Admin to or from other Organisation Admins. The last-remaining Billing Admin in an Organisation cannot revoke their own capability until they have granted it to another admin; this is enforced by the Service to prevent the Organisation from being locked out of billing.

7.2 How seat changes are authorised

Seat-change requests require a deliberate re-authorisation of the saved payment method at the time of the request:

> Re-authorisation requirement. Every seat-change request generates a one-time > Stripe-hosted Checkout link. The requesting Billing Admin must re-enter the card > details and complete any strong customer authentication challenge (e.g. 3-D Secure) > presented by the card issuer before the change is applied. The Service does not > apply a seat change on the strength of the saved payment method alone. > > The same Checkout link is also delivered by email to the requesting Billing Admin > so the request can be completed from a fresh login if the original session is closed. > > Card-replacement and cancellation continue to use the Stripe Customer Portal, which > presents its own confirmation gates.

7.3 Visibility to other admins

When a seat-change request is submitted, the Service emails every Organisation Admin a notification that includes the requester, the proposed change, any members named for removal, and a one-click link that any admin can use within 72 hours to flag the request and invalidate the Stripe Checkout link if the change was not expected.

When the change is subsequently applied (after the requester completes Stripe re-authorisation), the Service emails every Organisation Admin a fulfilment notification and emails any removed members directly. SafeForge.AI also maintains a tamper-evident append-only billing action log of every seat-change request, including who submitted it, who confirmed it, and which members were removed; this log is available to your Organisation Admins on request.

7.4 Acceptance of billing authority

By holding Billing Admin you confirm that you have authority to bind your Organisation to charges arising from seat-change requests you submit. By granting Billing Admin to another user you confirm you trust that user with the same authority. SafeForge.AI is not liable for charges resulting from seat-change requests that completed re-authorisation, including requests submitted by Billing Admins you or your founding admin have promoted, except to the extent expressly required by law.

You acknowledge this section each time you promote a user to Billing Admin.

8. Subscriptions, Trial, and Billing

Payment processor. All billing is handled by our third-party payment processor (Stripe). We do not store, process, or have access to your full card details. Your use of the payment processor is subject to its own terms.
Free trial. New subscriptions begin with a 14-day free trial. A valid payment method is required to start the trial. Unless you cancel before the trial ends, the subscription automatically converts to a paid subscription at the end of the 14-day trial period and your payment method is charged. You can cancel at any time during the trial through the customer billing portal, with no charge.
When a free trial ends without a subscription. Your Organisation's projects stay in the Service and become read-only: everyone who could see them can still open and export them, and nobody can change them, start a change request in them, import into them or run a project workshop in them, until an Organisation admin chooses a plan. A risk workshop that is not part of a project, and the sample project and sample workshop (fictional data), can still be used. Nothing is deleted because a trial ended; the data retention terms in Section 13 apply.
Fees and seats. Fees are charged per Authorised User seat, on the plan and at the prices shown at the time you subscribe. Adding seats increases your fees; changes take effect as described in the billing portal at the time of the change.
Renewal. Subscriptions renew automatically for successive billing periods until cancelled.
Cancellation. You may cancel at any time through the billing portal. Cancellation stops future renewals. Unless required by law, fees already paid are non-refundable, and you retain access until the end of the period you have paid for.
Failed payment. If a payment fails, we may suspend or downgrade access to the Service after a reasonable grace period.
Taxes. Fees are exclusive of taxes unless stated otherwise. You are responsible for any applicable taxes other than taxes on our income.
Price changes. We may change prices for future billing periods. We will give reasonable notice of any increase before it applies to you.

9. Customer Responsibilities

You are responsible for:

The accuracy and completeness of your hazard log and all other Customer Data. The Service organises and presents what you put into it; it does not guarantee that what you put into it is correct, complete, or current.
Your regulatory and contractual compliance. Determining and meeting the safety, engineering, regulatory, and contractual obligations that apply to your work is your responsibility. The Service does not assess or assure your compliance.
Who you share exports with. Exports (spreadsheets, HTML snapshots, share links, and similar) are generated at your direction. Once you download, send, or share an export, its distribution and security are entirely in your hands. You are responsible for the recipients of any export and for any share link you create.
Your users. You are responsible for the acts and omissions of your Authorised Users as if they were your own.
Backups of exported records. While the Service maintains your Customer Data and we keep our own backups, you are responsible for retaining your own exported copies of records you are legally or contractually required to retain.

10. Warranties and Disclaimers

The Service is provided "as is" and "as available".

To the maximum extent permitted by law, and subject to Section 12:

We make no warranty that the Service will be uninterrupted, error-free, secure, or free from data loss, or that it will meet your requirements.
We make no warranty of fitness for a particular purpose, including any safety, engineering, regulatory, certification, or assurance purpose.
We do not warrant the accuracy, completeness, reliability, or suitability of any data, analysis, visualisation, export, or AI output produced by or through the Service.
We disclaim all warranties, conditions, and representations not expressly stated in these Terms, whether express, implied, statutory, or otherwise.

Nothing in these Terms excludes, restricts, or modifies any guarantee, right, or remedy you have under the Australian Consumer Law or any other law that cannot lawfully be excluded, restricted, or modified (see Section 12).

11. Limitation of Liability

This section limits our liability to you. Read it carefully.

Subject to Section 12 (Australian Consumer Law) and to the maximum extent permitted by law:

Excluded losses. We are not liable for any indirect, incidental, special, consequential, or punitive loss; or for any loss of profit, revenue, business, goodwill, anticipated savings, or data; or for any loss arising from your reliance on the Service or its outputs for any safety, engineering, regulatory, or commercial decision — in each case however arising, whether in contract, tort (including negligence), statute, or otherwise.
Safety decisions. Without limiting the above, we are not liable for any incident, accident, injury, loss, damage, omission, regulatory finding, or decision arising from the use of the Service or from any hazard, control, risk rating, or AI suggestion recorded in, produced by, or omitted from the Service. Responsibility for safety decisions rests with you (see Section 3).
Liability cap. Our total aggregate liability to you for all claims arising out of or in connection with the Service or these Terms is limited, in aggregate, to the total fees you actually paid to us for the Service in the twelve (12) months immediately preceding the event giving rise to the claim.

Australian Consumer Law. Nothing in these Terms excludes, restricts, or modifies any consumer guarantee, right, or remedy conferred by the Competition and Consumer Act 2010 (Cth) (including the Australian Consumer Law) or any other applicable law that cannot lawfully be excluded, restricted, or modified. Where our liability for a breach of such a non-excludable guarantee can lawfully be limited, our liability is limited, at our option, to: (a) re-supplying the Service or the relevant part of it; or (b) paying the cost of having the Service or the relevant part of it re-supplied.

12. Customer Data, Intellectual Property, and Confidentiality

You own your Customer Data. As between you and us, you retain all right, title, and interest in your Customer Data. You grant us a limited licence to host, process, transmit, display, and back up your Customer Data solely to provide, secure, support, and improve the Service for you, and to the extent necessary to operate AI Features you have enabled.
Service improvement (aggregated and de-identified only). You also grant us the right to use Customer Data in aggregated and de-identified form — from which your Organisation and any individual cannot be identified — to maintain and improve the Service, in particular its import and column-mapping heuristics. This is not used to train AI models, and is not sent to any third-party AI provider. It is separate from, and does not widen, the per-project AI Features described in Section 4.
We own the Service. As between you and us, we (and our licensors) retain all right, title, and interest in the Service itself, including its software, design, templates, and documentation. These Terms grant you a non-exclusive, non-transferable, revocable right to use the Service during your Subscription. No other rights are granted.
Feedback. If you give us feedback or suggestions, we may use them without restriction or obligation to you.
Confidentiality. Each party must protect the other's confidential information and use it only as needed under these Terms. Your Customer Data is your confidential information. This does not apply to information that is public through no fault of the receiving party, or that must be disclosed by law.
Data portability. The Service provides export functionality so you can obtain your Customer Data in a usable format at any time during your Subscription.

12A. Connected Systems and Stored Connection Credentials

The Service can connect to external systems that your Organisation controls — for example a SharePoint site you nominate, or a requirements management system such as IBM DOORS Next — so that the Service can read your existing engineering data and keep it in sync, and (where you configure it) write exports back to a location you choose.

Some connections require a stored credential. Where an external system offers no application-identity grant, the Service stores one sign-in credential for a dedicated service account that you create in that system for this purpose. When this applies:

What we store. The connection settings you enter, and the service-account credential you provide. We store nothing else from or about your external system account.
Dedicated account only. The connection must use a dedicated service account created for SafeForge, with a unique, machine-generated password. Connecting a person's real account, or a reused password, is not supported and is a breach of these Terms. You control — and are responsible for — the account's permissions in your system, and we require that you scope it to read-only access to the specific project or area being connected.
Encrypted at rest, key held separately. The stored credential is encrypted at the application layer before it is written to our database. The encryption key is held in a separate system from the database, so a copy of the database — including any backup — does not contain a usable credential without the separately held key.
Write-only. Once stored, the credential is never displayed back to any user and is never returned by the Service's interfaces. The Service shows only that a credential is set and when the connection last verified.
Used only to sync. The credential is decrypted only at the moment of each scheduled or requested sync, used to sign in, and the session is closed when the sync completes. Read-type connections are read-only by construction: the Service does not write to your connected system through them.
Deleted on disconnect. When you disconnect the external system, the stored credential is deleted immediately. You can additionally revoke or disable the service account in your own system at any time, which stops access regardless of anything stored in the Service.
If something goes wrong. If we become aware that a stored credential may have been compromised, we will notify you consistent with our Privacy Policy's data-breach commitments and advise you to revoke or rotate the affected service account.

For clarity: the restriction in Section 5 on storing credentials applies to the content you place in your hazard log and other Customer Data. It does not prohibit supplying a connection credential through the Service's connection settings, which is handled exclusively as described in this section.

13. Suspension and Termination

By you. You may stop using the Service and cancel your Subscription at any time through the billing portal (see Section 8).
By us. We may suspend or terminate your access if you materially breach these Terms (including Section 5), if your payment fails and is not resolved within a reasonable grace period, if your trial ends without conversion to a paid Subscription (your projects first become read-only, as Section 8 describes), or if required by law or to protect the Service or other customers. Where practical and lawful, we will give notice and an opportunity to remedy.
Effect of termination. On termination, your right to access the Service ends.
Data retention after termination. After your Subscription ends, your Customer Data is retained for a limited period to allow reactivation and final export, and is then permanently deleted. The current retention period is described in our Privacy Policy. Export any records you need to keep before your access ends. Our routine, encrypted backups age out on their own retention cycle thereafter.
Survival. Sections 3, 5, 7, 9, 10, 11, 12, 12A, 13, 14, and 16, and any other provision that by its nature should survive, survive termination.

14. Changes to These Terms

We may update these Terms from time to time. If we make a material change, we will give reasonable notice — for example, by email to Organisation Admins or by a notice in the Service — before the change takes effect. Your continued use of the Service after a change takes effect constitutes acceptance of the updated Terms. The "Last updated" date at the top of this document reflects the most recent version.

15. General

Entire agreement. These Terms, together with the Privacy Policy and any plan details shown at the time you subscribe, are the entire agreement between you and us regarding the Service, and supersede any prior understanding on that subject.
Assignment. You may not assign these Terms without our consent. We may assign them to a successor in connection with a merger, acquisition, or sale of assets.
Severability. If any provision is found unenforceable, the rest remains in effect.
No waiver. A failure to enforce a provision is not a waiver of it.
Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control.
Notices. We may give notices to you by email to your Organisation Admins or in-Service. You may give notices to us at the contact address in Section 17.
Relationship. These Terms do not create any partnership, agency, or employment relationship between the parties.

16. Governing Law

These Terms are governed by the laws of the State of Victoria, Australia. You and we submit to the non-exclusive jurisdiction of the courts of Victoria, Australia and the courts competent to hear appeals from them.

17. Contact

Questions about these Terms can be sent to:

SafeForge AI Email: support@safeforge.ai

SafeForge AI · ABN 89190664116 · Victoria, Australia · support@safeforge.ai