Master Services Agreement: Standard Terms — version 2.6
Published 2026-10-29. Supersedes version 2.5. Superseded versions remain available at/legal/terms/archive.
Aporta Systems, LLC - Master Services Agreement: Standard Terms
Version 2.6 - published 29 October 2026.
These Standard Terms are not signed. They are posted at aportasystems.com/legal/terms and bind Customer through an Order Form: either one Customer signs, or an Online Order Customer accepts in the Service.
These Standard Terms govern the Service that Aporta Systems, LLC, a Tennessee limited liability company (“Aporta”), provides to the customer named on an Order Form (“Customer”). They take effect when Customer signs an Order Form or places an Online Order that refers to them. The Order Form, these Standard Terms, the Data Processing Agreement and the Incorporated Pages together form the agreement between the Parties (the “Agreement”).
1. Definitions
“Service” means Aporta’s hosted service and browser extension, as described in Exhibit A.
“Supported AI Tools” means the generative-AI services listed at aportasystems.com/legal/supported-tools, at the version in effect for Customer under Section 15.
“Authorized Users” means Customer’s employees and contractors licensed to use the Service.
“Super User” means an Authorized User whom Customer has given administrative control of the Service.
“Customer Data” means data submitted to or captured by the Service for Customer, including prompt text, token-to-value mappings and audit records.
“Crypto-shredding” means permanently destroying the encryption key that protects a set of records. The encrypted records remain, but they cannot be read without that key.
“Vault Key” means the key that protects Customer’s token-to-value mappings, described in Exhibit B, Section B.3, and any recovery code issued with it.
“Managed Device” and “Unmanaged Device” have the meanings given in Exhibit A, Section A.5.
“Order Form” means an ordering document signed by the Parties, or an Online Order, that refers to these Standard Terms.
“Online Order” means an order Customer places in the Service under Exhibit D.
“Effective Date” means the date the Order Form is signed by both Parties, or the date the Online Order is accepted in the Service.
“Term” means each period an Order Form is in effect: its initial term and each renewal term. For an Online Order, each monthly period is a Term.
“Standard Terms” means this document, at the version stated on the Order Form.
“Data Processing Agreement” means Aporta’s Data Processing Agreement posted at aportasystems.com/legal/dpa, at the version stated on the Order Form. It forms part of the Agreement and is accepted with it, without a separate signature. Aporta will provide a countersigned copy on request.
“Incorporated Pages” means the pages listed in Section 15.2.
2. The Service
2.1 Provision. Subject to this Agreement, Aporta will provide the Service described in the Order Form and Exhibit A, and grants Customer a non-exclusive, non-transferable, non-sublicensable right for Authorized Users to use it during the Term.
2.2 What the Service does. The Service works in Google Chrome and Microsoft Edge, in a browser profile where the Aporta extension is installed and signed in. When an Authorized User types into a Supported AI Tool, the Service detects categories of sensitive data, replaces them with tokens before the text is sent, and records what was detected and what was sent. The Service covers the Supported AI Tools in Chrome and Edge, as listed for each browser on the Supported AI Tools page. The exact sites covered for each tool, in each browser, are listed there.
2.3 What the Service does not do. Customer acknowledges the limits in Exhibit A, Section A.4, which are material to this Agreement. In particular:
- the Service covers only the Supported AI Tools. Other AI sites are blocked or redirected, as Customer’s policy sets;
- the Service cannot reach AI built into other applications, such as Microsoft 365 Copilot in the Word, Excel, PowerPoint and Outlook applications, or Einstein in Salesforce;
- on an Unmanaged Device the Service gives visibility, not enforcement. An Authorized User can disable the extension, use another browser or use a personal device, and the Service records the gap rather than preventing it;
- the Service dramatically reduces inadvertent exposure of sensitive data. Against a determined insider it is a detective control, not a preventive one. It does not prevent a person intent on getting data out from doing so. It makes that person’s use of the Supported AI Tools, and gaps in coverage such as a disabled extension, visible to Customer through the audit record and the alerts shown to Super Users, so the behaviour can be caught. It does not see activity outside the Service, such as on a personal device;
- tokenization protects the identifiers the Service detects, not confidential content that contains no detectable identifier; and
- the audit record shows what was sent. It does not record AI responses and is not a complete record of AI use.
2.4 Managed browsers. Force-installing the extension through Customer’s device or browser management, as described in Exhibit A, Section A.5, stops an Authorized User disabling or removing it on that device. Aporta makes no representation that coverage is enforced on any other device. On a Managed Device too, the Service remains a detective control against a determined insider (Section 2.3).
2.5 Changes to the Service. Aporta may change the Service, but may not materially reduce the core functions in Exhibit A during a paid Term. Changes to the Incorporated Pages are governed by Section 15.
2.6 Aporta Chat. Where the Service offers it and Customer’s Super User turns it on, an Authorized User whose Supported AI Tool is blocked because Aporta’s protection for it has stopped working may use Aporta Chat, a chat in the Aporta console answered by Google’s Gemini model on Aporta’s account. It is off unless a Super User turns it on, and a Super User may turn it off at any time. It is not available while Aporta holds the Vault Key. An Authorized User can still read their past conversations after the tool is restored. The Privacy Policy states what is sent and what is kept. Aporta may limit its use with a monthly spending cap and a limit on a conversation’s length.
3. Customer Responsibilities
3.1 Deployment and accounts. Customer deploys the extension, appoints at least one Super User, configures its device management, and keeps its role assignments accurate. Customer chooses on the Order Form whether Authorized Users must sign in with multi-factor authentication, and Aporta applies that choice.
3.2 Vault Key custody. Aporta provisions and holds the Vault Key when the Service starts. Until a Super User takes custody of it, the Service tokenizes nothing: a send that contains a detected value is blocked, and no token-to-value mapping is stored. Taking custody creates a new key that Aporta has never held, wrapped to Customer’s enrolled browsers and to a recovery code shown once to the Super User. Custody does not move back to Aporta. After that, Aporta stores only key material it cannot unwrap, and Aporta’s servers cannot decrypt Customer’s vault without a key held by Customer. Aporta holds the Audit Key in every case (Exhibit B, Section B.3). Key material belongs to a browser profile, not to a person; Exhibit B, Section B.3 explains what that means for shared devices. Aporta recommends a separate browser profile for each Authorized User.
3.3 Recovering the Vault Key. After Customer takes custody, Customer’s vault can be opened from any of Customer’s enrolled browsers, and from Customer’s recovery code. Any enrolled browser can enroll a new one, and a Super User can issue a new recovery code. Aporta has no means of decrypting the vault itself. If every enrolled browser and the recovery code are all lost, the token-to-value mappings cannot be recovered by anyone, including Aporta. Customer will keep the recovery code apart from every enrolled browser and from the credentials used to sign in to the Service.
3.4 Configuration. A Super User sets the Service’s options in the console, including which Supported AI Tools are allowed, attachment scanning, the optional detection of company and place names described in Exhibit A, Section A.1, Aporta Chat and approval rules. Server-side detection is part of the Service and is not a setting. Customer is responsible for those choices. Aporta records the protection in effect for each event.
3.5 Customer’s own obligations. Customer is responsible for its AI-use policy, employee acknowledgments, its accounts with AI vendors, and what it tells its insurers and regulators. The Service supplies evidence drawn from real events. It does not write these documents, and Aporta does not give legal advice.
3.6 Acceptable use. Customer will not (a) reverse engineer the Service’s detection logic, except as the law permits; (b) use the Service to gain access a third party has not authorized; (c) submit data that Exhibit A, Section A.6 excludes; or (d) resell or provide the Service to a third party without a separate written agreement with Aporta.
4. Fees, Invoicing and Taxes
4.1 Fees are stated on the Order Form. Unless it says otherwise, fees are billed monthly in advance, are non-refundable except as this Agreement provides, and are due within thirty (30) days of invoice.
4.2 Fees are set by the number of Authorized Users. The deployment (managed or unmanaged) recorded on the Order Form does not change the fee. For 1 to 250 Authorized Users, the fee is a price per Authorized User, charged for no fewer than a minimum number of Authorized Users and never more than a monthly maximum for Customer’s band of 1–25, 26–99 or 100–250, each as shown on the Order Form. Above 250 Authorized Users, fees are agreed on an Order Form. Under an Online Order, the Service counts Customer’s active Authorized User accounts each day, and the fee for the next billing period follows that count. When the count moves into another band, up or down, the Service also emails Customer’s Super Users. A day on which the count cannot be read changes nothing. A count above 250 changes no fee: Aporta notifies Customer, and the Parties agree fees on an Order Form. Under a signed Order Form, the Order Form sets the fee.
4.2A Add-ons. Single sign-on (SSO) and directory sync are optional add-ons, each billed monthly at the price shown in the Service or on the Order Form, in addition to the fee under Section 4.2. A Super User may add either at any time, and it is billed from that day for the rest of the billing period. A Super User may remove either, and it ends at the end of the current billing period. While Customer’s count of Authorized Users under Section 4.2 is seventy (70) or more, both add-ons are included at no charge. When the count crosses seventy, up or down, the charge changes from the next billing period, and the add-on itself stays as Customer set it. Customer sets up and maintains its own connection to its identity provider.
4.2B Assisted deployment. Customer may ask Aporta to help it force-install the Service’s browser extension through Customer’s own device or browser management, for a one-time fee shown in the Service or on the Order Form. The fee is charged once, with the first invoice after Customer chooses it. Customer keeps responsibility for its own device and browser management, and Section 2.4 still applies.
4.3 Fees exclude taxes. Customer pays applicable sales, use and similar taxes, excluding taxes on Aporta’s income.
4.4 Aporta may increase fees at renewal by giving at least sixty (60) days’ written notice before the start of the Term in which the increase applies.
4.5 Non-payment. If an invoice is unpaid when due, Aporta will notify Customer’s billing contact and Super Users. If it is still unpaid thirty (30) days later, Aporta may block the Supported AI Tools for Customer’s Authorized Users until it is paid. Aporta will not stop protecting while leaving the tools open. Throughout, Customer keeps access to its audit record, its exports and its recovery code.
5. Confidentiality
5.1 Each Party will keep the other’s confidential information confidential, use it only for this Agreement, and protect it with at least reasonable care. Where a Mutual Non-Disclosure Agreement is in effect between the Parties, it also applies; where the two conflict, this Agreement controls.
5.2 Customer Data is Customer’s confidential information. Aporta will use it only to provide, secure, support and improve the Service as the Data Processing Agreement permits, and will not use prompt text, token-to-value mappings or Customer’s own detection terms to train, fine-tune or evaluate any model.
5.3 What Aporta may learn from use. Aporta’s only right to data derived from Customer’s use is the one in the Data Processing Agreement: counts of which detection categories fired, and how often, used to improve detection. Aporta will not use, disclose or export underlying values, prompt text or Customer’s own terms, and the counts will not identify Customer.
5.4 Shared detection patterns. Aporta may add a detection pattern for all customers, or for an industry, only where the format is documented in a public or third-party source or has been counted independently at three or more customers, and the pattern does not identify Customer, its clients or its matters. Aporta writes any such pattern itself. It is never a copy of a pattern Customer submitted, and a pattern specific to Customer is never shared. Before releasing a shared pattern prompted by a format Customer submitted, Aporta will show Customer how that format was classified, and Customer may challenge the classification within thirty (30) days. If the challenge is upheld, Aporta will withdraw or rewrite the pattern.
6. Privilege and Professional Obligations
6.1 Where Customer is a law firm or other professional services firm, Customer remains solely responsible for its professional obligations, including competence, confidentiality and, where they apply, the preservation of privilege.
6.2 Aporta processes Customer Data at Customer’s direction. Nothing in this Agreement creates an attorney-client relationship between Aporta and Customer or Customer’s clients.
6.3 Aporta makes no representation that use of the Service preserves, restores or prevents waiver of any privilege, or complies with any bar rule or ethics opinion. Customer decides whether and how its Authorized Users may use generative-AI tools.
7. Data, Records and Retention
7.1 Processing terms. The Data Processing Agreement governs the processing of personal data.
7.2 Retention. Audit records, token-to-value mappings and Aporta Chat conversations are kept for seven (7) years. An Authorized User may remove their own Aporta Chat conversation from their list, which does not delete it. Audit records are encrypted, hash-chained and numbered in sequence.
7.3 Deletion and integrity. Because audit records are hash-chained, altering, deleting or reordering one breaks verification of every record after it. The storage retention setting does not prevent deletion by an account credential, so Aporta’s commitment is that tampering is detected, not that it is prevented. Where Customer asks for deletion of audit records, Aporta crypto-shreds them instead of deleting them, because deleting them would destroy the evidence the retention period exists to keep. Aporta will confirm the crypto-shredding, and what survives, in writing.
7.4 Exports. Customer can obtain a sealed, encrypted export of its records, including its token-to-value mappings and audit record. Download from the console is always available to a Super User. If Customer connects Microsoft OneDrive or a SharePoint document library in its own Microsoft 365, or an Amazon S3 bucket in its own Amazon Web Services account, where the Service offers that destination, Aporta also delivers exports there on a schedule: a full copy weekly and an increment daily. Each export comes with an offline reader that runs on Customer’s computer and needs no connection to Aporta. Microsoft or Amazon holds delivered files under Customer’s own agreement with it, and is not Aporta’s sub-processor for them. Customer is responsible for keeping its exports and its recovery code.
7.5 Exit. On termination or expiry, Aporta will deliver a final export with its offline reader, for download from the console or to the destination Customer has connected under Section 7.4, confirm with Customer that the export has been received, crypto-shred Customer’s audit records, destroy its other copies of Customer’s key material, delete any storage credential it holds for Customer, and give Customer a written statement of what data survives and where. Opening an export needs Customer’s recovery code; if Customer has lost it or cannot open an export, Aporta has no means of opening it (Section 3.3). Where Customer connected its own storage, destroying the storage credential does not remove the access Customer granted in its own Microsoft or Amazon account; Customer removes it there.
8. Security
8.1 Aporta will maintain the measures in Exhibit B and will not materially reduce them during the Term.
8.2 Certifications. Aporta holds no third-party security certification. SOC 2 and ISO 27001 are phased and not yet certified; the roadmap is in Exhibit B, Section B.6. Neither Party will represent otherwise.
8.3 Incidents. Aporta will notify Customer of a security incident affecting Customer Data without undue delay, and within the period stated in the Data Processing Agreement, and will provide the information reasonably available to it.
9. Warranties and Disclaimers
9.1 Mutual. Each Party warrants that it has authority to enter into this Agreement and will comply with the laws that apply to its performance.
9.2 Aporta warranty. Aporta warrants that the Service will perform materially as described in Exhibit A. Customer’s exclusive remedy for breach of this warranty is Aporta’s reasonable efforts to correct the non-conformity and, if that fails within thirty (30) days of notice, termination of the affected Order Form with a pro-rata refund of prepaid fees.
9.3 No detection guarantee. Aporta does not warrant that the Service will detect every instance of sensitive data. Detection varies by data category, format, context and language. Aporta measures detection internally, category by category, on public text:
- on 16 and 22 September 2026, against published labelled datasets: 124 real court judgments, 500 encyclopaedia sentences, 411 real business emails, and five samples of 100 synthetic records; and
- from 9 to 13 October 2026, on 40 public documents (US federal court documents and business email). An Aporta employee read 20 of them whole and marked every value without seeing the detector’s answers, and reviewed each disagreement between Aporta’s detector and an independent open-source model in the other 20.
These measurements cover server-side detection, and in October address detection in the browser. Their results are recorded as counts per data category; Aporta states no overall accuracy figure. They are Aporta’s own, not independently validated, and not a warranty. Customer may not rely on an accuracy figure that is not stated in a writing signed by Aporta.
9.4 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE SERVICE IS PROVIDED “AS IS” AND APORTA DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. APORTA DOES NOT WARRANT THAT USE OF THE SERVICE ACHIEVES COMPLIANCE WITH ANY LAW, REGULATION, INSURANCE REQUIREMENT OR PROFESSIONAL RULE.
10. Indemnification
10.1 By Aporta. Aporta will defend Customer against a third-party claim that the Service as provided infringes a United States patent, copyright or trademark, and will pay damages finally awarded, if Customer gives prompt notice, lets Aporta control the defense, and reasonably cooperates. Aporta may obtain the right for Customer to continue using the Service, modify the Service, or terminate the affected Order Form with a pro-rata refund.
10.2 By Customer. Customer will defend Aporta against a third-party claim arising from (a) Customer Data, or Customer’s use of the Service in breach of Section 3.6, or (b) Customer’s statements to third parties about the Service that go beyond Exhibit A.
10.3 Exclusions. Aporta has no obligation for a claim arising from Customer’s modification of the Service, its combination with items Aporta did not supply, or use after notice to stop.
11. Limitation of Liability
11.1 EXCEPT FOR THE EXCLUDED CLAIMS AND DATA PROTECTION CLAIMS, NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY.
11.2 General cap. EXCEPT FOR THE EXCLUDED CLAIMS AND DATA PROTECTION CLAIMS, EACH PARTY’S TOTAL LIABILITY IS LIMITED TO THE FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY (THE “GENERAL CAP”).
11.3 Data protection cap. EACH PARTY’S TOTAL LIABILITY FOR ALL DATA PROTECTION CLAIMS IS LIMITED TO THE GREATER OF (A) THREE (3) TIMES THE GENERAL CAP, AND (B) THE PER-CLAIM LIMIT OF THE TECHNOLOGY ERRORS AND OMISSIONS INSURANCE POLICY APORTA HOLDS WHEN THE CLAIM IS MADE. WHILE APORTA HOLDS NO SUCH POLICY, THE LIMIT IS THREE (3) TIMES THE GENERAL CAP. THIS LIMIT APPLIES TO DATA PROTECTION CLAIMS INSTEAD OF THE GENERAL CAP.
11.4 Definitions. “Data Protection Claims” means claims arising from a Party’s breach of Section 5 (Confidentiality), Section 8 (Security) or the Data Processing Agreement. “Excluded Claims” means (a) Customer’s payment obligations; (b) either Party’s indemnification obligations; and (c) a Party’s gross negligence, willful misconduct or fraud. A claim that is both a Data Protection Claim and an Excluded Claim is an Excluded Claim. Nothing in this Section 11 limits liability for the Excluded Claims.
12. Operational Continuity
12.1 Key person. Aporta is currently run by its founder, and Customer acknowledges that concentration as a known risk. Aporta has adopted the measures in this Section rather than representing that the risk does not exist.
12.2 Designated successor. Aporta maintains a designated successor with standing administrative access to its identity, credential-management, source-code, domain and cloud accounts, enough to continue or wind down operations without the founder. That access does not depend on any trigger. Aporta will notify Customer if the designation lapses and is not replaced within thirty (30) days.
12.3 Key custody. Key material needed to operate the Service is held so that no one person’s unavailability prevents Customer from recovering its data. Aporta keeps at least two copies in separate secured physical locations, with a separately held break-glass credential, each reachable by the designated successor in their own right. Aporta holds this custody itself, keeps a written custody record, and reviews it at least once a year.
12.4 Continuity without Aporta. The exports in Section 7.4 are the main continuity measure. With a connected storage destination, Customer holds a current copy of its records and a reader that opens them without Aporta, so Aporta ceasing to operate interrupts the Service but does not take Customer’s data with it.
12.5 Wind-down. If Aporta ceases operations, it will use commercially reasonable efforts to give Customer at least sixty (60) days’ notice, deliver a final export, and provide the statement described in Section 7.5.
13. Term and Termination
13.1 This Agreement begins on the Effective Date and continues until every Order Form has expired or been terminated.
13.2 Either Party may terminate for material breach not cured within thirty (30) days of written notice.
13.3 Either Party may terminate immediately if the other becomes insolvent, makes an assignment for the benefit of creditors, or has a receiver appointed.
13.4 On termination, Customer’s right to use the Service ends, Aporta will perform Section 7.5, and Sections 1, 5, 6, 7, 9.3, 9.4, 10, 11, 13.4 and 14 survive.
14. General
14.1 Governing law and venue. Tennessee law governs, without regard to conflict-of-laws rules. The state and federal courts located in Davidson County, Tennessee have exclusive jurisdiction.
14.2 Publicity. Neither Party will name the other publicly without prior written consent. Customer may separately consent to an anonymized case study, which will not identify Customer or any of its clients.
14.3 Assignment. Neither Party may assign this Agreement without the other’s consent, except to a successor by merger or sale of substantially all its assets that assumes this Agreement in full.
14.4 Independent contractors. The Parties are independent contractors. Neither is the other’s agent.
14.5 Force majeure. Neither Party is liable for delay caused by events beyond its reasonable control. This does not excuse payment obligations.
14.6 Order of precedence. (1) The Data Processing Agreement, for the processing of personal data; (2) the Order Form; (3) these Standard Terms; (4) the Exhibits; (5) the Incorporated Pages. The same order applies whether or not a countersigned copy of the Data Processing Agreement has been provided.
14.7 Entire agreement. This Agreement is the entire agreement on its subject. Amendments must be in a signed writing. Counterparts and electronic signatures are effective. A Super User’s acceptance in the Service of a stated version of these Standard Terms or the Data Processing Agreement is a signed writing for this Section.
15. Posted Terms, Incorporated Pages and Versioning
15.1 Versions. These Standard Terms are posted at aportasystems.com/legal/terms. Each version has a number and a publication date. The Order Form states the version in effect when Customer signed or placed it, and that version governs Customer for the rest of the current Term, whatever is published later. The Data Processing Agreement is posted at aportasystems.com/legal/dpa and is versioned, stated on the Order Form and pinned in the same way. Aporta keeps every superseded version of each available at a stable address.
15.2 Incorporated Pages. These pages are versioned and dated in the same way and form part of the Agreement:
| Page | Address | What it contains |
|---|---|---|
| Supported AI Tools | aportasystems.com/legal/supported-tools | The AI tools the Service covers, and the sites covered for each, by browser |
| Sub-processors | aportasystems.com/legal/subprocessors | The providers that process Customer Data, what each does, and the data each can reach |
| Standard Terms archive | aportasystems.com/legal/terms/archive | Every superseded version of these Standard Terms, with its dates |
| Privacy Policy | aportasystems.com/legal/privacy | How Aporta handles personal data, including what the extension reads and sends and what survives deletion |
15.3 Ordinary changes. Aporta may update these Standard Terms and the Incorporated Pages. An update applies to Customer from its next renewal Term, except an update required by law or one that adds a Supported AI Tool, which applies immediately.
15.4 Material adverse changes. A change is material and adverse if it removes a Supported AI Tool, adds a sub-processor, reduces the measures in Exhibit B, or otherwise materially reduces Customer’s rights. Aporta will give at least thirty (30) days’ written notice of such a change before it takes effect. Customer may terminate the affected Order Form without penalty within that period and receive a pro-rata refund of prepaid fees. Sub-processor changes are also subject to the objection right in the Data Processing Agreement.
15.5 Notice. Aporta gives notice of every update to these Standard Terms or an Incorporated Page by email to the “Administrative contact and notice email” on the Order Form at least thirty (30) days before the renewal at which it applies, and at least thirty (30) days before a material adverse change takes effect. Posting alone is not notice.
15.6 Evidence. On request, Aporta will certify in writing which version of these Standard Terms and of each Incorporated Page applied to Customer on a stated date.
These Standard Terms are not signed. They bind Customer when Customer signs an Order Form or places an Online Order that refers to this version.
EXHIBIT A — SERVICE DESCRIPTION AND SCOPE
A.1 What the Service does
The Aporta extension runs in Google Chrome and Microsoft Edge. On a Supported AI Tool it reads what an Authorized User types into the message box and applies two tiers of detection:
- Tier 1 runs in the browser and finds fixed formats: government identification numbers, payment card numbers checked by checksum, email addresses, North American phone numbers, credentials and API keys, and Customer’s own terms.
- Tier 2 runs on Aporta’s detection service, hosted in the United States, when the user pauses typing and again at send. It finds people’s names and street addresses, which pattern matching cannot find reliably, and checks the fixed formats and Customer’s own terms again. Company names are detected only if a Super User turns that on; in spreadsheet columns, company and place names are detected unless a Super User turns that off. Names, places and organizations are detected in English only. Tier 2 is part of the Service and Customer cannot turn it off.
Detected values are replaced with tokens before the text is sent. The link between each token and its value is encrypted and stored in a vault for Customer. The AI tool receives only tokens; Aporta restores the original values in the answer for the Authorized User to read and copy.
If a Super User turns on attachment scanning, the extension also scans spreadsheets, Word documents and presentations attached to a Supported AI Tool, in the browser. Where the Service offers it, it also scans a PDF it can read as text: it reads the text in the browser, scans it as it scans other attachments, and sends a new file built from that text in place of the PDF.
Each send creates an audit record with the tokenized text as sent, what was detected, the device and its coverage tier, the protection in effect, and the AI account tier.
A.2 Supported AI Tools
The current list, with the sites covered for each browser, is at aportasystems.com/legal/supported-tools. It is an Incorporated Page under Section 15.
- An AI site that is not on the list is blocked or redirected, as Customer’s policy sets. It is not protected, and it is not silently allowed.
- Adding a tool requires a new extension version. It is not a setting, and Aporta cannot add a tool on request within a support cycle.
- Removing a tool is a material adverse change under Section 15.4.
A.3 Detection layers
| Layer | Applies to | Content |
|---|---|---|
| 1 — Global | Every customer | Standard identifier and credential detection |
| 2 — Industry | Customers Aporta assigns to an industry, from the industry stated on the Order Form | Detection patterns Aporta writes for that industry under Section 5.4, delivered to the browser with the other patterns. Aporta records the assignment in its own configuration. An industry has patterns only once Aporta publishes them. |
| 3 — Custom | This Customer only | Customer’s own terms and formats, exact match |
A.4 Limits of the Service (material)
These limits are structural. They are not defects, and configuration does not remove them.
| Limit | What it means for Customer |
|---|---|
| Device management | On a Managed Device the user cannot disable the extension. On an Unmanaged Device the user can disable or remove it, use another browser or use a phone; Aporta records the loss of coverage, it does not prevent it. On either, the Service makes a determined insider’s behaviour visible; it does not prevent it (Section 2.3). |
| Browser profiles and private windows | Only the browser profile signed in to Aporta is covered. Another profile on the same computer is not. Private windows are not covered unless Customer’s browser policy turns them off. |
| Other browsers, apps and devices | Firefox, Safari, AI desktop apps, phones and tablets, and direct use of an AI vendor’s API are not covered. |
| AI inside other applications | AI built into another application, such as Microsoft 365 Copilot in the Word, Excel, PowerPoint and Outlook applications, cannot be reached by a browser extension, whatever the deployment. |
| Hand-offs | When an AI tool sends its answer into another application, the answer arrives with tokens in it. |
| Detection is incomplete | Detection varies by category and context. Aporta’s measurements of it are internal (Section 9.3). Names, places and organizations are detected in English only. Content with no detectable identifier is not tokenized. |
| Attachments | Only spreadsheets, Word documents and presentations are scanned, and, where the Service offers it, PDFs it can read as text; and only when attachment scanning is on. A PDF is refused if a page holds a scan, characters that cannot be read as text, or images beyond what the Service accepts, or if it carries form fields, attached files, annotations or scripts. A PDF that is scanned is sent as a new file built from its text, without its layout or document details. Any image the Service accepts is left out of the new file, as the layout is. If a PDF’s characters are encoded as letters other than those it displays, the Service scans and sends the encoded letters, so a value the PDF displays may not be detected. Images are not scanned. A file with a part the Service cannot read is refused. |
| Drafts are sent for detection | Tier 2 sends in-progress text to Aporta’s servers when the user pauses typing, including text later deleted and never sent. |
| Client-reported record | Aporta is not in the network path to the Supported AI Tools. The hash chain shows records were not altered; it cannot show none are missing. Completeness is judged from device heartbeats, which are reliable on Managed Devices and best-effort elsewhere. Aporta Chat is the exception: Aporta relays it, and its audit entries are written by Aporta’s service. |
| Tamper-evident, not tamper-proof | Alteration, deletion or reordering of an audit record is detected, not prevented. Aporta makes no immutability representation and will not make one in a security questionnaire. |
| Sends only | The audit record does not record AI responses, and the Supported AI Tools’ responses are not kept. Google’s answers in Aporta Chat are kept with the conversation (Section 2.6). |
| Revocation looks forward | Removing a device or a user stops future access. It does not undo what was already seen or copied. |
| Training settings | Where Aporta checks an AI vendor’s training setting, it does so per device, at a point in time, and reports one of three states: verified, not opted out, or unchecked. |
A.5 Deployment tiers
| Tier | How the extension is installed | Can the user remove it? | Coverage |
|---|---|---|---|
| Managed Device | Force-installed by Customer’s device management | No | The Supported AI Tools in that browser |
| Containerized BYOD | Force-installed in a managed browser profile or work profile | Not from the managed profile | The managed profile only; a personal profile beside it is a gap |
| Unmanaged Device | Installed by the user | Yes | Visibility only |
A.6 Excluded data
Customer will not use the Service for data whose handling requires a certification or regime Aporta does not hold, including HIPAA data as a business associate, PCI cardholder data environments, ITAR or EAR controlled technical data, and classified information. Detecting a card number in a prompt is not operating a cardholder data environment.
EXHIBIT B — SECURITY ADDENDUM
B.1 Providers
The providers that process Customer Data, what each does and where, are listed on the Sub-processors page (Section 15.2).
B.2 Encryption
- Stored values are encrypted with AES-256-GCM before they reach storage, with a fresh initialization vector each time, and each ciphertext is bound to its tenant and token.
- Data is encrypted in transit with TLS. TLS ends at Aporta’s edge, so text is unencrypted on Aporta’s infrastructure while detection runs. The Service is not end-to-end encrypted.
- Unwrapped keys cannot be extracted or written to a log or a response.
B.3 Key custody
Reading the audit record and unmasking a token are different privileges, so they use different keys.
| Key | Protects | Held by | Effect |
|---|---|---|---|
| Vault Key | Token-to-value mappings | Aporta at the start; Customer from the moment a Super User takes custody, which is one-way | Until custody is taken, nothing is tokenized and no mapping is stored. After it, Aporta stores the key only wrapped to Customer’s enrolled browsers and recovery code, which Aporta cannot unwrap. |
| Audit Key | The tokenized audit record | Aporta, always, separately from the Vault Key | Aporta can read the tokenized audit record. The record holds tokenized text, never the replaced values, and reading it gives no ability to unmask a token. |
| Chat Key | Aporta Chat conversations | Aporta, always; a custody move does not change it | Aporta’s service can read stored Aporta Chat conversations. They hold tokenized text; the values the Service replaced are in the vault. The key is destroyed when Customer leaves. |
Each customer’s data keys are wrapped by a key held in a managed key service, which was generated in the provider’s hardware and cannot be exported.
Once Customer holds the Vault Key, Aporta’s servers cannot decrypt Customer’s vault without a key held by Customer. That statement is about the vault only. It does not change four things, each disclosed in the Data Processing Agreement: (a) sensitive values are in plaintext in Customer’s browser where they are detected and tokenized; (b) prompt text, including in-progress text, is sent to Aporta’s server-side detection, processed in memory and not kept; (c) tokenized text goes to the AI tool the Authorized User chose or, in Aporta Chat, to Google; and (d) Aporta Chat conversations are stored under the Chat Key, which Aporta holds.
Shared devices. Key material belongs to a browser profile. Where each Authorized User has a separate profile, which Aporta recommends, the separation between them is cryptographic. Where users share one profile and sign in and out of it, each still has their own records, and unmasking is attributed to the signed-in user, but the separation between them rests on Aporta’s server-side authorization rather than on cryptography. Aporta never enrolls more than one customer on a single browser profile.
B.4 Access control
- Six roles with least-privilege separation. Support and reseller roles have no access to prompt text. An auditor role can read the record and change nothing.
- Aporta staff accounts cannot read a customer’s audit record or prompt text through the Service. Aporta’s integrity check on a customer’s audit record reads identifiers, sequence numbers and counts only, and each use is recorded.
- Aporta staff identities are kept apart from customer users, and no Aporta account is a member of a customer’s organization.
- Sending a detected value without its token needs a Super User’s approval. For government identification numbers, payment card and financial account numbers, and credentials, two people must approve, and no setting can lower that. The one exception: where Customer has only one active Super User, that person may approve alone, and the record says the approval was self-approved. Customer may turn this exception off.
B.5 Monitoring and integrity
- Audit events are hash-chained and numbered per device, so alteration, deletion or reordering breaks verification.
- Each browser reports a heartbeat with its identity, extension version and audit-chain position. A lost heartbeat, or a chain that moves backwards, is shown to Customer’s Super Users as a coverage failure.
- Aporta checks each Supported AI Tool in both browsers on a schedule, so a vendor’s page change is found by Aporta rather than by Customer.
- If the extension loses its hold on a Supported AI Tool, it blocks that tool rather than let it run unprotected, until the hold is restored. During that time the tool is unavailable. Where Aporta Chat is on (Section 2.6), Authorized Users can use it instead.
B.6 Certification roadmap
Aporta holds no third-party security certification. Where a questionnaire asks, Aporta may say that its infrastructure providers hold their own certifications; that is never a substitute for a certification of Aporta. The planned sequence is a penetration test, then a SOC 2 Type I report, then a six-to-twelve-month observation window, then a SOC 2 Type II report. Aporta will not describe itself as SOC 2 compliant or as meeting any framework it has not completed, and Customer may not do so on Aporta’s behalf.
EXHIBIT C — SUPPORT
Support is by email during Aporta’s published business hours. There is no out-of-hours cover except the Severity 1 target below.
| Severity | Definition | Target first response |
|---|---|---|
| 1 — Coverage failure | The Service is not tokenizing on a Supported AI Tool, or a tool is blocked because Aporta’s protection for it has stopped working | Same business day |
| 2 — Degraded | A function is unavailable; tokenization continues | One business day |
| 3 — Question or request | Configuration, reporting or a feature request | Three business days |
These are response targets, not resolution times. Aporta offers no uptime commitment and no service credits.
EXHIBIT D — ONLINE ORDER
D.1 Who may place one
An Online Order is placed in the Service by the first Super User of an organization that Aporta has created for Customer. Aporta records the account in the Service of the person who placed it, and the date it was accepted. This Exhibit D forms part of each Online Order, so it ranks as the Order Form under Section 14.6. Pilots are not available by Online Order; a pilot is provided only under a signed Pilot Evaluation Agreement.
D.2 Versions
The Online Order incorporates the versions of these Standard Terms and of the Data Processing Agreement shown in the Service when Customer places it, and Aporta records those versions with it. Customer has been shown a copy of each. By placing the Online Order Customer accepts both; the Data Processing Agreement needs no separate signature, and Aporta will provide a countersigned copy on request. The versions stated here govern for the rest of the current Term (Section 15.1).
D.3 Customer
Customer enters or selects these in the Service when it places the Online Order:
| Field | Entry |
|---|---|
| Legal name | As entered |
| Entity type and state of formation | As selected |
| Address | As entered |
| Administrative contact and notice email (Section 15.5) | As entered |
| Billing contact and email | As entered |
D.4 Fee, payment and term
| Field | Entry |
|---|---|
| Fee | The price per Authorized User, the minimum number of Authorized Users charged and the monthly maximum for each band, and the one-time fee for assisted deployment if Customer chooses it (Section 4.2B), as shown on Aporta’s payment processor’s checkout page when Customer starts payment. Aporta records the price sold with the subscription |
| Add-ons | SSO and directory sync, each at the price Aporta shows in the Service, if a Super User chooses it, and at no charge at seventy (70) or more Authorized Users (Section 4.2A) |
| Billing | Monthly in advance, charged through Aporta’s payment processor, named on the Sub-processors page (Section 15.2). A monthly charge that does not succeed is an unpaid invoice for Section 4.5 |
| Billing questions | Customer sends billing questions and payment problems to Aporta at [email protected] |
| Start | The Service starts only once the first payment succeeds. If no payment succeeds within 14 days of acceptance, the Online Order lapses: it ends without liability for fees, and the Service never starts |
| Term | One month from the start, renewing for further months unless either party gives 30 days’ written notice. Cancellation takes effect at the end of the paid month in which the notice period ends. Customer may instead cancel on the payment processor’s billing page, opened from the Service; the subscription then ends at the end of the current billing period |
| Authorized Users | The number Customer enters on the Online Order, or the number of Authorized Users counted in Customer’s organization in the Service if that is more. The first billing period’s fee follows that number; after that, Section 4.2 applies and the fee follows the count. Above 250 Authorized Users, fees are agreed separately on a signed Order Form (Section 4.2), so that band is not available by Online Order |
| Retention | Audit records, token mappings and Aporta Chat conversations are kept seven (7) years (Section 7.2) |
D.5 Set-up
| Field | Entry |
|---|---|
| Multi-factor sign-in for Authorized Users | As set for Customer’s organization in the Service |
| Industry (for industry detection patterns, Exhibit A, Section A.3) | As Customer tells Aporta; Aporta records it in its own configuration |
| Deployment | As chosen by Customer on the Online Order: Managed (force-installed by Customer’s device or browser management) or Unmanaged (installed by users). Where Customer already has a live subscription, the deployment of that subscription |
If Deployment is “Unmanaged”, Customer is buying visibility, not enforcement. On an unmanaged device an Authorized User can disable or remove the extension, use another browser or use a personal device. Aporta records that; it does not prevent it. Enforcement requires force-install on managed browsers (Section 2.4).
If the deployment recorded on the Online Order does not match how Customer deploys the extension, Aporta may correct the record, on notice. The correction does not change the fee.
D.6 Scope acknowledgment
Customer has read Exhibit A, Sections A.4 and A.6. The person placing the Online Order acknowledges each of the three paragraphs below separately in the Service, and the rest of this Section once.
Vault-key loss. Aporta holds the Vault Key until a Super User takes custody of it, and until then the Service blocks any send containing a detected value. Section 3.3 of the Standard Terms then applies:
3.3 Recovering the Vault Key. After Customer takes custody, Customer’s vault can be opened from any of Customer’s enrolled browsers, and from Customer’s recovery code. Any enrolled browser can enroll a new one, and a Super User can issue a new recovery code. Aporta has no means of decrypting the vault itself. If every enrolled browser and the recovery code are all lost, the token-to-value mappings cannot be recovered by anyone, including Aporta. Customer will keep the recovery code apart from every enrolled browser and from the credentials used to sign in to the Service.
Determined insider. The Service dramatically reduces inadvertent exposure. Against a determined insider it is a detective control, not a preventive one: the audit record and alerts make that person’s behaviour visible so it can be caught, but do not prevent it.
Excluded data. Customer will not use the Service for data whose handling requires a certification or regime Aporta does not hold, including HIPAA data as a business associate, PCI cardholder data environments, ITAR or EAR controlled technical data, and classified information (Standard Terms Exhibit A, Section A.6).
The rest of this Section. Customer understands that:
- the Service covers only the tools listed at aportasystems.com/legal/supported-tools, in Google Chrome and Microsoft Edge, and that page lists the exact sites covered in each browser. Other AI sites are blocked or redirected, not protected;
- AI built into other applications, such as Microsoft 365 Copilot in the Word, Excel, PowerPoint and Outlook applications, or Einstein in Salesforce, cannot be reached by a browser extension;
- Aporta measures detection internally, not independently, and states no overall accuracy figure (Standard Terms § 9.3);
- the audit record is reported by Customer’s browsers, except for Aporta Chat, which Aporta’s service records; it covers what was sent and does not record AI responses;
- server-side detection receives in-progress text, including text a user deletes and never sends.
D.7 Other terms
Anonymized case study: not consented. Customer may consent separately (Section 14.2).
Customer authorizes its Super Users to accept later versions of the Standard Terms and Data Processing Agreement on its behalf.
Except as stated above, the Standard Terms and the Data Processing Agreement apply unchanged. Where this Exhibit D conflicts with the rest of the Standard Terms, this Exhibit D controls.