Master Services Agreement: Standard Terms — version 2.4
Published 2026-10-19. Supersedes version 2.3. Superseded versions remain available at /legal/terms/archive.

Aporta Systems, LLC - Master Services Agreement: Standard Terms

Version 2.4 - published 19 October 2026.

These Standard Terms are not signed. They are posted at aportasystems.com/legal/terms and bind Customer through an Order Form: either one Customer signs, or an Online Order Customer accepts in the Service.

These Standard Terms govern the Service that Aporta Systems, LLC, a Tennessee limited liability company (“Aporta”), provides to the customer named on an Order Form (“Customer”). They take effect when Customer signs an Order Form or places an Online Order that refers to them. The Order Form, these Standard Terms, the Data Processing Agreement and the Incorporated Pages together form the agreement between the Parties (the “Agreement”).

1. Definitions

“Service” means Aporta’s hosted service and browser extension, as described in Exhibit A.

“Supported AI Tools” means the generative-AI services listed at aportasystems.com/legal/supported-tools, at the version in effect for Customer under Section 15.

“Authorized Users” means Customer’s employees and contractors licensed to use the Service.

“Super User” means an Authorized User whom Customer has given administrative control of the Service.

“Customer Data” means data submitted to or captured by the Service for Customer, including prompt text, token-to-value mappings and audit records.

“Crypto-shredding” means permanently destroying the encryption key that protects a set of records. The encrypted records remain, but they cannot be read without that key.

“Vault Key” means the key that protects Customer’s token-to-value mappings, described in Exhibit B, Section B.3, and any recovery code issued with it.

“Managed Device” and “Unmanaged Device” have the meanings given in Exhibit A, Section A.5.

“Order Form” means an ordering document signed by the Parties, or an Online Order, that refers to these Standard Terms.

“Online Order” means an order Customer places in the Service under Exhibit D.

“Effective Date” means the date the Order Form is signed by both Parties, or the date the Online Order is accepted in the Service.

“Term” means each period an Order Form is in effect: its initial term and each renewal term. For an Online Order, each monthly period is a Term.

“Standard Terms” means this document, at the version stated on the Order Form.

“Data Processing Agreement” means Aporta’s Data Processing Agreement posted at aportasystems.com/legal/dpa, at the version stated on the Order Form. It forms part of the Agreement and is accepted with it, without a separate signature. Aporta will provide a countersigned copy on request.

“Incorporated Pages” means the pages listed in Section 15.2.

2. The Service

2.1 Provision. Subject to this Agreement, Aporta will provide the Service described in the Order Form and Exhibit A, and grants Customer a non-exclusive, non-transferable, non-sublicensable right for Authorized Users to use it during the Term.

2.2 What the Service does. The Service works in Google Chrome and Microsoft Edge, in a browser profile where the Aporta extension is installed and signed in. When an Authorized User types into a Supported AI Tool, the Service detects categories of sensitive data, replaces them with tokens before the text is sent, and records what was detected and what was sent. The Service covers the Supported AI Tools in Chrome and Edge, as listed for each browser on the Supported AI Tools page. The exact sites covered for each tool, in each browser, are listed there.

2.3 What the Service does not do. Customer acknowledges the limits in Exhibit A, Section A.4, which are material to this Agreement. In particular:

• the Service covers only the Supported AI Tools. Other AI sites are blocked or redirected, as Customer’s policy sets;
• the Service cannot reach AI built into other applications, such as Microsoft 365 Copilot in the Word, Excel, PowerPoint and Outlook applications, or Einstein in Salesforce;
• on an Unmanaged Device the Service gives visibility, not enforcement. An Authorized User can disable the extension, use another browser or use a personal device, and the Service records the gap rather than preventing it;
• the Service dramatically reduces inadvertent exposure of sensitive data. Against a determined insider it is a detective control, not a preventive one. It does not prevent a person intent on getting data out from doing so. It makes that person’s use of the Supported AI Tools, and gaps in coverage such as a disabled extension, visible to Customer through the audit record and the alerts shown to Super Users, so the behaviour can be caught. It does not see activity outside the Service, such as on a personal device;
• tokenization protects the identifiers the Service detects, not confidential content that contains no detectable identifier; and
• the audit record shows what was sent. It does not record AI responses and is not a complete record of AI use.

2.4 Managed browsers. Force-installing the extension through Customer’s device or browser management, as described in Exhibit A, Section A.5, stops an Authorized User disabling or removing it on that device. Aporta makes no representation that coverage is enforced on any other device. On a Managed Device too, the Service remains a detective control against a determined insider (Section 2.3).

2.5 Changes to the Service. Aporta may change the Service, but may not materially reduce the core functions in Exhibit A during a paid Term. Changes to the Incorporated Pages are governed by Section 15.

2.6 Optional Gemini answer. If Customer’s Super User turns it on, an Authorized User whose Supported AI Tool is blocked because Aporta’s protection for it has stopped working may ask a question through Google’s Gemini model, on Aporta’s account. It is off unless a Super User turns it on, and a Super User may turn it off at any time. The Privacy Policy states what is sent. Aporta may limit its use with a monthly spending cap.

3. Customer Responsibilities

3.1 Deployment and accounts. Customer deploys the extension, appoints at least one Super User, configures its device management, and keeps its role assignments accurate. Customer chooses on the Order Form whether Authorized Users must sign in with multi-factor authentication, and Aporta applies that choice.

3.2 Vault Key custody. Aporta provisions and holds the Vault Key when the Service starts. Until a Super User takes custody of it, the Service tokenizes nothing: a send that contains a detected value is blocked, and no token-to-value mapping is stored. Taking custody creates a new key that Aporta has never held, wrapped to Customer’s enrolled browsers and to a recovery code shown once to the Super User. Custody does not move back to Aporta. After that, Aporta stores only key material it cannot unwrap, and Aporta’s servers cannot decrypt Customer’s vault without a key held by Customer. Aporta holds the Audit Key in every case (Exhibit B, Section B.3). Key material belongs to a browser profile, not to a person; Exhibit B, Section B.3 explains what that means for shared devices. Aporta recommends a separate browser profile for each Authorized User.

3.3 Recovering the Vault Key. After Customer takes custody, Customer’s vault can be opened from any of Customer’s enrolled browsers, and from Customer’s recovery code. Any enrolled browser can enroll a new one, and a Super User can issue a new recovery code. Aporta has no means of decrypting the vault itself. If every enrolled browser and the recovery code are all lost, the token-to-value mappings cannot be recovered by anyone, including Aporta. Customer will keep the recovery code apart from every enrolled browser and from the credentials used to sign in to the Service.

3.4 Configuration. A Super User sets the Service’s options in the console, including which Supported AI Tools are allowed, attachment scanning, the optional detection of company and place names described in Exhibit A, Section A.1, the optional Gemini answer and approval rules. Server-side detection is part of the Service and is not a setting. Customer is responsible for those choices. Aporta records the protection in effect for each event.

3.5 Customer’s own obligations. Customer is responsible for its AI-use policy, employee acknowledgments, its accounts with AI vendors, and what it tells its insurers and regulators. The Service supplies evidence drawn from real events. It does not write these documents, and Aporta does not give legal advice.

3.6 Acceptable use. Customer will not (a) reverse engineer the Service’s detection logic, except as the law permits; (b) use the Service to gain access a third party has not authorized; (c) submit data that Exhibit A, Section A.6 excludes; or (d) resell or provide the Service to a third party without a separate written agreement with Aporta.

4. Fees, Invoicing and Taxes

4.1 Fees are stated on the Order Form. Unless it says otherwise, fees are billed monthly in advance, are non-refundable except as this Agreement provides, and are due within thirty (30) days of invoice.

4.2 Fees are set by the number of Authorized Users, in bands of 1–25, 26–99 and 100–250, and by deployment (managed or unmanaged) as recorded on the Order Form. Above 250 Authorized Users, fees are agreed on an Order Form. Under an Online Order, the Service counts Customer’s active Authorized User accounts each day; when the count moves into another band, up or down, the Service moves Customer to that band from the next billing period and emails Customer’s Super Users. A day on which the count cannot be read changes nothing. A count above 250 changes no fee: Aporta notifies Customer, and the Parties agree fees on an Order Form. Under a signed Order Form, the Order Form sets the fee.

4.2A Add-ons. Single sign-on (SSO) and directory sync are optional add-ons, each billed monthly at the price shown in the Service or on the Order Form, in addition to the band fee. A Super User may add either at any time, and it is billed from that day for the rest of the billing period. A Super User may remove either, and it ends at the end of the current billing period. Customer sets up and maintains its own connection to its identity provider.

4.3 Fees exclude taxes. Customer pays applicable sales, use and similar taxes, excluding taxes on Aporta’s income.

4.4 Aporta may increase fees at renewal by giving at least sixty (60) days’ written notice before the start of the Term in which the increase applies.

4.5 Non-payment. If an invoice is unpaid when due, Aporta will notify Customer’s billing contact and Super Users. If it is still unpaid thirty (30) days later, Aporta may block the Supported AI Tools for Customer’s Authorized Users until it is paid. Aporta will not instead stop protecting while leaving the tools open. Throughout, Customer keeps access to its audit record, its exports and its recovery code.

5. Confidentiality

5.1 Each Party will keep the other’s confidential information confidential, use it only for this Agreement, and protect it with at least reasonable care. Where a Mutual Non-Disclosure Agreement is in effect between the Parties, it also applies; where the two conflict, this Agreement controls.

5.2 Customer Data is Customer’s confidential information. Aporta will use it only to provide, secure, support and improve the Service as the Data Processing Agreement permits, and will not use prompt text, token-to-value mappings or Customer’s own detection terms to train, fine-tune or evaluate any model.

5.3 What Aporta may learn from use. Aporta’s only right to data derived from Customer’s use is the one in the Data Processing Agreement: counts of which detection categories fired, and how often, used to improve detection. Aporta will not use, disclose or export underlying values, prompt text or Customer’s own terms, and the counts will not identify Customer.

5.4 Shared detection patterns. Aporta may add a detection pattern for all customers, or for an industry, only where the format is documented in a public or third-party source or has been counted independently at three or more customers, and the pattern does not identify Customer, its clients or its matters. Aporta writes any such pattern itself. It is never a copy of a pattern Customer submitted, and a pattern specific to Customer is never shared. Before releasing a shared pattern prompted by a format Customer submitted, Aporta will show Customer how that format was classified, and Customer may challenge the classification within thirty (30) days. If the challenge is upheld, Aporta will withdraw or rewrite the pattern.

6. Privilege and Professional Obligations

6.1 Where Customer is a law firm or other professional services firm, Customer remains solely responsible for its professional obligations, including competence, confidentiality and, where they apply, the preservation of privilege.

6.2 Aporta processes Customer Data at Customer’s direction. Nothing in this Agreement creates an attorney-client relationship between Aporta and Customer or Customer’s clients.

6.3 Aporta makes no representation that use of the Service preserves, restores or prevents waiver of any privilege, or complies with any bar rule or ethics opinion. Customer decides whether and how its Authorized Users may use generative-AI tools.

7. Data, Records and Retention

7.1 Processing terms. The Data Processing Agreement governs the processing of personal data.

7.2 Retention. Audit records and token-to-value mappings are kept for seven (7) years. Audit records are encrypted, hash-chained and numbered in sequence.

7.3 Deletion and integrity. Because audit records are hash-chained, altering, deleting or reordering one breaks verification of every record after it. The storage retention setting does not prevent deletion by an account credential, so Aporta’s commitment is that tampering is detected, not that it is prevented. Where Customer asks for deletion of audit records, Aporta crypto-shreds them instead of deleting them, because deleting them would destroy the evidence the retention period exists to keep. Aporta will confirm the crypto-shredding, and what survives, in writing.

7.4 Exports. Customer can obtain a sealed, encrypted export of its records, including its token-to-value mappings and audit record. Download from the console is always available to a Super User. If Customer connects Microsoft OneDrive or a SharePoint document library in its own Microsoft 365, or an Amazon S3 bucket in its own Amazon Web Services account, where the Service offers that destination, Aporta also delivers exports there on a schedule: a full copy weekly and an increment daily. Each export comes with an offline reader that runs on Customer’s computer and needs no connection to Aporta. Microsoft or Amazon holds delivered files under Customer’s own agreement with it, and is not Aporta’s sub-processor for them. Customer is responsible for keeping its exports and its recovery code.

7.5 Exit. On termination or expiry, Aporta will deliver a final export with its offline reader, for download from the console or to the destination Customer has connected under Section 7.4, confirm with Customer that the export has been received, crypto-shred Customer’s audit records, destroy its other copies of Customer’s key material, delete any storage credential it holds for Customer, and give Customer a written statement of what data survives and where. Opening an export needs Customer’s recovery code; if Customer has lost it or cannot open an export, Aporta has no means of opening it (Section 3.3). Where Customer connected its own storage, destroying the storage credential does not remove the access Customer granted in its own Microsoft or Amazon account; Customer removes it there.

8. Security

8.1 Aporta will maintain the measures in Exhibit B and will not materially reduce them during the Term.

8.2 Certifications. Aporta holds no third-party security certification. SOC 2 and ISO 27001 are phased and not yet certified; the roadmap is in Exhibit B, Section B.6. Neither Party will represent otherwise.

8.3 Incidents. Aporta will notify Customer of a security incident affecting Customer Data without undue delay, and within the period stated in the Data Processing Agreement, and will provide the information reasonably available to it.

9. Warranties and Disclaimers

9.1 Mutual. Each Party warrants that it has authority to enter into this Agreement and will comply with the laws that apply to its performance.

9.2 Aporta warranty. Aporta warrants that the Service will perform materially as described in Exhibit A. Customer’s exclusive remedy for breach of this warranty is Aporta’s reasonable efforts to correct the non-conformity and, if that fails within thirty (30) days of notice, termination of the affected Order Form with a pro-rata refund of prepaid fees.

9.3 No detection guarantee. Aporta does not warrant that the Service will detect every instance of sensitive data. Detection varies by data category, format, context and language. Aporta measures detection internally, category by category, on public text:

• on 16 and 22 September 2026, against published labelled datasets: 124 real court judgments, 500 encyclopaedia sentences, 411 real business emails, and five samples of 100 synthetic records; and
• from 9 to 13 October 2026, on 40 public documents (US federal court documents and business email). An Aporta employee read 20 of them whole and marked every value without seeing the detector’s answers, and reviewed each disagreement between Aporta’s detector and an independent open-source model in the other 20.

These measurements cover server-side detection, and in October address detection in the browser. Their results are recorded as counts per data category; Aporta states no overall accuracy figure. They are Aporta’s own, not independently validated, and not a warranty. Customer may not rely on an accuracy figure that is not stated in a writing signed by Aporta.

9.4 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE SERVICE IS PROVIDED “AS IS” AND APORTA DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. APORTA DOES NOT WARRANT THAT USE OF THE SERVICE ACHIEVES COMPLIANCE WITH ANY LAW, REGULATION, INSURANCE REQUIREMENT OR PROFESSIONAL RULE.

10. Indemnification

10.1 By Aporta. Aporta will defend Customer against a third-party claim that the Service as provided infringes a United States patent, copyright or trademark, and will pay damages finally awarded, if Customer gives prompt notice, lets Aporta control the defense, and reasonably cooperates. Aporta may obtain the right for Customer to continue using the Service, modify the Service, or terminate the affected Order Form with a pro-rata refund.

10.2 By Customer. Customer will defend Aporta against a third-party claim arising from (a) Customer Data, or Customer’s use of the Service in breach of Section 3.6, or (b) Customer’s statements to third parties about the Service that go beyond Exhibit A.

10.3 Exclusions. Aporta has no obligation for a claim arising from Customer’s modification of the Service, its combination with items Aporta did not supply, or use after notice to stop.

11. Limitation of Liability

11.1 EXCEPT FOR THE EXCLUDED CLAIMS AND DATA PROTECTION CLAIMS, NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY.

11.2 General cap. EXCEPT FOR THE EXCLUDED CLAIMS AND DATA PROTECTION CLAIMS, EACH PARTY’S TOTAL LIABILITY IS LIMITED TO THE FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY (THE “GENERAL CAP”).

11.3 Data protection cap. EACH PARTY’S TOTAL LIABILITY FOR ALL DATA PROTECTION CLAIMS IS LIMITED TO THE GREATER OF (A) THREE (3) TIMES THE GENERAL CAP, AND (B) THE PER-CLAIM LIMIT OF THE TECHNOLOGY ERRORS AND OMISSIONS INSURANCE POLICY APORTA HOLDS WHEN THE CLAIM IS MADE. WHILE APORTA HOLDS NO SUCH POLICY, THE LIMIT IS THREE (3) TIMES THE GENERAL CAP. THIS LIMIT APPLIES TO DATA PROTECTION CLAIMS INSTEAD OF THE GENERAL CAP.

11.4 Definitions. “Data Protection Claims” means claims arising from a Party’s breach of Section 5 (Confidentiality), Section 8 (Security) or the Data Processing Agreement. “Excluded Claims” means (a) Customer’s payment obligations; (b) either Party’s indemnification obligations; and (c) a Party’s gross negligence, willful misconduct or fraud. A claim that is both a Data Protection Claim and an Excluded Claim is an Excluded Claim. Nothing in this Section 11 limits liability for the Excluded Claims.

12. Operational Continuity

12.1 Key person. Aporta is currently run by its founder, and Customer acknowledges that concentration as a known risk. Aporta has adopted the measures in this Section rather than representing that the risk does not exist.

12.2 Designated successor. Aporta maintains a designated successor with standing administrative access to its identity, credential-management, source-code, domain and cloud accounts, enough to continue or wind down operations without the founder. That access does not depend on any trigger. Aporta will notify Customer if the designation lapses and is not replaced within thirty (30) days.

12.3 Key custody. Key material needed to operate the Service is held so that no one person’s unavailability prevents Customer from recovering its data. Aporta keeps at least two copies in separate secured physical locations, with a separately held break-glass credential, each reachable by the designated successor in their own right. Aporta holds this custody itself, keeps a written custody record, and reviews it at least once a year.

12.4 Continuity without Aporta. The exports in Section 7.4 are the main continuity measure. With a connected storage destination, Customer holds a current copy of its records and a reader that opens them without Aporta, so Aporta ceasing to operate interrupts the Service but does not take Customer’s data with it.

12.5 Wind-down. If Aporta ceases operations, it will use commercially reasonable efforts to give Customer at least sixty (60) days’ notice, deliver a final export, and provide the statement described in Section 7.5.

13. Term and Termination

13.1 This Agreement begins on the Effective Date and continues until every Order Form has expired or been terminated.

13.2 Either Party may terminate for material breach not cured within thirty (30) days of written notice.

13.3 Either Party may terminate immediately if the other becomes insolvent, makes an assignment for the benefit of creditors, or has a receiver appointed.

13.4 On termination, Customer’s right to use the Service ends, Aporta will perform Section 7.5, and Sections 1, 5, 6, 7, 9.3, 9.4, 10, 11, 13.4 and 14 survive.

14. General

14.1 Governing law and venue. Tennessee law governs, without regard to conflict-of-laws rules. The state and federal courts located in Davidson County, Tennessee have exclusive jurisdiction.

14.2 Publicity. Neither Party will name the other publicly without prior written consent. Customer may separately consent to an anonymized case study, which will not identify Customer or any of its clients.

14.3 Assignment. Neither Party may assign this Agreement without the other’s consent, except to a successor by merger or sale of substantially all its assets that assumes this Agreement in full.

14.4 Independent contractors. The Parties are independent contractors. Neither is the other’s agent.

14.5 Force majeure. Neither Party is liable for delay caused by events beyond its reasonable control. This does not excuse payment obligations.

14.6 Order of precedence. (1) The Data Processing Agreement, for the processing of personal data; (2) the Order Form; (3) these Standard Terms; (4) the Exhibits; (5) the Incorporated Pages. The same order applies whether or not a countersigned copy of the Data Processing Agreement has been provided.

14.7 Entire agreement. This Agreement is the entire agreement on its subject. Amendments must be in a signed writing. Counterparts and electronic signatures are effective. A Super User’s acceptance in the Service of a stated version of these Standard Terms or the Data Processing Agreement is a signed writing for this Section.

15. Posted Terms, Incorporated Pages and Versioning

15.1 Versions. These Standard Terms are posted at aportasystems.com/legal/terms. Each version has a number and a publication date. The Order Form states the version in effect when Customer signed or placed it, and that version governs Customer for the rest of the current Term, whatever is published later. The Data Processing Agreement is posted at aportasystems.com/legal/dpa and is versioned, stated on the Order Form and pinned in the same way. Aporta keeps every superseded version of each available at a stable address.

15.2 Incorporated Pages. These pages are versioned and dated in the same way and form part of the Agreement:

15.3 Ordinary changes. Aporta may update these Standard Terms and the Incorporated Pages. An update applies to Customer from its next renewal Term, except an update required by law or one that adds a Supported AI Tool, which applies immediately.

15.4 Material adverse changes. A change is material and adverse if it removes a Supported AI Tool, adds a sub-processor, reduces the measures in Exhibit B, or otherwise materially reduces Customer’s rights. Aporta will give at least thirty (30) days’ written notice of such a change before it takes effect. Customer may terminate the affected Order Form without penalty within that period and receive a pro-rata refund of prepaid fees. Sub-processor changes are also subject to the objection right in the Data Processing Agreement.

15.5 Notice. Aporta gives notice of every update to these Standard Terms or an Incorporated Page by email to the “Administrative contact and notice email” on the Order Form at least thirty (30) days before the renewal at which it applies, and at least thirty (30) days before a material adverse change takes effect. Posting alone is not notice.

15.6 Evidence. On request, Aporta will certify in writing which version of these Standard Terms and of each Incorporated Page applied to Customer on a stated date.

These Standard Terms are not signed. They bind Customer when Customer signs an Order Form or places an Online Order that refers to this version.

EXHIBIT A — SERVICE DESCRIPTION AND SCOPE

A.1 What the Service does

The Aporta extension runs in Google Chrome and Microsoft Edge. On a Supported AI Tool it reads what an Authorized User types into the message box and applies two tiers of detection:

• Tier 1 runs in the browser and finds fixed formats: government identification numbers, payment card numbers checked by checksum, email addresses, North American phone numbers, credentials and API keys, and Customer’s own terms.
• Tier 2 runs on Aporta’s detection service, hosted in the United States, when the user pauses typing and again at send. It finds people’s names and street addresses, which pattern matching cannot find reliably, and checks the fixed formats and Customer’s own terms again. Company names are detected only if a Super User turns that on; in spreadsheet columns, company and place names are detected unless a Super User turns that off. Names, places and organizations are detected in English only. Tier 2 is part of the Service and Customer cannot turn it off.

Detected values are replaced with tokens before the text is sent. The link between each token and its value is encrypted and stored in a vault for Customer. The AI tool receives only tokens; Aporta restores the original values in the answer for the Authorized User to read and copy.

If a Super User turns on attachment scanning, the extension also scans spreadsheets, Word documents and presentations attached to a Supported AI Tool, in the browser.

Each send creates an audit record with the tokenized text as sent, what was detected, the device and its coverage tier, the protection in effect, and the AI account tier.

A.2 Supported AI Tools

The current list, with the sites covered for each in each browser, is at aportasystems.com/legal/supported-tools. It is an Incorporated Page under Section 15.

• An AI site that is not on the list is blocked or redirected, as Customer’s policy sets. It is not protected, and it is not silently allowed.
• Adding a tool requires a new extension version. It is not a setting, and Aporta cannot add a tool on request within a support cycle.
• Removing a tool is a material adverse change under Section 15.4.

A.3 Detection layers

A.4 Limits of the Service (material)

These limits are structural. They are not defects, and configuration does not remove them.

A.5 Deployment tiers

A.6 Excluded data

Customer will not use the Service for data whose handling requires a certification or regime Aporta does not hold, including HIPAA data as a business associate, PCI cardholder data environments, ITAR or EAR controlled technical data, and classified information. Detecting a card number in a prompt is not operating a cardholder data environment.

EXHIBIT B — SECURITY ADDENDUM

B.1 Providers

The providers that process Customer Data, what each does and where, are listed on the Sub-processors page (Section 15.2).

B.2 Encryption

• Stored values are encrypted with AES-256-GCM before they reach storage, with a fresh initialization vector each time, and each ciphertext is bound to its tenant and token.
• Data is encrypted in transit with TLS. TLS ends at Aporta’s edge, so text is unencrypted on Aporta’s infrastructure while detection runs. The Service is not end-to-end encrypted.
• Unwrapped keys cannot be extracted or written to a log or a response.

B.3 Key custody

Reading the audit record and unmasking a token are different privileges, so they use different keys.

Each customer’s data keys are wrapped by a key held in a managed key service, which was generated in the provider’s hardware and cannot be exported.

Once Customer holds the Vault Key, Aporta’s servers cannot decrypt Customer’s vault without a key held by Customer. That statement is about the vault only. It does not change three things, each disclosed in the Data Processing Agreement: (a) sensitive values are in plaintext in Customer’s browser where they are detected and tokenized; (b) prompt text, including in-progress text, is sent to Aporta’s server-side detection, processed in memory and not kept; and (c) tokenized text goes to the AI tool the Authorized User chose.

Shared devices. Key material belongs to a browser profile. Where each Authorized User has a separate profile, which Aporta recommends, the separation between them is cryptographic. Where users share one profile and sign in and out of it, each still has their own records, and unmasking is attributed to the signed-in user, but the separation between them rests on Aporta’s server-side authorization rather than on cryptography. Aporta never enrolls more than one customer on a single browser profile.

B.4 Access control

• Six roles with least-privilege separation. Support and reseller roles have no access to prompt text. An auditor role can read the record and change nothing.
• Aporta staff accounts cannot read a customer’s audit record or prompt text through the Service. Aporta’s integrity check on a customer’s audit record reads identifiers, sequence numbers and counts only, and each use is recorded.
• Aporta staff identities are kept apart from customer users, and no Aporta account is a member of a customer’s organization.
• Sending a detected value without its token needs a Super User’s approval. For government identification numbers, payment card and financial account numbers, and credentials, two people must approve, and no setting can lower that. The one exception: where Customer has only one active Super User, that person may approve alone, and the record says the approval was self-approved. Customer may turn this exception off.

B.5 Monitoring and integrity

• Audit events are hash-chained and numbered per device, so alteration, deletion or reordering breaks verification.
• Each browser reports a heartbeat with its identity, extension version and audit-chain position. A lost heartbeat, or a chain that moves backwards, is shown to Customer’s Super Users as a coverage failure.
• Aporta checks each Supported AI Tool in both browsers on a schedule, so a vendor’s page change is found by Aporta rather than by Customer.
• If the extension loses its hold on a Supported AI Tool, it blocks that tool rather than let it run unprotected, until the hold is restored. During that time the tool is unavailable, unless the optional Gemini answer in Section 2.6 is on.

B.6 Certification roadmap

Aporta holds no third-party security certification. Where a questionnaire asks, Aporta may say that its infrastructure providers hold their own certifications; that is never a substitute for a certification of Aporta. The planned sequence is a penetration test, then a SOC 2 Type I report, then a six-to-twelve-month observation window, then a SOC 2 Type II report. Aporta will not describe itself as SOC 2 compliant or as meeting any framework it has not completed, and Customer may not do so on Aporta’s behalf.

EXHIBIT C — SUPPORT

Support is by email during Aporta’s published business hours. There is no out-of-hours cover except the Severity 1 target below.

These are response targets, not resolution times. Aporta offers no uptime commitment and no service credits.

EXHIBIT D — ONLINE ORDER

D.1 Who may place one

An Online Order is placed in the Service by the first Super User of an organization that Aporta has created for Customer. It records the name of the person who placed it, their email address, and the date it was accepted. This Exhibit D forms part of each Online Order, so it ranks as the Order Form under Section 14.6. Pilots are not available by Online Order; a pilot is provided only under a signed Pilot Evaluation Agreement.

D.2 Versions

The Online Order incorporates the versions of these Standard Terms and of the Data Processing Agreement shown in the Service when Customer places it, and Aporta records those versions with it. Customer has been shown a copy of each. By placing the Online Order Customer accepts both; the Data Processing Agreement needs no separate signature, and Aporta will provide a countersigned copy on request. The versions stated here govern for the rest of the current Term (Section 15.1).

D.3 Customer

Customer enters these in the Service when it places the Online Order:

D.4 Fee, payment and term

D.5 Set-up

If Deployment is “Unmanaged”, Customer is buying visibility, not enforcement. On an unmanaged device an Authorized User can disable or remove the extension, use another browser or use a personal device. Aporta records that; it does not prevent it. Enforcement requires force-install on managed browsers (Section 2.4).

If the deployment recorded on the Online Order does not match how Customer deploys the extension, Aporta may correct the record, on notice. Any resulting change in fee applies from the next billing period, as for a band move under Section 4.2.

D.6 Scope acknowledgment

Customer has read Exhibit A, Sections A.4 and A.6. The person placing the Online Order acknowledges each of the three paragraphs below separately in the Service, and the rest of this Section once.

Vault-key loss. Aporta holds the Vault Key until a Super User takes custody of it, and until then the Service blocks any send containing a detected value. Section 3.3 of the Standard Terms then applies:

3.3 Recovering the Vault Key. After Customer takes custody, Customer’s vault can be opened from any of Customer’s enrolled browsers, and from Customer’s recovery code. Any enrolled browser can enroll a new one, and a Super User can issue a new recovery code. Aporta has no means of decrypting the vault itself. If every enrolled browser and the recovery code are all lost, the token-to-value mappings cannot be recovered by anyone, including Aporta. Customer will keep the recovery code apart from every enrolled browser and from the credentials used to sign in to the Service.

Determined insider. The Service dramatically reduces inadvertent exposure. Against a determined insider it is a detective control, not a preventive one: the audit record and alerts make that person’s behaviour visible so it can be caught, but do not prevent it.

Excluded data. Customer will not use the Service for data whose handling requires a certification or regime Aporta does not hold, including HIPAA data as a business associate, PCI cardholder data environments, ITAR or EAR controlled technical data, and classified information (Standard Terms Exhibit A, Section A.6).

The rest of this Section. Customer understands that:

• the Service covers only the tools listed at aportasystems.com/legal/supported-tools, in Google Chrome and Microsoft Edge, and that page lists the exact sites covered in each browser. Other AI sites are blocked or redirected, not protected;
• AI built into other applications, such as Microsoft 365 Copilot in the Word, Excel, PowerPoint and Outlook applications, or Einstein in Salesforce, cannot be reached by a browser extension;
• Aporta measures detection internally, not independently, and states no overall accuracy figure (Standard Terms § 9.3);
• the audit record is reported by Customer’s browsers, covers what was sent, and does not record AI responses;
• server-side detection receives in-progress text, including text a user deletes and never sends.

D.7 Other terms

Anonymized case study: not consented. Customer may consent separately (Section 14.2).

Customer authorizes its Super Users to accept later versions of the Standard Terms and Data Processing Agreement on its behalf.

Except as stated above, the Standard Terms and the Data Processing Agreement apply unchanged. Where this Exhibit D conflicts with the rest of the Standard Terms, this Exhibit D controls.