Terms of Service

These Terms of Service (the "Terms") govern access to and use of the KYC File platform — including the website at kycfile.com, the application at app.kycfile.com, and any related services (together, the "Service") — provided by KYC File ("we", "us", "our"). By accessing or using the Service, you agree to be bound by these Terms.

The Service is provided to organisations operating in regulated industries, such as banks, payment processors, insurers, brokers, and fiduciaries (each, an "Operator"), and to the individual end clients those Operators invite to participate in document collection and identity verification workflows ("Client Users"). References to "you" mean the Operator or Client User accepting these Terms, as the context requires.

1. Eligibility and account creation

Accounts on the Service are created by invitation. There is no public sign-up. By accepting an invitation and creating an account you represent that (a) you are at least the age of majority in your jurisdiction, (b) you are authorised to act on behalf of any organisation you are representing, and (c) the information you provide is accurate.

2. Description of service

The Service enables Operators to:

• Compose and send document-collection requests to their clients;
• Receive uploaded documents through a controlled portal, where each upload is virus-scanned and audit-logged before becoming visible to reviewers;
• Approve, reject, or request replacements for uploaded documents;
• Optionally include identity verification (powered by a third-party provider, currently Didit) within their workflows; and
• Maintain an immutable audit trail of every action taken in connection with a request.

The Service is provided on an ongoing, subscription-style basis pursuant to a separate commercial agreement between the Operator and us. These Terms govern the use of the Service; the commercial agreement governs pricing, term, and other commercial matters.

3. Acceptable use

You agree not to, and not to permit others to:

• Use the Service in violation of applicable law, including anti-money-laundering, sanctions, data-protection, and consumer-protection laws;
• Upload material you do not have the right to upload, or material that infringes the intellectual property or privacy rights of any third party;
• Upload malicious code, attempt to circumvent security measures, probe or scan the Service for vulnerabilities other than under a security disclosure programme operated by us, or otherwise interfere with the Service or other users;
• Reverse-engineer, decompile, or attempt to discover the source code of the Service except to the extent that such restriction is prohibited by applicable law;
• Resell, sublicense, or otherwise commercialise access to the Service without our prior written consent.

4. Customer data and ownership

You retain all right, title, and interest in the documents, identity-verification results, and other content you upload or generate through the Service ("Customer Data"). You grant us a limited, non-exclusive, worldwide licence to host, process, transmit, and display Customer Data solely as necessary to provide the Service to you and to comply with applicable law.

We do not sell Customer Data. We do not use Customer Data to train machine-learning models. We do not access Customer Data except as required to operate, secure, or troubleshoot the Service, or as required by law.

5. Confidentiality

Each party agrees to treat the other's non-public information, including the contents of the Service and any Customer Data, as confidential and to use it only as permitted by these Terms or by a separate written agreement. Confidentiality obligations survive termination of the Service.

6. Intellectual property

The Service, including all software, design, documentation, and brand elements, is owned by us and our licensors and is protected by intellectual-property laws. We grant you a limited, non-transferable, non-exclusive licence to use the Service in accordance with these Terms. No other rights are granted by implication, estoppel, or otherwise.

7. Identity verification

Where an Operator includes identity verification in a workflow, the Client User completes the verification through a hosted flow operated by our verification provider. The provider's decision is recorded in the Service, together with the supporting compliance report. We act as a controller of the verification result and the Client User's account information; the provider acts as a controller of the underlying biometric and document data, in accordance with their own policies.

A Client User who declines to complete identity verification may be unable to complete a request that requires it; the Operator decides which workflows require verification.

8. Service availability and security

We use commercially reasonable efforts to keep the Service available and secure. We do not guarantee uninterrupted availability. Planned maintenance is announced in advance where practical; emergency maintenance may occur without notice.

Our security practices are summarised in the Platform Security Overview available on request. They include tenant isolation, multi-factor authentication for staff, encryption of data at rest and in transit, anti-virus scanning of uploads, an append-only audit log, and off-site encrypted backups.

9. Term and termination

These Terms apply for as long as you have an account on the Service. We may suspend or terminate access for breach of these Terms, for legal or regulatory reasons, or where continued provision of the Service would expose us to material risk. Termination of an Operator's account causes the suspension of the Operator's Client Users' access to that Operator's data.

On termination we will, on written request and within a reasonable period, return Customer Data to the Operator in a structured electronic format and then delete it from production systems, subject to retention requirements imposed by law and to the rolling backup retention described in our Privacy Policy.

10. Warranties and disclaimers

The Service is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all warranties, whether express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted, error-free, or free of harmful components.

The Service is a tool for collecting and reviewing documents and identity verifications. It does not constitute legal, regulatory, or compliance advice. You remain responsible for determining whether the documents and verifications you collect are sufficient for your regulatory obligations.

11. Limitation of liability

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, or exemplary damages, or for any lost profits, lost revenue, or lost data, arising out of or in connection with these Terms or the Service. Each party's aggregate liability arising out of or in connection with these Terms will not exceed the amount paid or payable by the Operator to us in the twelve months preceding the claim.

These limitations do not apply to (a) breach of confidentiality, (b) gross negligence or wilful misconduct, or (c) liability that cannot be limited by applicable law.

12. Indemnification

Each party will defend, indemnify, and hold harmless the other from and against third-party claims arising out of (a) the indemnifying party's breach of these Terms, or (b) the indemnifying party's gross negligence or wilful misconduct, subject to the limitations of liability in Section 11.

13. Force majeure

Neither party will be liable for delay or failure to perform caused by events beyond its reasonable control, including acts of nature, civil unrest, government action, network or utility failures, or pandemic.

14. Governing law and disputes

These Terms are governed by the laws of Saint Christopher and Nevis, without regard to its conflict-of-laws principles. The parties submit to the exclusive jurisdiction of the courts of Saint Christopher and Nevis for any dispute arising under or in connection with these Terms, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

15. Changes to these terms

We may update these Terms from time to time. We will post the updated Terms on this page and update the effective date. For material changes affecting Operators we will provide written notice through the Service or by email. Continued use of the Service after the updated Terms take effect constitutes acceptance.

16. Contact

Questions about these Terms can be sent to legal@kycfile.com. Security disclosures should be sent to security@kycfile.com.