Terms of Service

ZeusLock is published and operated by ZEUSLOCK, a simplified joint-stock company (société par actions simplifiée) with share capital of 100 euros, registered with the Nanterre Trade and Companies Register under number 105 482 707, with its registered office at 11 allée des Ormes, 92420 Vaucresson, France.

Publication director: Mohamed Rassoul Tounkara, President.

Contact: security@zeuslock.ai, telephone +33 7 58 81 13 88.

The website and the platform are hosted in France by OVH SAS, 2 rue Kellermann, 59100 Roubaix, telephone +33 9 72 10 10 07, in its Gravelines data centres.

In the rest of this text, "ZeusLock" or "we" means ZEUSLOCK SASU, and "you" or "the Customer" means the organisation that uses the platform.

ZeusLock is a service for businesses, public bodies and organisations. It is not offered to consumers. The person who creates an account or signs a quote declares that they act on behalf of their organisation and have the authority to bind it.

You accept these terms by creating an account, signing a quote or purchase order, or using the platform. If you do not accept them, do not use the service.

Your relationship with ZeusLock may rest on several documents. If they conflict, they apply in this order: the signed contract or quote, the data processing agreement, these terms, then the service documentation. The Customer's purchasing terms or general terms do not apply, even if they have been sent to us.

ZeusLock is a platform that prevents data leaks to generative artificial intelligence services. In what your staff are about to submit to an AI tool, it detects the sensitive information defined by your rules, and it blocks, anonymises or reports it according to the policy you have chosen.

Depending on your subscription, the service includes:

• a dashboard to manage your users, detection rules, incidents, alerts and reports;
• components installed on your side: a browser extension, an endpoint agent for workstations and a command-line interface;
• an API to integrate ZeusLock with your tools, and export of incidents to your SIEM;
• the documentation and support described in article 12.

Content that your staff submit to AI tools is analysed in real time by ZeusLock's detection engine, hosted in France, and then discarded immediately. This content is never stored. Only incident metadata is recorded: type of data detected, timestamp, application concerned, user, action applied. The analysis is performed by our own models, on our servers. We do not pass your content to any third-party AI service and we do not use it to train our models.

We develop the service continuously. During your subscription, we do not withdraw an essential feature without informing you at least sixty days in advance, unless a security reason or a legal obligation requires it.

The edition deployed in your own infrastructure (on-premise edition) is covered by a separate contract. These terms apply to the platform hosted by ZeusLock.

You create your account with accurate information and keep it up to date. An administrator appointed by you manages your organisation's users, their roles and your detection rules.

Each account is personal. Credentials are not shared. We recommend enabling two-factor authentication on all administrator accounts; it is mandatory for the most sensitive roles where the platform requires it.

You are responsible for everything done from your accounts, by your users or by anyone who obtained access through your negligence. If you notice or suspect unauthorised access, tell us without delay at security@zeuslock.ai. We may suspend an account that poses a risk to the platform or to other customers, and we inform you immediately.

ZeusLock analyses what your staff submit to AI tools. You decide to deploy ZeusLock components on their workstations and browsers, you choose the detection rules and the mode applied (blocking, anonymisation or reporting only), and you review the incidents.

As employer and data controller, you undertake to inform your staff of the introduction of ZeusLock and its purposes, to consult your employee representative bodies where the law requires it, and to comply with employment law and the General Data Protection Regulation in your use of the service. ZeusLock has no access to the analysed content and decides neither the rules nor how they are applied.

Our prices are not published on the website. They are set out in the quote or purchase order we prepare for you, together with the subscription term, the number of users, the features included and the billing frequency. Prices are exclusive of taxes.

Invoices are payable within thirty days of their date, by the payment method stated on the quote. In case of late payment, penalties are due by operation of law at the European Central Bank refinancing rate plus ten points, together with a fixed indemnity of forty euros for recovery costs, in accordance with article L441-10 of the French Commercial Code. If an invoice remains unpaid fifteen days after a written reminder, we may suspend access to the service until payment.

We may revise our prices at each renewal of the subscription, giving you at least sixty days' notice before the renewal date. If you refuse the new price, you may choose not to renew.

Where we offer a free trial, it is for evaluating the service. It is provided as is, for the period we specify, and without any availability commitment. At the end of the trial, the account is closed and its data deleted within thirty days, unless you take out a subscription.

The subscription starts on the date stated on the quote and lasts for the period specified there. It then renews automatically for the same period, unless either party notifies the other in writing at least thirty days before the end of the term.

Either party may terminate the contract if the other seriously breaches its obligations and does not remedy the breach within thirty days of formal written notice. We may also terminate the contract without notice in case of use contrary to article 8 that endangers the platform or third parties.

If we decide to discontinue the service, we give you at least three months' notice and refund the part of the subscription already paid that has not been used.

When the contract ends, whatever the reason, your access to the platform stops. You can export your rules and incidents from the dashboard before the end date, or ask us for an export within the following thirty days. We then delete your data within sixty days, except what we must keep by law (invoices, accounting records) and backup copies, which are erased according to their rotation cycle.

You use ZeusLock in compliance with applicable law and the rights of third parties. You must not:

• circumvent or attempt to circumvent the security, authentication or usage-limitation measures of the platform;
• decompile, disassemble or reverse-engineer the platform, the client components or the API, except where the law allows it;
• resell, rent, lend or redistribute the service without our written consent;
• use the service to monitor people outside the legal framework that applies to you, or to infringe the rights of your staff;
• overload or disrupt the platform, introduce malicious code into it, or carry out penetration tests without our prior written consent;
• access, or attempt to access, another customer organisation's data;
• use the service for any illegal activity.

If we find use contrary to these rules, we may suspend the access concerned, then terminate the contract under the conditions of article 7.

The platform, the client components, the API, the documentation, the detection models, and the ZeusLock trademarks and logos belong to us or to our licensors. For the duration of the subscription, we grant you a non-exclusive, non-transferable right to use the service for your organisation's internal needs, within the number of users subscribed. This right gives you no other right in the service.

The client components may contain open-source software, which remains subject to its own licences. The list is available in the documentation.

Your data belongs to you: your rules, your incidents, your configurations and the personal data of your users. We process it only to provide the service to you, under the conditions of article 10. We may compile aggregated, anonymous usage statistics, which identify neither your organisation nor your users, to operate and improve the service.

If you share suggestions or comments about the service with us, we may use them freely, without compensation.

We process personal data in two capacities.

For the data of your account and your contacts (identity, business contact details, billing, exchanges with us, connection logs), we are the data controller. This data is used to perform the contract, keep the service secure, support you and meet our legal obligations. We keep it for the duration of the contract, then for as long as those obligations require.

For the data processed by the platform on your behalf (identity of your users, workstation identifiers, incident metadata), you are the data controller and we are your processor. This processing is governed by the data processing agreement that forms part of your contract. It sets out our commitments, the list of our sub-processors and the conditions for any change to that list.

Platform data is hosted in France. We do not transfer personal data outside the European Union, except to a provider listed in the data processing agreement and with the safeguards provided by the General Data Protection Regulation, in particular the European Commission's standard contractual clauses.

You have the right of access, rectification, erasure, restriction, objection and portability for the data for which we are the controller, as well as the right to lodge a complaint with the French data protection authority (CNIL). Write to us at security@zeuslock.ai; we reply within one month. For your users' data, you answer the requests; we give you the help you need.

We implement appropriate technical and organisational measures to protect data: encryption of communications, access control, separation of data between organisations, logging, backups. They are described in the data processing agreement. If a personal data breach affects you, we inform you without undue delay after becoming aware of it, with the information we have.

Each party keeps confidential the non-public information it receives from the other under the contract, uses it only to perform the contract, and discloses it only to people who need to know it and are bound by the same obligation. This obligation lasts for the duration of the contract and five years after it ends. It does not apply to information that has become public through no fault of the receiving party, that the receiving party already knew, or that the law or an authority requires to be disclosed.

We operate the platform with a goal of permanent availability and use reasonable means to achieve it. We do not guarantee uninterrupted availability. Planned maintenance is carried out, as far as possible, outside French business hours and announced at least forty-eight hours in advance in the dashboard or by email. Where a service-level commitment exists, it is set out in your subscription contract; without such a clause, no quantified service level is guaranteed.

Support is provided by email on French business days. Hours, response times and any additional channels (chat, telephone) are specified in your contract. Any security incident, vulnerability or suspected compromise should be reported to security@zeuslock.ai.

ZeusLock reduces the risk of data leaks to AI tools; it does not eliminate it. Detection relies on rules and models that may miss sensitive content or flag content that is not sensitive. We do not guarantee that the service will detect or prevent every leak, and you remain responsible for your security policy, the configuration of your rules and the training of your staff.

The service is provided with the features described in the documentation. We give no other warranty, express or implied, to the extent permitted by law.

Our liability, for all causes combined, is limited to the amount you paid us for the twelve months preceding the event giving rise to the claim. We are not liable for indirect damage: loss of revenue, of customers, of data you did not back up, damage to reputation, cost of substitute services. These limits do not apply in case of fraud or gross negligence, nor where the law prohibits limiting liability.

You indemnify us against any third-party claim relating to use of the service contrary to the law or to these terms, in particular regarding your obligations towards your staff.

We may suspend all or part of the service, after notifying you where possible, in case of non-payment under the conditions of article 6, use contrary to article 8, a serious threat to the security of the platform or other customers, or a request from a competent authority. The suspension is lifted as soon as its cause has gone. It gives rise to no compensation when it results from a failure on your part.

By default, the website and the platform use only cookies that are strictly necessary for them to work: authentication, security, display preferences. The optional services of the website (live chat, appointment booking, adapting the language to your country) are only activated with your consent, which you can give or withdraw at any time through the "Cookie preferences" link at the bottom of the page. The sign-up and sign-in forms use a bot-protection service, which may set its own cookies. You can also block or delete cookies in your browser settings; some features may then stop working.

We may change these terms. When a change reduces your rights or increases your obligations, we inform you by email or in the dashboard at least thirty days before it takes effect. If you refuse it, you may terminate the contract before that date, and we refund the unused part of the subscription. After that period, continued use of the service constitutes acceptance. Other changes take effect when published on the website.

These terms are governed by French law.

In case of disagreement, we start by discussing it: either party may refer the matter to the other in writing, and the parties endeavour to find a solution within thirty days. Failing agreement, the dispute is brought before the Nanterre economic activities court (tribunal des activités économiques, formerly the commercial court), to which the parties grant exclusive jurisdiction, including for interim proceedings, multiple defendants or third-party claims.

These terms are written in French. The translations offered on the website are provided for your convenience; in case of discrepancy, the French version prevails.

If a clause of these terms is held void or unenforceable, the others remain in force. A party's failure to exercise a right does not constitute a waiver of that right.

You may not assign the contract without our written consent. We may assign it to a company affiliated with us or that takes over our business, informing you.

Neither party is liable for a failure caused by force majeure within the meaning of article 1218 of the French Civil Code. If the force majeure lasts more than sixty days, either party may terminate the contract.

The platform's logs and records, kept under reasonable security conditions, are evidence of the operations performed. Email exchanges and acceptances made in the dashboard have the same value as a signed written document.

Articles 9, 10, 11 and 13 remain applicable after the end of the contract for the periods they provide.