Terms of Service

These Terms of Service ("Terms") govern your access to and use of:

• The Omnitrex website at omnitrex.eu ("Website")
• The Omnitrex GRC platform at app.omnitrex.eu ("Hosted Service")
• Self-hosted deployments of the Omnitrex platform ("Software")

By accessing or using any of the above, you agree to be bound by these Terms. If you are acting on behalf of an organization, you represent and warrant that you have the authority to bind that organization to these Terms.

Omnitrex is a Governance, Risk, and Compliance (GRC) platform supporting compliance with GDPR, DORA, AI Act, NIS2, ISO 27001, and SOC 2 frameworks. The Platform includes:

• Organizational modeling across 15 domains
• Risk-control mapping
• Audit logging
• Reporting and compliance gap analysis
• API and agent integrations

• You must be at least 18 years old (or the age of legal majority in your jurisdiction) to use the Services
• You must provide accurate and complete registration information
• You must maintain the security of your account credentials. Password requirements: minimum 8 characters, including uppercase, lowercase, number, and special character
• You must notify us immediately of any unauthorized access to your account
• You are responsible for all activity under your account
• One account per person; organizational accounts are managed by the Customer

We may suspend accounts that violate these Terms, with notice except in cases of imminent security risk.

You own your data. We claim no ownership of Customer Data.

• We process Customer Data solely to provide the Services
• We do not use Customer Data for advertising, profiling, or any purpose unrelated to service delivery
• We do not sell, rent, or trade Customer Data
• You grant us a limited, non-exclusive license to process Customer Data as necessary to operate the Services (including backups, security monitoring, and support)
• You are responsible for the legality of Customer Data you upload, including any personal data of third parties

Upon termination: see Section 13 (Data Portability & Switching).

• Personal data processing is governed by our Privacy Notice
• For the Hosted Service: Omnitrex acts as a data processor (Art. 28 GDPR) with respect to personal data you upload. You remain the data controller
• A standalone Data Processing Agreement (DPA) is available on request and will be published at omnitrex.eu/dpa
• Until a signed DPA is in place, the data processing terms in this section and our Privacy Notice apply
• Sub-processors are listed in our Privacy Notice
• We will notify you of changes to sub-processors at least 30 days in advance

For the Community Edition (self-hosted): you are both controller and processor of any personal data stored in your own deployment. Omnitrex has no access to your self-hosted data.

The Platform includes optional AI-powered features, including:

• Workflow automation prompts
• Agent integrations via MCP (Model Context Protocol)
• AI-assisted proposals and compliance analysis

AI features use third-party AI providers. Currently: Anthropic (Claude). Providers may change; we will update this section accordingly.

The Platform is a tool, not a legal advisor. Omnitrex provides software to support your compliance program — it does not provide legal, regulatory, or compliance advice.

• Compliance assessments, gap analyses, risk scores, and framework mappings generated by the Platform are informational and should be independently verified
• We do not guarantee that use of the Platform will result in regulatory compliance
• You remain solely responsible for your organization's compliance obligations
• We recommend consulting qualified legal and compliance professionals for regulatory decisions
• Nothing in the Platform or these Terms creates a lawyer-client or advisor-client relationship

You agree not to:

• Use the Services in violation of applicable law (including GDPR, DORA, NIS2, or other regulations)
• Upload content that infringes third-party intellectual property rights
• Attempt to gain unauthorized access to the Services or other users' data
• Transmit malicious code or interfere with service operation
• Use the Services to store or process data in violation of export control laws
• Circumvent technical restrictions, rate limits, or access controls
• Use automated means to scrape or extract data from the Services (except via the documented API)

Violation may result in suspension or termination, with notice (except in cases of imminent security risk or legal obligation).

• Omnitrex IP: The Platform, its design, branding, documentation, and non-BUSL-1.1 proprietary components are owned by Omnitrex
• Software license: The Platform source code is licensed under BUSL-1.1 as described in Section 4. The license grants you specific rights to use, copy, modify, and redistribute — subject to the Additional Use Grant restriction
• Trademarks: "Omnitrex" and the Omnitrex logo are trademarks of Omnitrex. You may not use them without our written permission, except as required to comply with the BUSL-1.1 license
• Your IP: You retain all rights to your Customer Data. We claim no ownership of content you create using the Platform
• Feedback: If you provide suggestions, feature requests, or feedback, you grant us a non-exclusive, royalty-free, perpetual license to use that feedback to improve the Services. This does not apply to your Customer Data

• During Early Access: The Hosted Service is provided on an "as available" basis. No uptime commitment or SLA applies. We will use reasonable efforts to maintain availability, but the service may be interrupted for maintenance, updates, or unforeseen issues
• After General Availability: A published SLA with uptime commitments and service credits will apply to paid plans. Enterprise customers may negotiate custom SLA terms
• Planned maintenance: We will provide reasonable advance notice of scheduled maintenance
• Self-hosted deployments: Availability is your responsibility. We provide documentation but no uptime guarantee for self-hosted instances

Your data, your choice. No lock-in.

• You may export your Customer Data at any time via the Platform's export functionality, in standard machine-readable formats (CSV, JSON, XLSX)
• The Platform source code is publicly available under BUSL-1.1, providing an additional layer of portability — you can always inspect exactly how your data is stored and processed

If you decide to switch to another provider:

• You may terminate your account with no more than 2 months' notice (as required by Regulation (EU) 2023/2854, the EU Data Act)
• We will provide a 30-day transition period during which you can export all Customer Data
• We will provide reasonable switching assistance during the transition period at no additional charge
• After the transition period, we will delete your data in accordance with Section 15

These rights apply regardless of your edition or plan tier. We do not impose contractual, commercial, technical, or organizational barriers to switching.

• During Early Access: The Hosted Service is provided at no charge. No payment is required
• After General Availability: Paid plans will be introduced with published pricing. We will notify existing users at least 30 days before paid plans take effect. You will not be charged without explicit consent. Existing free-tier or Community Edition users will not be retroactively charged
• Refunds (once paid plans are active): Governed by the applicable plan terms. We will comply with applicable Dutch and EU consumer protection law, although our services are directed at businesses (B2B)

By you

You may terminate at any time by contacting info@omnitrex.eu or using the account deletion feature. For the Community Edition, you may stop using the Software at any time (subject to the BUSL-1.1 license terms for any copies you retain).

By us

We may terminate or suspend your access if:

• You materially breach these Terms and fail to cure within 14 days of notice
• You use the Services in a way that poses a security risk or legal liability
• Required by law or court order
• We discontinue the Early Access program (with at least 30 days' notice)

Effect of termination

• Your access to the Hosted Service will cease
• You may export your Customer Data during a 30-day post-termination period
• After the 30-day period, Customer Data will be permanently deleted (with a 30-day soft-delete grace period as described on our Security page)
• Sections that by their nature should survive termination will survive (intellectual property, liability, governing law, data portability obligations)

• Our total aggregate liability for any claims arising under or in connection with these Terms is limited to the total fees paid by you to Omnitrex in the twelve (12) months preceding the event giving rise to the claim
• During the Early Access Period (when no fees are charged), our total aggregate liability is limited to EUR 0 (zero)
• We are not liable for indirect, incidental, special, or consequential damages, including but not limited to: loss of profits, loss of data, loss of business opportunity, regulatory fines or penalties, or cost of procuring substitute services

These limitations apply to the maximum extent permitted by Dutch law (Book 6 of the Dutch Civil Code) and reflect the allocation of risk between the parties.

• We may update these Terms from time to time
• Material changes: we will notify you via email (if we have your address) or a prominent notice on the website, at least 30 days before the changes take effect
• Non-material changes (formatting, clarifications): effective immediately upon posting
• If you do not agree with material changes, you may terminate your account before the changes take effect
• Continued use of the Services after the effective date constitutes acceptance
• Previous versions of these Terms will be archived and available on request