Terms of Use

Agreement

These Terms of Use (the “Terms”) are a contract between you and SichGate Inc. (“SichGate,” “we,” “us”). They govern your use of sichgate.com, app.sichgate.com, our API, and our managed assessment service (together, the “Service”).

By creating an account, purchasing credits, or using the Service, you agree to these Terms. If you are using the Service on behalf of an organisation, you represent that you have authority to bind it, and “you” means that organisation.

If you have a separately signed agreement with us (for example a managed assessment agreement, design partner agreement, or data processing agreement), that agreement controls where it conflicts with these Terms. A data processing agreement, incorporating the Standard Contractual Clauses and the UK International Data Transfer Addendum, is available on request at legal at sichgate dot com.

The Service

SichGate is an adversarial testing platform for small language models. The Service runs structured adversarial assessments (“Assessments”) against models you supply — across base, fine-tuned, and quantized stages — using probe batteries authored by SichGate, and produces results including probe transcripts, severity classifications, category scores, drift measurements, comparison views, and certification tiers (“Results”).

The Service also includes:

• —Certification tiers (SG-1 through SG-4). An automated tier computed from Assessment results under our published methodology.
• —Evidence Bundles. A purchasable export containing structured technical documentation (including EU AI Act Article 11-oriented technical files), a CycloneDX AI-BOM, and ed25519-signed attestations of the Assessment run.
• —Managed assessments. Assessments scoped and run by SichGate under a separate statement of work.
• —Public model registry. Published Assessment results for models, either published by SichGate under its own research programme or published by you at your election.

We may improve, modify, or discontinue features of the Service. We will not materially degrade the core function of a paid plan mid-term without notice.

Accounts and eligibility

You must be at least 18 and able to form a binding contract. The Service is a business tool and is offered for professional use.

Authentication is handled through our identity provider. You are responsible for activity under your account and for keeping your credentials secure. Tell us at security at sichgate dot com promptly if you believe your account has been compromised.

Your content and your models

“Customer Content” means the models, model identifiers, endpoints, configurations, credentials, and other material you supply, and the Results generated from your Assessments.

You own your Customer Content. You grant us a limited licence to host, process, transmit, and display it solely to provide the Service and to maintain security and integrity.

We do not use your Customer Content to train or fine-tune any model of ours, and we do not share it with other customers. We do derive aggregated, non-identifying statistics from Assessment activity — for example, how often a probe category elicits a failure across all Assessments — provided those statistics do not reveal your models, your Results, or your identity. Data handling is described in our Privacy Policy, including which external services receive probe transcripts on each testing path.

Authorization to test — read this one

Adversarial testing of a system you are not authorized to test can be a criminal offence in many jurisdictions. By starting an Assessment, you represent and warrant that:

• —you own the model being tested, or hold rights sufficient to subject it to adversarial testing (including under the model’s licence and, for hosted models, the host’s terms);
• —any access token, API key, or endpoint credential you supply is yours to use for this purpose;
• —where you point SichGate at a custom endpoint, you control that endpoint or have the operator’s explicit permission to test it; and
• —your use of the Assessment does not violate any third party’s terms of service, licence, or applicable law.

We may require evidence of authorization, and we may refuse or terminate any Assessment we reasonably believe is not authorized. You are solely responsible for the consequences of directing the Service at a target you had no right to test.

Acceptable use

You may not:

• —use the Service to test, probe, or attack any model, endpoint, or system you are not authorized to test;
• —extract, scrape, or reverse-engineer SichGate’s probe batteries, attack taxonomies, judging pipelines, or scoring methodology, or use the Service to build a competing evaluation product, except to the extent such a restriction is prohibited by applicable law (including the mandatory decompilation rights under Article 6 of Directive 2009/24/EC);
• —use probe content or Results to attack, jailbreak, or degrade third-party systems in production, or to develop tools whose primary purpose is unauthorized harm;
• —resell, sublicense, or provide the Service to third parties as a service bureau without a written agreement with us (managed service providers: talk to us);
• —circumvent credit metering, plan limits, rate limits, or tenant isolation;
• —misrepresent Assessment Results, certification tiers, or Evidence Bundles, including presenting a tier for one model version as applying to a different version, fine-tune, or quantization;
• —interfere with the operation or security of the Service, other than through our responsible disclosure programme at sichgate.com/security, which is the sanctioned path for testing SichGate itself;
• —use the Service in violation of applicable law, including export control and sanctions law.

Credits, plans, and billing

Credits. Assessments consume credits. Credits are sold in packs and included in plans. Credits are prepaid, non-transferable, hold no cash value, and expire 12 months after purchase unless your plan states otherwise. Credit consumption rates per Assessment type are shown at app.sichgate.com/plans and may change prospectively; a change does not affect credits already consumed.

Plans. Subscription plans renew automatically for successive terms until cancelled. You can cancel any time from the application; cancellation takes effect at the end of the current billing period. Plan limits are described on the plans page.

Payment. Billing is processed by Stripe. You authorise us to charge your payment method for subscriptions, credit packs, Evidence Bundles, and managed assessment fees. Prices exclude taxes, which you are responsible for.

Refunds. Fees and credits are non-refundable except where required by law or expressly stated otherwise. If we terminate your account without cause, we will refund unused prepaid credits pro rata.

Price changes. We may change prices with at least 30 days’ notice; changes apply from your next renewal.

Adversarial content

The Service is designed to elicit failures. Assessment transcripts will, by design, contain harmful, offensive, deceptive, or otherwise objectionable content — that is the point of adversarial testing. You acknowledge that:

• —probe prompts and model responses in your Results may include such content;
• —you are responsible for how you store, share, and use Results, including compliance with your own policies and applicable law when distributing transcripts; and
• —SichGate is not liable for content generated by your model in response to probes.

Probes are authored for evaluation purposes only. Nothing in the Service is an instruction, encouragement, or licence to cause real-world harm.

Intellectual property

SichGate owns the Service, including the probe batteries, attack taxonomies, classifiers and judging pipelines, scoring and certification methodology, software, and documentation. Except for the limited rights expressly granted, no rights are transferred to you.

You own your Customer Content, as stated in section 04. You may use, publish, and share your Results freely, subject to section 06 (no misrepresentation) and section 10 (badge rules). If you publish Results, attribute them to SichGate and identify the exact model version, stage (base / fine-tuned / quantized), and Assessment date.

If you give us feedback, we may use it without restriction or obligation.

Certification tiers, Evidence Bundles, and what they are not

What a tier is. SG-1 through SG-4 tiers are computed automatically from a specific Assessment of a specific model artefact at a specific point in time, under our published methodology. A tier is a measurement, not a guarantee.

What a tier is not. A certification tier is not: a warranty that the model is safe, secure, or free of vulnerabilities; a legal or regulatory compliance determination; an endorsement of your product; or applicable to any model version, fine-tune, quantization, or deployment configuration other than the one tested. Adversarial robustness degrades across model modifications — that is the premise of the product — so a tier for your base model says nothing about your quantized deployment unless you tested it.

Badges. While your account is in good standing, you may display the tier badge for a tested model, identifying the exact artefact and Assessment date. We may revoke badge rights for misrepresentation or breach of these Terms.

Evidence Bundles. Evidence Bundles are technical documentation generated from your Assessment, structured to support regulatory workflows such as EU AI Act Article 11 technical files. The ed25519 attestation attests to the integrity and provenance of the Assessment run and its outputs — that these Results came from this run, unmodified. It does not attest that your model or your organisation complies with the EU AI Act or any other law. An Evidence Bundle is an input to your compliance process, not a substitute for it, and nothing in the Service is legal advice.

Model execution and credentials

Models loaded for an Assessment run in ephemeral compute environments and are destroyed at the end of the run. Access tokens and endpoint credentials you supply are held in memory for the duration of the run and are not written to disk or retained. Details are in the Privacy Policy.

You are responsible for the scope of the credentials you supply. Use least-privilege, revocable tokens where your provider supports them.

Third-party services

The Service interoperates with third-party services you choose to connect — for example Hugging Face, NVIDIA NIM, or your own inference endpoints — and is built on infrastructure providers listed in the Privacy Policy. Your use of a third-party service is governed by that party’s terms, and we are not responsible for third-party services, including their availability or their handling of your data outside our instructions.

Where you direct an Assessment at a hosted model or an endpoint you supply, that provider receives your probe prompts and your model’s responses, because it is serving the model under test. Privacy Policy section 06 sets out which services receive transcripts on each testing path.

API

If we issue you API access, you may use it to integrate the Service into your own workflows, subject to these Terms, published rate limits, and credit metering. Keep your API keys confidential; you are responsible for calls made with them. We may version, deprecate, or modify the API with reasonable notice for breaking changes.

Beta features

Features identified as beta, preview, or experimental are provided as-is, may change or be withdrawn at any time, may consume credits at introductory rates, and are excluded from any availability commitments.

Confidentiality

Each party will protect the other’s non-public information disclosed in connection with the Service with reasonable care and use it only as needed to perform under these Terms. This does not restrict information that is public, independently developed, or rightfully received from a third party, and does not prevent disclosures required by law (with notice where lawful). Your Assessment Results are your confidential information; our probe content and methodology internals are ours.

Suspension and termination

You may stop using the Service and close your account at any time from the application.

We may suspend or terminate your access if you materially breach these Terms (in particular sections 05 and 06), if required by law, or to protect the Service or other customers, with notice where practicable. For breaches of section 05 (unauthorized testing), suspension may be immediate.

On termination: your right to use the Service ends, unused credits are forfeited except as stated in section 07, and data deletion follows the retention schedule in the Privacy Policy. You can export your Results before closing your account. Sections that by their nature survive (including 04, 07, 08, 09, 10, 15, 17, 18, 19, 20, 21, 23) survive termination.

Disclaimers

The Service is provided “as is” and “as available.” To the maximum extent permitted by law, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.

Specifically, and because this is a security product: no adversarial testing finds every failure. An Assessment measures your model’s behaviour against our probe battery at a point in time. It does not and cannot establish that your model is free of vulnerabilities, jailbreaks, or harmful behaviours, and passing any tier does not mean your model will behave safely in deployment. You remain responsible for your model, your deployment decisions, and your compliance obligations.

Limitation of liability

Exclusion of indirect damages. To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill, however caused and on any theory of liability, even if advised of the possibility. This exclusion applies to all claims, including those identified in the paragraphs below, and is limited only by liability that cannot lawfully be excluded.

General cap. Subject to the paragraphs below, each party’s total aggregate liability arising out of or relating to the Service is limited to the amounts you paid us in the 12 months before the event giving rise to the claim.

Confidentiality super-cap. For a breach of section 15, the limit is the greater of three times the amounts you paid us in the 12 months before the event, or one hundred thousand US dollars.

Uncapped matters. No cap in this section applies to: your breach of section 05; your indemnification obligations under section 19; amounts owed under section 07; or liability that cannot be limited by applicable law, including, where applicable law so provides, liability for wilful misconduct or gross negligence.

Indemnification

You will defend and indemnify SichGate against third-party claims, and resulting damages and reasonable costs, arising from: (a) your breach of section 05 — directing the Service at a model, endpoint, or system you were not authorized to test; (b) your Customer Content; (c) your misrepresentation of Results, tiers, or Evidence Bundles; or (d) your violation of law in connection with the Service. We will notify you promptly of any such claim and reasonably cooperate at your expense.

Export and sanctions

You may not use the Service in violation of export control or sanctions law, and you represent that you are not located in an embargoed jurisdiction or on a restricted-party list.

Governing law and disputes

These Terms are governed by the laws of the State of Delaware, excluding conflict-of-laws rules. Disputes will be resolved in the state and federal courts located in the State of Delaware, and each party consents to that jurisdiction.

Nothing in this section deprives you of mandatory consumer protections in your country of residence, where they apply.

Changes to these Terms

We may update these Terms. For material changes we will notify account holders by email or in-app at least 14 days before the change takes effect; continued use after that date is acceptance. If you do not agree, stop using the Service and close your account before the effective date.

Miscellaneous

These Terms, the Privacy Policy, and any signed agreements between us are the entire agreement regarding the Service. If a provision is unenforceable, the rest remains in effect. Failure to enforce a provision is not a waiver. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets. Neither party is liable for delay or failure caused by events beyond its reasonable control. Notices to us go to legal at sichgate dot com; notices to you go to your account email.

Contact

Legal and notices: legal at sichgate dot com

Security: security at sichgate dot com

Privacy: privacy at sichgate dot com

Registered address: SichGate Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

Our responsible disclosure policy is published at sichgate.com/security.