Cedreon Terms of Service

1. Parties, and the documents that make up this agreement

Cedreon is operated by SFF S26 AG, Schuetzengasse 7, 9000 St. Gallen, Switzerland ("Cedreon", "we", "us"). These terms form the agreement between Cedreon and the person or organisation that opens an account ("you", "Customer").

Where an account belongs to an organisation, the person who accepts these terms confirms they are authorised to accept them on that organisation's behalf, and the organisation is the Customer.

Cedreon is available to businesses, to individual professionals and to private individuals. Where you are a consumer acting outside your trade or profession, mandatory consumer protections of your place of residence apply in your favour and nothing in these terms limits them.

The documents. This agreement consists of these terms, the Data Processing Agreement ("DPA") published at /dpa, the sub-processor list at /subprocessors, the security description at /security, and the plan and pricing details shown when you subscribe. Where they conflict, the following order decides, most specific first:

1. any agreement signed by both parties from your account page, including a professional-secrecy agreement;
2. the DPA, for anything concerning the processing of personal data;
3. the plan and pricing details shown at subscription;
4. these terms.

Your own general terms and conditions do not apply. They become part of this agreement only where we have accepted them expressly and in writing.

2. Definitions

"Authorised User" means an individual you permit to use the service under your account: your personnel, and contractors working under your direction who do not compete with Cedreon.

"Compliance Profile" means a named, technically enforced restriction on which model providers, processing routes and external tools may be used, activated by a signed agreement as described in clause 10.

"Customer Content" means everything you submit to the service and everything the service returns to you in response, including messages, uploaded documents and generated output.

"Documentation" means the descriptions of the service published on cedreon.com, including /security and /subprocessors, as updated from time to time.

"Model Provider" means a third party that operates an AI language model reachable through the service.

"Screening" means the process described in clause 3: detection of recognisable sensitive values in Customer Content and their replacement with reversible placeholders before a request is forwarded.

"Seat" means one licensed Authorised User position on a paid plan.

"Service" means the Cedreon platform, its interfaces and any professional services we agree to provide.

3. What Cedreon provides

Cedreon is a screened interface to third-party AI language models. In ordinary use, a message you send is screened for recognisable sensitive values, those values are replaced with placeholders, the screened text is forwarded to a Model Provider, the reply is screened again, and the original values are restored in the reply for you alone. Each exchange is recorded in an append-only, hash-chained record.

We describe the mechanism this way because it is the substance of what you are buying. It is layered, best-effort detection, not a guarantee that every sensitive value in every input will be recognised. Clause 10 exists because screening alone is not a sufficient answer where professional secrecy applies.

Model availability. The models reachable through the service, and their capabilities, are set by their providers and change. We may add, remove or replace a model. Where a removal materially reduces what your plan can do, we will tell you, and you may terminate the affected part of the service for the remainder of the paid period.

Output. Model output is generated automatically. It can be wrong, out of date or misleading. It is not legal, medical, tax or financial advice. You remain responsible for what you do with it, and where you act on it in a regulated capacity the professional judgment is yours.

4. Your account and your Authorised Users

You need a verified email address to use the service. You are responsible for the security of your credentials and for activity under your account, and you will tell us without undue delay if you learn of any unauthorised use.

An account belongs to one person. Accounts may not be shared, and a Seat may not be used by more than one individual at a time. You may reassign a Seat when someone leaves.

You are responsible for your Authorised Users' compliance with this agreement, and you will inform them of the obligations that apply to them before they begin using the service.

We may suspend an account that is being used to break this agreement, to attack the service, or in a way that puts other customers at risk. Where circumstances allow, we will tell you first; where they do not, we will tell you as soon as we can.

5. Acceptable use

You will not use the service:

• to break the law, or to infringe anyone's rights;
• to generate material that sexually exploits children, or that is unlawfully hateful, defamatory or discriminatory;
• to send unsolicited bulk messages;
• to build or train a competing model from its output;
• to circumvent the screening layer, the guardrail layer or the Compliance Profile controls in clause 10;
• to submit content you have no right to submit;
• to probe, load-test, reverse engineer, decompile or disassemble the service, except to the extent that restriction is unenforceable under mandatory law;
• to exceed the usage limits of your plan, or to resell access to third parties who are not your Authorised Users.

We may remove content or suspend access where we reasonably believe this clause has been broken, or where a competent authority requires it.

6. Your content and your rights in it

You keep every right you already have in Customer Content. You grant us only the licence we need to run the service for you: to process, transmit, store and display Customer Content for the purpose of providing the service to you, and to meet our legal obligations. That licence ends when the content is deleted.

We do not use Customer Content to train models, and no gateway or Model Provider may train on it or use it for its own purposes. That obligation is contractual: it sits in our agreement with the gateway named at /subprocessors, through which every model request is made, and in the gateway's own agreements with the Model Providers it routes to. It is not a statement about how long a Model Provider keeps a request in its own operational logs, which is a different question, answered per model row at /security.

You are responsible for having the right to submit what you submit, and for the lawfulness of doing so.

Feedback. If you choose to send us suggestions about the service, we may use them without restriction and without owing you anything. This applies to suggestions only, never to Customer Content.

Publicity. We will not use your name or logo publicly without your prior written consent.

7. Data protection

Personal data you submit as part of Customer Content is processed by us as your processor, on your instructions, under the DPA at /dpa. The DPA is incorporated into these terms and forms part of them. Accepting these terms makes it applicable; no separate signature is required for it to be in force.

An organisation whose procurement or legal function requires an individually executed copy may sign one from its account page. That signature produces an execution record; it does not change the substance of what already applies.

How we process personal data as a controller, for account data, billing data and website data, is described in the Privacy Policy at /privacy. The Privacy Policy is an information notice. It is not a consent, and we do not treat your acceptance of these terms as consent to anything it describes.

8. Fees, billing and price changes

Paid plans are billed in advance through our payment processor at the price shown when you subscribe. Seat bundles are billed per Seat. All amounts are exclusive of value added tax and any other applicable duties, which are added where they apply.

Unless required by law, fees already paid are not refundable. You may cancel at any time and the plan runs to the end of the paid period.

Free allowances are a courtesy, are not guaranteed, and may change.

Changing the price. We may change the price of a plan with at least 60 days' notice by email, taking effect at the start of your next billing period. If you do not agree, you may terminate the affected plan with effect from the date the new price would take effect, by telling us before then. We will say so in the notice. We will not change the price of a period you have already paid for.

Late payment. If payment fails we will tell you and retry. If an invoice remains unpaid 15 days after it fell due, we may suspend access until it is paid. Statutory default interest applies.

Set-off. You may set off only claims that are undisputed or have been finally determined by a court.

9. Availability and support

We aim to keep the service available and will give reasonable notice of planned maintenance where we can. Maintenance needed to preserve the security or integrity of the service may be carried out without notice.

Service level. No availability figure is committed on the plans currently offered, and we do not pretend otherwise. Availability commitments and service credits are available only where they are stated expressly in a separate written agreement. We depend on third-party Model Providers whose availability is outside our control, and an interruption caused by a Model Provider is not a failure of the service.

Support is provided by email at [email protected] during Swiss business days. We aim to acknowledge within one business day.

10. Compliance Profiles

You may sign additional agreements from your account page that place your account, or your whole organisation, into a Compliance Profile: a named, technically enforced restriction on which Model Providers, processing routes and external tools may be used.

Three things follow, and you should read all three before signing one:

• A profile takes effect only when the agreement is fully executed, signed by you and countersigned by Cedreon. Where an organisation signs, it applies to every member of that organisation.
• A profile narrows what is available. Where several apply, only routes approved under all of them may be used. If no approved route exists for a request, the request is refused rather than served by an unapproved one.
• We may add or remove a route from a profile's approved set when the underlying contractual or technical position changes. Where a removal materially narrows what you can use, we will tell you.

Signing is done electronically. Clause 16 describes what that signature is and what it is not.

11. Intellectual property

The service, and everything in it other than Customer Content, belongs to Cedreon or its licensors. You receive a non-exclusive, non-transferable, non-sublicensable right to use the service during the term, for your own internal purposes and in accordance with the Documentation. All rights not expressly granted are reserved.

If a third party claims that your use of the service infringes its rights, tell us promptly and do not settle without our agreement. We will defend the claim, and you will give us reasonable assistance.

12. Confidentiality

Each party will keep the other's confidential information confidential, use it only to perform this agreement, and protect it with at least reasonable care. Confidential information may be shared with employees and contractors who need it and are bound to equivalent confidentiality.

This does not apply to information that is or becomes public without breach, was already lawfully known to the recipient, is received lawfully from a third party, or is developed independently. Disclosure required by law is permitted, and where lawful the disclosing party will be told first.

These obligations continue for five years after this agreement ends. Obligations under a professional-secrecy agreement signed under clause 10, and any statutory secrecy duty, continue for as long as that instrument or that duty provides, without limit of time where it says so.

13. Warranties and disclaimer

We warrant that the service will perform materially as described in the Documentation, and that we will provide it with reasonable skill and care.

To the extent the law allows, and beyond that warranty, the service is provided as it is, and we exclude implied warranties of merchantability, fitness for a particular purpose and non-infringement. We do not warrant that the service will be uninterrupted or error free, nor that screening will detect every sensitive value.

If the service does not perform as warranted, tell us with enough detail to reproduce the problem. We will use reasonable efforts to correct it. If we cannot within a reasonable period, you may terminate the affected part of the service and receive a pro-rata refund of fees paid for the unused remainder of the paid period. That is your exclusive remedy for breach of this warranty.

14. Liability

Neither party limits liability for death or personal injury caused by negligence, for intentional wrongdoing or gross negligence, for breach of confidentiality under clause 12, or for anything else the law does not permit to be limited.

Subject to that, and to the extent the law allows:

• neither party is liable for indirect or consequential loss, loss of profit, loss of goodwill, or loss of data beyond the cost of restoring it from the claiming party's own backups;
• each party's total liability arising in any twelve-month period is limited to the greater of the fees you paid us in that period and CHF 5,000.

Claims under this agreement must be brought within one year of the date the claiming party became aware, or ought reasonably to have become aware, of the circumstances giving rise to them.

15. Term, termination and what happens after

This agreement begins when you create an account and continues until terminated.

A paid plan runs for the period you purchased and renews automatically for successive periods of the same length unless cancelled before the end of the current period. You may cancel at any time from your account page, effective at the end of the paid period.

Either party may terminate for material breach that is not cured within 30 days of written notice, or immediately if the other becomes insolvent or enters an insolvency procedure.

On termination: your right to use the service ends; we delete Customer Content in line with the DPA and the Privacy Policy; and fees for the period already begun remain payable. The append-only record survives. It does not store the plaintext of your prompts or of model responses; it retains integrity and operational metadata, described in clause 11 of the DPA, and deleting Customer Content destroys the encrypted mapping and the stored payload its references point at. Clauses 6, 11, 12, 13, 14 and 17 survive termination.

16. Electronic signature

Agreements offered under clause 10 are signed electronically through Cedreon's own workflow. That produces an ordinary electronic signature. It is not a qualified electronic signature within the meaning of the Swiss ZertES or the EU eIDAS Regulation, and it is not offered as one. Both parties agree that an agreement executed this way is valid and binding between them, and that neither will dispute its validity on the ground that it was concluded electronically.

Each execution produces a record naming the parties, the exact document version, its SHA-256 hash, the time of each signature and the address the signature was submitted from. What that record contains is described at /esign-disclosure.

17. General

Changes to these terms. We may publish a new version of these terms. A material change is published as a new version with a new effective date, and you will be asked to accept it before continuing to use the service. Each acceptance records the exact version and its cryptographic hash, so what you accepted stays reproducible. Continued use without acceptance is not treated as agreement.

Sub-processors and subcontracting. We may have parts of the service performed by third parties. We remain responsible for their performance. Sub-processors handling personal data are governed by the DPA and listed at /subprocessors.

Assignment. Neither party may assign this agreement without the other's written consent, except that either may assign it in full to a successor of its business, on notice.

Notices. Notices to us go to [email protected]. Notices to you go to the email address on your account; it is your responsibility to keep it current.

Force majeure. Neither party is liable for a failure caused by something outside its reasonable control, for as long as that continues.

Entire agreement. The documents listed in clause 1 are the whole agreement between the parties on their subject matter and replace any earlier understanding. Neither party relies on any statement not set out in them, except for fraudulent misrepresentation.

Severability. If a provision is or becomes invalid or unenforceable, the rest stands, and the invalid provision is replaced by a valid one that comes as close as the law allows to what the parties intended.

No waiver. A failure to enforce a right is not a waiver of it.

18. Law and forum

Swiss law applies, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.

The courts of St. Gallen, Switzerland have exclusive jurisdiction, subject to any mandatory forum available to a consumer.

19. Contact

SFF S26 AG, Schuetzengasse 7, 9000 St. Gallen, Switzerland. [email protected]

Version 1.2, in force from 2026-08-17