Effective 20 September 2026
These terms are a contract between you and SOREG LTD (“Soreg”, “we”, “us”), a Delaware corporation. They govern the soreg.ai website, your Soreg account, and your subscription to the Soreg service. The software you install in your own environment is licensed separately, under the End User Licence Agreement.
Read section 9 and section 14 before you accept. Section 9 sets out what Soreg does not promise about your regulatory compliance. Section 14 limits what we owe you if something goes wrong. Those two sections are where the real allocation of risk sits, and we would rather you found them now than later.
You accept these terms by ticking the box that refers to them, by clicking a button marked “I agree”, “Create account”, “Subscribe” or similar, or by downloading, installing or using the Soreg software. Any one of those is enough. If you do not accept, do not do any of them.
If you accept on behalf of a company or other organisation, you are confirming that you have authority to bind it, and “you” in these terms means that organisation. If you do not have that authority, do not accept.
Soreg is a business product. You may not use it if you are under 18, and you may not use it for personal or household purposes. Consumer protection laws that apply to personal purchases do not apply here, and nothing in these terms tries to exclude any right you do have that cannot lawfully be excluded.
We keep a record of which version of these terms you accepted and when.
Soreg is a gateway that sits between an organisation's own records and the AI models its staff want to use. Questions go in as plain English. The gateway validates what the model proposes, runs only read-only queries against masked views, sends the model a payload with the regulated and confidential fields removed, re-identifies results server-side for the roles you permit, and writes the whole sequence to an audit log.
The software runs in your environment, not ours. You install it on infrastructure you control, you point it at your own databases, and you connect your own account with whichever model provider you choose. Your records do not pass through Soreg's systems. This is a deliberate architectural choice and most of the rest of this agreement follows from it.
What we provide centrally is the account, the subscription, the software itself and its updates, the compliance mappings, documentation, and support. That is the “Service” in these terms. The software you install is the “Software”, and it is governed by the EULA.
Our agreement consists of these terms, the End User Licence Agreement, the Data Processing Agreement, the Privacy Policy, and any order form or subscription confirmation you receive. Together they are the whole agreement between us about the Service.
If they conflict, the order of priority is: a signed order form first, then the Data Processing Agreement, then these terms, then the EULA, then anything else. The Privacy Policy describes practice rather than creating obligations, so it does not override the others.
You need an account to subscribe and to receive licence keys, updates and support. Give us accurate registration details and keep them current — we send contractual notices to the address on the account, and an out-of-date address is your problem, not ours.
You are responsible for everything done under your account and for keeping credentials and licence keys confidential. Tell us at security@soreg.ai promptly if you believe either has been compromised. We are not liable for loss arising before you tell us; you are not liable for our own failures.
You may not share an account across organisations, resell access, or use the Service on behalf of a third party unless we have agreed in writing.
The plan, the fee, the billing period and the subscription term are the ones shown to you at the point of purchase and confirmed in your order. Fees are stated exclusive of tax, and you are responsible for any sales, use, VAT, GST or withholding taxes, other than taxes on our income.
Unless your order says otherwise, subscriptions renew automatically for successive periods of the same length. You can stop renewal by cancelling in your account or by writing to us before the current period ends. Cancelling takes effect at the end of the period you have paid for — it does not shorten the current one.
Fees are payable in advance and are non-refundable except where these terms say otherwise or where the law requires a refund. If you pay by card, you authorise us to charge it for each renewal until you cancel. If an invoice is more than 30 days overdue we may suspend the Service and stop issuing licence keys, after giving you at least 10 days' written notice and a chance to pay.
We may change fees for a renewal period by telling you at least 30 days before the current period ends. If you do not accept the change, cancel before renewal.
Your right to install and run the Software is granted by the End User Licence Agreement, not by these terms. In outline it is a non-exclusive, non-transferable right, limited to the term of your subscription and to the deployment scope in your order, to run the Software on infrastructure you control for your own internal business purposes. The EULA sets out the restrictions, and they matter.
The licence lasts as long as your subscription does. When the subscription ends, so does the licence, and the EULA tells you what you must then do with your copies.
Because the Software runs in your environment, you are responsible for that environment: the infrastructure, the operating system, the network, the databases you connect, the credentials, the backups, and the security of all of it. We cannot see it and cannot protect it.
You are also responsible for how you configure the gateway — in particular, which fields you mark as regulated or confidential, which roles you permit to re-identify data, and what you set the gateway to do when it detects sensitive data in a prompt. The gateway enforces the policy you give it. It cannot know which of your columns are sensitive unless you tell it, and a field you did not classify is a field it was not asked to protect.
Your records stay yours. We claim no ownership of them, and in the ordinary course we never receive them. Where we do handle personal data on your behalf — which is essentially limited to account, billing and support information, and to anything you choose to send us when you ask for help — the Data Processing Agreement governs it.
A practical warning about support. The most likely way your regulated data ever reaches us is that someone on your team pastes a log, a stack trace, a configuration file or a database extract into a support request. Please do not. Redact first. Section 3 of the DPA says what we do if it happens anyway.
You may not, and may not permit anyone else to:
The audit log is a feature, not an obstacle. Deliberately disabling, altering or destroying it and then relying on Soreg as evidence of compliance is a breach of this section.
This section is the important one. Please read it properly.
Soreg is a technical control. It is not legal advice, not compliance advice, not an audit, not a certification, and not a substitute for your own judgement or your own counsel. We are not your lawyers, your auditors or your compliance function.
We do not warrant that using Soreg makes you compliant with NYDFS Part 500, HIPAA, HITECH, GLBA, the GDPR or UK GDPR, any US state privacy law, SOC 2, or any other framework. Compliance depends on your policies, your people, your other systems and your regulator's view of them, none of which we control or can see.
The compliance packages and evidence packs map Soreg's controls to the wording of a framework. They are a starting point for a conversation with your examiner. They are not a finding, an opinion, or a guarantee that your examiner will agree.
No detection method is perfect. The gateway's detection of sensitive data in prompts and attachments is a strong control, not an infallible one, and the masking it applies depends entirely on the field classifications you configure. You remain responsible for deciding what is sensitive in your own data and for verifying that your configuration does what you intend. We strongly recommend you test it against your own records before you rely on it.
You remain responsible for your regulatory obligations. Soreg helps you meet them. It does not assume them.
You choose the model and you connect your own account with the provider. Whether that is Anthropic, OpenAI, Google, or a model you run on your own hardware, your relationship with that provider is yours: their terms, their privacy policy, their pricing, their availability, their handling of what they receive.
The gateway is designed so that what leaves your environment for the model is a masked payload, and it shows you the literal request so you can check. But once that payload has left, it is in the provider's hands and under the provider's terms, and we have no control over it and no liability for it. If a provider changes its API, its terms or its model, that is between you and them. We will make reasonable efforts to keep the Software working with the providers we support, and we may add or drop support for a provider on reasonable notice.
Each of us may learn confidential information of the other. Each of us will use it only to perform this agreement, protect it with at least reasonable care, and disclose it only to people and contractors who need it and are bound to keep it confidential.
This does not apply to information that is public through no fault of the recipient, was already known to the recipient without a duty of confidence, or is independently developed. Either of us may disclose where legally compelled, giving the other prompt notice where lawful so it can object.
Your configuration — which fields you classify as regulated or confidential, your role definitions, your schema — is your confidential information. In the normal course we never see it. The Software, its documentation, and any non-public pricing are ours.
We own the Service, the Software, the documentation, the compliance mappings and the Soreg name and marks, along with every improvement to them. You get the licence described in the EULA and nothing more; rights not expressly granted are reserved.
You own your data, your configuration and your outputs.
If you send us feedback, suggestions or bug reports, we may use them freely and without obligation or payment to you. You do not give up anything you already own by doing so, and we will not name you as a customer in public without your permission.
We warrant that we have the right to license the Software to you, and that we will provide the Service with reasonable skill and care.
Otherwise, and to the fullest extent the law allows, the Service and the Software are provided “as is” and “as available”, and we disclaim all other warranties, express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or trade usage.
We do not warrant that the Service or the Software will be uninterrupted, error-free, or free of harmful components, that defects will be corrected, or that they will meet your requirements or produce any particular result. We do not warrant the accuracy or usefulness of anything a model returns.
We do not offer a service level commitment for the Service unless your order expressly includes one. The Software runs on your infrastructure and its availability is a function of that infrastructure, not of ours.
To the fullest extent permitted by law, neither of us is liable to the other for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, lost revenue, lost business, lost goodwill, regulatory fines or penalties, or the cost of substitute services — even if told such loss was possible and even if a remedy fails of its essential purpose.
Our total aggregate liability arising out of or relating to this agreement, whether in contract, tort (including negligence), strict liability or otherwise, will not exceed the total fees you actually paid us for the Service in the three (3) months immediately before the first event giving rise to the claim.
If you have paid us nothing in that period, our total aggregate liability will not exceed one hundred US dollars ($100).
These limits do not apply to: your obligation to pay fees; either party's breach of section 11 (confidentiality); our indemnity in section 15; either party's fraud, wilful misconduct or gross negligence; or any liability that cannot lawfully be limited. Some jurisdictions do not allow certain exclusions, and in those places these limits apply only as far as the law allows.
Each of us acknowledges that these limits reflect a deliberate allocation of risk, that the fees were set on the basis of them, and that neither of us would have entered into this agreement without them.
We will defend you against any third-party claim that the Software, used as permitted by this agreement, infringes that third party's patent, copyright or trade secret, and we will pay damages finally awarded or agreed in settlement. You must tell us promptly, let us control the defence, and give us reasonable cooperation.
If such a claim is made or we think one is likely, we may at our option obtain the right for you to keep using the Software, modify or replace it so it is no longer infringing, or, if neither is commercially reasonable, terminate the affected subscription and refund the unused portion of prepaid fees. This paragraph and the paragraph above are your sole remedy for infringement claims.
We are not liable for a claim arising from your modification of the Software, from combining it with anything we did not supply, from your continued use after we told you to stop, or from your configuration or data.
You will defend us against any third-party claim arising from your data, your configuration, your use of the Software in breach of section 8, or your breach of a law that applies to you, and you will pay damages finally awarded or agreed in settlement, on the same notice and cooperation terms.
This agreement starts when you first accept it and continues while you have an active subscription or account.
Either of us may terminate for material breach if the breach is not cured within 30 days of written notice describing it. You may cancel your subscription at any time, effective at the end of the paid period. We may decline to renew a subscription by telling you before the renewal date.
We may suspend the Service immediately, without the 30-day cure period, if your use poses a genuine security risk to us or others, if we are required to by law, or if fees are overdue as described in section 5. We will tell you why and restore the Service once the cause is resolved.
When this agreement ends: your licence ends and you must follow section 9 of the EULA; outstanding fees fall due; and each of us returns or destroys the other's confidential information on request. Sections 7, 9, 11, 12, 13, 14, 15, 18 and 19 survive termination, along with anything else that by its nature should.
Because the Software and your data are in your environment, termination does not cut you off from your own records. You keep your data. What you lose is the licence to keep running our Software against it.
We may change the Service, and we may change these terms. For a change that materially reduces your rights or increases your obligations, we will give you at least 30 days' notice by email to your account address or by a notice in the product, and the change takes effect at your next renewal. If you do not accept it, cancel before then; continuing to use the Service after it takes effect means you accept it.
Other changes — clarifications, new features, corrections — take effect when we post them, and we update the effective date at the top.
We will not apply a change retroactively to a dispute that has already arisen.
This agreement is governed by the laws of the State of Delaware, without regard to its conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
The state and federal courts located in Delaware have exclusive jurisdiction, and each of us consents to their jurisdiction and waives any objection based on venue or inconvenient forum. Either of us may seek injunctive relief in any court of competent jurisdiction to protect confidential information or intellectual property.
Before filing anything, please write to legal@soreg.ai describing the dispute, and give us 30 days to try to resolve it. We will do the same for you. Most things are cheaper to fix in an email than in a filing.
Notices. Contractual notices to us go to legal@soreg.ai and to the postal address in section 20. Notices to you go to the email address on your account. Notice is effective when sent, if sent on a business day.
Assignment. Neither of us may assign this agreement without the other's written consent, except that either may assign it in full to a successor in a merger, acquisition or sale of substantially all assets, on written notice.
Independent contractors. Nothing here creates a partnership, joint venture, agency or employment relationship.
Force majeure. Neither of us is liable for a delay or failure caused by something genuinely outside our reasonable control. This does not excuse paying money that is owed.
Export and sanctions. You confirm that you are not located in, and not acting for anyone located in, a country subject to a US embargo, and that you are not on any US government restricted party list. You will not export or re-export the Software in breach of US export laws.
US government users. The Software is “commercial computer software” under FAR 12.212 and DFARS 227.7202. Government users get only the rights in this agreement.
Severability and waiver. If a provision is unenforceable it is modified to the minimum extent necessary, or severed, and the rest stands. A failure to enforce something is not a waiver of it.
Third parties. This agreement is between you and us. No one else can enforce it.
Entire agreement. This agreement supersedes every prior discussion, proposal and representation about its subject matter. Nothing in a purchase order or similar document of yours adds to or changes it, even if we accept the document.