Last updated: 25 August 2026 · Version 1.0
These Terms of Service ("Terms") govern access to and use of the SAMMY platform and related services (the "Service"). Your contract is with:
(in each case, "SAMMY Labs", "we", "us"). If you have signed an Order Form with us, the entity named in it is your contracting party and the Order Form prevails over these Terms to the extent of any conflict. "Customer" or "you" means the business entity accepting these Terms; the individual accepting confirms they have authority to bind that entity.
By creating an account, signing an Order Form referencing these Terms, or using the Service, you agree to these Terms.
SAMMY compiles regulatory rules and your operating procedures into deterministic engines that audit records, generate reports, and support your compliance workflows, as further described in the applicable Order Form, the documentation, and the service description published at sammylabs.com/service-description. In case of any conflict, the Order Form and these Terms prevail over the service description and documentation. We may improve or modify features of the Service, provided we do not materially reduce its core functionality during a paid subscription term.
The Service is for business use by users aged 18 or over. You are responsible for the accuracy of your account information, for maintaining the confidentiality of credentials, and for all activity under your accounts. Notify us immediately at security@sammylabs.com of any suspected unauthorised access.
"Customer Data" means data submitted to the Service by or on behalf of you, and outputs generated from it for you. As between the parties, you own Customer Data. You grant us a non-exclusive licence to host, process, and transmit Customer Data solely to provide and support the Service, as permitted by these Terms and our Data Processing Agreement (the "DPA", available at sammylabs.com/dpa), which is incorporated into these Terms where we process personal data on your behalf. You are responsible for having the rights and lawful bases needed to submit Customer Data to us. We will not use Customer Data to train machine-learning models available to other customers.
We maintain an information security management system covering the Service, and we commit to the following:
(a) Certification. We maintain an information security management system aligned with ISO/IEC 27001 and are undergoing certification with an independent, accredited certification body. Certificates and summaries of audit reports are made available on request as they are issued.
(b) Encryption. Customer Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent.
(c) Access control. Access to Customer Data is restricted to personnel who need it to provide the Service, protected by single sign-on and multi-factor authentication, and logged.
(d) Subprocessors. We list the third parties that process Customer Data at sammylabs.com/subprocessors and will provide notice of changes as described in the DPA.
(e) Incident notification. We will notify affected customers without undue delay after becoming aware of a personal data breach affecting Customer Data, as set out in the DPA.
(f) Vulnerability reporting. Security concerns and vulnerabilities can be reported to security@sammylabs.com; we investigate all good-faith reports.
Material changes to these commitments will be communicated as described in Section 14 and reflected on our security page.
You will not, and will not permit anyone to: use the Service unlawfully or to infringe anyone's rights; attempt to probe, breach, or circumvent its security; reverse engineer or copy the Service except as law allows; resell or provide the Service to third parties except to your own affiliates and advisers using it for your benefit; submit malicious code; or use the Service to build a competing product.
The Service produces analysis, reports, and other outputs by applying encoded rules to your data. Outputs are information, not legal, tax, accounting, or other professional advice, and no solicitor-client or attorney-client relationship is created. You are responsible for reviewing outputs, with qualified professional advisers where appropriate, before relying on them or filing them with any regulator, and for your own compliance with the laws applicable to your business. We do not guarantee that use of the Service will ensure compliance with any law or regulation.
We and our licensors own the Service, including all software, models, rule engines, and documentation, and all improvements to them. No rights are granted except those expressly stated. You may use outputs generated from your Customer Data for your internal business purposes. If you give us feedback, we may use it without restriction or obligation.
Fees, billing frequency, and payment terms are set out in the applicable Order Form or on-screen at purchase. Fees are exclusive of taxes, which you are responsible for (other than taxes on our income). We may charge interest on late undisputed amounts at the lower of 4% per annum above the Bank of England base rate or the maximum lawful rate, and may suspend the Service for material non-payment after 14 days' written notice.
Each party will protect the other's confidential information with at least reasonable care, use it only to perform under these Terms, and not disclose it except to personnel and advisers under confidentiality obligations, or where disclosure is required by law (with notice to the other party where lawful). This obligation survives termination for 5 years; trade secrets are protected for as long as they remain trade secrets.
We warrant that we will provide the Service with reasonable skill and care and materially in accordance with its documentation. Except as expressly stated in these Terms, the Service is provided "as is", and we disclaim all other warranties, express or implied, including fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation, to the maximum extent permitted by law.
Nothing in these Terms excludes or limits liability that cannot lawfully be excluded, including (for contracts with Sammy Labs Ltd) liability for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation.
Subject to that: (a) neither party is liable for indirect or consequential loss, loss of profits, revenue, goodwill, or anticipated savings; and (b) each party's total aggregate liability arising out of or relating to these Terms in any 12-month period is capped at the fees paid or payable by you for the Service in that period. The cap does not apply to your payment obligations, your breach of Section 6, or either party's breach of Section 10.
You will defend and indemnify us against third-party claims arising from Customer Data or your use of the Service in breach of these Terms. We will defend and indemnify you against third-party claims that the Service, as provided by us and used as permitted, infringes their intellectual property rights; if such a claim arises we may modify or replace the Service or, if neither is reasonably possible, terminate and refund prepaid unused fees. Each indemnity is conditional on prompt notice, control of the defence by the indemnifying party, and reasonable cooperation.
We may update these Terms. For material changes we will give at least 30 days' notice by email to your account contact and/or in-product notice, and the change takes effect at the end of that period; continued use after that constitutes acceptance. If a material change adversely affects you, you may terminate before it takes effect and receive a pro-rata refund of prepaid unused fees. The current version and its effective date are always published at sammylabs.com/terms.
These Terms apply while you use the Service or have an active subscription. Either party may terminate for material breach uncured within 30 days of written notice, or immediately on the other's insolvency. On termination: your access ends; you may export Customer Data for 30 days; and we then delete Customer Data in accordance with the DPA, except where law requires retention.
Contracts with Sammy Labs Ltd are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except that either party may seek injunctive relief in any court of competent jurisdiction.
Contracts with Sammy Labs, Inc. are governed by the laws of the State of Delaware, excluding its conflict-of-laws rules, and the state and federal courts located in Delaware have exclusive jurisdiction. To the maximum extent permitted by law, each party irrevocably waives any right to trial by jury in any proceeding arising out of or relating to these Terms.
You agree that breach of Section 6 (Acceptable use) or Section 10 (Confidentiality) may cause irreparable harm for which damages are inadequate, and the affected party may seek injunctive and other equitable relief in addition to other remedies.
Neither party may assign these Terms without the other's consent, except to an affiliate or in connection with a merger or sale of substantially all assets, on notice. These Terms, the DPA, and any Order Form are the entire agreement and supersede prior discussions. If a provision is unenforceable, the remainder stands. Neither party is liable for delay caused by events beyond its reasonable control. Notices to us: privacy@sammylabs.com; notices to you: your account email.