Who these terms are with
Agent Control Room is operated by Complyee AB, a company registered in Sweden with organisation number 559161-6452, at Kvarndammsringen 11, 134 39 Gustavsberg, Sweden. In these terms, "we" and "us" mean Complyee AB.
"Customer" means the organisation that orders or is given a workspace. "You" means that customer and each person it authorises to use the service. If you accept these terms for an organisation, you confirm that you have authority to bind it.
These terms apply when you use the site, request a workspace, access a workspace or call the Agent Control Room API.
Workspaces, accounts and API keys
A workspace belongs to the customer organisation. Its administrators control membership, roles, single sign-on, network restrictions, agent registration, action vocabulary, policies, context contracts, approval settings and evidence retention. We may act on an administrator's instructions without separately checking with each affected member.
Member access is personal. Keep one-time sign-in codes and sessions to yourself, and keep API keys secret. The customer is responsible for assigning appropriate roles, removing access promptly, configuring any required IP allow-lists, and protecting credentials in its own systems.
Tell us at legal@complyee.ai promptly if you believe an account, session or API key has been lost, disclosed or misused. We may revoke or rotate affected credentials to protect the workspace and service.
Acceptable use
- Do not use the service or its decisions for unlawful, fraudulent, infringing or harmful activity.
- Do not try to reach another workspace's data, bypass access controls or policy enforcement, impersonate another member or agent, or forge or reuse a signed grant.
- Do not falsify a payload hash, context fact, provenance assertion or observation time, or knowingly cause the service to evaluate a different action or payload from the one that will be executed.
- Do not circumvent API, rate-window, cooldown, approval, network or plan limits; overload the service; or probe, scan or stress-test it without our written permission.
- Do not reverse engineer or copy the service except where mandatory law permits it, or resell access without our written agreement.
Customer configuration and decision data
The customer keeps all rights to its action vocabulary, policy rules, context contracts, agent records, supplied context facts, approval instructions and other customer-provided configuration or data. The customer gives us only the rights needed to host, process, secure and return that material as part of the service.
A decision request contains the agent and action identifiers, a one-way payload hash, an optional resource reference and context facts supplied for policy evaluation. Agent Control Room does not receive, inspect or store the underlying document, message, record or other payload represented by that hash.
For workspace data we act as a processor on the customer's documented instructions. Our privacy notice and the applicable data processing agreement explain the controller and processor roles, storage, sub-processors, retention and deletion. Agent Control Room, its software and our own materials remain ours and our licensors'.
Optional Complyee Policy Library integration
Agent Control Room supports an optional pairing with the Complyee Policy Library. This is a specific integration using the request and assessment contract agreed between the two services; these terms do not promise compatibility with another policy-library endpoint.
A workspace administrator chooses whether to pair the Complyee Policy Library and which actions are advisory or gated. For a consultation, Agent Control Room may send the Policy Library the action key, a plain-language action description, the agent key, a decision correlation identifier and supplied context facts. It does not send the payload hash or underlying payload. The customer is responsible for minimising that data, having authority to disclose it and maintaining its own agreement and credentials with Complyee AB.
A Complyee Policy Library assessment never grants authority. Advisory readings do not alter an Agent Control Room decision. A restrictive gate can only preserve or tighten a local allow according to the workspace's fail-closed setting; it cannot override a refusal or a requirement for human approval. The customer remains responsible for reviewing the recorded assessment, citations and resulting decision in light of its own policies and obligations.
If the customer disables the pairing, supplies invalid credentials, or the Complyee service is unavailable, advisory actions retain Agent Control Room's original outcome while gated actions follow the configured hold-or-refuse fallback. Availability, support, retention and other obligations for the Complyee service are governed by the customer's separate arrangement with Complyee AB.
Decisions and grants: scope and limits
Agent Control Room evaluates a request deterministically against the customer's published configuration and may allow it, refuse it, or ask a person first. Missing, malformed, stale or untrusted required context can instead produce Not decided before a rule runs. A recorded decision reflects the configuration and supplied facts at the time of evaluation; it is not legal, regulatory or professional advice.
The customer designs and operates its agents, writes and approves its policies and context contracts, selects approvers, and remains responsible for the truth and lawful collection of facts sent to the service. Provenance checks test supplied metadata against the customer's contract; they do not independently inspect the customer's source systems.
Agent Control Room does not execute the proposed action. The customer must place an effective enforcement point in the execution path, verify each signed grant and its expiry and payload binding, refuse execution without a valid grant, and prevent reuse. The customer remains responsible for human approval choices and for the consequences of actions taken in its systems.
Developer and evaluation workspaces
Developer workspaces and evaluation environments are for integration, testing and validation before production. They are subject to the agents, decisions, history and other limits shown for the relevant plan or agreed pilot scope.
A free Developer workspace carries no production service commitment and must not be used to control live or safety-critical activity. We may change, limit or withdraw free evaluation access on reasonable notice, or immediately where needed for security or abuse prevention.
API access and limits
API keys are issued to the customer workspace, carry operation scopes and may carry network restrictions. The customer is responsible for every request authenticated with its keys and for using idempotency, timeouts, retries, approval polling and grant verification as described in the API documentation.
API use is subject to technical and plan limits. Customer-authored policy obligations may also impose atomic per-agent, per-action rate windows and cooldowns. These policy controls are part of the customer's configuration and are not a substitute for the service's abuse protection or plan capacity.
We may throttle requests or suspend or rotate a key immediately if it is leaked, abused or threatens the service or another customer. We may evolve API operations, but will use reasonable efforts to document material changes and avoid breaking supported production integrations without notice.
Plans, fees and payment
The current standard plans, included workspaces, active agents, monthly governed-decision capacity, evidence history and support level are described on our pricing page. A pilot, order form or customer agreement may set a different scope. Unless stated otherwise, prices exclude VAT and other applicable taxes.
Paid production plans are normally contracted annually. Pilots, Enterprise arrangements and other assisted purchases may be invoiced directly under the relevant order form. Where checkout is offered, Paddle acts as merchant of record, runs the checkout, takes payment and handles invoicing and applicable sales tax or VAT; its checkout terms also apply. Card details entered with Paddle never reach us.
A paid term renews only as stated in the order form or checkout presented to the customer. Fees already paid are not refundable except where the agreement or law requires it. If an undisputed amount remains unpaid after notice and a reasonable opportunity to remedy it, we may suspend the affected workspace.
Use above included capacity is handled as described on the pricing page or in the customer agreement. We do not impose a different fee or production limit without the notice or agreement stated there.
Service commitments, maintenance and customer-owned storage
We use reasonable efforts to keep the service available, keep interruptions short and plan maintenance. Standard plans do not include a contractual uptime guarantee; service levels and support commitments apply only where they are written into a signed customer agreement. Our security page describes the current resilience, recovery and assurance position.
We may improve, replace or retire features. During a paid term we will not materially reduce the core functionality of the purchased plan without reasonable advance notice, unless a change is needed sooner for security, law or third-party platform continuity.
Where a customer chooses an evidence bucket in its own Google Cloud project, the customer is responsible for that cloud account, charges, region, lifecycle and retention settings, access controls, availability and timely renewal of the scoped credential supplied to us. We are not responsible for loss of access or failure to write, export or delete evidence caused by the customer's cloud configuration or revoked credential, but we will report such a failure rather than claim the operation succeeded.
Confidentiality
Each of us protects the other's non-public information, uses it only to perform under these terms, and shares it only with people who need it and are bound to keep it confidential.
The customer's policy rules, context contracts, context facts, agent registry, decisions, approvals and audit events are the customer's confidential information. Confidentiality does not apply to information that is public without breach, was already lawfully known, is independently developed without using the other side's information, is received lawfully from another source, or must be disclosed by law.
Suspension, termination and deletion
These terms apply for as long as you use the service. A paid plan runs for the term in its order form or checkout. Either side may end it as stated there, or for a material breach that is not remedied within a reasonable written cure period. Either side may end immediately where the breach cannot be remedied or continued performance would be unlawful.
We may suspend access immediately for a serious security risk, unlawful or abusive use, compromise of a credential, an attempt to cross a workspace boundary, or an undisputed overdue payment after notice. Where practical, we will limit suspension to the affected key, member, agent or workspace and restore access when the cause is resolved.
Before closure, an administrator should download the system records and evidence the customer needs using the exports available in the service or an agreed return process. On deletion we remove the workspace's rule sets, context contracts, action vocabulary, agent registry, approvals, decision index, evidence bucket and audit trail, workspace-only sign-in accounts and other workspace records as described in our privacy notice and data processing agreement. We complete a valid deletion request within 30 days and retain a limited deletion receipt so completion remains provable.
If evidence is stored in the customer's own cloud project and our credential has been revoked, the customer is responsible for deleting the remaining objects there. Legal retention duties, residual backup cycles and the treatment of historical audit identifiers are described in our privacy notice.
Warranties and liability
The service is provided as is. Beyond what these terms state, and to the extent the law allows, we exclude all other warranties, including implied warranties of merchantability, fitness for a particular purpose and non-infringement.
We do not warrant that a customer-authored policy is legally sufficient, that supplied context facts are true, or that the customer's agent or enforcement point will obey a decision. The customer must test its integration and maintain appropriate human, technical and operational safeguards for the actions it governs.
To the extent the law allows, neither side is liable for indirect or consequential loss, loss of profit, loss of business or loss of data. Our aggregate liability arising out of or relating to the service is limited to the fees the customer paid us for the service in the twelve months before the event giving rise to the claim; for a free workspace, the cap is zero.
Nothing here limits liability that cannot be limited by law, including liability for wilful misconduct or gross negligence, or a consumer's mandatory rights.
Indemnity
The customer will defend and indemnify us against a third-party claim arising from the customer's agent code or execution, customer-authored policy or context contract, data or facts supplied to the service, infringement caused by customer material, or use in breach of these terms. This does not apply to the extent the claim was caused by our breach, gross negligence or wilful misconduct.
We will notify the customer promptly, provide reasonable cooperation at the customer's cost, and allow the customer to control the defence. The customer may not settle a claim in a way that admits fault by us, imposes an obligation on us or fails to release us without our written agreement.
Changes to these terms
This page carries the date it was last updated and is the authoritative version. When a change materially affects your rights or obligations, we tell workspace administrators before it takes effect. Continuing to use the service after that means you accept the updated terms.
Governing law and disputes
These terms are governed by Swedish law, without regard to its conflict of law rules.
Disputes arising out of or in connection with these terms are finally settled by arbitration administered by the Arbitration Institute of the Stockholm Chamber of Commerce (SCC). The seat of arbitration is Stockholm, Sweden, and the language of the proceedings is English. Arbitration proceedings are confidential.
If you use the service as a consumer, this does not affect your mandatory rights, including the right to bring a claim in the courts of the country where you live.
Contact
Legal notices and questions about these terms: legal@complyee.ai. Privacy questions, data subject requests and data processing agreements: privacy@complyee.ai. Vulnerability reports and security questionnaires: security@complyee.ai.
Complyee AB, organisation number 559161-6452, Kvarndammsringen 11, 134 39 Gustavsberg, Sweden.