Terms of Service
Last updated: May 2026
These Terms of Service ("Terms") govern your use of RiskQuilt on the Form, Focus, and Flex subscription tiers. By creating an account or using the platform, you agree to these Terms.
If you are subscribing on the Flow tier, a separate Master Subscription Agreement applies. Contact hello@riskquilt.com for details.
1. Definitions
1.1 "RiskQuilt" — the cloud-hosted risk management platform operated by Risk Quilt Ltd (company number 17049484) ("we", "us", "our").
1.2 "Customer" — the organisation or individual who creates an account and subscribes to RiskQuilt ("you", "your").
1.3 "Customer Data" — all data submitted to RiskQuilt by or on behalf of Customer.
1.4 "Subscription Tier" — the tier selected at signup or subsequently changed: Form, Focus, or Flex, each with published capabilities and pricing.
1.5 "Subscription Term" — the billing period applicable to your subscription (monthly or annual).
1.6 "Documentation" — user guidance and supporting materials made available for RiskQuilt.
1.7 "GenAI API" — the optional API providing structured read and write access to Customer Data for use with Customer's own AI tools.
1.8 "Anonymised Usage Statistics" — aggregated, statistical information derived from Customer Data that: (a) does not include any personal data; (b) does not include any free-text, narrative, or descriptive content entered by users; (c) cannot reasonably be used, alone or in combination with other data, to identify Customer, any individual, or Customer's confidential information; and (d) is derived solely from quantitative counts, classifications, and structural metadata.
2. Account and Access
2.1 By creating an account, you accept these Terms on behalf of your organisation. You represent that you have authority to bind your organisation.
2.2 We grant you a non-exclusive, non-transferable right to access and use RiskQuilt during your Subscription Term, subject to these Terms and payment of applicable fees.
2.3 Use is limited to your internal business purposes. No ownership rights in RiskQuilt are transferred.
2.4 All tiers include unlimited users. You are responsible for managing user access within your tenant.
3. Free Trial
3.1 New accounts receive a one-month free trial at the selected tier with full platform access.
3.2 During the trial, magic link authentication is available. No identity provider configuration is required.
3.3 At the end of the trial, you may convert to a paid subscription. All data and configuration created during the trial is preserved on conversion.
3.4 If you do not convert, your account will be suspended. You may export your data for 30 days following suspension. After 30 days, Customer Data will be deleted in accordance with section 15.
3.5 We reserve the right to modify or discontinue the free trial offer at any time.
4. Use Restrictions
4.1 You must not:
- reverse engineer or attempt to derive source code
- circumvent structural or technical limits of your Subscription Tier
- provide access to unauthorised third parties
- use RiskQuilt to provide services to third parties
- interfere with service integrity or security
4.2 Tier capabilities are enforced structurally, not on a trust basis.
5. Customer Responsibilities
5.1 You are responsible for:
- maintaining confidentiality of user credentials
- ensuring authorised use only
- accuracy and appropriateness of Customer Data
- decisions made using information recorded in RiskQuilt
5.2 RiskQuilt supports decision-making. It does not replace judgement or accountability.
6. Fees and Billing
6.1 Fees are as published on our pricing page at the time of signup or renewal.
6.2 Fees are exclusive of VAT and similar taxes, which will be added where applicable.
6.3 Free trials require no payment details. On conversion to a paid subscription, self-serve subscriptions are billed by card, or by invoice where agreed with us. Monthly subscriptions are billed monthly in advance. Annual subscriptions are billed annually in advance.
6.4 If payment fails, we will notify you and may suspend access after a reasonable grace period.
6.5 We may change published pricing. Price changes take effect at your next renewal, not during a current billing period.
7. Tier Changes
7.1 You may upgrade your Subscription Tier at any time. Upgrades take effect immediately with a pro-rata adjustment to your billing.
7.2 You may downgrade your Subscription Tier. Downgrades take effect at the start of your next billing period.
7.3 On downgrade, features or structural limits that exceed the lower tier's capabilities may become unavailable. Existing data is preserved but may be read-only where it exceeds the new tier's limits.
8. GenAI API
8.1 The GenAI API is an optional paid add-on available on some tiers.
8.2 The GenAI API provides structured read and write access to your Customer Data for use with your own AI tools. RiskQuilt does not process your data through any AI model.
8.3 You are solely responsible for your choice of AI provider, the prompts you submit, the outputs you receive, and any decisions made on the basis of AI-generated content.
8.4 Free GenAI API access during the first month applies once per tenant. After the first month, continued access requires an active GenAI API add-on subscription.
8.5 GenAI API add-on fees are as published on the pricing page. The add-on may be added or removed at any time; changes take effect at the next billing period.
9. Renewal and Cancellation
9.1 Subscriptions renew automatically at the end of each billing period (monthly or annual) unless cancelled.
9.2 You may cancel at any time by contacting us at hello@riskquilt.com. Cancellation takes effect at the end of the current billing period. No refunds are provided for partial periods.
9.3 On cancellation, you may export your data for 30 days following the end of your billing period. After 30 days, section 15 applies.
10. Data Protection
10.1 Each party will comply with applicable data protection laws, including the UK GDPR and EU GDPR where applicable.
10.2 For the purposes of applicable data protection legislation: (a) you act as data controller; (b) we act as data processor only.
10.3 We process Customer Data solely: (a) on your documented instructions; (b) to provide and support RiskQuilt; and (c) to comply with applicable law.
10.4 We do not determine the purposes or means of processing Customer Data.
10.5 Personal data and Customer Data are handled in accordance with our Platform Privacy Notice at https://www.riskquilt.com/legal/platform-privacy/, which is incorporated into these Terms by reference and forms part of the agreement between the parties. The Platform Privacy Notice describes data residency, sub-processors, your data subject rights, and our incident notification approach. In the event of conflict between these Terms and the Platform Privacy Notice, these Terms prevail in respect of contractual obligations between the parties; the Platform Privacy Notice prevails in respect of statutory data protection rights.
10.6 We will assist you in responding to data subject access requests where your obligations relate to Customer Data held in RiskQuilt.
10.7 We will notify you without undue delay of any personal data breach affecting Customer Data.
Anonymised Usage Statistics
10.8 You grant us a limited, non-exclusive, irrevocable right to use Anonymised Usage Statistics for: (a) improving, benchmarking, and operating RiskQuilt; (b) developing and refining optional advisory and decision-support features; and (c) producing aggregated industry-level insights and operational metrics.
10.9 We shall not use Customer Data for these purposes other than in anonymised and aggregated form as defined in section 1.8.
Explicit Exclusions
10.10 We shall not:
- use any free-text, narrative, descriptive, or unstructured data submitted by or on behalf of Customer for the purpose of training, tuning, prompting, or validating any machine learning or generative model — this restriction applies regardless of how such data is labelled, stored, or presented within RiskQuilt
- extract or infer meaning from narrative descriptions entered by users
- use Customer-specific data to generate outputs for other customers
- expose Customer-specific statistics or benchmarks outside your tenant
10.11 Upon reasonable request, we will provide a high-level description of the categories of Anonymised Usage Statistics used and the safeguards applied to prevent re-identification.
11. Security
11.1 We apply appropriate technical and organisational measures to protect Customer Data. The specific measures, including encryption, access control, tenant isolation, and incident response procedures, are described in our Platform Privacy Notice.
11.2 Authentication is externalised via OpenID Connect or via single-use magic links sent to verified email addresses. We do not store user passwords.
11.3 No guarantee of uninterrupted service or absence of security incidents is made. Our obligations are to apply reasonable and appropriate measures and to respond promptly to incidents.
12. Support and Availability
12.1 RiskQuilt is provided as a cloud service.
12.2 Support scope, availability targets, and maintenance windows are described in our Documentation.
12.3 No service level credits apply unless separately agreed in writing.
13. Intellectual Property
13.1 We retain all rights, title, and interest in: (a) RiskQuilt; (b) underlying software and systems; (c) Documentation; and (d) improvements and modifications.
13.2 You retain all rights in Customer Data.
13.3 Anonymised Usage Statistics do not constitute Customer Data once anonymised in accordance with these Terms. We retain all intellectual property rights in any insights, models, metrics, or outputs generated from Anonymised Usage Statistics, provided that such materials do not identify you or disclose your confidential information.
14. Confidentiality
14.1 Each party may receive confidential information from the other.
14.2 Confidential information must: (a) be used only for purposes of these Terms; (b) be protected using reasonable care; and (c) not be disclosed except as permitted.
14.3 These obligations survive termination.
15. Termination and Off-boarding
15.1 Either party may terminate these Terms: (a) for material breach not cured within 30 days of written notice; or (b) immediately on insolvency of the other party.
15.2 On termination, expiry, or cancellation: (a) your access to RiskQuilt will cease at the end of the current billing period; and (b) you may export Customer Data for 30 days.
15.3 Data export is provided using standard, machine-readable formats via self-service functionality.
15.4 We are not obliged to provide data transformation, migration, or professional services as part of off-boarding.
15.5 Following the 30-day off-boarding period, we will delete or anonymise Customer Data in accordance with our standard retention and deletion processes, except where retention is required by law.
16. Suspension
16.1 We may suspend access where reasonably necessary to: (a) protect security or data integrity; (b) comply with law; or (c) prevent material harm.
16.2 Suspension will be proportionate and time-limited where reasonably practicable.
17. Warranties and Disclaimers
17.1 We warrant that we will provide RiskQuilt using reasonable care and skill.
17.2 Except as expressly stated: (a) RiskQuilt is provided "as is"; and (b) all implied warranties are excluded to the extent permitted by law.
17.3 RiskQuilt does not provide legal, regulatory, or professional advice.
18. Limitation of Liability
18.1 Nothing in these Terms limits liability for: (a) death or personal injury caused by negligence; or (b) fraud or fraudulent misrepresentation.
18.2 Subject to section 18.1: (a) neither party is liable for indirect or consequential loss; and (b) our total aggregate liability under these Terms is limited to the fees paid by you in the 12 months preceding the event giving rise to the claim.
18.3 The liability cap applies regardless of the basis of claim.
19. Indemnity
19.1 We will defend you against third-party claims alleging that RiskQuilt infringes UK intellectual property rights.
19.2 This does not apply where the claim arises from: (a) Customer Data; (b) unauthorised use; or (c) combination with non-RiskQuilt systems.
20. Dispute Resolution
20.1 If a dispute arises, the parties will attempt to resolve it through good-faith discussions.
20.2 If unresolved within 30 days, either party may propose mediation, conducted in England using a mediator agreed by the parties.
20.3 Court proceedings may be commenced only after mediation has concluded or been declined.
20.4 Nothing prevents either party seeking urgent injunctive relief.
21. Changes to These Terms
21.1 We may update these Terms with reasonable notice.
21.2 Material changes take effect at the start of your next billing period. Continued use after that date constitutes acceptance.
21.3 If you do not agree to material changes, you may cancel your subscription before the next billing period.
22. General
22.1 You may not assign these Terms without our prior written consent.
22.2 We may assign these Terms as part of a corporate restructuring or sale.
22.3 These Terms are governed by the laws of England and Wales. The courts of England have exclusive jurisdiction, subject to section 20.
22.4 A person who is not a party to these Terms shall not have any rights under the Contracts (Rights of Third Parties) Act 1999.
22.5 These Terms constitute the entire agreement between you and us regarding your use of RiskQuilt on the Form, Focus, and Flex tiers.
Contact
For questions about these Terms: hello@riskquilt.com
For privacy-related queries: privacy@riskquilt.com