Everything in one place.
Click any section to expand. Anchor links open the matching section directly — for example, /legal#privacy-policy opens the Privacy Policy.
Effective 2026-05-15 · 99industries, LLC · Delaware, USA
Terms of Service
In force
Terms of Service
In force1. Who we are
These Terms of Service ("Terms") govern your access to and use of the v1.spot service, the trustvice.com website, and related products (collectively, the "Trustvice service" or the "Service") operated by 99industries, LLC, a Delaware limited liability company with its principal place of business in Delaware, USA ("99industries", "we", "us", or "our"). The Trustvice name and the v0.spot, v1.spot, v2.spot product names are trademarks of 99industries, LLC used in commerce by the same entity.
By creating an account or installing the v1.spot plugin, you accept these Terms. If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" refers to that entity.
2. The service
Trustvice provides AI Actors — observability and record-keeping companions for AI agents across the 94 supported agent frameworks listed at /frameworks. The Service produces records about agent activity within your environment and stores them in a tenant-scoped database in the jurisdiction you select at workspace creation (United States or European Union).
We do not act on your data. The adapter runs inside your environment and writes to your tenant. We never use Customer data to train models or for any secondary purpose.
3. Accounts
You are responsible for safeguarding your account credentials, workspace tokens, and access keys, and for all activity that occurs under your account. You must be at least 18 years old to use the Service. You must promptly notify us of any unauthorized access at security@trustvice.com.
4. Acceptable use
You agree not to:
- Reverse engineer, decompile, or disassemble the Service for the purpose of building a competing product or service;
- Use the Service to violate any applicable law, including export-control, anti-discrimination, or privacy laws;
- Submit data that violates third-party rights or applicable law;
- Attempt to access another tenant's data, or interfere with the integrity or performance of the Service;
- Use the Service to track or surveil individuals in ways that violate the GDPR, CCPA/CPRA, or any other applicable privacy law.
5. Plans, fees, and auto-renewal
Paid subscriptions are billed monthly or annually in advance via Stripe in US Dollars (USD). Applicable sales tax or VAT may be added by Stripe Tax depending on your billing address. Run-pack purchases are one-time charges; balances roll over and do not expire. Metered overage (when allowance and run-pack balance are both exhausted and auto top-up is enabled) is itemised on the Stripe invoice. You can hard-cap monthly auto top-up spend in workspace settings.
Auto-renewal disclosure. Subscriptions automatically renew at the end of each billing period at the then-current rate. You may cancel renewal at any time through the Stripe Customer Portal accessible from your dashboard. Cancellation takes effect at the end of the current billing period. We do not provide pro-rated refunds for partial periods except where required by law.
6. Your data; our records
You retain all rights to Customer data you submit through the Service. We process Customer data as your service provider (CCPA) or processor (GDPR) under the Data Processing Addendum. Records produced by Trustvice are append-only and hash-linked. Deletion of an entire workspace purges all records. In-record redaction is available for GDPR Article 17 and CCPA deletion requests without breaking the cryptographic chain.
7. Intellectual property
We retain all right, title, and interest in the Service, the Trustvice plugins, and all related documentation, except for the limited license to use the Service granted under these Terms. You retain all right, title, and interest in your Customer data and any configurations you create within the Service.
8. Beta features
Features marked "beta", "alpha", "early access", or "preview" are provided as-is and may change or be withdrawn at any time. We give reasonable advance notice for breaking changes to general-availability features.
9. Service levels
Free and Starter plans are best-effort, no SLA. Pro: 99.5% monthly uptime target. Team and Scale: 99.9% monthly uptime with service credits per the published SLA. Enterprise: as agreed in an order form. Maintenance windows are announced at least 48 hours in advance.
Run packs purchased under any paid plan add to your workspace balance and roll over indefinitely, subject only to (a) deletion of the workspace by you, (b) termination of the master subscription agreement for non-payment after notice and a cure period, or (c) the winding-up or dissolution of 99industries, LLC, in which case any unused balance is refundable on a pro-rata basis under applicable Delaware UCC §2 principles. Run packs are not transferable between workspaces unless the destination workspace is owned by the same billing entity.
10. Disclaimers
EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
We do not warrant that Trustvice will satisfy any specific regulatory obligation on your behalf — it produces inputs to your compliance programme. Trustvice is not legal advice. Where the Service is used in connection with the Texas Responsible AI Governance Act, the EU AI Act, NIST AI RMF, or any similar framework, you remain responsible for your own compliance obligations.
11. Limitation of liability
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUES, DATA, OR BUSINESS OPPORTUNITIES, ARISING FROM OR RELATING TO THESE TERMS OR THE SERVICE.
OUR AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE AMOUNTS YOU PAID TO US UNDER THESE TERMS IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY, OR USD $1,000, WHICHEVER IS GREATER.
12. Indemnification
You will defend, indemnify, and hold harmless Trustvice from and against any third-party claims arising from (a) your use of the Service in violation of these Terms or applicable law, (b) your Customer data, or (c) your AI agents' actions or outputs. We will defend, indemnify, and hold you harmless from third-party claims alleging that the Service, as provided by us and used in accordance with these Terms, infringes a US patent, copyright, or trademark.
13. Governing law
These Terms are governed by the laws of the State of Delaware, USA, without regard to conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
14. Arbitration and class action waiver
Please read this section carefully — it affects your legal rights.
Any dispute, claim, or controversy arising out of or relating to these Terms or the Service that is not resolved through good-faith negotiation within 30 days will be resolved by binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules. The arbitration will be conducted in Wilmington, Delaware, before a single arbitrator, in English. Judgment on the award may be entered in any court of competent jurisdiction.
Class action waiver. You and Trustvice agree that any dispute will be resolved on an individual basis only, and that neither party may bring a claim as a plaintiff or class member in a class, collective, or representative action.
Opt-out. You may opt out of this arbitration agreement by sending written notice to legal@trustvice.com within 30 days of first accepting these Terms.
15. Termination
You may terminate by cancelling your subscription at any time. We may terminate or suspend your access for material breach (after reasonable opportunity to cure where possible), for non-payment, or if continued provision would expose us to legal liability. On termination, you may export your data through the dashboard for up to 30 days, after which we will delete your Customer data except where retention is legally required.
16. Changes to these Terms
We may update these Terms from time to time. For material changes, we will provide at least 30 days' notice via email to the workspace owner and prominent in-product notice. Continued use of the Service after the effective date of changes constitutes acceptance.
17. Contact
legal@trustvice.com · 99industries, LLC · Delaware, USA. See the Company information section for the full corporate address and registered agent.
Privacy Policy
In force
Privacy Policy
In force1. Who is responsible
This Privacy Policy explains how 99industries, LLC ("99industries", "we", "us") handles personal information ("PI") collected through trustvice.com and the Trustvice service. For data submitted through our plugins about your end users, 99industries acts as a service provider (under California CCPA/CPRA) and processor (under EU/UK GDPR) governed by our Data Processing Addendum.
99industries, LLC is a Delaware limited liability company. The Trustvice product is built and marketed by the same entity.
2. Personal information we collect
Account data — name, work email, workspace name, billing country, plan. Usage data — dashboard activity, IP address, user-agent for security and abuse prevention. Support data — what you send us when you contact support. Workspace records — the contents of your ledger live in your tenant; we only see aggregate run counts for billing and quota.
We do not knowingly collect personal information from children under 16. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
3. Categories under CCPA/CPRA
Categories collected in the last 12 months: identifiers (name, email, IP), commercial information (subscription, billing records), internet activity (usage metrics, error logs), professional information (workspace, role). Sources: directly from you, from your use of the Service, and from Stripe for billing data. Business purposes: providing the Service, billing, security, support, analytics. We do not sell or share PI as those terms are defined under CCPA/CPRA.
4. Your rights under CCPA/CPRA (California)
If you are a California resident, you have the right to:
- Know what PI we hold about you and how we use it;
- Delete your PI, subject to legal-retention exceptions;
- Correct inaccurate PI;
- Opt-out of sale or sharing — N/A, we don't do either;
- Limit the use of sensitive PI — N/A, we don't process sensitive PI;
- Non-discrimination for exercising your rights.
To exercise rights, email privacy@trustvice.com from the address on your account. We respond within 45 days.
5. Your rights under GDPR (EU / UK / EEA)
If you are in the EU, UK, or EEA, you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to lodge a complaint with your local data protection authority (in Germany, your respective state DPA).
Lawful bases we rely on: performance of the contract (Art. 6(1)(b)), our legitimate interest in operating the Service securely (Art. 6(1)(f)), compliance with legal obligations (Art. 6(1)(c)), and your consent for non-essential analytics (Art. 6(1)(a)) which you can withdraw at any time.
6. Where we store data
Your records and content reside in the region and with the provider you select at workspace creation. Two providers are supported: Cloudflare D1 (six global regions) and AWS Aurora (twenty-six AWS regions including coverage Cloudflare doesn't reach, e.g. São Paulo, Cape Town, Mumbai). Object-storage exports use Cloudflare R2, region-matched to your database region. There is no cross-region data flow.
Account metadata (email, billing reference, plan, sub-processor consent state) is held separately on Trustvice's home Cloudflare D1 region. Where you select an EU region with EU jurisdiction binding enabled, your account metadata is also pinned to the EU jurisdiction so all personal data on your account is EU-resident.
Stripe processes payments under its US and EU entities.
International transfers. Where personal data of EU/UK individuals is processed by US sub-processors, transfers rely on the EU Standard Contractual Clauses with additional technical and organizational measures (encryption at rest and in transit, workspace-scoped access tokens, hash-linked records). Details in the DPA.
7. Sub-processors
See the Sub-processors section below for the current list. We notify customers of changes at least 30 days in advance.
8. Retention
Account data: while you have an account, plus 30 days for legal ageing. Support tickets: 24 months. Workspace records: per your plan (7 / 30 / 60 / 90 / 180 days; custom for Enterprise). Billing records: per Delaware and applicable state-law commercial retention minimums.
9. Cookies
We use one essential cookie for authentication. We do not use advertising cookies. We do not respond to "Do Not Track" browser signals because there is no standard for what honoring such signals means; our defaults already approximate them.
10. Security
We protect personal information with technical and organizational measures appropriate to the risk: encryption in transit and at rest, workspace-scoped access tokens, append-only hash-linked records, least-privilege access, and personnel confidentiality. See the Security page for the full controls list.
11. Changes
We may update this Policy. Material changes will be notified by email to the account owner at least 30 days before taking effect.
12. Contact
privacy@trustvice.com · 99industries, LLC · Delaware, USA.
Data Processing Addendum (DPA)
In force
Data Processing Addendum (DPA)
In force1. Scope
This Data Processing Addendum ("DPA") forms part of the Trustvice Terms of Service and governs the processing of personal data by 99industries, LLC on behalf of the Customer in connection with the Trustvice service. It is designed to satisfy Article 28 of the EU GDPR, the UK GDPR, and the service-provider requirements of the California CCPA/CPRA.
The parties are 99industries, LLC, a Delaware limited liability company operating the Trustvice service ("Processor"), and the entity that subscribes to the Service ("Controller", or "Business" under CCPA/CPRA).
2. Nature and purpose
Trustvice processes personal data solely to provide, maintain, and secure the service. We do not use Customer data to train models or for any secondary purpose, and we do not sell or share personal data within the meaning of CCPA/CPRA.
3. Sub-processors
See the dedicated Sub-processors section below. We notify customers of changes at least 30 days in advance via in-product banner and email to the workspace owner. Customers may object on reasonable grounds; if we cannot accommodate the objection, the Customer may terminate the affected Service without penalty.
4. International data transfers
Where the Customer selects the EU jurisdiction, Customer data and the personal data of EU/UK data subjects remain in the EU during ordinary operation. Where personal data of EU/UK data subjects is transferred to or accessed from the United States (for example, for support purposes), the transfer relies on the EU Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller-to-processor), incorporated by reference, with Trustvice as data importer.
For UK data subjects, the UK International Data Transfer Addendum to the SCCs applies. For Swiss data subjects, equivalent safeguards under the FADP apply.
5. Security measures
We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest, workspace-scoped access tokens, hash-linked append-only records, least-privilege access controls, role-based access in the dashboard, short-lived workspace tokens, audited webhook signatures, and personnel confidentiality obligations. The full controls list is at /security.
6. Personal data breach
We notify the Customer without undue delay (and within 72 hours of becoming aware) of any personal data breach affecting Customer data.
7. Data subject requests
Trustvice will reasonably assist the Customer in responding to requests from data subjects to exercise their rights under GDPR (access, rectification, erasure, restriction, portability, objection) or CCPA/CPRA (know, delete, correct, opt-out, limit). Tools for self-service redaction and export are available in the dashboard.
8. Audit
Once per year, on at least 30 days' notice and during normal business hours, the Customer may audit Trustvice's compliance with this DPA. Where SOC 2 Type II or ISO/IEC 27001 reports become available, they will be accepted in lieu of on-site audit.
9. Deletion and return
On termination, Customer data is deleted within 30 days unless retention is legally required. The Customer may export all data through the dashboard at any time during the subscription.
10. CCPA / CPRA service-provider terms
To the extent Trustvice processes personal information that is subject to CCPA/CPRA, the parties agree:
- Trustvice is a "service provider" under §1798.140(ag);
- Trustvice will not sell, share, or retain personal information for any purpose other than performing the Service;
- Trustvice will not combine personal information received from the Customer with personal information from other sources, except as permitted under §1798.140(ag)(1)(D);
- Trustvice certifies that it understands and will comply with these restrictions.
11. Contact
dpa@trustvice.com · 99industries, LLC · Delaware, USA.
Acceptable Use Policy (AUP)
In force
Acceptable Use Policy (AUP)
In forceVersion 2026-07-31 · binding on all plans
This policy applies to every use of Trustvice, by you and by any agent, automation or person acting on your account. Breach is grounds for suspension under section 15 of the Terms of Service.
1. Prohibited AI practices
You may not use Trustvice, or any output of Trustvice, in connection with a practice prohibited by Article 5 of Regulation (EU) 2024/1689. That includes:
- subliminal, purposefully manipulative or deceptive techniques that materially distort a person's behaviour so as to cause significant harm;
- exploiting vulnerabilities of age, disability, or a specific social or economic situation;
- social scoring — evaluating or classifying natural persons in ways that lead to detrimental treatment in unrelated contexts, or treatment that is unjustified or disproportionate;
- predicting the risk that a person will commit a criminal offence, based solely on profiling or on personality traits;
- untargeted scraping of facial images to build or expand facial-recognition databases;
- inferring emotions in the workplace or in education, other than for medical or safety reasons;
- biometric categorisation to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation;
- real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes.
This clause is not boilerplate imported from the Regulation for appearance. It is here because Article 5 has applied since 2 February 2025, it binds you whatever we write, and because we hold the same line ourselves — our own Article 5 screening is published in the EU AI Act Role Declaration section above, practice by practice.
2. Integrity of disclosure and marking
Trustvice exists to make AI interaction and provenance provable. You may not use it to do the opposite. Specifically, you may not:
- remove, alter, forge, suppress or conceal a content provenance marker, an AI-disclosure label, or a Trustvice receipt or signature;
- present a Trustvice artifact as attesting to something it does not attest to, or represent an unverified artifact as verified;
- use the Service to help a third party do either of the above.
The third bullet mirrors an obligation that binds any organisation or individual under Article 10 of the Chinese AI labelling measures, including tool suppliers. We hold ourselves to it and we ask the same of you. Trustvice ships no capability that removes a content marker, and a test in our codebase enforces that.
3. Lawful use
- You may not use the Service to violate applicable law, or the rights of any third party.
- You are responsible for having a lawful basis for the data you bring into your workspace, and for the AI systems you point Trustvice at.
- You may not use the Service to process personal data of a category, or in a manner, that your own agreements with your data subjects do not permit.
4. Security
- No attempt to access another workspace, another customer's data, or Trustvice infrastructure beyond your entitlement.
- No circumvention of quota, metering, tier gating or authentication.
- No sharing of workspace credentials or API keys outside your organisation.
- Security research is welcome under the Responsible Disclosure Policy; the safe harbour there applies, and this section does not.
5. Agents and automation
- Agents acting on your account act as you, and you are responsible for what they do.
- You may not operate agents through Trustvice that themselves breach this policy, third-party rights or applicable privacy law.
- Automated use must stay within your published plan limits unless we have agreed an exception in writing.
6. Competitive use
You may not reverse engineer the Service for the purpose of building a competing product. Benchmarking for your own evaluation is permitted, and you may publish the results.
7. Enforcement
We investigate before we act, and we tell you what we found. Where a breach is ongoing and causing harm we may suspend first and explain immediately after. Suspension for breach of section 1 or section 2 is not subject to a cure period.
Report a suspected breach: legal@trustvice.com
EU AI Act — Role Declaration (Provider & Deployer)
In force
EU AI Act — Role Declaration (Provider & Deployer)
In force1. The declaration
99industries, LLC declares itself both a provider and a deployer of the AI systems it operates in Trustvice, within the meaning of Article 3(3) and Article 3(4) of Regulation (EU) 2024/1689, and discharges both sets of obligations.
We do not hold a narrower role in reserve. Where a provision could be read to place a duty on a supplier or on an operator, we take it as placed on us and meet it. A compliance vendor arguing its way out of the regulation it sells against is not a position we want to be able to take.
2. Establishment
99industries, LLC is a Delaware, United States company with no establishment, branch or subsidiary in the Union. That removes no obligation: Art. 2(1)(a) reaches a provider placing an AI system on the Union market irrespective of establishment, and Art. 2(1)(c) reaches a third-country provider or deployer whose system output is used in the Union. Both apply to us.
An authorised representative under Article 22 is not required, because that obligation attaches to third-country providers of high-risk systems and no system below screens as high-risk. If that changes, so does this sentence.
3. Per-system determination
Every system we place on the market, with the basis for its classification under Article 3(1) and the result of its Annex III screening. Neither “it does not learn” nor “it is deterministic” appears as a basis anywhere below: Article 3(1)’s adaptiveness element is permissive, and Recital 12 names logic- and knowledge-based approaches. Both arguments are worthless and we do not make them.
| System | AI system? | Tier | Annex III |
|---|---|---|---|
| Number One | Yes | Art. 50 transparency duties | Not in scope |
| Herald (Authority · Coverage · Precondition · Mark) | Yes | Art. 50 transparency duties | Not in scope |
| Driftvice | No | Not an AI system (Art. 3(1)) | Not in scope |
| Redline | Yes | Art. 50 transparency duties | Not in scope |
| TrustActor | Yes | Art. 50 transparency duties | Not in scope |
Number One
Machine-based system that infers from input how to generate outputs (text, recommendations, and — in admin mode — actions) with varying levels of autonomy. Squarely inside Art. 3(1). No argument is made from determinism or absence of learning.
Annex III · Number One answers questions about, and operates, the customer's own Trustvice workspace. It performs no recruitment, CV screening, candidate evaluation, task allocation, promotion/termination input, or monitoring/evaluation of worker performance, and no creditworthiness or insurance function. Point 4 is the one to re-screen before any feature touches staff evaluation — including our OWN internal use of it. Points considered: Point 4 (employment, worker management) — the point that actually needs care; Point 5(a)-(c) (essential services, creditworthiness, insurance pricing); Point 1 (biometrics); Point 8 (administration of justice).
Herald (Authority · Coverage · Precondition · Mark)
DECLARED IN SCOPE, and deliberately not argued down. The prior internal reading — flat decision table, therefore inside the Recital 12 carve-out — was rejected on review as an invented discriminator applied to one file out of a 2,329-line module. Art. 3(1) classifies the system placed on the market, not its most flattering component. Declaring it in scope costs a transparency-only duty set that we discharge anyway.
Annex III · Classifies agent interactions and emits evidence about disclosure obligations. It makes no determination about any natural person's access to a service, employment, or legal position. Points considered: Point 4 (employment); Point 5 (essential services); Point 8 (justice).
Driftvice
Deterministic lexical comparison — normalisation, Jaccard overlap, fixed thresholds. It performs NO inference: `env.AI` is declared and the Workers AI binding is provisioned in all four zones, but it is never called on any code path. The binding's presence is precisely why this determination is gated in code (see driftvice/src/ai-gate.ts) rather than trusted to stay true.
Annex III · Semantic drift detection over the customer's own sources. No natural-person determination. Points considered: Point 4; Point 5.
Redline
NOT YET BUILT — declared in scope in advance, as a design constraint. A mixed battery of pattern detectors and inferential ones is an AI system in its entirety; the Act classifies the system placed on the market, not the individual detector. Redline cannot be kept out of scope by counting how many of its detectors are regexes, and building it on the assumption that it can would be expensive to unwind.
Annex III · Detects undisclosed AI interaction in the customer's own traffic. Screened again at build time before first release. Points considered: Point 4; Point 5; Point 8.
TrustActor
Executes agent runs with varying autonomy against a declared charter, generating outputs and actions from inputs. In scope.
Annex III · A runtime for the customer's own agents. It takes no decision about a natural person on its own account; where a CUSTOMER points it at an Annex III use, the customer is the provider of that use and Herald is what evidences the boundary. Points considered: Point 4; Point 5; Point 8.
4. Article 5 — prohibited practices
Article 5 is a ban, not a duty a document discharges, and it has applied since 2 February 2025. Each practice is screened by name rather than covered by a blanket assurance, because a blanket assurance is what an omission looks like.
| Provision | Practice | Present | Basis |
|---|---|---|---|
| Art. 5(1)(a) | Subliminal, manipulative or deceptive techniques materially distorting behaviour | No | No persuasion, nudging or engagement-optimisation surface. Number One refuses rather than persuades; refusals are receipted. |
| Art. 5(1)(b) | Exploiting vulnerabilities of age, disability or socio-economic situation | No | B2B compliance tooling; no consumer surface and no vulnerability signal is collected or modelled. |
| Art. 5(1)(c) | Social scoring | No | Actor Score rates AGENT behaviour against a declared charter within one workspace. It scores no natural person and produces no cross-context social evaluation. |
| Art. 5(1)(d) | Predicting criminal offences from profiling or personality traits | No | No criminal-risk product exists or is planned. |
| Art. 5(1)(e) | Untargeted scraping of facial images for facial-recognition databases | No | No facial or biometric data is collected on any surface. |
| Art. 5(1)(f) | Emotion inference in the workplace or education | No | No emotion-recognition capability. Sentiment is not inferred anywhere in the product. |
| Art. 5(1)(g) | Biometric categorisation inferring protected attributes | No | No biometric data of any kind is collected, stored or processed. Agent identity is cryptographic (DID, SPIFFE, Ed25519 keys) and attaches to workloads, never to bodies. |
| Art. 5(1)(h) | Real-time remote biometric identification in public spaces | No | No biometric processing, no camera or sensor ingestion, and no law-enforcement channel. The platform observes agent-to-service traffic, not physical spaces. |
5. Obligations that attach, and how each is met
| Provision | Binding from | What it requires | How we meet it |
|---|---|---|---|
| Art. 25(4) | 2026-07-27 | Where a customer integrates our tools, services, components or processes into THEIR high-risk AI system, we are the 'third party that supplies' under Art. 25(4) and owe them a written agreement specifying the information, capabilities, technical access and assistance they need to meet their own obligations. Newly fineable via Art. 99(4)(da). Note the direction: this duty runs from us TO the customer, and it is the enterprise buyer's first contractual ask. | AI Act Value-Chain Agreement, accepted at sign-up and downloadable from /legal. Offered to every customer rather than gated on whether their system is high-risk — we cannot see their classification, and an agreement we owe should not depend on us guessing it. |
| Art. 4 | 2025-02-02 | Take measures to support AI literacy of staff and others operating the systems on our behalf. As replaced by Reg. (EU) 2026/1744 this does NOT require guaranteeing any level for any individual — but 'take measures' is a duty and evidence of measures is what an authority asks for. | Published AI Literacy Statement + the literacy record it describes. |
| Art. 5 | 2025-02-02 | Prohibited practices. Not a duty that a document discharges — a ban. Exposure under Art. 99(3) is €35 000 000 / 7% of worldwide turnover. | Screening recorded per system (see PROHIBITED_PRACTICE_SCREENING) + Acceptable Use Policy §1 binding customers to the same line. |
| Art. 50(1) | 2026-08-02 | Systems intended to interact directly with natural persons must be designed so the person is informed they are interacting with an AI system, unless obvious to a reasonably well-informed person. | Trustvice composes and delivers this itself — no other platform is involved. `runtime/shared/disclosure/self-disclosure.ts` composes the notice per locale with the required elements (artificial nature · on whose behalf · where to learn more) asserted by test in all six; `components/dashboard/ai-disclosure.tsx` renders it in the Number One chat pane, above the transcript, on every render. Not dismissible: a strip a returning user cleared weeks ago informs nobody at the interaction it is meant to cover. Plus the published Transparency Notice. |
| Art. 50(2) | 2026-08-02 | Outputs of systems generating synthetic audio, image, video or TEXT must be marked in a machine-readable format and detectable as artificially generated. A visible label does NOT discharge this — the Guidelines treat labelling and marking as complementary. | runtime/shared/disclosure/synthetic-marking.ts — marker on every synthetic-text delivery surface, with an explicit coverage accounting for surfaces that cannot carry one. |
| Art. 50(4) 2nd subpara | 2026-08-02 | Deployers publishing AI-generated or AI-manipulated TEXT to inform the public on matters of public interest must disclose that it is artificially generated. This reaches OUR OWN published output, not a customer's. | In progress — Editorial disclosure policy for published material + the AI-assistance notice rendered on affected pages. |
| Art. 50(5) | 2026-08-02 | Information under 50(1) and 50(4) must be provided clearly and distinguishably at the latest at the time of the first interaction or exposure. | The notice is in the DOM ahead of the message list and rendered before any assistant turn exists — verified in the browser, not asserted. `satisfiesTimingRule()` in self-disclosure.ts encodes the deadline: only a notice first rendered at assistant-turn ZERO passes; arriving after the system has spoken is late, and lateness is the precise failure 50(5) exists to prevent. |
1 obligation still being worked
Listed above rather than omitted. A published declaration that only shows the parts we have finished is worth less than one that shows the parts we have not.
6. Article 50(2) marking — coverage
Machine-readable marking is applied on every delivery surface we control. Where it is not carried, we say so rather than let you assume it is.
- json-response — marked
- sse-stream — marked
- stored-message — marked
- conversation-export — marked
- human-copy-paste — not marked; see the AI System Transparency Notice for why
7. Dates
Number One and the systems listed above were placed on the market on 2026-07-31. That date makes the Article 111(4) transition available to us — Article 50(2) marking would not bite until 2 December 2026. We do not rely on it. Marking is live from launch.
Article 50(1), 50(4) and 50(5) apply from 2 August 2026 with no transition. Article 4 and Article 5 have applied since 2 February 2025. Article 25(4) became fineable under Article 99(4)(da) on 27 July 2026.
8. Review and contact
This declaration is generated from runtime/shared/eu-ai-act/own-role.ts, the same module the platform enforces against, so the page and the software cannot disagree. It is reviewed when any system’s classification changes, and at least annually.
Questions, or a request under Article 25(4): legal@trustvice.com
Declared role: provider+deployer · 7 transparency-tier obligations · 5 systems screened
AI Act Value-Chain Agreement (Art. 25(4))
In force
AI Act Value-Chain Agreement (Art. 25(4))
In forceAI Act Value-Chain Agreement
Article 25(4), Regulation (EU) 2024/1689
99industries, LLC ("Trustvice", "we") and the customer accepting these terms ("you") agree as follows.
1. Why this agreement exists
Article 25(4) of Regulation (EU) 2024/1689 requires that where a third party supplies an AI system, tools, services, components or processes that are used or integrated in a high-risk AI system, that third party and the provider of the high-risk system must, by written agreement, specify the information, capabilities, technical access and other assistance — based on the generally acknowledged state of the art — needed for the provider to comply with the Regulation.
If you integrate any part of Trustvice into an AI system that is high-risk under Article 6, you are that provider and we are that third party. This agreement is the written agreement Article 25(4) requires.
We offer it to every customer, not only those who tell us their system is high-risk. We cannot see your classification, and an obligation we owe should not depend on us guessing correctly.
2. What we supply
Trustvice supplies runtime components, evidence-generating services and programmable interfaces. We do not supply a general-purpose AI model, and we do not train models on your data.
3. Information we will provide
On written request to legal@trustvice.com, and without additional charge, we will provide:
(a) a description of the intended purpose, capabilities and known limitations of each Trustvice component you have integrated;
(b) the technical documentation of interfaces, data formats and the meaning of each output field, sufficient for you to interpret our outputs correctly in your own conformity assessment;
(c) the accuracy characteristics and known failure modes of any classification or detection component you rely on, including the conditions under which it is designed to fail closed;
(d) a description of the logging and record-keeping our components perform, the fields recorded, and the retention applied;
(e) the cybersecurity measures relevant to the integrated component;
(f) notice of any change to a supplied component that could reasonably affect your compliance, before that change takes effect, other than a change made to remediate an active security incident — which we will notify as soon as it is safe to do so.
4. Technical access
We will provide the technical access needed for you to exercise oversight over the integrated component: programmatic retrieval of the records our components generate about your workspace, the ability to reproduce a decision from its recorded inputs where the component is deterministic, and export of that material in a machine-readable format.
Where a Trustvice component emits signed evidence, we will provide the means to verify those signatures independently of Trustvice, including after termination.
5. Assistance
We will provide reasonable assistance to you and, at your direction, to a notified body, market surveillance authority or auditor acting in relation to your system, including responding to documented technical questions about the supplied component.
We will not, and cannot, perform your conformity assessment, sign your declaration of conformity, or determine the risk classification of your system. Those are the provider's own acts.
6. What this agreement does not do
This agreement does not make Trustvice the provider of your AI system, and it does not transfer any obligation of yours to us. It does not alter the roles either party holds under the Regulation. If your use of a Trustvice component puts our name or trade mark on a high-risk AI system, or substantially modifies one, Article 25(1) may apply on its own terms and neither party can contract out of it.
7. Duration and survival
This agreement runs for as long as you use any Trustvice component in your AI system, and Sections 3 and 4 survive termination for the period you are required to retain documentation under the Regulation.
8. Relationship to the other terms
This agreement supplements the Terms of Service and the Data Processing Addendum. Where it conflicts with them on a matter Article 25(4) governs, this agreement prevails.
9. Contact
legal@trustvice.com — mark the subject line "Article 25(4) request". We aim to respond substantively within 15 working days.
AI System Transparency Notice (Art. 50)
In force
AI System Transparency Notice (Art. 50)
In forceAI System Transparency Notice
Articles 50(1), 50(2) and 50(5), Regulation (EU) 2024/1689
This notice describes the AI systems 99industries, LLC operates in the Trustvice service, and how we meet the transparency duties that apply to them. It concerns our own systems. It is not advice about yours.
1. You are interacting with an AI system
Number One is an AI system. When you use it, you are interacting with a machine, not a person.
It says so itself, before you exchange anything with it: the disclosure sits above the conversation, on every visit, in the clear and distinguishable manner Article 50(5) requires. It is not dismissible — a notice you cleared weeks ago informs nobody at the interaction it is meant to cover — and it is shown in your own language, carrying who operates the system and on whose instructions it acts.
Number One can answer questions about your workspace, look records up deterministically, and — where you grant it permission — carry out actions in your workspace on your instruction. It is not a compliance determination, a legal conclusion or an audit sign-off, and it is designed to refuse rather than guess.
2. Machine-readable marking of generated text
Where Number One's answer is composed by a language model, that output is marked in a machine-readable format and is detectable as artificially generated, as Article 50(2) requires. The marking is applied:
- in the JSON response envelope and in HTTP response headers on the API; - as an in-band event on the streaming interface, delivered with the first token of generated text; - on the stored message, so a later read or export of the conversation carries the same marking rather than re-deriving it.
The marker carries the IPTC digital source type trainedAlgorithmicMedia — the identifier used by C2PA and the wider content provenance ecosystem — so any consumer that already understands content credentials understands ours.
Where the marking does not reach. If you select text in the interface with your mouse and paste it into another document, the marking does not travel with it. Carrying it would require embedding an invisible watermark in the prose itself. Any reformatting removes such a watermark, it corrupts text you may put in front of a regulator, and a hidden channel is the wrong thing to add to a product whose value is that nothing is hidden. Article 50(2) requires marking that is effective and robust as far as technically feasible; this is the edge of that, and we would rather state it than let you assume otherwise.
We do not over-mark. Fixed text — a refusal, a quota notice, an error, a plan description — is written by people and selected by a program. It is not marked as artificially generated, because it is not. Every response carries an explicit origin so you can tell the difference rather than infer it.
3. Our own published material
Where we publish text on this site that was generated or materially assisted by an AI system and concerns a matter of public interest, we disclose that on the page, as the second subparagraph of Article 50(4) requires.
4. Our role
99industries, LLC declares itself both provider and deployer of the AI systems it operates in Trustvice, and discharges both duty sets. Our full role declaration, the per-system risk screening and the resulting obligations are published in the EU AI Act Role Declaration section of this page.
5. Contact
legal@trustvice.com
AI Literacy Statement (Art. 4)
In force
AI Literacy Statement (Art. 4)
In forceAI Literacy Statement
Article 4, Regulation (EU) 2024/1689 (as replaced by Regulation (EU) 2026/1744)
Article 4 requires providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. It has applied since 2 February 2025.
The replaced text does not require guaranteeing any specific level of literacy for any individual. It requires measures. This statement records ours.
Measures in place
- Role declaration. Every person building on the platform works against a published, tested declaration of which of our systems are AI systems, at what risk tier, and what each one owes. It is code, not a memo, so it does not drift from the product.
- Determinations are written down and challenged. Classification decisions are recorded with the provision relied on and the basis, and are reviewed adversarially — specifically for readings that are convenient to us. Where a reading is not settled, the record says so.
- Two arguments are banned. "It doesn't learn, so it isn't an AI system" and "it's deterministic, so it isn't an AI system" are both legally worthless — Article 3(1)'s adaptiveness element is permissive, and Recital 12 names logic- and knowledge-based approaches. Neither may appear in any determination, and a test enforces it.
- Legal basis travels with the evidence. Every compliance artifact the platform emits carries the interpretation profile it was produced under, and marks any claim resting on non-binding guidance as such. Nobody working here can mistake guidance for statute, because the artifacts do not let them.
- Gates where classification could change silently. Where connecting a model would change a product's status under the Act, the code path is closed behind a gate that states the regulatory consequence and the steps required before it opens.
- Customer-facing literacy. Number One's interface states what it is, what it will not do, and when an answer is illustrative rather than determinative. Literacy is not only an internal duty.
Review
This statement is reviewed when the role declaration changes, and at least annually. Questions: legal@trustvice.com
Service Level Agreement (SLA)
Outline
Service Level Agreement (SLA)
OutlineOutline — full text added before public launch
The published SLA will be added before public launch. Starter and Pro plans are best-effort. Team and Scale plans target 99.5% and 99.9% monthly uptime respectively, measured against the dashboard and ingest endpoints. Enterprise SLA is per-contract. Service credits formula and the definition of an "excluded" outage (planned maintenance, customer-side issues, force majeure) will appear in the full document.
DMCA Notice & Takedown
Outline
DMCA Notice & Takedown
OutlineOutline — full text added before public launch
DMCA designation will be added before public launch. We (99industries, LLC, the operating entity behind Trustvice) will file the designation of agent with the US Copyright Office under 17 U.S.C. § 512(c)(2) prior to launch, and the public confirmation link will appear here once registered. Until then, takedown notices and counter-notices may be submitted to dmca@trustvice.com in the form described at 17 U.S.C. § 512(c)(3). Repeat-infringer policy details will appear in the full document.
Responsible Disclosure Policy
Outline
Responsible Disclosure Policy
OutlineOutline — full text added before public launch
The Responsible Disclosure Policy will be added before public launch. Security researchers acting in good faith and reporting through security@trustvice.com are granted safe harbour from legal action by Trustvice, provided they (a) do not access more data than necessary to demonstrate the issue, (b) do not exploit the issue against other customers, and (c) give Trustvice a reasonable period (90 days) to remediate before public disclosure. Scope, out-of-scope items, and the PGP key fingerprint will appear in the full document.
Sub-processors
In force
Sub-processors
In forceTrustvice uses the following sub-processors to provide the Service. We notify customers of any change at least 30 days in advance.
| Sub-processor | Purpose | Jurisdiction |
|---|---|---|
| Cloudflare, Inc. | Database (D1) when selected as customer's data provider, object storage (R2), compute (Workers), CDN, DNS, WAF, control-plane database (account metadata) | Per workspace (6 global regions; EU jurisdiction binding available) |
| Amazon Web Services, Inc. | Database (Aurora Serverless v2 Postgres) when selected as customer's data provider | Per workspace (26 AWS regions including São Paulo, Cape Town) |
| Stripe, Inc. (US) & Stripe Payments Europe Ltd. (EU) | Billing, payments, customer portal, tax, Stripe Radar fraud envelope | US and EU |
| Vercel, Inc. | Marketing site and dashboard frontend hosting (edge runtime; no customer data plane) | Global edge; no data plane |
| Resend, Inc. | Transactional email (magic links, billing notifications, legal-override notifications) | US (EU sending option for EU workspaces) |
| DigiCert, Inc. | RFC 3161 Time-Stamp Authority (C2PA + Notarian + audit-log periodic anchoring; SHA-256 digests only) | US |
| Sift | Account-level fraud detection (ATO, fake-account, payment fraud) — envelope only (no workspace contents) | US |
| Castle | Account takeover, impossible-travel, credential-stuffing detection on auth events — envelope only | US and EU |
| Sardine | KYC + sanctions screening — customer-consented identity data only (Enterprise) | US |
| Persona | KYC + KYB document verification — customer-consented document images (Enterprise onboarding only) | US |
| MaxMind | IP risk / proxy / VPN / TOR detection — IP address only | US |
| IPQualityScore | Email / phone validation + IP fingerprinting — envelope only (signup + ban-list checks) | US |
Workspace data (records, runs, exports) lives in Cloudflare D1 and R2 pinned to the jurisdiction selected at workspace creation. Vercel does not see customer data — only marketing pages and dashboard chrome render through it. The fraud-detection providers (Sift, Castle, Sardine, Persona, MaxMind, IPQualityScore) only receive envelope-level data per the disclosures published at /.well-known/fraud-providers.json; per audit policy 38, no workspace contents, audit log content, or agent action content is ever shared with them. Trustvice does not operate any sub-processor on AWS, Azure, or Google Cloud as part of the customer data plane. Full inventory with attestations + processing regions at /sub-processors.
Company information
In force
Company information
In forceLegal entity
99industries, LLC
A Delaware limited liability company
State of Delaware, USA
Trustvice is the product brand. The contracting, billing, processing, and customer-facing legal entity for the Trustvice service is 99industries, LLC. Customer contracts are governed by Delaware law unless specified otherwise.
Registered office & agent
Registered office address, registered agent name and address, and Delaware Division of Corporations file number for 99industries, LLC will be filled in before public launch.
Contact channels
- General: hello@trustvice.com
- Enterprise: enterprise@trustvice.com
- Legal: legal@trustvice.com
- Privacy / DSARs: privacy@trustvice.com
- Security disclosure: security@trustvice.com
- Billing: billing@trustvice.com
- DMCA: dmca@trustvice.com
EU representative (GDPR Article 27)
For data subjects in the EU, the founder serves as the personal point of contact pending appointment of a formal Article 27 representative. Until then, EU/UK data subjects may contact privacy@trustvice.com.
Trustvice 360Declare as regras. Deixe cada execução ser verificada.
Agentes, evidências, governação, comércio e divulgação estão no Trustvice 360. Registe-se grátis e abra todas as suítes a partir de um só painel.