Business Terms

These terms govern business and API use of Vilkax - protecting employees, routing an organisation's mail or traffic through the service, or calling the Protect API. They replace the consumer Terms of Service for business customers. Together with the Order Form, the Data Processing Agreement and, where purchased, the service level agreement, they form the whole agreement.

Order of precedence: the Order Form, then the DPA, then the SLA, then these terms.

1. What the service does, and does not, undertake

Vilkax is a risk-signalling service. It produces opinions about the likelihood that a message, sender, domain, wallet or transaction is fraudulent.

Vilkax does not undertake to detect every threat, and does not make decisions for the Customer. False negatives and false positives are inherent to the technology. The Customer keeps sole responsibility for its own controls - payment authorisation, dual approval of transfers, callback verification, KYC and AML obligations, and any regulatory duty it owes. The Customer must not present Vilkax to its own customers, auditors or regulators as a control that eliminates fraud risk, and must not rely on Vilkax as its sole control over any payment or access decision.

Regulatory duties are not transferred. Where the Customer is a regulated entity, its obligations remain its own. Vilkax is a tool it uses in discharging them.

2. Licence, accounts and API

Vilkax grants a non-exclusive, non-transferable right to use the service during the term for the Customer's internal business purposes, for the seats or volume on the Order Form. Named seats are per individual; a seat may be reassigned on a permanent change of role, but not shared concurrently.

API access is subject to the published rate limits and documentation. Credentials must be kept secret and rotated on compromise, and the Customer is responsible for all use made with them. No reverse engineering, no published benchmarking without consent, no use of outputs to train a competing model, and no resale or provision to third parties except as the Order Form permits. We may suspend access immediately where use threatens the security, integrity or availability of the service - we will say why, and restore it once resolved.

3. Fees, term and renewal

Fees are as stated on the Order Form, exclusive of VAT, payable in advance. Subscriptions renew for successive periods equal to the initial term unless either party gives notice at least 30 days before the end of the current period. We may increase fees on renewal with 60 days' notice. Late payment carries statutory interest. Fees are non-refundable except where these terms expressly say otherwise. Trials are provided as-is, excluded from sections 6 and 7, and may be terminated at any time.

4. Acceptable use

The Customer will not, and will not permit any authorised user to: submit data it has no right to submit; use the service to monitor individuals other than in accordance with applicable employment and data-protection law and with the notices that law requires; use the service to attack, harass or discriminate against any person; circumvent rate limits or security controls; or use an output to take an adverse action against an individual without human review. The Customer is responsible for making the disclosures its own employees and end users are owed in respect of data it routes through Vilkax.

5. Customer data and confidentiality

The Customer keeps all rights in its data and grants Vilkax the rights necessary to provide the service. Processing of personal data is governed by the DPA. We do not train general models on Customer data unless the Order Form expressly says so; the default is off. Each party keeps the other's confidential information confidential for the term and five years afterwards, using no less than reasonable care, with the usual carve-outs for information that is public, independently developed, lawfully received, or required to be disclosed by law.

6. Warranties, and what is disclaimed

We warrant that the service will perform materially in accordance with the documentation, and that we will provide it with reasonable care and skill using appropriately qualified personnel. Sole remedy for breach of this warranty: we will use commercially reasonable efforts to correct the non-conformity, and if we cannot within 30 days of written notice, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.

To the maximum extent permitted by law, and except as expressly stated in this section, the service is provided without warranties of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, accuracy, completeness, or that the service will detect any particular threat or will be uninterrupted or error-free.

7. Service levels

Where the Order Form includes an SLA, the uptime commitment and service credits are set out there. Service credits are the Customer's sole and exclusive remedy for failure to meet a service level, except where the failure also amounts to a material breach entitling the Customer to terminate. Detection quality is not an SLA metric - accuracy is measured and reported, but it is not warranted.

8. Indemnities

By Vilkax. We will defend the Customer against a third-party claim that the service, as provided by us and used in accordance with this agreement, infringes that party's intellectual property rights, and pay damages finally awarded or agreed in settlement. This does not cover claims arising from Customer data, from combination with anything not supplied by us, or from use in breach of this agreement. If such a claim arises or looks likely, we may procure the right to continue, modify the service, or terminate the affected service with a pro-rata refund.

By the Customer. The Customer will indemnify us against third-party claims arising from its data, from breach of section 4, or from its own decisions taken on the basis of service outputs - including claims by its employees, customers or counterparties.

9. Limitation of liability

Neither party excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for wilful misconduct or gross negligence, or for anything else that cannot be excluded by law. The Customer's payment obligations and each party's indemnity obligations under section 8 fall outside the cap.

Neither party is liable for indirect, incidental, special, punitive or consequential loss, nor for loss of profit, revenue, anticipated savings, business or goodwill, nor for loss or corruption of data, however arising and whether or not foreseeable.

Each party's total aggregate liability arising out of or in connection with this agreement in any twelve-month period is limited to the fees paid or payable by the Customer in the twelve months preceding the event giving rise to the claim.

10. Suspension and termination

Either party may terminate for material breach not remedied within 30 days of written notice, or immediately on the other's insolvency. We may suspend immediately for non-payment after 14 days' notice, or for a security or acceptable-use event, with notice as soon as practicable. On termination, access ends and the Customer may export its data for 30 days, after which we delete or return it under the DPA. Sections 5, 6 (disclaimer), 8, 9, 11 and 12 survive.

11. Compliance, sanctions and anti-bribery

Each party will comply with applicable anti-bribery, anti-money- laundering, export-control and sanctions law. Neither party is, nor is owned or controlled by, a sanctioned person. Breach of this section is a material breach not capable of remedy.

12. Artificial intelligence

The Service includes AI systems within the meaning of Regulation (EU) 2024/1689 (the AI Act). We are the provider of those systems. The Customer is the deployer.

Intended purpose. The Service is intended to detect indications of fraud, impersonation, social engineering and related financial crime in content, messages and transactions submitted to it, and to return a risk indication for assessment by the Customer's own staff. It is not intended for, and must not be used for, any of the following:

Outputs are indications, not decisions. Where a risk indication concerns an identified or identifiable person, the Customer will not take an adverse action on it without assessment by a competent person with authority to disregard it. The Service is built to support that: categories capable of implying misconduct by a person are restricted to human review and cannot produce an automated blocking action.

Use outside the intended purpose. A Customer who uses the Service for a purpose excluded above, who modifies it so that it serves such a purpose, or who places it on the market under its own name or trade mark, becomes the provider of that system under Article 25 of the AI Act and assumes the obligations attaching to it, including any obligations applicable to high-risk AI systems. The Customer will indemnify us against claims, penalties and costs arising from such use.

Deployer obligations. The Customer is responsible for its own obligations as a deployer, including assigning human oversight to people with the competence, training and authority to exercise it, ensuring that input data is relevant and sufficiently representative for its use, and, where the Service is used in any work-related context, informing affected workers and their representatives before doing so, as required by Article 26(7) of the AI Act and by applicable employment and data-protection law.

Transparency. Where a person interacts directly with an AI system of ours, or receives content generated by one, we disclose that fact at the interface, as required by Article 50. The Customer will not remove, obscure or contradict that disclosure.

AI literacy. Each party is responsible for the AI literacy of its own staff under Article 4.

13. General

Force majeure applies to both parties. Neither may assign without consent, except to a successor in a merger or acquisition of substantially all assets. Nothing here creates a partnership or agency. Notices are in writing to the addresses on the Order Form, with legal notices also by email to the named address. Variation requires writing signed by both parties. Terms on a Customer purchase order or vendor portal have no effect unless we sign them. If a provision is unenforceable the rest stands. These terms, the Order Form, the DPA and any SLA are the entire agreement, excluding liability for pre-contractual statements other than fraud. Lithuanian law governs, and the competent courts of Lithuania have exclusive jurisdiction.

Last updated: 2026-08-22 · Version v2. Consumer accounts are governed by the Terms of Service instead. Questions about these terms: contact us.