Terms and Conditions

1. Agreement to Terms

By accessing or using the Cipherion Data Security Platform, including its APIs, SDKs, software, documentation, and all current and future data security modules (collectively, the "Service" or the "Platform"), you agree to be bound by these Terms and Conditions ("Terms"). These Terms constitute a legally binding agreement between you (the "Client") and K3NP Cipherion Pvt. Ltd. ("Cipherion," "we," "us," or "our"), a private limited company incorporated under the Companies Act, 2013, registered in Karnataka, India.

If you do not agree to these Terms, you must immediately cease all use of the Service. By accessing or continuing to use the Service, you represent and warrant that: (a) you are of legal age to form a binding contract in your jurisdiction; and (b) if you are accepting these Terms on behalf of a company or other legal entity, you have the full legal authority to bind that entity to these Terms.

2. Definitions

The following definitions apply throughout these Terms and all associated agreements (including any Data Processing Agreement and Business Associate Agreement) entered into with Cipherion.

• "Cipherion Data Security Platform" or "Platform" or "Service" means Cipherion's unified suite of data security products and services, which currently includes field-level encryption, decryption, tokenization, anonymization, data masking, and secure key management capabilities, and which may from time to time include Additional Modules made generally available by Cipherion. The Platform is delivered via API, SDK, web dashboard, and related infrastructure.
• "Additional Modules" means any new data security, or data protection features or products made available by Cipherion as part of the Platform after the effective date of these Terms, whether offered as part of the base subscription or as separately licensed add-ons. Additional Modules are subject to supplemental product terms published by Cipherion at the time of their general availability release.
• "Client-Controlled Key Architecture" means Cipherion's cryptographic model in which encryption key material is stored in encrypted form within Cipherion's infrastructure and is accessible only by means of a passphrase or secret held exclusively by the Client, which is never transmitted to or accessible by Cipherion in plaintext.
• "Client" means the individual or legal entity that has agreed to these Terms and is accessing or using the Platform.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable law including GDPR, DPDP Act 2023, and CCPA/CPRA.
• "Service Order" means a written order, purchase order, or subscription agreement between Cipherion and the Client that specifies the Platform modules, pricing, and commercial terms applicable to that Client.

3. Scope of Services

Cipherion provides the Cipherion Data Security Platform — a unified suite of data security capabilities designed to help organisations protect, manage, and govern sensitive data across their systems and workflows.

3.1 Current Capabilities

The Platform currently includes the following capabilities, delivered via API, SDK, and web dashboard over HTTPS-secured endpoints:

• Field-level encryption and decryption using AES-256 with an additional proprietary obfuscation layer;
• Data tokenization for replacing sensitive values with non-sensitive tokens;
• Data anonymization and pseudonymization for privacy-preserving data processing;
• Data masking for controlled partial exposure of sensitive fields;
• Secure encryption key management under the Client-Controlled Key Architecture;
• Audit logging, usage metrics, and compliance reporting via dashboard and API.

3.2 Future Capabilities and Additional Modules

The Platform is designed to expand. Cipherion may from time to time make available additional features, module, services, technologies, products. Additional Modules will be made available subject to supplemental product terms published by Cipherion at or before the time of general availability. The inclusion of future capabilities in this Section does not constitute a commitment by Cipherion to develop or deliver any specific feature or product. Cipherion reserves the right to modify, delay, or discontinue any planned capability without liability.

3.3 AI Features — Specific Commitments

Where Cipherion offers AI Features as part of the Platform or as Additional Modules, the following commitments apply and form part of these Terms:

• No Training on Client Data: Cipherion will not use Client data, or any Personal Data processed through the Platform, to train, fine-tune, improve, or benchmark Cipherion's AI models or any third-party AI systems. Client data processed by AI Features is used solely to provide the specific feature output to that Client.
• No Automated Decisions Affecting Individuals: AI Features will not make binding automated decisions about individuals without human review, unless the Client explicitly configures and enables such functionality and accepts sole responsibility for compliance with applicable law including GDPR Article 22.
• DPIA Availability: Prior to the general availability of any AI Feature, Cipherion will make a Data Protection Impact Assessment (DPIA) summary available to Clients upon request, to assist Clients in fulfilling their own DPIA obligations under GDPR Article 35 and equivalent provisions.
• Supplemental Terms: Each AI Feature will be subject to supplemental terms specifying the data processed, the purpose, the model architecture (at a high level), and any additional data protection commitments relevant to that Feature.

3.4 Infrastructure

The Platform's primary infrastructure is hosted on dedicated VPS infrastructure located in Mumbai, India ("Primary Infrastructure"), which currently hosts the API Gateway, Encryption Server, Anonymization Server, and PostgreSQL database. Encrypted database backups are stored with approved third-party sub-processors as documented in the sub-processor list at www.cipherion.in/sub-processors. Infrastructure may be expanded to support additional services and regions as the Platform grows, subject to the sub-processor notification obligations in Section 13.5.

3.5 Platform Changes

Cipherion reserves the right to update, modify, add to, or discontinue specific features or capabilities of the Platform to maintain security standards, adapt to emerging threats, introduce new products, or comply with applicable law. Cipherion will provide reasonable advance notice of material changes where practicable, and will publish release notes for significant capability additions.

4. Multi-Regulatory Compliance & Shared Responsibility

Cipherion provides technical tools and contractual mechanisms designed to support compliance with global data protection standards across the full scope of the Platform's capabilities. However, use of the Service does not automatically guarantee the Client's legal compliance. Compliance is a shared responsibility.

• GDPR (EU) / UK GDPR: Cipherion acts as a Data Processor under Article 28 GDPR and processes personal data on behalf of the Client in accordance with the executed Data Processing Agreement (DPA). The Client acts as Data Controller and remains solely responsible for the lawful basis of processing.
• DPDP (India — Digital Personal Data Protection Act, 2023): Cipherion acts as a Data Processor/Data Fiduciary under the DPDP Act. Clients must obtain valid consent or establish a lawful basis before submitting personal data to the Service.
• HIPAA (US): Clients processing Electronic Protected Health Information (ePHI) must execute a Business Associate Agreement (BAA) with Cipherion prior to any processing. Processing ePHI without an executed BAA is a material breach of these Terms.
• CCPA/CPRA (California, US): Cipherion acts as a Service Provider. Clients must not direct Cipherion to Sell or Share personal information as defined under CCPA/CPRA.
• PCI-DSS: Cipherion provides field-level encryption and tokenization to help reduce PCI audit scope. Clients remain solely responsible for their own PCI Attestation of Compliance (AOC).
• NHS Data Security Standards (UK): Cipherion's security controls are designed to support clients operating within NHS data protection frameworks, including alignment with the principles of the Data Security and Protection Toolkit (DSPT). Clients are responsible for their own DSPT self-assessment and submission.

As new Additional Modules and AI Features are introduced, Cipherion will publish supplemental compliance guidance specifying how each new capability fits within the applicable regulatory frameworks listed above. Clients are responsible for assessing and ensuring their own compliance with applicable law when using any Additional Module.

5. Client-Controlled Key Architecture & Data Loss

Cipherion utilises a Client-Controlled Key Architecture for all encryption and decryption operations. This means:

• Cipherion does not store or have access to plaintext (unencrypted) personal data at any point. All data submitted to the Service is encrypted before any storage or transmission.
• Encryption key material (encrypted private keys, initialisation vectors, and key derivation salts) is stored in encrypted form within Cipherion's infrastructure, protected using AES-256 encryption and an additional obfuscation layer. This key material is protected by a passphrase or secret known only to the Client and never accessible to Cipherion in plaintext.
• Cipherion personnel cannot access, read, or decrypt Client data or Client encryption passphrases under any circumstances.
• AI Features and Additional Modules that process Client data do so on encrypted representations of that data or on metadata and structural information, and do not give Cipherion access to plaintext personal data.

Client Responsibilities and Data Loss Risk:

• Key and Credential Management: You are solely responsible for the management, backup, and safeguarding of your API keys, administrative credentials, passphrase secrets, and encryption context.
• No Passphrase Recovery: If you lose or forget your passphrase or other decryption secrets, Cipherion has no technical capability to recover your encrypted data. Cipherion expressly disclaims all liability for permanent data loss resulting from Client-side mismanagement, credential loss, or credential compromise.
• OTP and Session Security: One-time passwords (OTPs) generated for key operations are single-use, time-limited, and automatically purged from our systems within 24 hours of verification or expiry.

6. Acceptable Use

You agree not to use the Platform or any of its modules for any of the following:

• Any unlawful, fraudulent, abusive, or malicious purpose.
• Reverse engineering, decompiling, or attempting to derive the source code, model weights, or proprietary logic of any component of the Platform, including AI Features.
• Conducting unauthorised security testing, stress testing, or denial-of-service attacks against Cipherion infrastructure without prior written authorisation.
• Attempting to bypass API rate limits, security perimeters, access controls, or encryption mechanisms.
• Processing categories of sensitive personal data (including health, biometric, or financial data) without first executing the applicable regulatory agreement (BAA or DPA) with Cipherion.
• Uploading or transmitting malicious code, malware, or any content designed to disrupt, damage, or gain unauthorised access to any system.
• Using any AI Feature or Additional Module in a manner that violates applicable law, including using AI outputs to make automated decisions affecting individuals without the required legal basis or human oversight.

Violation of this Section constitutes a material breach of these Terms and entitles Cipherion to suspend or terminate the Service immediately without notice, without prejudice to any other remedies available at law or in equity.

7. Intellectual Property Rights

All rights, titles, and interests in the Platform — including but not limited to algorithms, API structures, encryption logic, SDK code, obfuscation layers, AI models, trained model weights, data classification logic, and software comprising any current or future module — remain the exclusive property of K3NP Cipherion Pvt. Ltd. and its licensors. Nothing in these Terms transfers any intellectual property rights to the Client.

Subject to your compliance with these Terms and payment of applicable fees, Cipherion grants you a limited, non-exclusive, non-transferable, revocable licence to integrate and use the Platform within your applications for the duration of your active subscription. This licence extends to any Additional Modules or AI Features you have subscribed to under an applicable Service Order.

Client data processed through the Platform remains the exclusive property of the Client. Cipherion acquires no rights in Client data by virtue of processing it through the Platform.

8. Privacy Policy Incorporation

Your use of the Service is governed by our Privacy Policy, incorporated herein by reference and available at www.cipherion.in. The Privacy Policy describes how we handle account metadata, billing information, audit logs, and any operational data generated by current and future Platform modules, and sets out Client rights under applicable law.

9. Fees and Payments

• Services are billed according to the agreed pricing plan or Service Order in force at the time of use. Additional Modules and AI Features may be subject to separate pricing as set out in the applicable Service Order.
• Failure to remit payment by the due date may result in suspension of Platform access after reasonable written notice.
• Fees are non-refundable except where required by applicable law or explicitly stated in a separate Service Level Agreement (SLA) or Service Order.
• Any applicable taxes (including GST, VAT, or equivalent) shall be payable by the Client in addition to the stated fees unless otherwise agreed in writing.

10. Limitation of Liability

To the maximum extent permitted by applicable law, Cipherion's total cumulative liability for any claim arising out of or in connection with the Platform — including any current module, Additional Module, or AI Feature — shall be limited to the total fees paid by the Client to Cipherion in the twelve (12) months immediately preceding the event giving rise to the claim.

Cipherion shall not be liable for indirect, incidental, special, punitive, or consequential damages, including loss of profits, loss of data, or loss of business opportunity, whether arising in contract, tort, or otherwise, even if advised of the possibility of such damages.

Nothing in this Section limits Cipherion's liability for: (a) death or personal injury caused by Cipherion's negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot be excluded or limited under applicable law, including obligations under data protection law arising from Cipherion's role as Data Processor/Data Fiduciary.

Clients in regulated verticals (HIPAA, GDPR) may negotiate enhanced liability terms within a separate SLA or Service Order. Contact official@cipherion.in.

11. Service Availability

Cipherion will use commercially reasonable efforts to maintain the availability of its API endpoints and Platform services. Target availability metrics, credit mechanisms, maintenance windows, and measurement methodologies for specific modules are set out in the applicable SLA Schedule forming part of the Client's Service Order. Where no separate SLA is in place, Cipherion provides the Service on an "as available" basis.

Cipherion is not liable for service interruptions caused by: planned or emergency maintenance (with reasonable advance notice where practicable); failures of underlying VPS providers, cloud infrastructure, or global internet infrastructure; Client-side implementation errors or misconfiguration; or Force Majeure events including natural disasters, acts of war, civil unrest, pandemic, or government action.

SLA terms for Additional Modules and AI Features will be specified in the supplemental product terms applicable to those modules at time of release.

12. Termination & Post-Termination Data Handling

Upon termination or expiry of your subscription, the following shall apply:

• Platform Access Revocation: Access to the Cipherion Data Security Platform — including all APIs, SDKs, dashboards, and all subscribed modules (including any Additional Modules and AI Features) — will be revoked on the effective termination date.
• Client Pre-Termination Obligation: It is the Client's sole responsibility to export, rotate, migrate, decrypt, or otherwise manage their data from all active Platform modules prior to the effective termination date. Cipherion is not responsible for data that remains encrypted, tokenized, or otherwise inaccessible after termination due to the absence of active Platform access.
• Personal Data Deletion: Personal data held by Cipherion (including account metadata, configuration data, and audit logs) will be deleted or rendered permanently inaccessible within thirty (30) days of the effective termination date, except where retention is required by applicable law. Automated database backups are maintained on a thirty (30) day rolling cycle and overwritten thereafter. Cipherion will provide written confirmation of deletion upon written request.
• Restricted Retention: Where retention of personal data is legally required beyond the thirty (30) day window, Cipherion will restrict processing of such data to the minimum extent necessary for the legal purpose only.

13. Governing Law & Dispute Resolution

These Terms shall be governed by and construed in accordance with the laws of India, without regard to its conflict of law principles.

For Clients domiciled in India: The courts of Belagavi, Karnataka shall have exclusive jurisdiction to resolve any dispute arising in connection with these Terms.

For International Clients (outside India): Any dispute, controversy, or claim arising out of or relating to these Terms, or the breach, termination, or validity thereof, shall be finally settled by arbitration administered under the rules of the Singapore International Arbitration Centre (SIAC), with the seat of arbitration in Singapore, conducted in the English language. The number of arbitrators shall be one (1) unless the parties mutually agree otherwise.

Notwithstanding the foregoing, nothing in this Section shall limit: (a) either party's right to seek interim injunctive relief; or (b) Cipherion's obligations under applicable data protection laws, including the right of data subjects to lodge complaints with the relevant supervisory authority.

14. Data Protection & Global Privacy Compliance

This Section governs all processing of personal data carried out by Cipherion on behalf of the Client across all current and future modules of the Platform. It is intended to satisfy the requirements of GDPR (EU), UK GDPR, DPDP (India), CCPA/CPRA (California), HIPAA (US), and other applicable data protection laws. In the event of conflict between this Section and other parts of these Terms, this Section shall prevail with respect to personal data processing.

14.1 Roles of the Parties

Cipherion acts as: Data Processor under GDPR (EU) and UK GDPR; Data Processor / Data Fiduciary under the DPDP Act, 2023 (India); Service Provider under CCPA/CPRA (California, US); and Business Associate under HIPAA (US) where a BAA is executed. The Client acts as Data Controller / Business and determines the purposes and means of processing. These roles apply to all current Platform capabilities and to any Additional Modules or AI Features the Client subscribes to, unless a supplemental product term specifies otherwise.

14.2 Scope of Processing

Cipherion processes personal data solely for the purpose of providing the Cipherion Data Security Platform as instructed by the Client. Depending on the modules subscribed to, processing operations may include:

• Encryption, decryption, tokenization, anonymization, pseudonymization, and data masking operations on data submitted by the Client via API or SDK;
• Secure key management operations including key generation, storage (in encrypted form), rotation, and revocation;
• For AI Features: structural analysis, metadata processing, pattern detection, and data classification on encrypted representations or de-identified data — but never on plaintext personal data accessible to Cipherion;
• For Additional Modules: such data processing operations as are described in the supplemental product terms applicable to each module;
• Audit logging, request logging, and system monitoring metadata as described in Section 14.9;
• OTP generation and verification for key management operations.

Cipherion shall not process personal data for any purpose other than as documented in these Terms, any applicable supplemental product terms, and as instructed by the Client. As new modules are added, processing scope will be documented in the applicable supplemental terms and updated in the Data Processing Agreement (DPA) Schedule.

14.3 Processing Instructions

Cipherion processes personal data only on documented instructions from the Client, as provided through API usage, SDK configuration, and dashboard settings. Where Cipherion is required by applicable law to process personal data beyond the Client's instructions, it shall inform the Client before processing, unless prohibited by law.

14.4 Security Measures

Cipherion implements appropriate technical and organisational measures (TOMs) across all Platform modules, including:

• AES-256 encryption for all data at rest, including encrypted key material;
• TLS 1.2 or higher for all data in transit;
• A proprietary obfuscation layer applied to encrypted outputs;
• Role-based access controls (RBAC) and multi-factor authentication (MFA);
• Comprehensive audit logging and real-time security monitoring;
• Regular vulnerability assessments and penetration testing;
• Employee data protection training and contractual confidentiality obligations.

Security measures for Additional Modules and AI Features will be documented in supplemental product terms prior to their general availability release.

14.5 Sub-Processors

Current approved sub-processors are listed in the table below and at www.cipherion.in/sub-processors. The Client grants general written authorisation for Cipherion to engage sub-processors as listed. Cipherion will notify Clients at least fourteen (14) days before adding or replacing any sub-processor.

As Additional Modules and AI Features are introduced, any new sub-processors required to deliver them will be added to this list with fourteen (14) days' advance notice to Clients.

14.6 International Data Transfers

Cipherion's primary infrastructure is in Mumbai, India. Transfer safeguards: EU/EEA Clients — SCCs (Module 2) with all relevant sub-processors including Cloudflare; UK Clients — UK IDTAs where applicable; Indian Clients — compliance with DPDP Act cross-border transfer restrictions; all other jurisdictions — adequacy decisions or appropriate contractual safeguards. Transfer mechanisms for Additional Modules will be documented in supplemental terms.

14.7 Data Subject Rights

Cipherion shall provide reasonable technical assistance across all Platform modules to enable Clients to fulfil data subject rights obligations including: Right of Access (Art. 15 GDPR / Sec. 11 DPDP); Right to Rectification (Art. 16 GDPR); Right to Erasure (Art. 17 GDPR / Sec. 12 DPDP); Right to Restriction (Art. 18 GDPR); Right to Data Portability (Art. 20 GDPR); Right to Opt-Out of Sale/Sharing (CCPA/CPRA). All requests must be initiated by the Client as Data Controller. Cipherion will not respond directly to data subjects without Client authorisation.

14.8 Data Breach Notification

Cipherion will notify the Client within forty-eight (48) hours of becoming aware of a personal data breach affecting Client data processed through any Platform module. Notification shall include: nature and category of breach; categories and approximate number of data subjects and records affected; likely consequences; and measures taken or proposed. The Client remains responsible for notifying the relevant supervisory authority (within 72 hours under GDPR; as prescribed under DPDP Act 2023) and affected data subjects.

14.9 Data Retention

Retention schedules across the Platform:

14.10 CCPA / CPRA Obligations

Cipherion acts as a Service Provider for California residents' personal information across all Platform modules. Cipherion shall not Sell or Share personal information; shall not retain, use, or disclose it for any commercial purpose other than providing the Service; shall not process Sensitive Personal Information beyond what is strictly necessary; and certifies compliance with all applicable CCPA/CPRA Service Provider obligations. These commitments apply to all current modules and any Additional Modules or AI Features.

14.11 HIPAA Compliance

Where the Client is a Covered Entity or Business Associate under HIPAA/HITECH, a separate Business Associate Agreement (BAA) must be executed before any ePHI is processed through any Platform module. The BAA governs all processing of ePHI regardless of which module is used. Contact official@cipherion.in to request a BAA.

14.12 Data Protection Contact

Clients, data subjects, and supervisory authorities may contact Cipherion's privacy team at official@cipherion.in for data protection concerns, DPA or BAA requests, data subject rights assistance, or regulatory correspondence.

14.13 Data Minimisation

Cipherion processes only the minimum amount of personal data necessary to provide the Service across all modules, consistent with GDPR Article 5(1)(c), DPDP Act 2023, and equivalent provisions. This principle extends to all Additional Modules and AI Features, which are designed to process the minimum data required to deliver the specific feature output.

14.14 OTP and Session Data

OTP records (VERIFIED or EXPIRED) are automatically purged within twenty-four (24) hours. Session tokens are invalidated on logout or expiry. These retention rules apply across all Platform modules.

14.15 Backup and Recovery

Cipherion performs periodic encrypted backups for disaster recovery. Backups are stored with Cloudflare R2 on a 30-day rolling cycle and overwritten thereafter. Deletion from active systems does not result in immediate deletion from backups. Backup data is processed only for restoration purposes.

14.16 Audit Rights

Cipherion will make available all information reasonably necessary to demonstrate compliance with this Section 14. Audits by the Client or mandated third-party auditors are supported subject to thirty (30) days' written notice, agreed scope, and NDA execution. Third-party certifications (e.g., ISO 27001, SOC 2) may be provided in lieu of on-site inspection at Cipherion's discretion.

14.17 DPIA Assistance

Cipherion shall provide reasonable assistance to the Client in fulfilling DPIA obligations under GDPR Article 35 and equivalent provisions, including for AI Features where a DPIA is required before activation.

15. Contact Us

For all legal notices, compliance documentation, DPA or BAA execution, security disclosures, or data subject rights enquiries: