Terms of service

These terms describe the basis on which Baobyte Consulting Limited (“Baobyte”) makes the Baobyte AML Suite (the “Platform”) available to a customer institution (“you”).

The contracting entity details and the relationship between these terms and a signed master agreement have not been settled. Where an executed agreement exists between you and Baobyte, that agreement governs and these terms are subordinate to it; the order of precedence must be stated expressly before adoption.

The Platform is enterprise software for regulated institutions. It is not offered to consumers and is not intended for personal use.

• Platform — the Baobyte AML Suite software, its documentation, and any updates made available to you.
• Customer Data — data you or your users submit to, or generate within, your tenant, including customer records, transactions, alerts, cases, reports and audit events.
• Tenant — the isolated logical instance of the Platform allocated to you.
• Deployment — the environment in which the Platform runs, which may be operated by you or, where agreed, by Baobyte.
• Order — the document recording the subscription, its scope, term and fees.
• Content Pack — versioned regulatory content such as rules, risk weights and report templates, distributed with a cryptographic signature.
• Documentation — the controlled document set describing the Platform’s design, configuration, operation and controls.

The Order records what you have subscribed to: the modules enabled, the deployment shape, the number of tenants and users or other measure of scale, the term, and the fees. Nothing in these terms grants access to a module not named in an Order.

Usage measurement exists in the Platform and is visible to you. Where an Order sets a volume boundary, exceeding it is a commercial conversation and not a technical cut-off: the Platform will not silently stop processing AML data because a threshold was crossed.

Subject to these terms and payment of the fees, Baobyte grants you a non-exclusive, non-transferable, non-sublicensable right, during the term, to use the Platform for your own internal anti-money-laundering, counter-terrorist-financing and related compliance purposes, and to allow your personnel and authorised contractors to do so on your behalf.

You may not:

• provide the Platform as a service to a third party, other than as expressly agreed;
• reverse engineer, decompile or disassemble the Platform except to the extent that applicable law expressly permits it notwithstanding this restriction;
• remove or obscure any proprietary notice, or attempt to circumvent a licence, signature verification or approval control;
• redistribute watchlist, sanctions or other licensed reference data supplied through the Platform, except as the data licence permits; or
• use the Platform in breach of the acceptable use policy.

The Platform is a tool your compliance programme uses. It is not the programme. You remain responsible for:

• your own AML/CFT policies, risk appetite, thresholds, rule configuration and the adequacy of your controls;
• every regulatory determination — whether a customer is accepted, whether an alert is a true match, whether a case warrants a report, and what is filed;
• the accuracy, legality and lawful basis of the Customer Data you submit, and the notices and rights of the individuals it concerns;
• administering your identity provider, your users, their roles and their deprovisioning;
• in an institution-operated deployment: infrastructure, backups, restore testing, key escrow, TLS certificates, network controls and monitoring, as described in the infrastructure requirements; and
• keeping credentials confidential, including service-account credentials which are revealed once and never retrievable afterwards.

The Platform supports an institution-operated deployment — a single node on your own infrastructure, including air-gapped, or your own Kubernetes cluster — and, where agreed, a Baobyte-operated deployment.

In an institution-operated deployment, you operate the database, the evidence store, the identity provider, the network and the backups. Baobyte supplies the software, its configuration contract and support. Availability, recovery point and recovery time are consequences of your infrastructure decisions, and the Platform cannot take a backup, escrow a key or renew a certificate on your behalf.

In a Baobyte-operated deployment, the operational responsibilities that transfer to Baobyte, and the subprocessors involved, must be set out in the Order and in the data processing agreement. No such deployment is currently offered, and its terms have not been settled.

No commercial terms are stated in this draft. Fees, currency, invoicing frequency, payment periods, late-payment consequences, renewal uplift and tax treatment — including Nigerian value added tax and withholding tax — are all to be set out in the Order and confirmed by counsel and finance.

Term length, renewal mechanics and notice periods are not stated in this draft.

Either party may terminate for material breach that is not remedied within a reasonable cure period, or on the other party’s insolvency. On termination your right to use the Platform ends.

A wind-down period matters more here than in ordinary software. Your AML records are subject to statutory retention and may be subject to legal holds; you will need a defined period, and a defined mechanism, to export your Customer Data and its audit evidence in a form an examiner will accept. That period and mechanism must be agreed before adoption and stated here.

Baobyte may suspend access where there is a serious and immediate security risk, where required by law, or on a material unremedied breach of the acceptable use policy. Suspension will be limited to what the circumstances require and, where lawful and practicable, notice will be given first. Because suspension of an AML platform can put a regulatory deadline at risk, the circumstances, the notice route and any carve-out for continued read access to filing evidence must be agreed by counsel before adoption.

Each party will protect the other’s confidential information with at least reasonable care, use it only for the purposes of the agreement, and disclose it only to those who need it and are bound by equivalent obligations. The usual exceptions apply for information that is public through no breach, independently developed, or lawfully received from a third party. Where disclosure is compelled by law, the disclosing party will give notice where it is lawfully able to.

Baobyte and its licensors retain all rights in the Platform, its documentation and its content packs. You retain all rights in Customer Data. Nothing in these terms transfers ownership of either.

Feedback you volunteer about the Platform may be used without restriction or obligation. That does not extend to Customer Data, and it does not permit the use of your name as a reference or the publication of a case study without your separate written consent.

Where Baobyte processes personal data on your behalf, it does so as a processor under the data processing agreement, which forms part of the agreement between us. The privacy policy describes the processing for which Baobyte is itself a controller. Both are drafts pending legal review.

The support model — tiers, ticket requirements, severity definitions, support access controls and change management — is described at support.

No response time, restoration time or availability commitment is stated in this draft. Those are contractual terms to be agreed in a service level agreement per customer. Anything indicative published on the support pages is a starting point for that negotiation and is not a guarantee.

Baobyte warrants that it will provide the Platform with reasonable skill and care and in accordance with its documentation.

The Platform does not provide legal, regulatory or compliance advice, and nothing it produces is a determination of an institution’s obligations. It applies the rules, thresholds and mappings you configure. Whether a customer is accepted, whether a match is a true hit, whether conduct is suspicious, whether a report must be filed, and what is filed, are your decisions and your regulatory responsibility.

Two limitations are stated plainly rather than buried. First, no detection system finds everything: rule-based monitoring produces false positives and false negatives, and a clean screening result means only that the configured lists, as versioned at that moment, produced no match. Second, report schemas must be validated against an authoritative regulator artefact before use; the Platform refuses to submit a report generated against an unvalidated schema, and it is your responsibility to obtain and confirm the authoritative artefact.

To the fullest extent permitted by law, and except as expressly stated, all other warranties, conditions and terms, whether express or implied by statute, common law or otherwise, are excluded. Counsel must confirm the enforceability of this exclusion.

No limitation or cap is stated in this draft. This clause has been left deliberately empty rather than filled with an indicative figure, because a placeholder cap adopted unread is worse than an absent one.

Counsel must settle, at minimum:

• the liabilities that cannot lawfully be limited, and are therefore carved out;
• whether a separate, higher cap applies to a data protection breach or a confidentiality breach;
• the heads of loss excluded, and how regulatory fines incurred by the institution are treated — the most commercially significant question in this clause for an AML product; and
• the shape and quantum of the general cap.

No indemnity is offered or accepted in this draft. Whether Baobyte gives an intellectual-property indemnity, on what conditions, and whether any indemnity is required from the customer in respect of Customer Data, are open questions for counsel.

Neither party is liable for a failure or delay caused by an event beyond its reasonable control, provided it notifies the other and takes reasonable steps to mitigate. This does not excuse an obligation to pay sums already due. Because an AML filing deadline is not suspended by a force majeure event affecting a vendor, the continuity plan’s escalation route — preserve the events, escalate the deadline, and do not file unvalidated output — applies regardless.

Baobyte may improve the Platform, and will not materially reduce its core functionality during a paid term without notice and a right to terminate. Changes to regulatory content — rules, risk weights, report mappings, watchlists — run through the Platform’s own proposal, approval and activation flow, so they are visible, versioned and attributable rather than applied silently. The notice route and period for changes to these terms must be settled by counsel.

Neither party may assign the agreement without the other’s consent, which is not to be unreasonably withheld, except to an affiliate or in connection with a merger or a transfer of substantially all assets. Baobyte may engage subprocessors as permitted by the data processing agreement, and remains responsible for their acts and omissions. The current state of the subprocessor register is published at trust centre → subprocessors.

Governing law, jurisdiction and the dispute-resolution route are not stated in this draft. The Platform is built for the Nigerian regulatory environment and Nigerian law is the expected choice, but the forum, the escalation steps before formal proceedings, and any arbitration rules and seat must be settled by counsel rather than assumed.

Notices under the agreement should be given in writing to the addresses recorded in the Order. The notice addresses and the rules on when a notice is deemed received are not stated in this draft. Operational communications — maintenance, incidents, support — follow the routes described at support and are not a substitute for a contractual notice.

The agreement is the entire agreement between the parties on its subject matter and supersedes prior discussions. If a provision is held unenforceable, the remainder continues in effect. A failure to enforce a right is not a waiver of it. Nothing creates a partnership, agency or employment relationship, and there are no third-party beneficiaries.