Terms of service
These terms govern the use of ARCA Vault (the «Service»), a product of ARCA Compliance (the «Provider»). By creating an organization or using the Service you accept them on behalf of the organization you represent (the «Customer»).
This text is a draft prepared for legal review. It is not final, it may change before ARCA Vault is offered commercially, and the passages marked as pending have yet to be completed by ARCA Compliance.
1. The Service
ARCA Vault is a document storage service. The Customer uploads documents and whole folders, organizes them, keeps their versions, sets until when they must be kept and places legal holds on them, receives files from people outside the organization through file requests, shares them with the people of its organization or with people outside it, exports them with a manifest that lets them be verified, and recovers what it deleted within the period it chooses. Every document is encrypted before it is stored.
The Service keeps and protects the documents; it does not read, interpret or validate their contents. The Customer remains solely responsible for what it stores, for whom it shares it with, for the permissions it grants and for meeting the record-keeping obligations that apply to it. The Provider does not give legal advice.
2. Documents and encryption
Each document is encrypted with a key derived for it from the Service's master key before it is written to storage, and the storage underneath encrypts it again at rest. Downloads use links signed by the Service that expire within the hour. The Provider's staff do not open the Customer's documents except to operate the Service under the Customer's instructions or when the law requires it.
The Service checks every upload against its size limits and the file types it accepts, scans its content for malware before storing it and refuses a file in which malware is detected, and generates previews and thumbnails where the type allows. No scanner detects everything: the Customer remains responsible for what it uploads and for what its people open.
3. Accounts
Accounts are created and managed on the ARCA Compliance platform, which authenticates every person who signs in to the Service. The Customer is responsible for the people it invites, for the roles it gives them, for keeping credentials confidential and for every action taken through its accounts, including the shares its people create. The Customer must give accurate organization and contact details and keep them current.
4. Acceptable use
The Customer may use the Service only to store, organize and share documents it has the right to hold, for the purposes of its own activity and in compliance with applicable law, including data protection and intellectual property law.
The Customer must not store or share unlawful content; upload material it has no right to process; use the Service to distribute malware or spam; interfere with the Service or its limits; attempt to access other customers' documents; or resell the Service.
5. Sharing
A share inside the organization grants the recipient the permission level the sharer chose (view, download, edit). A share with someone outside the organization is a link, with an optional message and an expiry date, that opens the document or folder without an account; the sharer may also protect it with a password, a limit on downloads and a watermark that marks images and PDFs with the recipient's address and the date. Whoever holds the link, and its password when there is one, can open it until it expires, is revoked or reaches its limit.
The Customer is responsible for the shares its people create, for the expiry dates they set and for revoking a share when it is no longer needed. The Service records every share, its recipient and its use.
A file request is a link through which someone outside the organization sends files into a folder the Customer chose, without an account. The files become the Customer's documents and are checked like any upload; the Customer is responsible for whom it sends the link to and for closing the request when it is no longer needed.
6. API
Access to the API uses credentials issued through the ARCA Compliance platform, limited by scopes (`vault:read`, `vault:write`). Requests are subject to rate limits, and the Idempotency-Key lets a retry return the original result instead of storing a document twice. The Provider may change the API with reasonable notice; breaking changes are announced in advance.
7. Subscription, quotas and trial
Plans and prices are [PENDING: plans and prices]. Each plan sets a storage quota and limits on documents and external shares; the limits warn at 80 % and 100 % and the Service may refuse new uploads once the quota is exceeded [PENDING: quota enforcement]. Subscriptions, invoicing and payments are handled by the ARCA Compliance platform under its own terms. A subscription that lapses may limit or suspend the Service until it is renewed; the Customer's documents are kept as described in the Privacy policy.
8. Availability and no warranty
The Service is provided «as is» and «as available». The Provider makes reasonable efforts to keep it running and the documents intact, keeps copies of the storage [PENDING: backup policy] and recovers documents from them when needed, but does not warrant uninterrupted availability. The Customer is encouraged to keep its own copies of documents critical to its activity.
9. Limitation of liability
To the extent permitted by law, the Provider is not liable for indirect, incidental or consequential damages, lost profits, regulatory penalties or the consequences of a lost, altered or disclosed document arising from the use of or inability to use the Service, except where caused by the Provider's gross negligence or wilful misconduct. The Provider's total liability for any claim is limited to the fees the Customer paid for the Service in the twelve months before the event giving rise to the claim.
10. Termination
The Customer may stop using the Service at any time by closing its organization on the ARCA Compliance platform. The Provider may suspend or terminate access for breach of these terms, non-payment or legal requirement, with notice where practicable. After termination the Customer may export its documents during a grace period of 30 days; documents are then deleted in line with the Privacy policy.
11. Changes
The Provider may update these terms. Material changes are announced in the Service or by email at least 15 days before they take effect. Continued use after that date is acceptance of the new terms.
12. Governing law and contact
These terms are governed by the laws of [PENDING: jurisdiction], and any dispute is subject to the courts of [PENDING: jurisdiction], without prejudice to mandatory provisions that apply to the Customer. Questions about these terms go to [PENDING: contact email].