/* ============================================================ NeuroRoute — Legal pages: Privacy Policy, Terms of Service, Code of Business Conduct. Structure follows the three reference documents supplied by the business (scaleflow.cloud term/privacy/code), but the CONTENT is rewritten for what NeuroRoute actually is and does. The reference set is a brochure-website template: it names another company throughout, cites no modern privacy statute, discloses no sub-processors and grants no data-subject rights beyond "email us". NeuroRoute is a multi-tenant SaaS that processes customer prompts and forwards them to third-party AI providers, so it is a PROCESSOR as well as a controller and needs the corresponding disclosures. Copying the template verbatim would have understated our obligations and contradicted the retention, encryption, erasure and export capabilities we already ship and market. !! THREE FACTS BELOW ARE PLACEHOLDERS AND MUST BE CONFIRMED BY COUNSEL BEFORE THESE PAGES ARE PUBLISHED — see LEGAL_ENTITY, LEGAL_ADDRESS and GRIEVANCE_OFFICER. They are deliberately conspicuous rather than invented. Globals used: React, Icon, LogoMark, CloudWorxMark, go Exposes: window.PAGES.privacy / .terms / .code ============================================================ */ const {useEffect: useEffectLG} = React; /* ---------- facts that must be confirmed before publishing ---------- */ /* CONFIRM BEFORE PUBLISHING — the contracting entity. sislcloudworx.ai's own privacy page names "SISLCloudWorx Pvt. Ltd." with @sislcloudworx.com contacts, while every NeuroRoute address is @sislinfotech.com. Those cannot both be the counterparty on a customer contract, and the wrong one on a signed agreement is a real problem. Set this to whichever entity actually signs and make the two sites agree. */ const LEGAL_ENTITY = 'SISLCloudWorx Pvt. Ltd.'; const LEGAL_SHORT = 'SISLCloudWorx'; /* Registered office as published on sislcloudworx.ai — not invented here. */ const LEGAL_ADDRESS = 'A-10/11, Mohan Cooperative Industrial Estate, Mathura Road, New Delhi – 110 044, India'; /* STILL OUTSTANDING — the IT Rules 2021 and the DPDP Act both require a NAMED grievance officer, not a role title. Published as a role for now so the page reads as a working contact rather than an unfilled template, but this does NOT satisfy either instrument: replace with the individual's name as soon as one is designated. */ const GRIEVANCE_OFFICER = 'The Grievance Officer'; const LEGAL_EFFECTIVE = '27 July 2026'; /* CONFIRM BEFORE PUBLISHING — privacy@ and legal@ are the right addresses to publish, but they must actually receive mail. A policy that names a contact nobody monitors fails the very obligation it is meant to discharge. Until they are provisioned, point them at a verified mailbox. */ const PRIVACY_EMAIL = 'privacy@sislcloudworx.com'; const LEGAL_EMAIL = 'legal@sislcloudworx.com'; const SALES_EMAIL = 'CloudSales@sislinfotech.com'; /* Sub-processors. This list is the set of providers ACTUALLY configured in production (verified against the deployed service's credentials), not the set of adapters the codebase can support. Listing a provider we do not use is as much a defect as omitting one we do — a customer's transfer impact assessment depends on this being exact. Update it whenever a provider key is added or removed in production. */ const SUBPROCESSORS = [ ['Google Cloud Platform', 'Hosting, database, cache, object storage, key management', 'India (asia-south1, Mumbai)'], ['Google Cloud Vertex AI', 'AI model inference; text embeddings for optional semantic cache', 'India / global endpoints'], ['Anthropic', 'AI model inference (Claude models)', 'United States'], ['DeepInfra', 'AI model inference (open-weight model catalogue)', 'United States'], ['Microsoft (Graph)', 'Transactional email delivery only — no customer prompt content', 'European Union / global'], ]; /* ---------- shared page chrome ---------- */ function LegalPage({eyebrow, title, updated, intro, sections, footNote}){ useEffectLG(function(){ window.scrollTo(0, 0); }, []); return (
{eyebrow}

{title}

Effective {updated} · {LEGAL_ENTITY}
{intro &&
{intro}
}
Contents
    {sections.map(function(s, i){ return
  1. {s.t}
    2. ; })}
{sections.map(function(s, i){ return (

{(i+1) + '. ' + s.t}

{s.b.map(function(block, j){ return ; })}
); })} {footNote &&
{footNote}
}
); } /* A block is either a paragraph string, {ul:[...]}, or {table:{head:[],rows:[[]]}}. */ function LegalBlock({block}){ if(typeof block === 'string') return

{block}

; if(block.ul) return ; if(block.callout) return
{block.callout}
; if(block.table){ return (
{block.table.head.map(function(h,i){ return ; })} {block.table.rows.map(function(r,i){ return {r.map(function(c,j){ return ; })}; })}
{h}
{c}
); } return null; } /* ============================================================ PRIVACY POLICY ============================================================ */ function PrivacyPage(){ const sections = [ {t:'Who we are, and which hat we are wearing', b:[ LEGAL_ENTITY + ' ("' + LEGAL_SHORT + '", "we", "us") operates NeuroRoute, an AI model routing platform available at neuroroute.sislcloudworx.ai. Our registered office is ' + LEGAL_ADDRESS + '.', 'This policy distinguishes two very different roles, because your rights differ depending on which applies:', {ul:[ 'As a CONTROLLER — for people who visit our website, submit a sales enquiry, or hold a NeuroRoute account. We decide why and how that data is processed, and this policy is the notice for it.', 'As a PROCESSOR — for the prompts, responses and other content your applications send through the NeuroRoute API. That content belongs to our customer. We process it only on the customer\'s documented instructions, under the Terms of Service and any Data Processing Agreement. If you are an end user of a company that uses NeuroRoute, that company is your controller and you should contact them first.', ]}, ]}, {t:'Information we collect', b:[ {table:{head:['Category','Examples','Where it comes from'], rows:[ ['Account data','Name, work email, organisation, role, authentication identifiers','You, or your organisation admin, at sign-up / Google sign-in'], ['Sales enquiry data','First and last name, company, designation, work email, mobile number, chosen solution, free-text message','The enquiry form on our website'], ['Usage metadata','Timestamps, model selected, token counts, latency, cost, request and organisation identifiers, routing decisions','Generated automatically when you call the API'], ['Customer content','Prompts, conversation history and model responses','Sent by your application. Stored only where your retention mode permits — see section 3'], ['Billing data','Plan tier, invoices, consumption records','Generated by the platform'], ['Technical data','IP address, browser and device information, security and audit events','Your browser and our infrastructure logs'], ]}}, 'We do not use customer content to train any model, ours or a third party\'s, and we do not sell personal information.', ]}, {t:'Customer content and retention modes', b:[ 'Retention of customer content is a per-organisation setting, not a single policy, and every API response states which mode served it in the X-Data-Retention header so you can verify it from your own logs rather than take our word for it.', {table:{head:['Mode','What is stored'], rows:[ ['zero-strict','Nothing. Response caches are bypassed on read and write, conversation memory is refused, and provider-side prompt caching is disabled.'], ['zero','Nothing is persisted by NeuroRoute. Provider-side prompt caching may apply.'], ['retain','Conversations and cache entries are stored for the number of days the organisation configures (1–365), encrypted at rest, then deleted by an automated sweeper.'], ]}}, {callout:'New organisations default to "zero". Usage metadata (section 2) is always retained regardless of mode — it is how we bill and how you audit spend — but it never contains prompt or response text.'}, ]}, {t:'Why we process it, and on what legal basis', b:[ {table:{head:['Purpose','Basis (GDPR/UK GDPR)','Basis (India DPDP Act, 2023)'], rows:[ ['Providing the platform to an account holder','Performance of a contract (Art. 6(1)(b))','Performance of a contract / legitimate use'], ['Responding to a sales enquiry you submitted','Steps prior to a contract at your request (Art. 6(1)(b))','Consent, given when you submit the form'], ['Billing, fraud prevention, security, abuse limits','Legitimate interests (Art. 6(1)(f))','Legitimate use'], ['Verifying your email by one-time code','Performance of a contract / legitimate interests','Consent'], ['Marketing communications','Consent (Art. 6(1)(a)), withdrawable at any time','Consent, withdrawable at any time'], ['Meeting statutory and tax obligations','Legal obligation (Art. 6(1)(c))','Legal obligation'], ]}}, 'Where we rely on consent you may withdraw it at any time; withdrawal does not affect processing already carried out.', ]}, {t:'Sub-processors and third-party AI providers', b:[ 'Routing a request means sending it to an AI provider. This is the most important disclosure in this policy: the content of your prompt leaves our infrastructure and is processed by the provider that serves it, under that provider\'s own terms.', 'The following sub-processors are engaged in production today:', {table:{head:['Sub-processor','Purpose','Processing location'], rows: SUBPROCESSORS}}, {ul:[ 'Bring Your Own Key (BYOK): where you supply your own provider credentials, the request is billed to and governed by your own account with that provider, and your relationship is direct with them.', 'We will give notice before adding a new sub-processor that handles customer content, so that customers with a Data Processing Agreement can object.', 'Our AI providers are engaged under terms that prohibit training on customer content. We do not control, and do not warrant, providers you configure yourself.', ]}, ]}, {t:'International transfers', b:[ 'The NeuroRoute platform is hosted in India (Google Cloud asia-south1, Mumbai) and customer content stored under "retain" mode stays there.', 'Inference is different. Some AI providers listed above process requests in the United States or on multi-region endpoints, so a prompt may be transferred outside your country at the moment it is routed. For transfers of personal data out of the EEA or the UK we rely on the European Commission\'s Standard Contractual Clauses together with the UK Addendum, and on the transfer terms in each provider\'s data processing agreement.', 'If you need inference confined to a specific jurisdiction, use a per-key model allowlist or a self-hosted model endpoint, or contact us before you send regulated data.', ]}, {t:'How long we keep it', b:[ {table:{head:['Data','Retention'], rows:[ ['Customer content','Per your retention mode — nothing at all, or 1–365 days as configured (section 3)'], ['Usage and billing metadata','Retained for the life of the account and then as required for tax and accounting law'], ['Account data','For the life of the account; anonymised on erasure'], ['Sales enquiry data','Up to 24 months from last contact, unless you ask us to delete it sooner'], ['One-time verification codes','5 minutes, stored only as a hash'], ['Security and audit events','Retained to evidence access to the platform'], ]}}, ]}, {t:'Your rights, and how to actually exercise them', b:[ 'Subject to the law that applies to you, you have rights of access, correction, erasure, restriction, objection, and portability, and the right not to be subject to a decision based solely on automated processing that produces legal effects. NeuroRoute\'s routing decisions select a model; they do not make decisions about people.', 'Several of these are self-service rather than a support ticket:', {ul:[ 'Portability and access — "Download my data" in Settings, or GET /v1/customer/export, returns your organisation\'s data as JSON or CSV/ZIP.', 'Erasure — an organisation admin can request erasure in-product. It runs after a 7-day cancellable grace period, deletes content, revokes credentials, anonymises identities, cryptographically destroys the organisation\'s encryption key so prior ciphertext including backups is unrecoverable, and issues a completion certificate. Billing metadata is retained on a lawful basis.', 'Correction — edit your profile in Settings, or contact us.', 'Objection and withdrawal of consent — email ' + PRIVACY_EMAIL + '.', ]}, 'We respond within 30 days (GDPR/UK GDPR) or 45 days (CCPA/CPRA, acknowledged within 10 business days), extendable where the law permits and we tell you why. There is no charge unless a request is manifestly unfounded or excessive.', 'If you are an end user whose data reached us through a customer\'s application, we will refer your request to that customer, who is your controller.', ]}, {t:'Security', b:[ {ul:[ 'Encryption in transit (TLS) and at rest. Stored conversation content is encrypted with a per-organisation AES-256-GCM data key, wrapped by a key in Google Cloud KMS.', 'Customer-managed encryption keys (CMEK) are available: the key lives in your cloud project, and revoking our access renders your stored content unreadable immediately.', 'Scheduled key rotation, and crypto-shredding on erasure.', 'Authentication by signed API keys, OAuth 2.1 for agent tooling, optional SSO (OIDC/SAML), and role-based access control.', 'Tenant isolation enforced in the data layer, an audit log of privileged actions, and metadata-only request logging — prompt and response bodies are not written to logs.', 'Egress from customer-supplied URLs is validated to prevent server-side request forgery.', ]}, 'No system is perfectly secure. We do not claim a certification we do not hold; if you need our current security documentation for a vendor review, ask at ' + LEGAL_EMAIL + '. Where a personal data breach is likely to result in a risk to individuals we notify the competent supervisory authority within 72 hours of becoming aware, and affected individuals and customers without undue delay.', ]}, {t:'Cookies', b:[ 'The NeuroRoute application sets only what it needs to work: a session cookie for authentication and preference storage for your dashboard. We do not run advertising cookies or cross-site trackers on the application.', 'Where analytics cookies are used on our marketing pages they are set only with your consent, and you can withdraw it at any time through your browser or our cookie controls.', ]}, {t:'Children', b:[ 'NeuroRoute is a business product and is not directed to children. We do not knowingly collect personal data from anyone under 18. Under the India DPDP Act, processing children\'s data requires verifiable parental consent, which our sign-up flow is not designed to obtain; if you believe a child has provided us data, contact us and we will delete it.', ]}, {t:'Changes to this policy', b:[ 'We may update this policy. Material changes affecting how we handle customer content will be notified to account holders by email or in-product notice before they take effect, and the effective date above will change. Continued use after that date means the updated policy applies.', ]}, {t:'Contact and grievance redressal', b:[ {ul:[ 'Privacy enquiries and data-subject requests: ' + PRIVACY_EMAIL, 'Grievance Officer (India, IT Rules 2021 and DPDP Act 2023): ' + GRIEVANCE_OFFICER + ', ' + PRIVACY_EMAIL, 'Postal: ' + LEGAL_ENTITY + ', ' + LEGAL_ADDRESS, ]}, 'We aim to acknowledge grievances within 24 hours and resolve them within 15 days, as the IT Rules require. If you are in the EEA or UK you also have the right to complain to your local supervisory authority; if you are in India, to the Data Protection Board.', ]}, ]; return Privacy Policy} updated={LEGAL_EFFECTIVE} intro={'How ' + LEGAL_ENTITY + ' collects, uses, shares and protects personal data in connection with NeuroRoute. It covers both the data we hold about you directly and the customer content your applications route through the platform.'} sections={sections} footNote="This policy describes controls the platform actually implements. Where a control is optional or tier-limited it says so." />; } /* ============================================================ TERMS OF SERVICE ============================================================ */ function TermsPage(){ const sections = [ {t:'Acceptance', b:[ 'These Terms of Service govern your access to and use of the NeuroRoute platform, website and APIs (the "Service"), operated by ' + LEGAL_ENTITY + ' ("' + LEGAL_SHORT + '", "we", "us"), registered at ' + LEGAL_ADDRESS + '.', 'By creating an account, calling the API, or otherwise using the Service you agree to these Terms. If you accept on behalf of an organisation you confirm you are authorised to bind it, and "you" means that organisation. If you do not agree, do not use the Service.', 'A separately signed order form, master agreement or Data Processing Agreement takes precedence over these Terms where they conflict.', ]}, {t:'Definitions', b:[ {ul:[ '"Customer Content" — prompts, conversation history, files and model responses you send through or receive from the Service.', '"Provider" — a third-party AI vendor whose models the Service can route to.', '"Output" — the response generated by a Provider for your request.', '"BYOK" — Bring Your Own Key, where you supply your own Provider credentials.', '"Usage Data" — metadata about your requests: model, tokens, latency, cost and routing decisions.', ]}, ]}, {t:'The Service and your account', b:[ 'The Service receives requests through an OpenAI-compatible API, selects a model according to the strategy and policies you configure, forwards the request to the relevant Provider, and returns the Output along with cost and routing metadata.', {ul:[ 'You are responsible for the security of your API keys and account credentials, and for all activity under them. Rotate or revoke a key immediately if it is exposed.', 'You must give accurate registration information and keep it current.', 'We may add, change or remove models and Providers. Model availability is determined by the Providers, not by us.', ]}, ]}, {t:'Acceptable use', b:[ 'You must not use the Service to:', {ul:[ 'break any applicable law, or infringe anyone\'s intellectual property, privacy or other rights;', 'generate or distribute unlawful material, including child sexual abuse material, content that incites violence, or targeted harassment;', 'attempt to defeat a Provider\'s safety systems, or breach a Provider\'s own usage policies — those apply to your traffic as well as ours;', 'send personal data of a category you are not lawfully permitted to process, or regulated data (for example health or payment card data) without first agreeing appropriate terms with us;', 'probe, scan, overload or attempt to gain unauthorised access to the Service or another tenant\'s data;', 'resell or provide the Service to a third party except as expressly permitted in writing;', 'use Outputs to train a competing model, or to represent machine-generated content as human-authored where doing so would mislead.', ]}, 'We may suspend access without notice where we reasonably believe continued use presents a security, legal or abuse risk, and will tell you why as soon as we can.', ]}, {t:'Ownership of content and Outputs', b:[ {ul:[ 'You retain all rights in your Customer Content. We claim no ownership of it.', 'As between you and us, and subject to each Provider\'s terms, you own the Outputs generated for your requests.', 'You grant us a limited licence to process Customer Content solely to operate the Service for you — route it, apply the features you enable, bill for it and support you. Nothing more.', 'We do not use Customer Content to train models, and we engage AI Providers under terms that prohibit them from doing so.', 'We own the Service itself, including the routing engine, dashboards, documentation and all improvements. Aggregated, de-identified Usage Data that cannot identify you or your content may be used to improve routing quality.', ]}, ]}, {t:'Third-party AI Providers', b:[ {callout:'Please read this section. The Service routes to models we do not operate, and their behaviour is outside our control.'}, {ul:[ 'Each Provider processes your request under its own terms and privacy policy. Our current sub-processors are listed in the Privacy Policy.', 'We are not responsible for a Provider\'s availability, latency, pricing changes, content filtering, model deprecation, or the substance of any Output.', 'Under BYOK, your contract for that inference is with the Provider; you are responsible for your own quota, spend and compliance with their terms.', 'A model may be withdrawn by a Provider at any time. Where we detect a model is unavailable we stop routing to it, which may change which model serves your traffic.', ]}, ]}, {t:'AI output — no reliance without review', b:[ 'AI models produce text probabilistically. Outputs can be inaccurate, incomplete, biased, out of date, or entirely fabricated while appearing confident.', 'You are responsible for reviewing Outputs before relying on them, and you must not use the Service as the sole basis for medical, legal, financial, employment, safety-critical or other consequential decisions about people. We make no warranty that any Output is accurate, fit for a particular purpose, or free of third-party rights.', ]}, {t:'Fees, billing and spend controls', b:[ {ul:[ 'Fees are the plan\'s flat monthly platform fee plus the metered per-token rate for your tier, as published or as set out in your order form.', 'Under BYOK you pay Providers directly. Under managed keys, Provider cost is passed through in addition to our platform fee.', 'Invoices are payable within the period stated on them. Overdue amounts may lead to suspension.', 'The Service provides budget caps at the run, key, workspace and organisation level. These are a control we offer, not a guarantee: they are enforced before a request is dispatched, but a request already in flight will complete, so actual spend can exceed a cap by up to the cost of one call. Setting and monitoring caps remains your responsibility.', 'Reported cost savings are estimates calculated against a published baseline model. They are illustrative, not a commitment.', 'We may change pricing on 30 days\' notice, effective at your next billing period.', ]}, ]}, {t:'Availability and support', b:[ 'We aim for high availability but the Service is provided without an uptime commitment unless a service level agreement is included in your plan or order form. Maintenance, Provider outages and force majeure events may interrupt access. Support channels and response targets depend on your tier.', ]}, {t:'Confidentiality', b:[ 'Each party may receive information the other treats as confidential. The recipient will use it only to perform under these Terms, protect it with at least reasonable care, and not disclose it except to personnel and advisers bound by equivalent obligations, or as legally compelled — in which case, where lawful, it will give notice first. These obligations survive termination.', ]}, {t:'Warranties and disclaimers', b:[ 'We warrant that we will provide the Service with reasonable skill and care.', 'Otherwise, and to the maximum extent the law allows, the Service is provided "AS IS" and "AS AVAILABLE" and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted, error-free, secure, or that any particular model, cost saving or Output quality will be achieved.', 'Nothing in these Terms excludes liability that cannot lawfully be excluded, including for death or personal injury caused by negligence, or for fraud.', ]}, {t:'Limitation of liability', b:[ 'Subject to the paragraph above, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data, however caused.', 'Each party\'s total aggregate liability arising out of or relating to these Terms is limited to the fees you paid or owed for the Service in the twelve months preceding the event giving rise to the claim. This cap does not apply to your payment obligations, or to either party\'s liability for breach of confidentiality or infringement of the other\'s intellectual property.', ]}, {t:'Indemnity', b:[ 'You will indemnify and hold us harmless against third-party claims arising from your Customer Content, your Outputs and how you use them, your breach of these Terms or of a Provider\'s terms, and your violation of any law or third-party right. We will notify you of any such claim, give you control of the defence, and cooperate reasonably at your expense.', ]}, {t:'Term, termination and getting your data out', b:[ {ul:[ 'These Terms run for as long as you use the Service. You may close your account at any time; we may terminate for material breach not cured within 30 days of notice, or immediately for the abuse grounds in section 4 or non-payment.', 'Before you leave, export your data with the self-service export described in the Privacy Policy. After termination we delete or return Customer Content in line with your retention mode and any Data Processing Agreement.', 'We retain billing and tax records as the law requires. Sections on ownership, confidentiality, disclaimers, liability, indemnity and governing law survive.', ]}, ]}, {t:'Changes to these Terms', b:[ 'We may amend these Terms. For material changes we will give account holders at least 30 days\' notice by email or in-product notice before they take effect. If you do not accept a material change, your remedy is to stop using the Service and close your account before the effective date. Continued use afterwards means acceptance.', ]}, {t:'Governing law and dispute resolution', b:[ 'These Terms are governed by the laws of India. Subject to the arbitration clause below, the courts at Bengaluru, Karnataka have exclusive jurisdiction.', 'Any dispute arising out of or relating to these Terms will be referred to arbitration by a sole arbitrator under the Arbitration and Conciliation Act, 1996. The seat is Bengaluru and the proceedings will be conducted in English. Either party may seek urgent injunctive relief from a court to protect its intellectual property or confidential information.', ]}, {t:'General', b:[ {ul:[ 'Severability — if a provision is held unenforceable it is replaced by an enforceable one closest to the original intent, and the rest stands.', 'No waiver — not enforcing a provision does not waive it.', 'Assignment — you may not assign these Terms without our written consent; we may assign to an affiliate or in connection with a merger or sale of assets.', 'Entire agreement — these Terms, the Privacy Policy and any signed order form or Data Processing Agreement are the entire agreement between us on this subject.', 'Notices — to you at your account email; to us at ' + LEGAL_EMAIL + '.', ]}, ]}, {t:'Contact and grievance redressal', b:[ {ul:[ 'Legal and contractual: ' + LEGAL_EMAIL, 'Sales: ' + SALES_EMAIL, 'Grievance Officer (India, IT Rules 2021): ' + GRIEVANCE_OFFICER + ', ' + PRIVACY_EMAIL, 'Postal: ' + LEGAL_ENTITY + ', ' + LEGAL_ADDRESS, ]}, 'A grievance should identify you, the specific content or conduct complained of, and the reason. We aim to acknowledge within 24 hours and resolve within 15 days.', ]}, ]; return Terms of Service} updated={LEGAL_EFFECTIVE} intro="The agreement between you and us for using NeuroRoute. Sections 6 and 7 — third-party AI Providers, and the limits of AI output — deserve particular attention, because they describe risks we cannot remove on your behalf." sections={sections} />; } /* ============================================================ CODE OF BUSINESS CONDUCT ============================================================ */ function CodePage(){ const sections = [ {t:'Scope and purpose', b:[ 'This Code sets out the standards of behaviour expected at ' + LEGAL_ENTITY + ' and its subsidiaries, and of everyone who works with us: employees, contractors, business partners, agencies, suppliers, subcontractors and their representatives.', 'It is not a substitute for the law or for your contract with us. Where this Code and local law differ, follow whichever sets the higher standard; where they genuinely conflict, tell us before you act.', 'If you work with us and cannot meet a requirement in this Code, say so. We would far rather have the conversation than discover the gap later.', ]}, {t:'Our values in practice', b:[ 'We expect work to be done with integrity, competence and candour: keep commitments, describe status honestly including when it is bad, raise problems early, and do not let a customer form a false impression through silence or selective disclosure.', ]}, {t:'Fair competition', b:[ 'Compete on the merits of our work. Do not agree with competitors to fix prices, rig bids or allocate customers or territories, do not obtain a competitor\'s confidential information improperly, and do not disparage competitors with claims you cannot substantiate. Comparative claims we publish must be accurate, current and defensible.', ]}, {t:'Confidentiality and personal data', b:[ 'Protect information entrusted to us — our own, our customers\' and our partners\' — with safeguards appropriate to its sensitivity, and use it only for the purpose it was shared for.', {ul:[ 'Customer content processed through our platform is subject to the customer\'s retention settings and our Privacy Policy. Do not copy it out of the platform, and do not access it except where strictly necessary to operate or support the service.', 'Never paste customer data, credentials or confidential material into an external tool, including a third-party AI assistant, that has not been approved for it.', 'Comply with applicable data protection law, including the India DPDP Act 2023 and, where relevant, the GDPR and UK GDPR.', 'Report any suspected data breach immediately — see section 13. Do not attempt to resolve it quietly first.', ]}, ]}, {t:'Regulatory compliance', b:[ 'Comply with the laws that apply where we operate, including export controls and trade sanctions, anti-money-laundering rules, anti-bribery and anti-corruption law, tax law, and sector regulation applicable to our customers where it flows down to us.', ]}, {t:'Business practices and records', b:[ {ul:[ 'Keep honest, complete and timely records. Never falsify a record, backdate a document, or create one to mislead.', 'Respect intellectual property. Use only properly licensed software, and do not incorporate third-party code, models or datasets into our products without checking the licence permits it.', 'Use company assets, cloud accounts and credentials responsibly and for legitimate business purposes.', ]}, ]}, {t:'Responsible AI', b:[ 'We build infrastructure that routes AI requests, which means our decisions affect what our customers can do and what it costs them. We therefore expect that:', {ul:[ 'we describe model capability, cost and savings accurately, and do not publish a benchmark or saving we cannot reproduce;', 'we do not train models on customer content, and we do not engage a provider that reserves the right to;', 'we design defaults that protect the customer — the most restrictive retention posture for new organisations, spend caps that fail safe, and controls that fail closed where failing open would expose data;', 'we decline work intended to build unlawful surveillance, deceptive content at scale, or systems that make consequential decisions about people without human review.', ]}, ]}, {t:'Diversity, equal opportunity and respect', b:[ 'We support internationally recognised human rights and hire and promote on merit. Discrimination or harassment on the basis of race, colour, religion, caste, sex, gender identity, sexual orientation, national origin, age, disability, marital status or any other protected characteristic is prohibited. Sexual harassment is treated as a serious violation and is handled under our Internal Committee process pursuant to the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013.', ]}, {t:'Labour standards and child labour', b:[ 'We prohibit child labour, forced labour, bonded labour and human trafficking in our operations and expect the same of our suppliers, who must verify the age and right to work of their personnel and keep records available to us on request. Working hours, wages and benefits must meet applicable law.', ]}, {t:'Health, safety and environment', b:[ 'Provide a safe place to work, report hazards and incidents, and meet applicable environmental obligations.', ]}, {t:'Bribery, corruption, gifts and hospitality', b:[ {ul:[ 'Never offer, promise, give, request or accept anything of value to obtain an improper advantage. This includes facilitation payments.', 'Particular care applies to government officials and to public-sector procurement.', 'Modest, infrequent, transparent hospitality is acceptable. Anything that could reasonably create a sense of obligation is not — if you would be uncomfortable seeing it reported, decline it and tell your manager.', 'Political and charitable contributions must not be used to obtain business advantage.', ]}, ]}, {t:'Conflicts of interest', b:[ 'Disclose promptly any interest that could compromise, or appear to compromise, your judgement — an outside role, a financial interest in a customer, competitor or supplier, a personal relationship affecting a procurement or hiring decision. Disclosure is usually enough; concealment is the problem.', ]}, {t:'Raising a concern', b:[ 'If you see something that appears to breach this Code, the law, or our security and privacy commitments, report it. You may report to your manager, or confidentially to ' + LEGAL_EMAIL + '. Reports may be made anonymously.', {ul:[ 'Security or personal data incidents: report immediately to ' + PRIVACY_EMAIL + ' — speed materially affects our regulatory obligations, including a 72-hour breach notification deadline.', 'We prohibit retaliation against anyone who raises a concern in good faith, or who assists an investigation. Retaliation is itself a breach of this Code.', 'We investigate proportionately and confidentially so far as we are able while still investigating properly.', ]}, ]}, {t:'Consequences', b:[ 'Breach of this Code may lead to disciplinary action up to termination of employment, termination of a contract or supply relationship, and referral to the authorities where the law requires it.', ]}, {t:'Contact', b:[ {ul:[ 'Code of Conduct and whistleblower reports: ' + LEGAL_EMAIL, 'Privacy and security incidents: ' + PRIVACY_EMAIL, 'Postal: ' + LEGAL_ENTITY + ', ' + LEGAL_ADDRESS, ]}, ]}, ]; return Code of Business Conduct} updated={LEGAL_EFFECTIVE} intro={'What ' + LEGAL_ENTITY + ' expects of its people and of everyone who does business with us.'} sections={sections} />; } function LegalStyles(){ return ; } window.PAGES = Object.assign(window.PAGES||{}, { privacy: PrivacyPage, terms: TermsPage, code: CodePage, });