Aetherium Compliance – Compliance Readiness and Evidence Management

Aetherium Compliance helps organisations assess their readiness against relevant standards and regulations. Bring your evidence, clause assessments, actions and progress tracking together in one place, with AI-assisted tools to help identify where documents may support your assessments.

Features

Standards and assessments: Work through applicable requirements clause by clause and record your assessment.

Evidence management: Submit supporting documents for compliance analysis, organise their evidence records and link them to the requirements they address. Original evidence files are stored persistently with OpenAI and are not available for later download through Aetherium Compliance, so you should retain your own source copies.

AI-assisted mapping: Use Auto-Map to help find relevant evidence and suggest how it relates to clauses. Review all suggestions before relying on them.

Actions and progress: Record gaps, assign follow-up actions and monitor readiness from your dashboard.

Team collaboration: Invite colleagues and manage their access within your organisation.

How to Use It

1. Sign in and set up your organisation. Create an organisation or join one using an invitation.
2. Choose your standards. Select the standards relevant to your work and set up the subjects you want to assess.
3. Upload evidence. Submit policies, procedures, records and other supporting documents for analysis. Uploaded evidence is stored persistently using OpenAI Files; retain your own original copies. The system can also analyse supported drawings.
4. Assess requirements. Review clauses, record your findings and link supporting evidence. You can use AI-assisted mapping to help identify potential matches.
5. Manage gaps. Create actions for work that remains and track progress on the dashboard.

AI-generated suggestions are a starting point for review, not a certification decision or a substitute for professional judgement.

Your data and uploaded evidence

Aetherium Compliance stores organisation information, assessments, actions, evidence metadata and related activity needed to provide the service.

Uploaded evidence documents are stored persistently using OpenAI Files rather than being stored as document files in the Aetherium Compliance application database. Aetherium Compliance retains the document metadata and OpenAI file identifier so that the evidence can be used again for authorised AI analysis without requiring repeated uploads.

Uploaded original documents cannot subsequently be opened or downloaded through Aetherium Compliance, including by the user who uploaded them. The application accesses the stored file programmatically when authorised analysis is requested.

You should therefore retain your own original copies of all evidence. Aetherium Compliance is not a document archive or backup service.

Users can initiate deletion of evidence through the application. This causes Aetherium Compliance to request deletion of the corresponding file from OpenAI storage and remove or update the related application records.

OpenAI is used to process evidence for AI-assisted functions such as evidence mapping and compliance assessment. AI-generated findings may be incomplete or incorrect and should always be reviewed by a suitably competent person before being relied upon.

Avoid uploading personal or sensitive information that is not reasonably necessary for your compliance assessment, and redact unnecessary information where practical.

For full details, please read the Aetherium Compliance Supplementary Privacy Notice, Terms of Use, and Schedule 1 – Data Processing Terms.

Open Aetherium Compliance in a new window.

Aetherium Compliance – Supplementary Privacy Notice & Terms of Use

Part A - Privacy Policy

Effective date: 28 September 2026
Last updated: 28 September 2026
Document version: 1.1

This Supplementary Privacy Notice applies specifically to Aetherium Compliance (“the Service”), provided by Aetherium Engineering Ltd, trading as Aetherium Tools (“Aetherium”).

It supplements the general Aetherium Tools Privacy Policy, which should be read alongside this notice.

If this notice conflicts with the general Privacy Policy in relation to processing performed specifically through Aetherium Compliance, this supplementary notice will apply.

Customer organisations are responsible for ensuring that their use of the Service, including information and documents submitted to it, complies with applicable laws, contractual obligations and regulatory requirements. This does not limit Aetherium’s own obligations under applicable data-protection law.

1. About the Service

Aetherium Compliance is a business compliance-readiness, evidence-management and assessment application.

The Service enables organisations to:

• Assess readiness against supported standards and requirements.
• Record assessments, applicability decisions, findings, gaps and recommendations.
• Submit and manage supporting evidence.
• Link evidence to clauses and compliance subjects.
• Use artificial intelligence to assist with evidence mapping and compliance assessment.
• Create and manage corrective or follow-up actions.
• Generate compliance reports.
• Collaborate with authorised members of their organisation.
• Request independent consultancy review where that functionality is available.

AI-generated findings are intended to assist human assessment. They do not constitute certification, accreditation, legal advice or a guarantee of compliance.

2. Our data-protection roles

The organisation using the Service normally determines why its compliance evidence, assessments and related information are processed.

That organisation is therefore normally the data controller for personal data contained within its evidence, assessments, actions and other Customer-provided information.

Aetherium normally acts as the Customer’s data processor for this information.

Where a Customer itself acts as processor for another organisation, Aetherium may act as its subprocessor.

Aetherium acts as a separate controller for information it processes for its own purposes in operating and protecting the Service, including:

• User-account information.
• Organisation membership and access control.
• Service administration and support.
• Security, audit and diagnostic information.
• Subscription and billing administration.
• Consultancy administration.
• Essential Service communications.
• Legal and regulatory compliance.

3. Information processed

Accounts and access

The Service may process:

• User name and display name.
• Email address.
• Profile/avatar URL.
• Clerk and application user identifiers.
• Account timestamps.
• Administrative status.
• Organisation membership and roles.
• Organisation join dates.

Invitations may include recipient email address, proposed role, inviter, invitation token, status and expiry information.

Organisation information

This may include:

• Organisation name and legal name.
• Industry.
• Country.
• Website.
• Certification or compliance scope.
• Organisation owner.
• Settings.
• Selected standards and package.
• Subscription and deletion status.

Compliance information

This may include:

• Selected standards and subjects.
• Scope selections.
• Applicability decisions and justifications.
• Clause assessments.
• Compliance statuses.
• Rationales and scores.
• Gaps.
• Recommendations.
• Assessment history and updates.
• Responsible or contributing users.

Evidence metadata

For evidence submitted to the Service, the Aetherium Compliance application database may store:

• Filename.
• File type.
• File size.
• File hash.
• Version information.
• Description.
• Tags.
• Uploader.
• Processing status.
• OpenAI file identifier.
• Evidence-to-clause or subject links.
• Associated notes.
• Users responsible for creating links or making changes.

Uploaded evidence file contents — important storage information

The contents of uploaded evidence documents are stored persistently using OpenAI Files. The document contents are not stored in the Aetherium Compliance application database.

This architecture is deliberately designed so that the stored evidence document itself is not made available for ordinary retrieval through Aetherium Compliance.

In particular:

• Aetherium Engineering personnel cannot open, browse or download the stored evidence document through Aetherium Compliance.
• The user who uploaded the document cannot subsequently open or download the stored document through Aetherium Compliance.
• Other users and organisation administrators cannot open or download the stored document through Aetherium Compliance.
• The Aetherium Compliance application can reference the OpenAI-hosted file when required to perform authorised evidence analysis.
• The application retains the OpenAI file identifier and associated metadata so that the same evidence can be analysed again without requiring the Customer to repeatedly upload the document.
• Users can use the Service's available controls to initiate deletion of an evidence file. The Service then requests deletion of the corresponding file from OpenAI storage and removes or updates the associated application records as appropriate.

The persistent storage of evidence at OpenAI is therefore part of the intended operation of the Service rather than temporary transmission solely for a single AI request.

Customers should retain their own original copies of documents. Aetherium Compliance must not be treated as a document archive, backup system or document-management repository from which original files can later be recovered.

Deletion requests involving OpenAI-hosted files depend on OpenAI's systems successfully processing the deletion request. Aetherium does not guarantee instantaneous deletion from all provider systems, backups or other residual storage where the provider's applicable arrangements permit temporary retention.

AI processing information

The Service may store:

• AI job status.
• Diagnostic information.
• Model information.
• Evidence references.
• Generated findings.
• Assessments.
• Recommendations.
• Explanations.
• Displayed results.
• In some cases, raw AI responses.
• AI-credit and usage information.

Actions and reports

The Service may store action descriptions, priorities, statuses, due dates, assignees, report configuration, filters, summary information and generated report or CSV information.

Subscription and consultancy information

Where applicable, this may include subscription package, standards, price, billing period, cancellation status, consultancy profiles, requests, instructions, messages, quotes, reviews, ratings, payment amounts, payment status and payment-provider identifiers.

4. Personal information contained in evidence

Evidence documents and free-text fields may contain personal information even where their primary purpose is organisational compliance.

Customers should minimise personal information submitted to the Service and should remove or redact information that is not reasonably required for the compliance purpose.

Particular care should be taken with:

• Special-category personal data.
• Health information.
• Criminal-conviction information.
• Government identification information.
• Financial information.
• Passwords or credentials.
• Children's information.
• Other highly confidential personal information.

Certain compliance activities, including occupational health and safety, may legitimately involve documents containing sensitive information.

Where a Customer determines that such information is necessary, the Customer is responsible for establishing an appropriate lawful basis, satisfying any additional legal requirements and determining that use of the Service is appropriate.

5. How information is used

Customer-controlled information is processed to:

• Maintain the organisation's compliance workspace.
• Conduct and record assessments.
• Organise evidence.
• Associate evidence with requirements.
• Analyse evidence using AI.
• Identify potentially relevant evidence.
• Identify potential gaps.
• Generate findings and recommendations.
• Manage actions.
• Generate reports.
• Enable collaboration.
• Administer requested consultancy services and associated communications.
• Maintain, secure and support the Service.

Aetherium will not use Customer-controlled information for unrelated purposes except where required by law or expressly agreed with the Customer.

6. Artificial intelligence and evidence analysis

Aetherium Compliance uses artificial intelligence to assist with:

• Evidence review.
• Evidence-to-requirement mapping.
• Compliance assessment.
• Identification of potential gaps.
• Generation of draft findings.
• Recommendations and explanatory material.

The Service currently uses OpenAI for this functionality.

When evidence is analysed, the Aetherium Compliance application instructs OpenAI's systems to process the relevant persistent OpenAI-hosted evidence file together with information required for the assessment.

This may include:

• Evidence contents.
• Compliance requirements.
• Organisation context.
• Existing assessments.
• Evidence references.
• User instructions.

The persistent OpenAI file identifier allows subsequent authorised analyses to reference the existing stored evidence without requiring the Customer to upload it again.

AI-generated information may be incomplete, inaccurate or based on an incorrect interpretation of evidence. AI cannot necessarily determine whether documented procedures accurately represent actual organisational practice.

AI findings are therefore assistance for human review and are not certification decisions.

Customers remain responsible for determining whether their organisation complies with applicable requirements.

7. Customer responsibilities

Customers are responsible for:

• Having an appropriate lawful basis for personal data submitted to the Service.
• Having authority to submit documents and evidence.
• Providing required privacy information.
• Ensuring evidence is relevant and appropriate.
• Minimising unnecessary personal information.
• Maintaining appropriate user permissions.
• Removing users who no longer require access.
• Reviewing AI-generated findings.
• Determining appropriate retention periods.
• Responding to data-subject requests.
• Maintaining their own original copies and backups of uploaded documents.
• Complying with confidentiality, intellectual-property and contractual obligations.

8. Activity and audit information

Selected audit events may record:

• Event type.
• Time.
• Organisation.
• Acting user.
• Affected item.
• Description and optional details.
• IP address.
• Browser user-agent.

Organisation administrators may have access to their organisation's audit log.

Audit logging does not necessarily represent a complete record of every action.

Server and infrastructure logs may also contain request identifiers, methods, paths, response statuses and diagnostic information.

Aetherium Compliance does not implement its own application-level behavioural analytics or browser fingerprinting. The surrounding Aetherium Tools website may use optional analytics or advertising technologies, including Google Analytics and Google Ads, where you have provided consent. See the general Aetherium Tools Privacy Policy and cookie controls for details.

Limited browser storage may be used for application functionality, including organisation selection and interface state.

9. Service providers

Clerk

Clerk provides authentication and session-management functionality and may process account, authentication and security information.

OpenAI

OpenAI provides AI processing and persistent evidence-file storage used by the Service.

OpenAI may process:

• Uploaded evidence documents.
• Personal or business information contained within evidence.
• Assessment context.
• Prompts and instructions.
• Generated responses.

Evidence files are retained persistently at OpenAI so they can be referenced for future authorised analysis without repeat upload.

Aetherium Compliance users, including the original uploader, are not provided with functionality to retrieve the stored original document. The application references it programmatically for authorised analysis.

Users may initiate deletion of evidence through available Service controls, which causes the Service to request deletion of the corresponding OpenAI-hosted file.

Microsoft

Microsoft Graph may be used for application emails, including invitations and Service communications. Sent messages may be retained in the sending mailbox's Sent Items.

Stripe

Where enabled, Stripe processes payment information.

Aetherium Compliance may store transaction amounts, status and provider identifiers but is not designed to store full payment-card numbers.

Hosting and infrastructure providers

Hosting, database and infrastructure providers may process information required to operate, secure and maintain the Service.

10. International transfers

Some providers may process information outside the United Kingdom.

Where required by Data Protection Law, an appropriate recognised transfer mechanism will apply, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses, or another permitted mechanism.

11. Security

Security measures include, as applicable:

• Authenticated access.
• Organisation-based separation.
• Role-based permissions.
• Managed authentication.
• Secure provider credentials.
• Encrypted network connections where supported.
• Audit and diagnostic logging.
• Input validation and application-security controls.
• Controlled application access to persistent evidence.

The architecture intentionally separates evidence contents from ordinary application records. Evidence contents are held at OpenAI and referenced by the Service when analysis is required rather than being stored as retrievable documents in the application database.

No online system can guarantee absolute security.

12. Retention and deletion

There is currently no single universal retention period applying to all Aetherium Compliance information.

Information is retained for as long as reasonably necessary for the purposes for which it is processed, subject to applicable Customer instructions and legal requirements.

Evidence files

Evidence files are deliberately stored persistently with OpenAI to allow future analysis without requiring repeat upload.

They remain stored until deletion is initiated or another applicable deletion process occurs.

Where a user initiates evidence deletion, Aetherium Compliance requests deletion of the corresponding OpenAI file and removes or updates associated application records as appropriate.

Because the underlying file is held by a third-party provider, deletion may be subject to OpenAI's technical processing, retention and backup arrangements.

Organisation deletion

Deleting an organisation initiates deletion of operational information associated with that organisation.

Some information may be retained where necessary for:

• Financial or accounting obligations.
• Payment records.
• Consultancy engagements.
• Security and fraud prevention.
• Dispute resolution.
• Legal claims.
• Other legal requirements.

Residual information may temporarily remain in infrastructure or provider backups.

13. Individual rights

Individuals may have rights under Data Protection Law to access, correct, erase or restrict personal data, object to certain processing and exercise other applicable rights.

Where the Customer is the controller, requests should normally be directed to that Customer.

Aetherium will provide reasonable assistance to Customers in accordance with Schedule 1.

14. Data incidents

Aetherium will notify affected Customers without undue delay after becoming aware of a confirmed personal-data breach affecting Customer-controlled personal data and will provide reasonably available information to assist with the Customer's response.

15. Independent consultancy

Where a Customer requests an independent consultancy review, the consultancy service is separate from the Service's automated AI evidence-processing functionality.

Consultants are not provided with access through Aetherium Compliance to evidence documents stored using OpenAI Files.

If a Customer wishes a consultant to review supporting documents or other evidence, the Customer must provide those materials directly to the consultant using an appropriate method separately from the evidence already uploaded for AI analysis.

Requesting a consultancy review does not grant the consultant access to the Customer's OpenAI-hosted evidence files.

16. Data Processing Terms

Aetherium's processing of Customer Personal Data is governed by Schedule 1 — Data Processing Terms, which forms part of the agreement with each Customer organisation.

17. Changes

This notice may be updated as the Service, providers, security arrangements or applicable requirements change.

Material changes will be published with an updated revision date.

18. Contact

Aetherium Engineering Ltd, trading as Aetherium Tools
1.30 Repton House
Bretby Business Park
Ashby Road
Burton-on-Trent
DE15 0YZ
United Kingdom

Email: admin@aetherium-tools.co.uk
Company number: 15338606

Individuals may also raise concerns with the UK Information Commissioner's Office at ico.org.uk.

Part B - Terms of Use

Effective date: 28 September 2026
Last updated: 28 September 2026
Document version: 1.0

1. About these Terms

These application-specific Terms govern access to and use of Aetherium Compliance (“the Service”).

They supplement the general Aetherium Tools Terms of Use.

The general Terms, these application-specific Terms and Schedule 1 — Data Processing Terms together form the agreement between Aetherium Engineering Ltd, trading as Aetherium Tools (“Aetherium”), and the organisation using the Service (“the Customer”).

If these application-specific Terms conflict with the general Terms in relation to the Service, these application-specific Terms will apply.

The Aetherium Compliance Supplementary Privacy Notice explains how information is processed.

2. Purpose of the Service

Aetherium Compliance provides tools intended to assist organisations with compliance-readiness activities, including:

• Managing compliance requirements.
• Recording assessments.
• Managing evidence.
• Mapping evidence to requirements.
• AI-assisted evidence assessment.
• Identifying potential gaps.
• Managing corrective or improvement actions.
• Generating reports.
• Collaborating between authorised users.
• Requesting independent consultancy services where available.

The Service is a compliance-assistance tool.

Use of the Service does not constitute or guarantee:

• Certification.
• Accreditation.
• Successful certification audit.
• Compliance with any particular standard.
• Compliance with legislation.
• Acceptance of evidence by a certification body, regulator, auditor or other third party.

3. Organisation registration and authority

A user creating or administering an organisation confirms that:

• Organisation details supplied are accurate.
• They have authority to establish the account.
• They have authority to accept these Terms on behalf of the organisation.
• Access will be granted only to authorised users.
• Membership and roles will be maintained appropriately.

The Customer is responsible for activity conducted through its organisation account except to the extent caused by Aetherium's failure to comply with its security obligations.

4. User accounts and security

Users must:

• Provide accurate account information.
• Keep authentication methods secure.
• Not share individual accounts.
• Protect devices used to access the Service.
• Comply with organisation access permissions.
• Promptly report suspected unauthorised access.

Organisation administrators are responsible for managing membership and removing access when no longer required.

5. Customer information and evidence

The Customer retains its rights in information and evidence it submits to the Service.

The Customer grants Aetherium permission to transmit, store, reference, analyse and otherwise process that information only as reasonably required to:

• Provide requested Service functionality.
• Conduct authorised AI analysis.
• Maintain and secure the Service.
• Provide requested consultancy.
• Follow Customer instructions.
• Comply with applicable law.

The Customer confirms that it has the necessary rights and authority to submit information and evidence to the Service.

6. Evidence-file storage

The Customer acknowledges and agrees that uploaded evidence documents are handled differently from ordinary application records.

OpenAI storage

Uploaded evidence file contents are transferred to and stored persistently using OpenAI Files.

The Aetherium Compliance database retains metadata and the corresponding OpenAI file identifier rather than storing the original evidence file contents as an ordinary application document.

Persistent storage enables the Service to reuse evidence for authorised analysis without requiring repeated uploads.

No document retrieval

The Customer acknowledges that:

• Uploaded evidence is submitted for analysis and evidence-management purposes.
• Aetherium Compliance does not provide a document-storage or document-retrieval service.
• Users cannot subsequently download or open the stored original evidence file through the Service.
• This includes the user who originally uploaded the file.
• Aetherium Engineering personnel do not have ordinary functionality within Aetherium Compliance to browse, open or download the stored evidence file.
• The Service can programmatically reference the OpenAI-hosted file for authorised analysis.

Customer copies

Customers must retain their own original documents and appropriate backups.

The Service must not be used as the sole repository or backup for evidence.

Aetherium is not responsible for a Customer's loss of an original document merely because a copy was previously submitted to the Service.

Evidence deletion

Users may initiate deletion of evidence through available Service functionality.

Where deletion is initiated, the Service will request deletion of the corresponding OpenAI-hosted file and remove or update associated application records as appropriate.

Deletion from third-party infrastructure may be subject to the provider's technical, backup and retention arrangements.

7. Artificial-intelligence features

The Service uses AI to assist with activities including:

• Evidence mapping.
• Evidence assessment.
• Gap identification.
• Compliance analysis.
• Recommendations.
• Explanations and draft findings.

The Customer acknowledges that AI-generated content:

• May be incorrect.
• May be incomplete.
• May misunderstand evidence.
• May miss relevant evidence.
• May incorrectly associate evidence with a requirement.
• Cannot necessarily determine whether documented procedures reflect actual organisational practice.
• Does not constitute a certification decision.
• Does not constitute legal or professional advice.

Users must apply appropriate human review before relying on AI-generated findings.

The Customer remains responsible for its compliance decisions.

Aetherium may change models or AI providers where reasonably necessary, subject to the Privacy Notice and Schedule 1.

8. Standards and third-party materials

Standards, specifications and other third-party materials may be protected by copyright or other intellectual-property rights.

Where the Service displays or processes third-party standards content, access and use may be subject to applicable licences or permissions.

The Customer is responsible for complying with any licensing restrictions applying directly to materials it supplies or independently accesses.

Nothing in these Terms transfers ownership of third-party standards or other third-party intellectual property to the Customer.

9. Customer responsibilities

The Customer is responsible for:

• Determining the standards and requirements applicable to it.
• Establishing appropriate assessment scope.
• Providing accurate organisational information.
• Maintaining appropriate evidence.
• Reviewing assessments and AI outputs.
• Determining whether identified evidence actually demonstrates compliance.
• Ensuring information submitted is lawful and appropriate.
• Maintaining original copies of evidence.
• Controlling user access.
• Meeting its own legal and regulatory obligations.

10. Prohibited use

Users must not:

• Use the Service unlawfully.
• Upload information they have no authority to process.
• Attempt to access another organisation's information.
• Circumvent security or access controls.
• Circumvent usage or AI-credit limits.
• Introduce malware.
• Interfere with Service operation.
• Reverse engineer the Service except where applicable law expressly permits.
• Use the Service to infringe intellectual-property or privacy rights.
• Attempt to obtain direct unauthorised access to underlying evidence storage.
• Submit passwords, authentication secrets or malicious files as evidence.

11. Confidentiality

Each party will take reasonable care to protect confidential information received from the other and use it only for purposes connected with the Service.

This does not apply to information that is lawfully public, independently developed, lawfully received without restriction or required to be disclosed by law.

12. Intellectual property

Aetherium and its licensors retain rights in the Service, software, interface, documentation, branding and underlying technology.

The Customer retains its rights in Customer-provided information and evidence.

Subject to applicable law and third-party rights, the Customer may use outputs generated specifically for it.

AI-generated outputs may not be unique.

13. Consultancy services

Where the Service enables Customers to request independent consultancy or compliance review, additional commercial terms, scope, price or engagement conditions may be presented before the Customer commits to the service.

AI assessments and independent consultancy reviews are separate functions.

Consultants are not provided with access through Aetherium Compliance to evidence documents stored using OpenAI Files. Requesting a consultancy review does not grant a consultant access to those documents.

Where a Customer wishes a consultant to review supporting documents or evidence, the Customer is responsible for providing those materials directly to the consultant separately from the evidence submitted to Aetherium Compliance for AI analysis.

A consultancy review does not guarantee certification or acceptance by a certification body.

14. Service changes and availability

Aetherium may maintain, update or change the Service to improve functionality, security, compliance or performance.

Unless separately agreed:

• Continuous availability is not guaranteed.
• AI models and providers may change.
• Features may be modified or withdrawn.
• Third-party provider outages may affect availability.
• Support is provided on a reasonable-efforts basis.

15. Usage limits

The Service may apply limits to:

• AI usage.
• Users.
• Standards.
• Evidence records.
• Reports.
• Storage.
• Other resource-intensive functionality.

Applicable allowances may depend on the Customer's package.

Users must not circumvent these limits.

16. Charges and subscriptions

Where paid functionality is offered, applicable prices, billing periods and allowances will be presented before purchase or specified separately.

Unless otherwise stated:

• Prices exclude applicable taxes.
• The Customer is responsible for authorised charges.
• Future prices may change on reasonable notice.
• Price changes will not retrospectively alter charges already due.

17. Payments

Where payment processing is provided by a third-party payment provider such as Stripe, that provider's applicable terms and privacy arrangements also apply.

Aetherium Compliance is not intended to store complete payment-card details.

18. Suspension

Aetherium may reasonably suspend or restrict access to:

• Protect Service security.
• Investigate unauthorised access.
• Prevent harm.
• Address a material breach.
• Comply with law.
• Address unpaid charges.

Where appropriate, Aetherium will provide notice and a reasonable opportunity to remedy the issue.

19. Ending use of the Service

The Customer may stop using the Service and initiate organisation deletion through available controls.

Aetherium may terminate access where:

• The Customer materially or repeatedly breaches these Terms.
• Use presents a material security or legal risk.
• Required fees remain unpaid.
• Aetherium discontinues the Service.
• Termination is legally required.

Deletion will follow the processes described in the Privacy Notice and Schedule 1.

20. Data export

Where available, organisation administrators may export applicable organisation records before deletion.

Because original evidence files cannot be retrieved through the Service, an export should not be expected to contain downloadable copies of the original evidence documents stored with OpenAI.

Customers must maintain their own source documents.

21. Warranties and reliance

Aetherium will provide the Service with reasonable care and skill.

Unless expressly agreed otherwise, Aetherium does not guarantee:

• Uninterrupted or error-free operation.
• Accuracy of AI-generated assessments.
• That all compliance gaps will be detected.
• That evidence will be interpreted correctly.
• That a Customer complies with a standard.
• That an auditor or certification body will accept particular evidence.
• That use will result in certification.
• That the Service replaces professional judgement, legal advice or certification assessment.

Nothing excludes obligations that cannot lawfully be excluded.

22. Responsibility and liability

Each party remains responsible for losses caused by its breach, negligence or failure to comply with applicable law.

Aetherium is not responsible for:

• Customer decisions based solely on unverified AI findings.
• Incorrect or incomplete Customer information.
• The Customer's failure to maintain original evidence.
• Information uploaded without appropriate authority.
• Customer access-control failures.
• Certification decisions made by independent certification bodies.
• Third-party services outside Aetherium's reasonable control.

Nothing excludes or limits liability where doing so would be unlawful, including liability for fraud, fraudulent misrepresentation or death or personal injury caused by negligence.

23. Changes to these Terms

Aetherium may update these Terms to reflect Service, provider, security, legal or commercial changes.

Material changes will be published with an updated revision date.

Renewed acceptance may be requested where appropriate.

24. Contact

Aetherium Engineering Ltd, trading as Aetherium Tools
1.30 Repton House
Bretby Business Park
Ashby Road
Burton-on-Trent
DE15 0YZ
United Kingdom

Email: admin@aetherium-tools.co.uk
Company number: 15338606

25. Governing law

These Terms and related non-contractual disputes are governed by the laws of England and Wales.

The courts of England and Wales will have jurisdiction except where applicable law requires otherwise.

26. Acceptance

By creating an organisation, accepting these Terms through the Service or continuing after being asked to accept updated Terms, the Customer agrees to:

• The general Aetherium Tools Terms of Use.
• These Aetherium Compliance Terms of Use.
• Schedule 1 — Data Processing Terms.

The accepting user confirms that they have authority to accept these Terms on behalf of the Customer.

Schedule 1 — Data Processing Terms

1. Status and scope

These Data Processing Terms form part of the agreement between:

Aetherium Engineering Ltd, trading as Aetherium Tools (“Aetherium”); and

the organisation using Aetherium Compliance (“the Customer”).

They apply where Aetherium processes personal data on behalf of the Customer through Aetherium Compliance (“the Service”).

For that processing:

• Where the Customer determines the purposes and means of processing, the Customer is controller and Aetherium is processor.
• Where the Customer processes personal data on behalf of another controller, the Customer is processor and Aetherium is subprocessor.

Aetherium remains a separate controller for information processed for its own account administration, security, support, billing, legal-compliance and similar purposes.

2. Definitions

Customer Personal Data means personal data processed by Aetherium on behalf of the Customer through the Service.

Data Protection Law means applicable United Kingdom data-protection and privacy law, including the UK GDPR and Data Protection Act 2018, as amended or replaced.

Subprocessor means another processor appointed by Aetherium to process Customer Personal Data in connection with the Service.

Other data-protection terms have the meanings given by applicable Data Protection Law.

3. Processing instructions

Aetherium will process Customer Personal Data only:

• On documented Customer instructions.
• As reasonably necessary to provide, secure and support the Service.
• As described in the agreement.
• Through authorised use and configuration of the Service.
• As required by applicable law.

Documented instructions include:

• Creating and maintaining organisation records.
• Uploading evidence.
• Transmitting evidence to OpenAI Files for persistent storage.
• Referencing stored evidence for authorised AI analysis.
• Assessing evidence.
• Linking evidence to requirements.
• Recording compliance assessments.
• Generating reports.
• Managing actions.
• Inviting users.
• Creating and administering consultancy requests, excluding access by consultants to evidence documents stored using OpenAI Files.
• Initiating evidence deletion.
• Requesting organisation deletion.
• Other instructions submitted through authorised Service functionality.

Where law requires processing contrary to Customer instructions, Aetherium will notify the Customer before processing unless prohibited by law.

Aetherium will inform the Customer if, in its reasonable opinion, an instruction infringes Data Protection Law.

4. Customer responsibilities

The Customer is responsible for:

• Complying with its obligations as controller or processor.
• Ensuring its instructions are lawful.
• Establishing lawful bases.
• Providing privacy information.
• Ensuring information is adequate, relevant and reasonably accurate.
• Determining appropriate retention periods.
• Obtaining necessary permissions.
• Assessing whether the Service is appropriate for its processing.
• Minimising unnecessary personal information.
• Maintaining original copies of evidence.
• Determining whether sensitive information is necessary and lawful.

The Customer acknowledges that compliance evidence may contain special-category or other sensitive personal data and is responsible for establishing any additional condition required by Data Protection Law before submitting such information.

5. Confidentiality

Aetherium will ensure that persons authorised to process Customer Personal Data:

• Are subject to appropriate confidentiality obligations.
• Receive access only where reasonably necessary.
• Process information in accordance with these Terms.
• Receive appropriate information regarding security and data-protection responsibilities.

6. Evidence-storage architecture

The parties acknowledge the following specific processing arrangement.

6.1 Persistent OpenAI storage

Evidence file contents submitted through the Service are transmitted to and stored persistently using OpenAI Files.

The Aetherium Compliance application database stores associated metadata and the OpenAI file identifier.

Persistent storage enables future authorised analysis without requiring repeat upload.

6.2 Access model

The Service is designed so that:

• Users cannot retrieve, open or download the persistent original evidence file through Aetherium Compliance after upload.
• This restriction also applies to the original uploader.
• Organisation administrators do not receive general retrieval access.
• Aetherium personnel do not have ordinary functionality within Aetherium Compliance to browse, open or download those persistent evidence files.
• The Aetherium Compliance application can programmatically reference the OpenAI-hosted file where required for authorised analysis.

This restriction on retrieval does not prevent processing of the file by the application and OpenAI as required to perform Customer-instructed analysis.

6.3 Customer source copies

The Customer remains responsible for maintaining its own original evidence documents and backups.

The Service is not intended to serve as the Customer's document archive or backup repository.

7. Security

Taking account of the nature, scope, context and purposes of processing and risks to individuals, Aetherium will maintain appropriate technical and organisational measures intended to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Current measures are described in Annex 2.

Aetherium may update security measures provided that overall protection is not materially reduced.

8. Personal-data breaches

Aetherium will notify the Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Personal Data.

Where available, notification will describe:

• The nature of the breach.
• Information and individuals potentially affected.
• Likely consequences.
• Containment or mitigation measures.
• A contact route.

Information may be supplied in phases.

Aetherium will provide reasonable assistance with applicable breach obligations.

The Customer remains responsible for determining whether notification to individuals, the ICO or another regulator is required except where Aetherium has an independent obligation.

9. Data-subject requests

Aetherium will provide reasonable assistance to enable the Customer to respond to requests concerning Customer Personal Data.

If Aetherium receives such a request directly, it will normally:

• Refer the individual to the Customer; or
• Notify the Customer and await instructions.

Aetherium will not independently fulfil the request unless instructed, functionality enables the Customer to do so, or law requires Aetherium to respond.

10. Regulatory assistance

Taking account of the nature of processing and information available, Aetherium will provide reasonable assistance concerning:

• Data-protection impact assessments.
• Prior regulatory consultation.
• Security and breach assessments.
• ICO or other competent authority enquiries.

Reasonable charges may apply to extensive or unusual assistance unless required because of Aetherium's breach.

11. Subprocessors

The Customer gives Aetherium general written authorisation to appoint subprocessors required to provide the Service.

Aetherium will:

• Select subprocessors using reasonable care.
• Apply appropriate contractual data-protection obligations.
• Ensure applicable processor obligations are passed down.
• Remain responsible for subprocessor performance to the extent required by Data Protection Law.

Current subprocessors are listed in Annex 3.

Changes

Aetherium may add, replace or remove subprocessors.

Reasonable advance notice of a material new subprocessor will be provided through the Service, email or published provider information. Where practical, at least 14 days' notice will be provided.

The Customer may object on reasonable data-protection grounds.

If an objection cannot reasonably be resolved, Aetherium may avoid the provider where practical, offer an alternative, or permit the Customer to stop using the affected Service.

12. International transfers

Where Customer Personal Data is transferred outside the United Kingdom to a destination not covered by applicable adequacy regulations, Aetherium will ensure an appropriate transfer mechanism applies.

This may include:

• UK adequacy regulations.
• UK International Data Transfer Agreement.
• UK Addendum to EU Standard Contractual Clauses.
• Another mechanism permitted by Data Protection Law.

13. Return, export and deletion

Application records

Authorised users may delete records using available controls.

Organisation administrators may request available exports where reasonably practicable.

Evidence files

Persistent evidence files are stored with OpenAI.

Where an authorised user initiates deletion of an evidence file through the Service:

1. Aetherium Compliance initiates a request to delete the corresponding OpenAI-hosted file.
2. Associated application metadata and links are removed or updated as appropriate.
3. The file ceases to be available for future Service analysis once deletion has been successfully processed.

Deletion may be subject to OpenAI's technical processing and applicable backup or residual-retention arrangements.

Aetherium does not guarantee instantaneous erasure from every underlying provider backup or residual system where temporary retention is permitted by the provider's applicable arrangements.

Organisation termination

Following termination, Aetherium will delete or return Customer Personal Data in accordance with Customer instructions and applicable Service functionality, subject to legal retention requirements.

Aetherium may retain limited information where required for:

• Law.
• Accounting.
• Security.
• Fraud prevention.
• Dispute resolution.
• Legal claims.

Retained information remains protected by these Terms.

Customers should maintain and obtain any information they require before deletion because permanently deleted information cannot be restored.

14. Compliance information

Aetherium will make available information reasonably necessary to demonstrate compliance with applicable processor obligations.

This may include:

• These Terms.
• Privacy information.
• Subprocessor information.
• Security descriptions.
• Available provider compliance documentation.
• Reasonable written responses.

15. Audits

Where existing information is insufficient, the Customer may conduct a reasonable audit relating to Aetherium's processing.

Unless a breach, regulator or reasonable evidence of material non-compliance requires otherwise:

• At least 30 days' written notice is required.
• Audits may occur no more than once per 12 months.
• Scope must be relevant to the Customer.
• Audits must occur during normal business hours.
• Other Customers' confidentiality and security must not be compromised.
• Auditors must be independent and bound by confidentiality.
• The Customer bears its audit costs and reasonable exceptional assistance costs.

Aetherium may provide appropriate independent reports or provider documentation instead of direct system access where sufficient.

Nothing limits a regulator's statutory powers.

16. Processing records

Aetherium will maintain processing records where required by Data Protection Law.

The Customer remains responsible for its own records, purposes, lawful bases, retention decisions and assessments.

17. Conflict and precedence

If this Schedule conflicts with another part of the agreement concerning processing of Customer Personal Data, this Schedule takes precedence for that processing.

Mandatory Data Protection Law takes precedence over inconsistent contractual provisions.

18. Liability

Liability under this Schedule is subject to the Terms of Use and general Aetherium Tools Terms except where applicable law does not permit limitation.

Nothing limits either party's statutory data-protection obligations or regulatory powers.

19. Duration

This Schedule begins when the Customer accepts the agreement or first instructs Aetherium to process Customer Personal Data, whichever occurs first.

It continues while Aetherium processes Customer Personal Data on the Customer's behalf.

Relevant confidentiality, deletion, retained-information, audit and liability provisions survive termination as appropriate.

Annex 1 — Processing Particulars

Subject matter:
Provision, operation, security and support of Aetherium Compliance.

Duration:
For the Customer's use of the Service and thereafter for applicable deletion, legal-retention and provider residual-retention periods.

Nature of processing:
Collection, recording, organisation, transmission, persistent evidence storage, programmatic access by the application for authorised processing, consultation, AI analysis, assessment, generation, linking, restriction, reporting, export and deletion.

Purposes:
Compliance-readiness assessment; evidence management; evidence-to-requirement mapping; AI-assisted evidence analysis; gap assessment; action management; reporting; collaboration; consultancy administration; security and Service operation.

Data Subjects may include:
Customer users, organisation administrators, employees, workers, contractors, suppliers, customers, client representatives and other individuals whose information is legitimately contained within compliance evidence or records.

User information:
Name, email, authentication identifier, organisation membership, role and audit information.

Organisation information:
Organisation profile, certification scope, standards, settings and subscription information.

Compliance information:
Assessments, statuses, applicability decisions, rationales, scores, gaps, recommendations, actions and reports.

Evidence information:
Evidence documents, contents, filename, type, size, hash, version, descriptions, tags, links and notes.

AI information:
Evidence references and contents, assessment context, prompts, model information, generated findings, recommendations, raw responses where retained, and usage information.

Special-category data:
Not specifically required by the Service as a general rule, but may be present in Customer-supplied compliance evidence where the Customer determines such processing is necessary and lawful.

Processing frequency:
Continuously for hosting and Service operation and otherwise as initiated by authorised users or automated Service processes.

Annex 2 — Technical and Organisational Measures

Access control

Measures include:

• Authenticated user access.
• Managed authentication through Clerk.
• Organisation-based separation.
• Role-based permissions.
• Organisation membership controls.
• Restrictions intended to prevent cross-organisation access.
• Removal or restriction of user access.

Evidence protection

The evidence architecture includes:

• Persistent evidence-file storage using OpenAI Files.
• Storage of evidence metadata and OpenAI file identifiers within the application database rather than ordinary storage of original document contents.
• No normal user interface for retrieving the persistent original evidence document after upload.
• No normal Aetherium Compliance administrative interface for Aetherium personnel to browse or download persistent evidence documents.
• Programmatic use of evidence by the application for authorised analysis.
• User controls capable of initiating evidence deletion.
• Customer responsibility for maintaining source documents.

Application and infrastructure security

Measures include, as applicable:

• Managed infrastructure providers.
• Encrypted network connections where supported.
• Secure application credentials and secrets.
• Dependency and security maintenance.
• Input validation.
• Access controls.
• Audit and diagnostic logging.
• Investigation of suspected security events.

Data protection and resilience

Measures include:

• Database and infrastructure backup arrangements where applicable.
• Organisation deletion controls.
• Evidence deletion controls.
• Provider deletion requests.
• Recovery and continuity arrangements appropriate to the Service.

Organisational measures

Measures include:

• Confidentiality obligations.
• Access limited according to role and necessity.
• Security-incident processes.
• Data-subject request processes.
• Provider review.
• Documentation of material processing providers.
• Periodic privacy and security review.

Annex 3 — Current Subprocessors and Providers

OpenAI

Purpose:
AI model processing and persistent evidence-file storage.

Information potentially processed:
Evidence documents and their contents; information contained in evidence; assessment context; prompts; generated responses; related identifiers.

Important processing characteristic:
Evidence files are stored persistently to enable repeated authorised analysis without repeated Customer upload.

Clerk

Purpose:
Authentication, user-account management and access control.

Information potentially processed:
Name, email address, authentication identifiers, session information, organisation membership and role.

Hosting/database infrastructure provider(s)

Purpose:
Application hosting, application database, infrastructure, security and operation.

Information potentially processed:
Customer application records, account information, organisation information, compliance records, evidence metadata, OpenAI file identifiers, technical information and generated results.

Microsoft

Purpose:
Application email and communications.

Information potentially processed:
Names, email addresses, invitation details and Service communications.

Stripe

Purpose:
Payment processing where Stripe-enabled payment functionality is active.

Information potentially processed:
Payment and transaction information required to process applicable transactions.

The providers' own subprocessors may process information as required to supply their respective services. Provider arrangements may change and current material changes will be handled in accordance with section 11.