Terms of Service

1. About these Terms#

These Terms apply when you use msharti.dev and, until a signed agreement replaces them, when your organisation takes part in a Shadow-AI Exposure Assessment or is onboarded to our services. "msharti", "we" and "us" means Msharti Intelligence Limited, trading as msharti. "You" means the person using the website or the organisation they represent. If you accept these Terms for an organisation, you confirm that you are authorised to do so.

Our Privacy Policy explains how we handle personal data.

2. Signed agreements come first#

Every engagement is agreed in writing. If these Terms conflict with a signed document, the signed document applies, in this order: the DPA (for personal data), the order form or statement of work, then the MSA, and then these Terms.

3. Using our website#

The website gives general information about msharti. You may view, print and share links to its pages for your own reference. Some pages, such as the assessment request page, are reached only by direct link; finding one does not mean access will be granted. We provide the website "as is" and may change or remove content at any time. Links to other websites are for convenience; we are not responsible for their content.

4. Acceptable use#

You must not:

• use the website or services unlawfully or to infringe anyone's rights;
• try to gain unauthorised access, bypass access controls, approvals or audit logging, or test our systems for vulnerabilities without our written permission;
• introduce malware, overload our systems, or scrape or harvest content or data;
• submit false information or impersonate anyone;
• resell, sublicense or copy our services or materials, or use them to build a competing product; or
• send logs, passwords or customer data through website forms.

If you find a security issue, please report it to contact@msharti.dev and do not exploit or publish it.

5. Our services#

msharti provides a contracted, service-led AI access layer. Depending on what is agreed, this can include: role-based control of what AI tools and agents can reach; visibility and an audit log of AI access; human approval for agent write actions; Shadow-AI discovery; custom connectors built for the client's systems; and related onboarding and support.

• How it is set up: the scope, service levels, fees and payment terms are agreed in the order form.
• What we don't provide: AI models, legal or regulatory advice, or certification of compliance with any law or standard.
• What the client is responsible for: having the right to give us access to its systems and data; choosing and licensing its own AI tools; deciding who its users and approvers are and keeping roles up to date; keeping its credentials secure; and the security of its own environment.

6. Shadow-AI Exposure Assessment#

The free assessment helps an organisation see which AI tools are in use without approval and what data may be exposed.

• At our discretion. We offer assessments to organisations we select, and we review every request by hand, including requests made through our assessment request form. We may decline or stop an assessment.
• Paperwork first. No client data is shared until we sign an NDA, a DPA and a short scope letter.
• Minimal data. We ask only for the read-only exports we need, replace user names with pseudonyms by default, and do not change anything in the client's environment.
• Confidential. Assessment data and findings are confidential and used only to carry out the assessment.
• Deleted after delivery. We delete raw assessment data within the period agreed in the DPA after delivering the findings and confirm this in writing. The client keeps the report.
• No obligation to buy anything afterwards.

7. Custom connectors#

We build connectors to an agreed specification for each client. The statement of work sets out which systems are connected, which actions are allowed, the approval rules and how the connector will be tested and accepted. Connectors start read-only; write actions are switched on only when the client asks in writing. The client is responsible for its access to third-party systems and their terms. Ownership and licence terms for each connector are set out in the order form.

8. AI and human approval#

• Human approval is a control, not a guarantee. Approvers are the client's people. We do not check whether an approved action is correct or lawful, and the client is responsible for the actions it approves.
• AI tools are third-party. AI providers' tools work under their own terms. AI outputs can be wrong or incomplete, and should be reviewed before use.
• Controls reduce risk; they don't remove it. No control can stop every attack, leak or misuse.
• No certification or endorsement. Using msharti does not make an organisation compliant with any law, and no regulator has approved or endorsed msharti.
• Findings are not legal advice. Assessment findings depend on the data provided and may not be complete.
• No training. We do not use client data to train AI models.

9. Data protection#

For personal data in client data, the client is the controller and msharti is the processor. We process it only on the client's instructions under the DPA. Any processing before a full engagement must be covered by a signed assessment agreement and DPA. Our Privacy Policy covers data we handle as controller.

10. Confidentiality#

Each party will keep the other's confidential information private, use it only for the engagement and protect it with reasonable care. This includes client data, credentials, security details, assessment findings and non-public business or technical information. It does not cover information that is public, already known, independently developed or lawfully received from someone else. Disclosure is allowed to advisers and staff who need to know, and where the law requires it. These duties continue for the duration required by the signed agreement and applicable law, including any continuing protection for client data and credentials.

11. Intellectual property and feedback#

We own our website, platform, materials, templates and know-how. The client owns its data. Reports we prepare for a client may be used by the client internally and shared with its advisers, auditors and regulators. If you give us feedback, we may use it, without using your confidential information. We will not use a client's name or logo publicly without written permission.

12. Disclaimers#

We perform our services with reasonable skill and care. Beyond what is stated in a signed agreement, we do not promise that the website or services will be uninterrupted or error-free, or that they will detect every unapproved AI use or security threat.

13. Limitation of liability#

Liability limits and any exclusions for an engagement are set out in the signed agreement and apply only to the extent permitted by law. Nothing in these Terms excludes or limits liability for fraud or anything that cannot legally be excluded or limited.

14. Suspension and termination#

We may suspend access to protect security, stop misuse or meet a legal requirement, and restore it once the issue is resolved. Termination rights, notice periods and any opportunity to remedy a breach are set out in the signed agreement. We may end a free assessment at any time.

When an engagement ends, data export, return and deletion follow the signed agreement and DPA, subject to legal retention requirements. Confidentiality, data protection and any provisions intended to continue remain in effect as applicable.

15. Changes to these Terms#

We may update these Terms. The version and date at the top show which version applies. Changes never override a signed agreement. We will communicate material changes affecting onboarded organisations before those changes take effect.

16. Governing law and disputes#

These Terms are governed by the laws of Kenya. If a dispute arises, we will first try to settle it through good-faith negotiation for 30 days; if that fails, the courts of Kenya will have jurisdiction. Either party may seek urgent relief from a court at any time.

17. General#

These Terms and any signed agreement form the whole agreement on their subject. Neither party may transfer its rights without the other's consent, except to a successor in a merger or sale. Neither party is liable for delays caused by events beyond its reasonable control. If one part of these Terms is invalid, the rest still applies.

18. Contact#

Msharti Intelligence Limited, trading as msharti. For questions about these Terms, email contact@msharti.dev. Website: msharti.dev.