Master Terms and Conditions of Service
Version 2026-07-11 · Effective July 11, 2026
Rillis — Master Terms and Conditions of Service (B2B)
Version: 2026-07-11 · Effective as of: July 11, 2026
Courtesy translation. This English version is provided for convenience. The Spanish version is the legally binding text and prevails in case of any discrepancy.
Note on use. This document is the master agreement that each corporate Client accepts in order to use the Rillis Platform. It is drafted as a multi-jurisdictional framework for the Americas, with connecting points (governing law, contracting entity, forum) that are completed by region in the Order Form. The Annexes — Data Processing Addendum (DPA), Acceptable Use Policy (AUP), Service Level Agreement (SLA), and the Product Annexes — form an integral part of these Terms. Capitalized terms refer to the glossary in Section 1.
1. Definitions
“Rillis” / “we”: the entity within the Rillis group identified as the contracting party in the applicable Order Form (by region).
“Client” / “you”: the legal entity that accepts these Terms, whether by online subscription, click-to-accept, or execution of an Order Form.
“Platform” or “Services”: the set of modules, APIs, SDKs, dashboards, webhooks, and features that Rillis makes available, including, as contracted: Identity Verification (KYC/KYB), AML Screening (sanctions, PEP, adverse media), Transaction Monitoring, Blockchain Intelligence, Rillis Sign (electronic signature with blockchain attestation), Flow Studio, the Single Verification Network (reusable KYC), Voice Verification, Audit & Reporting, and credentials for AI agents.
“Order Form”: the document (online or executed) that identifies the contracted modules, the plan (e.g., Starter, Professional, Enterprise), fees, term, volumes/quotas, and the contracting entity.
“Documentation”: the technical and functional documentation in effect that Rillis makes generally available (developer portal, product guides, API specifications).
“Authorized User”: an employee, contractor, or agent (including a software agent with credentials issued by Rillis) whom the Client authorizes to access the Platform.
“Verified Person” or “End User”: the natural person whose identity data is processed through the Platform on behalf of the Client.
“Client Data”: the data that the Client or its End Users enter, upload, or generate through the Platform, including identity data, document images, biometric data, and transaction data.
“Third-Party Data”: data provided by external sources and integrated into the Services, including sanctions, PEP, and adverse media lists, government databases, commercial data providers, and on-chain intelligence.
“Results”: any score, match, risk classification, alert, screening outcome, or analytical output generated by the Platform.
“Usage Data”: technical, performance, and configuration data generated by use of the Platform, in a form that does not identify End Users.
“DPA”: the Data Processing Addendum, incorporated by reference.
“AUP”: the Acceptable Use Policy, incorporated by reference.
2. Purpose, Scope, and Nature of the Service (Decision Support)
2.1 Grant. Subject to these Terms and payment of the fees, Rillis grants the Client a non-exclusive, non-transferable, and revocable right to access and use the Platform during the term, solely for its internal business and compliance purposes.
2.2 The Service is decision support, not a decision. The Client acknowledges and agrees that the Platform provides data, analytics, scores, and workflow tools to assist the Client’s own identity, due diligence, and compliance processes. The Services are decision support only. The Client is solely responsible for evaluating the Results, applying its own risk appetite and human judgment, and making all approval, rejection, escalation, reporting, or other compliance decisions. No Result constitutes a recommendation, and no Result may be used in isolation or as the sole basis for a decision producing legal or similarly significant effects on a person.
2.3 No legal advice; not a regulated entity. Rillis is a technology provider; it is not a law firm, compliance consultancy, consumer reporting agency (under the U.S. FCRA), or a financial institution or obligated subject. The Services do not constitute legal, regulatory, tax, or investment advice. The Client retains sole responsibility for designing, implementing, and operating its own AML/CFT, KYC/KYB, sanctions, and regulatory reporting program, and for determining whether and how to use the Services to meet its obligations under the laws applicable to it.
2.4 Human intervention. Where the Services are used to make or support decisions producing legal or similarly significant effects on a person (e.g., approval/rejection of onboarding), the Client undertakes to maintain meaningful human review before finalizing the decision, and to offer Verified Persons the mechanisms for human intervention, expression of their point of view, and challenge required by applicable law (including, where applicable, Article 22 GDPR and analogous regimes governing automated decisions in the Americas).
2.5 Availability and variation by jurisdiction. Certain modules, data sources, and features may not be available, may differ, or may not be compliant in certain markets. The availability of any Third-Party Data list or source may be limited, suspended, or discontinued by its source, without liability to Rillis.
3. Third-Party Data: Sanctions, PEP, Adverse Media, and Government Databases
3.1 Nature and origin. Screening Results (sanctions, PEP, adverse media), document verification, and on-chain analysis are compiled from Third-Party Data and public sources that Rillis does not control.
3.2 No accuracy warranty; probabilistic nature. Rillis does not warrant that Third-Party Data is accurate, complete, current, fit for any particular purpose, or timely. Matching is probabilistic and may produce false positives and false negatives. The Client is responsible for adjudicating matches, adjusting thresholds, investigating, and performing whatever further review its compliance program requires.
3.3 Blockchain analysis / wallet screening. Address clustering, attribution, and labeling functions and on-chain risk scoring are generated using heuristics and third-party intelligence and are probabilistic estimates, not confirmations of ownership, control, or unlawful conduct. Rillis makes no representation or warranty that any address, wallet, transaction, counterparty, or funds are or are not associated with unlawful activity or sanctioned persons. The Client retains sole responsibility for sanctions screening, freeze/reject decisions, reporting (SARs/STRs), and independent verification.
4. Client Responsibilities
4.1 Legal basis and consents. The Client represents and warrants that it holds the legal basis and all consents and notices required with respect to End Users for the processing of their data through the Platform, including biometric data, in accordance with the DPA and applicable law, and that it has informed End Users as required.
4.2 Own compliance program. The Client will maintain its own AML/CFT, KYC/KYB, and sanctions program, and will independently determine the sufficiency of the Services for its regulatory obligations.
4.3 Permitted use and prohibitions. The Client will comply with the AUP. Without limiting the foregoing, the Client will not use the Services: (a) as a factor in determining eligibility for credit, insurance, employment, housing, or other purposes regulated by the FCRA or analogous credit-reporting laws; (b) to unlawfully discriminate against any person or in a manner that causes harm; (c) for biometric processing without the consent and notices required by applicable law; or (d) to train, calibrate, or validate third-party machine learning models or systems using the Results or the Third-Party Data.
4.4 Account security and Authorized Users. The Client is responsible for the security of its credentials and for all acts or omissions of its Authorized Users (including AI agents operating with Rillis credentials) as if they were its own.
4.5 Sanctions/export compliance. The Client represents that neither it nor its beneficial owners are sanctioned persons, and that it will use the Services in accordance with applicable sanctions and export control laws.
5. Rillis Sign — Electronic Signature and Blockchain Attestation
5.1 Capability, not a warranty of validity. Rillis Sign generates electronic signatures with authentication, an audit trail, and integrity protection, and may anchor a cryptographic digest (hash) of the document on a blockchain network. Its evidentiary features are described in the Documentation under the “substantial conformance” warranty in Section 9.
5.2 No warranty of legal validity or enforceability. Rillis does not warrant that an electronic signature, record, or blockchain attestation is valid, admissible, or enforceable in any jurisdiction or for any type of act. The Client is solely responsible for determining whether the Services satisfy the requirements of the electronic signature and evidence legislation applicable to each transaction — including, as applicable, ESIGN/UETA (U.S.), eIDAS (EU), Law 19.799 (Chile), MP 2.200-2 and Law 14.063/2020 (Brazil), the Commercial Code/NOM-151 (Mexico), Law 527/1999 (Colombia), and Law 25.506 (Argentina) — and for selecting the appropriate signature level. Absent an express integration with an accredited certification authority/provider (e.g., a QTSP/QSCD under eIDAS, ICP-Brasil, e.firma/PSC in Mexico, or a licensed certifier in Argentina), the signatures produced are simple or advanced electronic signatures and not qualified/digital signatures carrying a legal presumption or equivalence to a handwritten signature.
5.3 Scope of the blockchain attestation. On-chain anchoring provides proof of integrity and timestamping only: evidence that a document existed and was not altered at a given point in time. It does not by itself confer signer identity, intent, non-repudiation, or legal enforceability, which depend on the signature workflow and applicable law. The anchor does not constitute a qualified timestamp under Article 42 of eIDAS unless expressly issued by a qualified provider. On-chain verification depends on the continued availability, integrity, and public accessibility of the network used; Rillis does not warrant the perpetual existence or immutability of any third-party network, and recommends that the Client independently retain the original document and the integrity certificate.
5.4 Excluded acts. The Client will not use Rillis Sign for acts that the law requires to be executed by public deed, before a notary, in person, or with a qualified certificate where the chosen assurance level does not satisfy local law (e.g., wills, certain family, real estate, or registry-related acts).
6. AI Features and Automated Decisions
6.1 Probabilistic outputs. AI/machine learning outputs (risk scores, liveness detection, facial/voice matching, adverse media relevance, monitoring alerts) are probabilistic, are not warranted to be accurate, complete, or error-free, and may reflect model limitations or bias.
6.2 Human in the loop. The Client will apply human review before acting on an AI output in any decision affecting a person, and will offer human intervention on disputed results, in accordance with Section 2.4.
6.3 Model training. Rillis does not train its models using Clients’ or End Users’ personal data; it uses only de-identified/aggregated data to improve the Services and fraud-pattern detection, and applies reasonable bias-mitigation safeguards (see Section 8).
6.4 AI agents. The Client is responsible for the conduct of software agents operating with Rillis credentials as if it were its own, and for maintaining the human oversight that applicable law requires.
6.5 Beta features. Features identified as beta, pilot, or experimental are provided “AS IS,” without an SLA, without support, availability, or security obligations, without liability to Rillis, and their use is at the Client’s sole risk; Rillis may modify or discontinue them at any time.
7. Single Verification Network (Reusable KYC)
The specific and detailed terms of the Network are set out in the Product Annex — Single Verification Network (a separate document). This Section incorporates its guiding principles into the master agreement.
7.1 Eligibility and activation. By accepting these Terms, the Client becomes eligible to participate in the Network as a Donor, Recipient, or both. Effective participation in a specific network requires express operational activation and configuration by Rillis; no Verified Person data will be accessible to other clients before such activation.
7.2 What travels and what does not. Only Verification Evidence (captured identity data) is communicated through the Network; the Donor’s Results are never communicated to the Recipient. Each reuse requires (a) the Verified Person’s explicit, specific, and informed consent for the particular Recipient, (b) biometric re-verification with liveness detection, and (c) the Recipient’s execution of its own AML screening and controls.
7.3 No reliance. The Network is a mechanism for reusing identity capture, not a mechanism of reliance on third-party due diligence within the meaning of FATF Recommendation 17. The Recipient retains full responsibility for its own due diligence (CDD/KYC) and makes its own decision. Rillis and the Donor do not warrant the accuracy, currency, or sufficiency of the Verification Evidence for the Recipient’s regulatory purposes.
7.4 Data roles and allocation of liability. The Donor and the Recipient act toward each other as independent controllers; Rillis acts as processor for each of them and as an independent controller solely with respect to the Network infrastructure. Cross-indemnities and the allocation of liability between Donor and Recipient are governed by the Product Annex and by Section 12.
8. Intellectual Property and Data Rights
8.1 Ownership. Rillis and its licensors retain all rights in the Platform, the models, the software, the Documentation, and the Third-Party Data. The Client retains ownership of the Client Data.
8.2 De-identified/aggregated data. The Client grants Rillis a right to use Usage Data and de-identified/aggregated data to operate, maintain, improve, and develop the Services and fraud detection, and to produce aggregate statistics. Rillis will not use End Users’ identifiable personal data to train AI models. Any feedback may be used freely.
8.3 Trademark license. Neither party acquires rights in the other’s trademarks except by written authorization.
9. Warranties and Disclaimers
9.1 Limited warranty. Rillis warrants that the Services will operate in substantial conformance with the Documentation during the term. The Client’s exclusive remedy for breach of this warranty is correction, replacement, or, at Rillis’s option, a pro-rata refund of fees for the affected period.
9.2 General “AS IS” disclaimer. Except for the express, limited warranty in Section 9.1, the Services are provided “AS IS” and “AS AVAILABLE.” To the maximum extent permitted by law, Rillis disclaims all other warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title, and non-infringement, as well as any warranty regarding the accuracy of data, Results, AI outputs, beta features, or uninterrupted or error-free operation. Security measures do not constitute a warranty against every breach.
10. Limitation of Liability
10.1 Exclusion of indirect damages. To the maximum extent permitted by law, neither party will be liable for lost profits, loss of business, goodwill, or data, or for indirect, incidental, special, consequential, or punitive damages.
10.2 Cap. Each party’s aggregate liability under these Terms will not exceed the total fees paid or payable by the Client in the twelve (12) months preceding the event giving rise to the claim.
10.3 Super-cap for biometric data/privacy claims. Given statutory exposure in biometric matters (e.g., the Illinois BIPA), the parties may agree in the Order Form on an enhanced cap (a multiple of the fees) for claims arising from data breaches or biometric privacy, absent which the cap in Section 10.2 applies.
10.4 Exceptions to the cap. The foregoing caps and exclusions do not apply to: (a) the Client’s payment obligations; (b) breach of confidentiality; (c) indemnification obligations; (d) IP infringement; or (e) willful misconduct, gross negligence, fraud, or liability for death or personal injury, or any liability that cannot be excluded by law.
11. Indemnification
11.1 By Rillis. Rillis will defend and indemnify the Client against third-party claims alleging that the Services, when used in accordance with these Terms, infringe intellectual property rights, subject to customary exclusions (unauthorized combined use, Client modifications, continued use after notice, Client specifications). Rillis’s remedy may include obtaining the right to use, modifying or replacing the component, or terminating and refunding.
11.2 By the Client. The Client will defend and indemnify Rillis against third-party claims arising from: (a) the Client Data and End User claims; (b) the absence of consent or legal basis; (c) use of the Services in breach of the FCRA, biometric or anti-discrimination laws; and (d) breach of the AUP.
12. Confidentiality
Each party will protect the other’s Confidential Information with the same care it uses to protect its own (never less than reasonable diligence), will use it solely to perform these Terms, and will not disclose it except to those who need to know it under confidentiality duties. Excluded is information that is public, independently developed, lawfully received from third parties, or whose disclosure is required by law (with prior notice where lawful). These obligations survive termination.
13. Fees, Taxes, and Renewal
13.1 Fees. The Client will pay the fees set out in the Order Form (Starter/Professional/Enterprise plans or the agreed volumes). For self-service plans, click-to-accept authorizes recurring automatic billing.
13.2 Taxes. Fees do not include taxes; the Client bears applicable taxes, except those levied on Rillis’s income.
13.3 Automatic renewal. Unless notice of non-renewal is given at least thirty (30) days before the end of the term, the subscription renews for equal periods at then-current fees. Rillis may pass through increases from Third-Party Data providers.
13.4 Suspension for non-payment. Rillis may suspend the Service for uncured delinquency after notice.
14. Term, Termination, and Suspension
14.1 Term. These Terms remain in effect for as long as an Order Form is in force.
14.2 Termination for breach. Either party may terminate for uncured material breach within thirty (30) days of notice, or immediately upon the other party’s insolvency.
14.3 Suspension/termination for legal or security risk. Rillis may suspend or terminate immediately, without a cure period, if (a) continuing the Service could violate the law or sanctions/export control rules; (b) necessary to protect the security or integrity of the Platform; or (c) Rillis’s due diligence on the Client yields a definitive adverse result. In case (a), through no fault of the Client, Rillis will refund the pro-rata portion of prepaid fees.
14.4 Effects. Upon termination, the right to use ceases; the return/deletion of data is governed by the DPA, without prejudice to regulatory retention obligations (e.g., retention of KYC records under FATF standards).
15. General Provisions
15.1 Governing law and forum. The governing law, contracting entity, and forum are specified by region in the Order Form. Absent specification, disputes will be resolved by arbitration administered by a recognized institution (e.g., the ICC or the institution of the agreed seat), with a class-action waiver where valid, without prejudice to interim relief before courts of competent jurisdiction.
15.2 Force majeure. Neither party is liable for failures due to causes beyond its reasonable control; if such causes persist for more than thirty (30) days, the other party may terminate the affected service.
15.3 Assignment. Neither party will assign these Terms without consent, except to a successor upon a change of control, with notice.
15.4 Order of precedence. In the event of conflict: Order Form → Product Annexes → DPA → AUP/SLA → these Master Terms → Documentation.
15.5 Entire agreement. These Terms and their Annexes constitute the entire agreement and supersede prior understandings.